@sema-agent/server 7.137.0 → 7.139.0

package/dist/plugins/remote-env-host.js

@@ -7,6 +7,7 @@ import { openSync, closeSync, readSync, statSync, truncateSync, unlinkSync, mkdi
 import { StringDecoder } from "node:string_decoder";
 import { armPipeDestroyGrace, numEnvOr } from "./remote-shell.js";
 import { buildLivenessCut, commandBoundsOf } from "../exec-bounds.js";
+import { buildCapturedOutput, createCutError } from "../exec-cut.js";
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
 import { IS_WIN32, resolveHostShell, hostShell, pinHostShell, spawnGroupOptions, killTreeHard, killTreeSoft, hardKillGroupNow, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
@@ -37,7 +38,7 @@ const UNSUPPORTED_SCHEDULER_CAPS = {
     maxScheduledHorizonSec: 0,
 };
 export class RemoteHostExecutionEnv {
-    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true, sharesProcessTable: true, hostLocalPaths: true, externalContentTarget: false, io: true, keepsReadFloor: false };
     get schedulerCapabilities() {
         return this.cfg.scheduler?.schedulerCapabilities ?? UNSUPPORTED_SCHEDULER_CAPS;
     }
@@ -454,11 +455,11 @@ export class RemoteHostExecutionEnv {
             };
             const timer = setTimeout(() => {
                 kill();
-                finish({ ok: false, error: new ExecutionError("timeout", `host exec exceeded ${timeoutMs}ms`) });
+                finish({ ok: false, error: createCutError({ code: "timeout", message: `host exec exceeded ${timeoutMs}ms` }, buildCapturedOutput(outBuf, errBuf)) });
             }, timeoutMs);
             const onAbort = () => {
                 kill();
-                finish({ ok: false, error: new ExecutionError("aborted", "host exec aborted") });
+                finish({ ok: false, error: createCutError({ code: "aborted", message: "host exec aborted" }, buildCapturedOutput(outBuf, errBuf)) });
             };
             if (options?.abortSignal)
                 options.abortSignal.addEventListener("abort", onAbort, { once: true });
@@ -607,32 +608,36 @@ export class RemoteHostExecutionEnv {
                 }
                 catch { }
             };
-            const feed = (lane, inc) => {
+            const record = (lane, inc) => {
                 lane.buf.push(inc);
-                if (!settled) {
-                    try {
-                        lane.cb?.(inc.toString("utf8"));
-                    }
-                    catch { }
+            };
+            const deliver = (lane, inc) => {
+                try {
+                    lane.cb?.(inc.toString("utf8"));
                 }
+                catch { }
             };
-            const pumpOnce = () => {
+            const feed = (lane, inc) => {
+                record(lane, inc);
+                deliver(lane, inc);
+            };
+            const pumpOnce = (take) => {
                 for (const lane of lanes) {
                     skipAhead(lane, ROTATE_BYTES);
                     const inc = readIncrement(lane.path, lane.key);
                     if (inc)
-                        feed(lane, inc);
+                        take(lane, inc);
                     reclaim(lane);
                 }
             };
-            const drainFinal = () => {
+            const drainFinal = (take) => {
                 for (const lane of lanes) {
                     skipAhead(lane, FINAL_TAIL_BYTES);
                     for (let i = 0; i < 4; i++) {
                         const inc = readIncrement(lane.path, lane.key);
                         if (!inc)
                             break;
-                        feed(lane, inc);
+                        take(lane, inc);
                     }
                 }
             };
@@ -661,15 +666,17 @@ export class RemoteHostExecutionEnv {
                 }
             };
             let removeDetachListener;
-            const finish = (r) => {
+            const finish = (outcome) => {
                 if (settled)
-                    return;
+                    return false;
                 settled = true;
+                const r = outcome();
                 clearTimeout(timer);
                 options?.abortSignal?.removeEventListener("abort", onAbort);
                 removeDetachListener?.();
                 cleanupSpool();
                 resolve(r);
+                return true;
             };
             const closeSpoolFds = () => {
                 for (const fd of spool.fds) {
@@ -697,66 +704,56 @@ export class RemoteHostExecutionEnv {
             ticket = adoptHostForegroundChild(child);
             closeSpoolFds();
             child.on("error", (e) => {
-                finish({ ok: false, error: new ExecutionError("spawn_error", `host spawn failed: ${e.message}`) });
+                finish(() => ({ ok: false, error: new ExecutionError("spawn_error", `host spawn failed: ${e.message}`) }));
             });
-            const partial = () => {
