@sema-agent/server 7.138.0 → 7.139.0

package/dist/plugins/remote-env-host.d.ts

@@ -76,11 +76,16 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
      */
     /** `sharesProcessTable`(core 7.57.0,必填):命令是本进程 spawn 的子进程(同一张进程表),引擎的模式杀守卫对它照 NodeExecutionEnv 一样问 `pgrep`。 */
+    /** 能力块(引擎 [ref],八键必填、各键只经引擎读器读):`hostLocalPaths` = 这条车道答出的路径是不是本进程所在机器上的文件;`externalContentTarget` = 产出是否来自部署信任边界之外;`io` = 文件与 shell 两面真到达目标;`keepsReadFloor` = 是否守住读拒表的字节地板(本车道不守 ⇒ 读拒表非空的 run 被告知,部署要求地板时准备期拒)。 */
     readonly capabilities: {
-        isolation: boolean;
-        suspendable: boolean;
-        canonicalPathAuthoritative: boolean;
-        sharesProcessTable: boolean;
+        isolation: false;
+        suspendable: false;
+        canonicalPathAuthoritative: true;
+        sharesProcessTable: true;
+        hostLocalPaths: true;
+        externalContentTarget: false;
+        io: true;
+        keepsReadFloor: false;
     };
     /** R7 自唤醒: structural delegation to the injected scheduler backend. `hasScheduler(env)` checks BOTH the method
      *  presence (always, since we implement the interface) AND `schedulerCapabilities.supported===true` — which is only
@@ -299,8 +304,9 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
         maxLines?: number;
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
-    /** core `NodeExecutionEnv` 的绑定读器 —— 首次 {@link openBound} 时建(构造无副作用,只记 cwd)。 */
-    private boundReader;
+    /** core `NodeExecutionEnv` 的一只实例 —— 本车道把**落盘那一步**委托给它的两只面({@link openBound} 的持有读、{@link writeFile} 的整文件替换);
+     *  首次用时建(构造无副作用,只记 cwd)。门(`fsReady`)、在飞登记(`withInflightFs`)与工作区相对解析留在本适配器。 */
+    private coreFs;
     /**
      * core 7.50.0 `FileSystem.openBound`:开着并**持有**一只对象(叶链接不跟,开后身份对拍),调用方判的与读的是同一只对象 ——
      * LSP 会话的读口与路径附件只经它读,不实现 ⇒ 两者在本车道一律拒。
@@ -310,8 +316,15 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      */
     openBound(p: string, abortSignal?: AbortSignal): Promise<Result<BoundFileObject, FileError>>;
     readBinaryFile(p: string, abortSignal?: AbortSignal): Promise<Result<Uint8Array, FileError>>;
-    /** [ref]:整只方法体(**含** `fsReady` 那道门)走 `withInflightFs` —— 登记必须与调用方同一同步段,
-     *  否则 destroy 的快照可能刚好在 `await this.fsReady(...)` 的让出点上取完。见那处头注。 */
+    /**
+     * 整文件替换:**整旧或整新;`aborted` ⇒ 目标未碰**。
+     * 🔴 **不重写**:落盘那一步委托 core `NodeExecutionEnv.writeFile`(同目录暂存 + fsync + rename;父目录自建;单跳链接改写它指的
+     * 常规文件、链接链 / 非常规文件 / rename 不可用的文件系统回落就地写;已有文件的权限位带过去)—— 该原语的唯一属主在 core。
+     * 本适配器只给它与其余写面同一的入口纪律:[ref] 在飞登记(整只方法体**含** `fsReady` 那道门走 `withInflightFs` —— 登记必须与
+     * 调用方同一同步段,否则 destroy 的快照可能刚好在 `await this.fsReady(...)` 的让出点上取完;见那处头注)、销毁后拒、工作区相对解析。
+     * 修前这里是裸 `fs.writeFile(abs, data, { signal })`:open 即 O_TRUNC,中途取消 / 出错 ⇒ 目标 = 新内容的前缀,原件不可恢复。
+     * 已知语义变化(与 core / CC 同形):rename 断开硬链接 —— 另一条链接留旧内容。
+     */
     writeFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
     /** [ref](写面一律 `withInflightFs`,见那处头注)。本面是唯一能在 `destroyed` **之后**过门的写面
      *  (`lingeringBgWrite`):那一族登记在 destroy 的快照**之后**,所以 destroy 不会去等它们 —— 正确,

package/dist/plugins/remote-env-host.js

@@ -7,6 +7,7 @@ import { openSync, closeSync, readSync, statSync, truncateSync, unlinkSync, mkdi
 import { StringDecoder } from "node:string_decoder";
 import { armPipeDestroyGrace, numEnvOr } from "./remote-shell.js";
 import { buildLivenessCut, commandBoundsOf } from "../exec-bounds.js";
+import { buildCapturedOutput, createCutError } from "../exec-cut.js";
 import { hostBackgroundShellEnabled, hostExecSpoolEnabled } from "../config.js";
 import { IS_WIN32, resolveHostShell, hostShell, pinHostShell, spawnGroupOptions, killTreeHard, killTreeSoft, hardKillGroupNow, collapseWin32EnvKeys, adoptHostForegroundChild } from "./host-platform.js";
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
@@ -37,7 +38,7 @@ const UNSUPPORTED_SCHEDULER_CAPS = {
     maxScheduledHorizonSec: 0,
 };
 export class RemoteHostExecutionEnv {
-    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true, sharesProcessTable: true };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true, sharesProcessTable: true, hostLocalPaths: true, externalContentTarget: false, io: true, keepsReadFloor: false };
     get schedulerCapabilities() {
         return this.cfg.scheduler?.schedulerCapabilities ?? UNSUPPORTED_SCHEDULER_CAPS;
     }
@@ -454,11 +455,11 @@ export class RemoteHostExecutionEnv {
             };
             const timer = setTimeout(() => {
                 kill();
-                finish({ ok: false, error: new ExecutionError("timeout", `host exec exceeded ${timeoutMs}ms`) });