-                pumpOnce();
-                const o = outBuf.result();
-                const e = errBuf.result();
-                return { stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes) };
+            const captured = () => {
+                pumpOnce(record);
+                return buildCapturedOutput(outBuf, errBuf);
             };
             let exited = false;
-            const timer = setTimeout(() => {
+            const cut = (c) => {
                 if (exited)
                     return;
-                try {
-                    if (child.pid != null)
-                        killTreeHard(child.pid);
-                }
-                catch {
+                finish(() => {
                     try {
-                        child.kill("SIGKILL");
+                        if (child.pid != null)
+                            killTreeHard(child.pid);
                     }
-                    catch { }
-                }
-                const p = partial();
-                finish({ ok: false, error: new ExecutionError("timeout", `host exec exceeded ${timeoutMs}ms; partial stdout: ${p.stdout.slice(-2048)}`) });
-            }, timeoutMs);
-            const onAbort = () => {
-                if (exited)
-                    return;
-                try {
-                    if (child.pid != null)
-                        killTreeHard(child.pid);
-                }
-                catch {
-                    try {
-                        child.kill("SIGKILL");
+                    catch {
+                        try {
+                            child.kill("SIGKILL");
+                        }
+                        catch { }
                     }
-                    catch { }
-                }
-                finish({ ok: false, error: new ExecutionError("aborted", "host exec aborted") });
+                    return { ok: false, error: createCutError(c, captured()) };
+                });
             };
+            const timer = setTimeout(() => cut({ code: "timeout", message: `host exec exceeded ${timeoutMs}ms` }), timeoutMs);
+            const onAbort = () => cut({ code: "aborted", message: "host exec aborted" });
             if (options?.abortSignal?.aborted) {
                 onAbort();
                 return;
             }
             if (options?.abortSignal)
                 options.abortSignal.addEventListener("abort", onAbort, { once: true });
-            pump = setInterval(pumpOnce, PUMP_MS);
+            pump = setInterval(() => pumpOnce(feed), PUMP_MS);
             pump.unref?.();
             const onDetach = () => {
                 if (settled || exited)
                     return;
-                pumpOnce();
+                pumpOnce(feed);
+                if (settled)
+                    return;
                 const fgDropped = spoolRemoved.out + spoolRemoved.err;
                 const shellId = this.adoptRunningExecSpool(child, spool, { out: 0, err: 0 }, fgDropped);
                 if (shellId === undefined)
                     return;
                 handedOver = true;
-                const o = outBuf.result();
-                const e = errBuf.result();
-                finish(ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode: 0, detached: { shellId } }));
+                finish(() => {
+                    const o = outBuf.result();
+                    const e = errBuf.result();
+                    return ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode: 0, detached: { shellId } });
+                });
             };
             if (detachSignal) {
                 if (detachSignal.aborted)
@@ -767,13 +764,20 @@ export class RemoteHostExecutionEnv {
                 }
             }
             const settleFromTermination = (code, signal) => {
-                if (settled)
-                    return;
-                drainFinal();
-                const o = outBuf.result();
-                const e = errBuf.result();
                 const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
-                finish(ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode }));
+                const drained = [];
+                const won = finish(() => {
+                    drainFinal((lane, inc) => {
+                        record(lane, inc);
+                        drained.push({ lane, inc });
+                    });
+                    const o = outBuf.result();
+                    const e = errBuf.result();
+                    return ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode });
+                });
+                if (won)
+                    for (const d of drained)
+                        deliver(d.lane, d.inc);
             };
             child.on("close", (code, signal) => {
                 if (drainTimer) {
@@ -972,13 +976,13 @@ export class RemoteHostExecutionEnv {
             lines = lines.slice(0, options.maxLines);
         return ok(lines);
     }
-    boundReader;
+    coreFs;
     async openBound(p, abortSignal) {
         const ready = await this.fsReady(p);
         if (!ready.ok)
             return ready;
-        this.boundReader ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
-        return this.boundReader.openBound(this.resolve(p), abortSignal);
+        this.coreFs ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
+        return this.coreFs.openBound(this.resolve(p), abortSignal);
     }
     async readBinaryFile(p, abortSignal) {
         const ready = await this.fsReady(p);
@@ -998,16 +1002,8 @@ export class RemoteHostExecutionEnv {
             const ready = await this.fsReady(p);
             if (!ready.ok)
                 return ready;
-            const abs = this.resolve(p);
-            try {
-                await fs.mkdir(path.dirname(abs), { recursive: true });
-                const data = typeof content === "string" ? content : Buffer.from(content);
-                await fs.writeFile(abs, data, { signal: abortSignal });
-                return ok(undefined);
-            }
-            catch (e) {
-                return { ok: false, error: this.fileError(e, abs, abortSignal) };
-            }
+            this.coreFs ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
+            return this.coreFs.writeFile(this.resolve(p), content, abortSignal);
         });
     }
     appendFile(p, content, abortSignal) {

package/dist/plugins/remote-env-k8s.d.ts

@@ -2,7 +2,7 @@ import { type SpaceReclaimer, type WorkspaceSpacePolicy, type CacheReclaimReason
 import { type SpaceCommitFence } from "../workspace-space-commit.js";
 import { type CacheMissMemory, type WorkspaceCacheCapability } from "../workspace-cache.js";
 import { type SandboxEgressGap, type SandboxIpv6 } from "../sandbox-egress-policy.js";
-import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll } from "@sema-agent/core";
+import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll, type ExecutionEnvCapabilities } from "@sema-agent/core";
 import type { PodSpecPatch } from "./k8s-exec-protocol.js";
 import { type LaneHomeConfig } from "../lane-home-probe.js";
 type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
@@ -16,7 +16,9 @@ export interface K8sEnvConfig extends LaneHomeConfig {
     caCert?: string;
     /** Skip TLS verification (lab only — never production). */
     insecureTls?: boolean;
-    namespace?: string;
+    /** The namespace the sandbox pods live in (env `K8S_NAMESPACE`). REQUIRED, no default: the deployment declares it, and every reader
+     *  (the adapter's API paths, the reaper's pod face, the boot's egress reading) reads this one field. */
+    namespace: string;
     /** Sandbox pod image (a plain docker image present in the cluster). REQUIRED. */
     image: string;
     /** RuntimeClass for the VM boundary. Default "kata-qemu" (set "" to run plain runc — tests/dev only). */
@@ -258,8 +260,6 @@ export { execSocketTlsOptions } from "./k8s-exec-protocol.js";
  *  String() is "[object ErrorEvent]" — that masked the real TLS failure for a whole drill. */
 export declare function errorMessageOf(e: unknown): string;
 export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
-/** The sandbox namespace when `K8S_NAMESPACE` is unset (the one spelling: the adapter and the boot's egress line read it). */
-export declare const K8S_SANDBOX_NAMESPACE_DEFAULT = "sandboxes";
 /**
  * The boot reading of the sandbox Secret seat, a closed set: `granted` — every verb allowed · `denied` — the API answered "not allowed" for these
  * verbs (a definite answer; it wins over a verb that could not be asked) · `unverified` — some verb could not be asked (the request failed, the
@@ -296,15 +296,13 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
      * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
      * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
      * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
-     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * 布尔字面量零影响(四键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
      * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
      * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
      */
-    readonly capabilities: {
-        isolation: boolean;
-        suspendable: boolean;
-        canonicalPathAuthoritative: true;
-    };
+    /** `sharesProcessTable`(core 7.57.0,必填):命令跑在沙箱 pod 自己的 PID 命名空间里(不开 hostPID),不在本进程所在的进程表。 */
+    /** 能力块(引擎 [ref],八键必填、各键只经引擎读器读):`hostLocalPaths` = 这条车道答出的路径是不是本进程所在机器上的文件;`externalContentTarget` = 产出是否来自部署信任边界之外;`io` = 文件与 shell 两面真到达目标;`keepsReadFloor` = 是否守住读拒表的字节地板(本车道不守 ⇒ 读拒表非空的 run 被告知,部署要求地板时准备期拒)。 */
+    readonly capabilities: ExecutionEnvCapabilities;
     cwd: string;
     private podName?;
     /** Cluster-internal pod address, captured when the pod reaches Running — the LSP `getHost` surface.