+                finish({ ok: false, error: createCutError({ code: "timeout", message: `host exec exceeded ${timeoutMs}ms` }, buildCapturedOutput(outBuf, errBuf)) });
             }, timeoutMs);
             const onAbort = () => {
                 kill();
-                finish({ ok: false, error: new ExecutionError("aborted", "host exec aborted") });
+                finish({ ok: false, error: createCutError({ code: "aborted", message: "host exec aborted" }, buildCapturedOutput(outBuf, errBuf)) });
             };
             if (options?.abortSignal)
                 options.abortSignal.addEventListener("abort", onAbort, { once: true });
@@ -607,32 +608,36 @@ export class RemoteHostExecutionEnv {
                 }
                 catch { }
             };
-            const feed = (lane, inc) => {
+            const record = (lane, inc) => {
                 lane.buf.push(inc);
-                if (!settled) {
-                    try {
-                        lane.cb?.(inc.toString("utf8"));
-                    }
-                    catch { }
+            };
+            const deliver = (lane, inc) => {
+                try {
+                    lane.cb?.(inc.toString("utf8"));
                 }
+                catch { }
             };
-            const pumpOnce = () => {
+            const feed = (lane, inc) => {
+                record(lane, inc);
+                deliver(lane, inc);
+            };
+            const pumpOnce = (take) => {
                 for (const lane of lanes) {
                     skipAhead(lane, ROTATE_BYTES);
                     const inc = readIncrement(lane.path, lane.key);
                     if (inc)
-                        feed(lane, inc);
+                        take(lane, inc);
                     reclaim(lane);
                 }
             };
-            const drainFinal = () => {
+            const drainFinal = (take) => {
                 for (const lane of lanes) {
                     skipAhead(lane, FINAL_TAIL_BYTES);
                     for (let i = 0; i < 4; i++) {
                         const inc = readIncrement(lane.path, lane.key);
                         if (!inc)
                             break;
-                        feed(lane, inc);
+                        take(lane, inc);
                     }
                 }
             };
@@ -661,15 +666,17 @@ export class RemoteHostExecutionEnv {
                 }
             };
             let removeDetachListener;
-            const finish = (r) => {
+            const finish = (outcome) => {
                 if (settled)
-                    return;
+                    return false;
                 settled = true;
+                const r = outcome();
                 clearTimeout(timer);
                 options?.abortSignal?.removeEventListener("abort", onAbort);
                 removeDetachListener?.();
                 cleanupSpool();
                 resolve(r);
+                return true;
             };
             const closeSpoolFds = () => {
                 for (const fd of spool.fds) {
@@ -697,66 +704,56 @@ export class RemoteHostExecutionEnv {
             ticket = adoptHostForegroundChild(child);
             closeSpoolFds();
             child.on("error", (e) => {
-                finish({ ok: false, error: new ExecutionError("spawn_error", `host spawn failed: ${e.message}`) });
+                finish(() => ({ ok: false, error: new ExecutionError("spawn_error", `host spawn failed: ${e.message}`) }));
             });
-            const partial = () => {
-                pumpOnce();
-                const o = outBuf.result();
-                const e = errBuf.result();
-                return { stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes) };
+            const captured = () => {
+                pumpOnce(record);
+                return buildCapturedOutput(outBuf, errBuf);
             };
             let exited = false;
-            const timer = setTimeout(() => {
+            const cut = (c) => {
                 if (exited)
                     return;
-                try {
-                    if (child.pid != null)
-                        killTreeHard(child.pid);
-                }
-                catch {
+                finish(() => {
                     try {
-                        child.kill("SIGKILL");
+                        if (child.pid != null)
+                            killTreeHard(child.pid);
                     }
-                    catch { }
-                }
-                const p = partial();