@@ -811,19 +809,18 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
         maxLines?: number;
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
-    /** 父目录自建(与 host/local-docker/adb/ssh 同口径)。抽成共用是因为 `appendFile` 曾**跳过**它:
-     *  🔴 2026-07-25 实测的跨腿分叉 —— `appendFile` 直接调 `writeChunked`,整条路上没有 `mkdir -p`,于是
-     *  「直接 append 建一个新日志路径」在 k8s 腿上返 `not_found`,而其余 5 腿都成功(host/local-docker/adb 实测,
-     *  ssh/e2b 由方法体判据)。core 的后台输出镜像正是"每拍 append 一次"的形,这条分叉会让它在 k8s 腿上从第一拍
-     *  就失败,而 `mirrorFailed` 只会表现成一句「output file is INCOMPLETE」。 */
-    private ensureParentDir;
     writeFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    /** 暂存写的两只面(规则与提交脚本的唯一属主 = `remote-shell.ts`;父目录与私有暂存目录由编排的准备那一步建):上传 = 分块整份写进私有目录里的暂存件;
+     *  提交 = 文件面探针 exec。两者同一身份(同一只容器里的 exec)。 */
+    private stagedLane;
     appendFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
     /**
      * Write `content` to `abs` via argv-embedded base64, chunked at WRITE_CHUNK_BYTES (no stdin on the exec
      * channel we use; v4 has no per-channel close). `truncateFirst` → the FIRST chunk uses `>` (overwrite),
      * the rest `>>` (append); `false` → all chunks `>>`. Empty content still runs exactly one command so an
      * empty file is created (write) / left intact (append). Shared by writeFile/appendFile (council DESIGN#2).
+     * Both file faces point this at a STAGING name (`writeFileStaged` / `appendFileStaged`), so a cut mid-way never reaches
+     * the target; the direct uses are the fallbacks of both faces (writeFile passes truncateFirst, appendFile does not) when the target's directory refuses a new name or the private staging directory could not be made private.
      */
     private writeChunked;
     private posixFsInst?;

package/dist/plugins/remote-env-k8s.js

@@ -4,7 +4,7 @@ import https from "node:https";
 import http from "node:http";
 import { StringDecoder } from "node:string_decoder";
 import WebSocket from "ws";
-import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode, numEnvOr } from "./remote-shell.js";
+import { appendFileStaged, buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode, numEnvOr, writeFileStaged } from "./remote-shell.js";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
 import { SNAPSHOT_BUCKET_MISSING, isNoSuchBucketAnswer } from "./s3-answer.js";
@@ -15,6 +15,7 @@ import { WORKSPACE_CACHE_SPACE_LABEL, workspaceCacheClaimOf, workspaceCacheEnv }
 import { recordFailOpen } from "../observability/fail-open.js";
 import { PodDeleteRefused, reportPodDeleteFailed } from "./k8s-pod-delete-failure.js";
 import { buildLivenessCut, commandBoundsOf, laneLivenessOf, LIVENESS_MS_DEFAULT } from "../exec-bounds.js";
+import { buildCapturedOutput, createCutError } from "../exec-cut.js";
 import { SANDBOX_IPV6_DEFAULT, sandboxEgressGaps, sandboxPodSysctls } from "../sandbox-egress-policy.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
@@ -171,7 +172,6 @@ export function errorMessageOf(e) {
     return typeof m === "string" && m ? m : String(e);
 }
 export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
-export const K8S_SANDBOX_NAMESPACE_DEFAULT = "sandboxes";
 const SANDBOX_SECRET_NAME_PREFIX = "sbx-env-";
 const SANDBOX_SECRET_LABEL = "sema.io/sandbox-secret";
 const secretEnvKey = (name) => `env.${name}`;
@@ -235,7 +235,7 @@ export class RemoteK8sExecutionEnv {
             token: config.token,
             caCert: config.caCert,
             insecureTls: config.insecureTls ?? false,
-            namespace: config.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT,
+            namespace: config.namespace,
             image: config.image,
             runtimeClass: config.runtimeClass ?? "kata-qemu",
             mountPath: config.mountPath ?? K8S_WORKSPACE_MOUNT_DEFAULT,
@@ -268,7 +268,7 @@ export class RemoteK8sExecutionEnv {
         this.logger = config.logger;
         this.onWorkspaceSnapshot = config.onWorkspaceSnapshot;
         this.cacheMisses = config.cacheMisses;
-        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true };
+        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true, sharesProcessTable: false, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false };
         const bgMax = Math.max(1, Math.min(K8S_BG_MAX_TIMEOUT_SEC, Math.floor(this.cfg.timeoutMs / 1000)));
         this.backgroundCapabilities = {
             supported: true,
@@ -1498,10 +1498,11 @@ export class RemoteK8sExecutionEnv {
             let sinkClosed = false;
             let removeDetachListener;
             const detachTee = opts?.detach?.tee;
-            const finish = (r) => {
+            const finish = (outcome) => {
                 if (settled)
-                    return;
+                    return false;
                 settled = true;
+                const r = outcome();
                 clearTimeout(wallTimer);
                 clearTimeout(livenessTimer);
                 opts?.signal?.removeEventListener("abort", onAbort);
@@ -1512,11 +1513,37 @@ export class RemoteK8sExecutionEnv {
                 catch {
                 }
                 resolvePromise(r);
+                return true;
             };
             const bounds = commandBoundsOf({ timeoutMs: opts?.timeoutMs, readTimeoutMs: opts?.readTimeoutMs }, this.laneLiveness);
             const capMs = opts?.capMs;
             const wallMs = bounds.wallMs === undefined ? capMs : capMs === undefined ? bounds.wallMs : Math.min(bounds.wallMs, capMs);
-            const wallTimer = wallMs !== undefined ? setTimeout(() => finish({ ok: false, error: new ExecutionError("timeout", `command exceeded ${wallMs}ms`) }), wallMs) : undefined;
+            const recordStderr = (bytes) => {
+                if (bytes.length === 0)
+                    return;
+                errBuf.push(bytes);
+                if (detachTee)
+                    feedMemStream(detachTee.err, bytes, K8S_BG_MEM_CAP);
+            };
+            const emitStderr = (bytes) => {
+                if (bytes.length > 0 && errDecoder)
+                    opts.onStderr(errDecoder.write(bytes));
+            };
+            const takeStderr = (bytes) => {
+                recordStderr(bytes);
+                emitStderr(bytes);
+            };
+            const heldStderr = () => opts?.stderrFilter?.endStderr();
+            const captured = () => {
+                const held = heldStderr();
+                if (held)
+                    recordStderr(held);
+                return buildCapturedOutput(outTail, errBuf);
+            };
+            const cut = (c) => {
+                finish(() => ({ ok: false, error: createCutError(c, captured()) }));
+            };
+            const wallTimer = wallMs !== undefined ? setTimeout(() => cut({ code: "timeout", message: `command exceeded ${wallMs}ms` }), wallMs) : undefined;
             let livenessTimer;
             const liveness = bounds.liveness;
             const armLiveness = () => {
@@ -1525,28 +1552,18 @@ export class RemoteK8sExecutionEnv {
                 clearTimeout(livenessTimer);
                 const idle = Date.now() - lastProgress;
                 if (idle >= liveness.ms) {
-                    const cut = buildLivenessCut(liveness);
-                    finish({ ok: false, error: new ExecutionError(cut.code, cut.message, undefined, undefined, cut.noOutputSec) });