-                finish({ ok: false, error: new ExecutionError("timeout", `host exec exceeded ${timeoutMs}ms; partial stdout: ${p.stdout.slice(-2048)}`) });
-            }, timeoutMs);
-            const onAbort = () => {
-                if (exited)
-                    return;
-                try {
-                    if (child.pid != null)
-                        killTreeHard(child.pid);
-                }
-                catch {
-                    try {
-                        child.kill("SIGKILL");
+                    catch {
+                        try {
+                            child.kill("SIGKILL");
+                        }
+                        catch { }
                     }
-                    catch { }
-                }
-                finish({ ok: false, error: new ExecutionError("aborted", "host exec aborted") });
+                    return { ok: false, error: createCutError(c, captured()) };
+                });
             };
+            const timer = setTimeout(() => cut({ code: "timeout", message: `host exec exceeded ${timeoutMs}ms` }), timeoutMs);
+            const onAbort = () => cut({ code: "aborted", message: "host exec aborted" });
             if (options?.abortSignal?.aborted) {
                 onAbort();
                 return;
             }
             if (options?.abortSignal)
                 options.abortSignal.addEventListener("abort", onAbort, { once: true });
-            pump = setInterval(pumpOnce, PUMP_MS);
+            pump = setInterval(() => pumpOnce(feed), PUMP_MS);
             pump.unref?.();
             const onDetach = () => {
                 if (settled || exited)
                     return;
-                pumpOnce();
+                pumpOnce(feed);
+                if (settled)
+                    return;
                 const fgDropped = spoolRemoved.out + spoolRemoved.err;
                 const shellId = this.adoptRunningExecSpool(child, spool, { out: 0, err: 0 }, fgDropped);
                 if (shellId === undefined)
                     return;
                 handedOver = true;
-                const o = outBuf.result();
-                const e = errBuf.result();
-                finish(ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode: 0, detached: { shellId } }));
+                finish(() => {
+                    const o = outBuf.result();
+                    const e = errBuf.result();
+                    return ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode: 0, detached: { shellId } });
+                });
             };
             if (detachSignal) {
                 if (detachSignal.aborted)
@@ -767,13 +764,20 @@ export class RemoteHostExecutionEnv {
                 }
             }
             const settleFromTermination = (code, signal) => {
-                if (settled)
-                    return;
-                drainFinal();
-                const o = outBuf.result();
-                const e = errBuf.result();
                 const exitCode = code ?? (signal ? 128 + (signalNumber(signal) ?? 0) : 1);
-                finish(ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode }));
+                const drained = [];
+                const won = finish(() => {
+                    drainFinal((lane, inc) => {
+                        record(lane, inc);
+                        drained.push({ lane, inc });
+                    });
+                    const o = outBuf.result();
+                    const e = errBuf.result();
+                    return ok({ stdout: markTruncated(o.text, o.droppedBytes), stderr: markTruncated(e.text, e.droppedBytes), exitCode });
+                });
+                if (won)
+                    for (const d of drained)
+                        deliver(d.lane, d.inc);
             };
             child.on("close", (code, signal) => {
                 if (drainTimer) {
@@ -972,13 +976,13 @@ export class RemoteHostExecutionEnv {
             lines = lines.slice(0, options.maxLines);
         return ok(lines);
     }
-    boundReader;
+    coreFs;
     async openBound(p, abortSignal) {
         const ready = await this.fsReady(p);
         if (!ready.ok)
             return ready;
-        this.boundReader ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
-        return this.boundReader.openBound(this.resolve(p), abortSignal);
+        this.coreFs ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
+        return this.coreFs.openBound(this.resolve(p), abortSignal);
     }