+                    cut(buildLivenessCut(liveness));
                     return;
                 }
                 livenessTimer = setTimeout(armLiveness, liveness.ms - idle);
             };
             armLiveness();
-            const onAbort = () => finish({ ok: false, error: new ExecutionError("aborted", "command aborted") });
+            const onAbort = () => cut({ code: "aborted", message: "command aborted" });
             if (opts?.signal) {
                 if (opts.signal.aborted)
                     return onAbort();
                 opts.signal.addEventListener("abort", onAbort, { once: true });
             }
-            const takeStderr = (bytes) => {
-                if (bytes.length === 0)
-                    return;
-                errBuf.push(bytes);
-                if (detachTee)
-                    feedMemStream(detachTee.err, bytes, K8S_BG_MEM_CAP);
-                if (errDecoder)
-                    opts.onStderr(errDecoder.write(bytes));
-            };
             sock.on("message", (...args) => {
                 const data = args[0];
                 const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
@@ -1588,7 +1605,7 @@ export class RemoteK8sExecutionEnv {
                     }
                     return;
                 }
-                finish({ ok: false, error: new ExecutionError("transport_lost", `exec socket error: ${errorMessageOf(e)}`, e instanceof Error ? e : undefined) });
+                finish(() => ({ ok: false, error: new ExecutionError("transport_lost", `exec socket error: ${errorMessageOf(e)}`, e instanceof Error ? e : undefined) }));
             });
             sock.on("close", () => {
                 if (spliceSink) {
@@ -1601,25 +1618,30 @@ export class RemoteK8sExecutionEnv {
                     return spliceSink.closed("error" in parsed ? { failed: true } : { failed: false, exitCode: parsed.exitCode });
                 }
                 if (statusFrame === undefined) {
-                    finish({ ok: false, error: new ExecutionError("transport_lost", "exec socket closed without status — k8s transport lost mid-command") });
+                    finish(() => ({ ok: false, error: new ExecutionError("transport_lost", "exec socket closed without status — k8s transport lost mid-command") }));
                     return;
                 }
                 const parsed = exitCodeFromStatus(statusFrame);
                 if ("error" in parsed) {
-                    finish({ ok: false, error: new ExecutionError("spawn_error", parsed.error) });
+                    const said = parsed.error;
+                    finish(() => ({ ok: false, error: new ExecutionError("spawn_error", said) }));
                     return;
                 }
-                if (opts?.stderrFilter)
-                    takeStderr(opts.stderrFilter.endStderr());
-                const err = errBuf.result();
-                const stderr = markTruncated(err.text, err.droppedBytes);
-                if (boundOutput) {
-                    const out = outTail.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode: parsed.exitCode }));
-                }
-                else {
-                    finish(ok({ stdout: Buffer.concat(outBufs).toString("utf8"), stderr, exitCode: parsed.exitCode }));
-                }
+                const exitCode = parsed.exitCode;
+                const held = heldStderr();
+                const won = finish(() => {
+                    if (held)
+                        recordStderr(held);
+                    const err = errBuf.result();
+                    const stderr = markTruncated(err.text, err.droppedBytes);
+                    if (boundOutput) {
+                        const out = outTail.result();
+                        return ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode });
+                    }
+                    return ok({ stdout: Buffer.concat(outBufs).toString("utf8"), stderr, exitCode });
+                });
+                if (won && held)
+                    emitStderr(held);
             });
             const detach = opts?.detach;
             if (detach) {
@@ -1925,30 +1947,15 @@ export class RemoteK8sExecutionEnv {
             lines = lines.slice(0, options.maxLines);
         return ok(lines);
     }
-    async ensureParentDir(abs, abortSignal) {
-        const dir = path.posix.dirname(abs);
-        if (!dir || dir === "." || dir === "/")
-            return undefined;
-        const mk = await this.fsExec(`mkdir -p ${shellQuote(dir)}`, abortSignal);
-        if (!mk.ok)
-            return { ok: false, error: fileErrorFromExec(mk.error, dir) };
-        if (mk.value.exitCode !== 0)
-            return { ok: false, error: classifyFsStderr(mk.value.stderr, dir) };
-        return undefined;
-    }
     async writeFile(p, content, abortSignal) {
-        const abs = this.resolve(p);
-        const bad = await this.ensureParentDir(abs, abortSignal);
-        if (bad)
-            return bad;
-        return this.writeChunked(abs, content, true, abortSignal);
+        return writeFileStaged(this.stagedLane(content), this.resolve(p), abortSignal);
+    }
+    stagedLane(content) {
+        return { upload: (dest, signal) => this.writeChunked(dest, content, true, signal), run: (cmd, signal) => this.fsExec(cmd, signal) };
     }
     async appendFile(p, content, abortSignal) {
         const abs = this.resolve(p);
-        const bad = await this.ensureParentDir(abs, abortSignal);
-        if (bad)
-            return bad;
-        return this.writeChunked(abs, content, false, abortSignal);
+        return appendFileStaged(this.stagedLane(content), abs, abortSignal, (ctx) => ctx.inPlace((signal) => this.writeChunked(abs, content, false, signal)));
     }
     async writeChunked(abs, content, truncateFirst, abortSignal) {
         const bytes = typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
@@ -2119,7 +2126,7 @@ export function createSandboxPodApi(config, deps) {
     let env;
     const control = () => (env ??= new RemoteK8sExecutionEnv(config, deps));
     return {
-        namespace: config.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT,
+        namespace: config.namespace,
         list: () => control().listSandboxPods(),
         delete: (name) => control().deletePod(name),
     };

package/dist/plugins/remote-env-local-docker.d.ts

@@ -23,7 +23,7 @@ export interface LocalDockerEnvConfig extends LaneHomeConfig {
      * lane stays `local-docker` (`REMOTE_EXEC=local-docker` + `DOCKER_HOST`; the settings-schema lane table lists
      * `DOCKER_HOST` as this lane's optional coordinate, and there is no separate `remote-docker` lane since 7.0.0).
      * Nothing about the class is host-local: the workspace is `mkdir`'d INSIDE the container (never a bind-mount of a
-     * host path) and bytes move by `docker cp` / `docker exec cat`, which stream over the daemon API.
+     * host path) and bytes move by `docker exec -i … cat >` / `docker exec cat`, which stream over the daemon API.
      */
     dockerHost?: string;
     /** Container memory limit (docker `--memory`, e.g. "2g"). Absent = no limit. */
@@ -62,10 +62,17 @@ export interface LocalDockerEnvDeps {
 }
 export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv {
     /** DUAL-MODE-DESIGN §5: a container is a real isolation boundary; v1 has no managed memory snapshot. */
+    /** `sharesProcessTable`(core 7.57.0,必填):命令跑在本机容器自己的 PID 命名空间里(不传 `--pid=host`),不在本进程所在的进程表。 */
+    /** 能力块(引擎 [ref],八键必填、各键只经引擎读器读):`hostLocalPaths` = 这条车道答出的路径是不是本进程所在机器上的文件;`externalContentTarget` = 产出是否来自部署信任边界之外;`io` = 文件与 shell 两面真到达目标;`keepsReadFloor` = 是否守住读拒表的字节地板(本车道不守 ⇒ 读拒表非空的 run 被告知,部署要求地板时准备期拒)。 */
     readonly capabilities: {
-        isolation: boolean;
-        suspendable: boolean;
-        canonicalPathAuthoritative: boolean;
+        isolation: true;
+        suspendable: false;
+        canonicalPathAuthoritative: true;
+        sharesProcessTable: false;
+        hostLocalPaths: false;
+        externalContentTarget: false;
+        io: true;
+        keepsReadFloor: false;
     };
     /** Working directory inside the container; relative paths resolve against it (ExecutionEnv contract). */
     cwd: string;
@@ -161,10 +168,27 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
         maxLines?: number;
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
+    /** 暂存写的两只面(规则与提交脚本的唯一属主 = `remote-shell.ts` `writeFileStaged` / `appendFileStaged`;父目录与私有暂存目录由编排的准备那一步建):
+     *  上传 = 容器内 `cat` 从 stdin 收整份字节落到私有目录里的暂存件({@link pipeIn});提交 = 容器内一次 shell 往返。两者同一身份 ——
+     *  同一只 argv 构造({@link execArgv}),都是镜像的用户。不用 `docker cp`:它由守护进程以 root 落盘,镜像用户 ≠ root 时暂存件属 root、
+     *  提交方拿不走也清不掉,「目录不收新名字」也探不出来(root 哪里都写得进)。 */
+    private stagedLane;
+    /** 整旧或整新(暂存 → 一次 `mv -f`)。修前 `docker cp` 直落目标(以守护进程的 root 身份):传输中途断 / 取消时目标剩什么取决于守护进程的解包实现,本适配器不依赖它。 */
     writeFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    /** 追加(暂存要加的字节 → 一次 `cat >>`;inode 不换、已有字节不重写)。修前 = 读旧 + 拼 + 整份 cp(O(文件);中途断 ⇒ 目标没了或半份)。
+     *  目录不收新名字 / 私有目录收不成私有时的退路 = 容器内 `cat >>` 从 stdin 直接追加到目标(同一身份)。 */
     appendFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    /**
+     * 把整份内容经 stdin 交给容器里的 `cat`,落到 `dest`(`>` 建或覆盖;`>>` 追加)。走与提交 / 文件面探针同一只往返({@link fsExec},argv 只多一个 `-i`)
+     * ⇒ 同一身份、同一工作目录、同一道守卫;二进制安全(载荷不经 shell 转义,也不在宿主落临时件)。stdin 没写完而进程退 0 ⇒ 按失败答(载荷未必整份到了)。
+     */
+    private pipeIn;
     private posixFsInst?;
     private get posixFs();
+    /** 文件面的一次容器内 shell 往返(基座、暂存写的准备 / 上传 / 提交 / 清理共用)。承 fsReady 契约(其余三腿走公有 exec、守卫天然在;本腿直用私有
+     *  docker,必须自带):destroyed 守卫 + 懒连接,fail closed 不抛 —— 消息保留 "destroyed" 字样(测试钉的就是它)。`input` 在场 ⇒ 同一只 argv 多一个
+     *  `-i`、载荷走 stdin({@link pipeIn});身份与工作目录与不带载荷的往返逐字相同。 */
+    private fsExec;
     fileInfo(p: string, abortSignal?: AbortSignal): Promise<Result<FileInfo, FileError>>;
     listDir(p: string, abortSignal?: AbortSignal): Promise<Result<FileInfo[], FileError>>;
     readLink(p: string, abortSignal?: AbortSignal): Promise<Result<string, FileError>>;
@@ -198,7 +222,8 @@ export declare class RemoteLocalDockerExecutionEnv implements RemoteExecutionEnv
     /** Prepend `-H <dockerHost>` to a docker argv when configured (per-invocation, not the process env). */
     private withHostFlag;
     /** Build the `docker exec` argv for a command, applying cwd (`-w`) and per-command env (`-e K=V`).
-     *  argv elements are SEPARATE (no host-side shell join) — the command runs in the CONTAINER's `/bin/sh -c`. */
+     *  argv elements are SEPARATE (no host-side shell join) — the command runs in the CONTAINER's `/bin/sh -c`.
+     *  `stdin` ⇒ `-i` (the payload of {@link pipeIn}); nothing else differs, so a piped upload runs as the same user as every other exec. */
     private execArgv;
     /** Like {@link execArgv} but for an internal FileSystem helper command (uses the workspace cwd + adapter env). */
     private execRaw;