     async readBinaryFile(p, abortSignal) {
         const ready = await this.fsReady(p);
@@ -998,16 +1002,8 @@ export class RemoteHostExecutionEnv {
             const ready = await this.fsReady(p);
             if (!ready.ok)
                 return ready;
-            const abs = this.resolve(p);
-            try {
-                await fs.mkdir(path.dirname(abs), { recursive: true });
-                const data = typeof content === "string" ? content : Buffer.from(content);
-                await fs.writeFile(abs, data, { signal: abortSignal });
-                return ok(undefined);
-            }
-            catch (e) {
-                return { ok: false, error: this.fileError(e, abs, abortSignal) };
-            }
+            this.coreFs ??= new NodeExecutionEnv({ cwd: this.workspaceDir });
+            return this.coreFs.writeFile(this.resolve(p), content, abortSignal);
         });
     }
     appendFile(p, content, abortSignal) {

package/dist/plugins/remote-env-k8s.d.ts

@@ -2,7 +2,7 @@ import { type SpaceReclaimer, type WorkspaceSpacePolicy, type CacheReclaimReason
 import { type SpaceCommitFence } from "../workspace-space-commit.js";
 import { type CacheMissMemory, type WorkspaceCacheCapability } from "../workspace-cache.js";
 import { type SandboxEgressGap, type SandboxIpv6 } from "../sandbox-egress-policy.js";
-import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll } from "@sema-agent/core";
+import { FileError, ExecutionError, RemoteExecutionError, type ExecutionEnv, type RemoteExecutionEnv, type WorkspaceHandle, type FileInfo, type Result, type SymlinkChain, type OutputChunk, type ExecStreamOptions, type RemoteConnectConfig, type SnapshotId, type SessionToken, type VmLifecycleOptions, type ExecutionEnvFactory, type BackgroundShellCapability, type BackgroundShellId, type BackgroundShellError, type BackgroundSpawnOptions, type BackgroundPoll, type ExecutionEnvCapabilities } from "@sema-agent/core";
 import type { PodSpecPatch } from "./k8s-exec-protocol.js";
 import { type LaneHomeConfig } from "../lane-home-probe.js";
 type ExecOpts = Parameters<ExecutionEnv["exec"]>[1];
@@ -16,7 +16,9 @@ export interface K8sEnvConfig extends LaneHomeConfig {
     caCert?: string;
     /** Skip TLS verification (lab only — never production). */
     insecureTls?: boolean;
-    namespace?: string;
+    /** The namespace the sandbox pods live in (env `K8S_NAMESPACE`). REQUIRED, no default: the deployment declares it, and every reader
+     *  (the adapter's API paths, the reaper's pod face, the boot's egress reading) reads this one field. */
+    namespace: string;
     /** Sandbox pod image (a plain docker image present in the cluster). REQUIRED. */
     image: string;
     /** RuntimeClass for the VM boundary. Default "kata-qemu" (set "" to run plain runc — tests/dev only). */
@@ -258,8 +260,6 @@ export { execSocketTlsOptions } from "./k8s-exec-protocol.js";
  *  String() is "[object ErrorEvent]" — that masked the real TLS failure for a whole drill. */
 export declare function errorMessageOf(e: unknown): string;
 export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
-/** The sandbox namespace when `K8S_NAMESPACE` is unset (the one spelling: the adapter and the boot's egress line read it). */
-export declare const K8S_SANDBOX_NAMESPACE_DEFAULT = "sandboxes";
 /**
  * The boot reading of the sandbox Secret seat, a closed set: `granted` — every verb allowed · `denied` — the API answered "not allowed" for these
  * verbs (a definite answer; it wins over a verb that could not be asked) · `unverified` — some verb could not be asked (the request failed, the
@@ -301,12 +301,8 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
      * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
      */
     /** `sharesProcessTable`(core 7.57.0,必填):命令跑在沙箱 pod 自己的 PID 命名空间里(不开 hostPID),不在本进程所在的进程表。 */
-    readonly capabilities: {
-        isolation: boolean;
-        suspendable: boolean;
-        canonicalPathAuthoritative: true;
-        sharesProcessTable: false;
-    };
+    /** 能力块(引擎 [ref],八键必填、各键只经引擎读器读):`hostLocalPaths` = 这条车道答出的路径是不是本进程所在机器上的文件;`externalContentTarget` = 产出是否来自部署信任边界之外;`io` = 文件与 shell 两面真到达目标;`keepsReadFloor` = 是否守住读拒表的字节地板(本车道不守 ⇒ 读拒表非空的 run 被告知,部署要求地板时准备期拒)。 */
+    readonly capabilities: ExecutionEnvCapabilities;
     cwd: string;
     private podName?;
     /** Cluster-internal pod address, captured when the pod reaches Running — the LSP `getHost` surface.
@@ -813,19 +809,18 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
         maxLines?: number;
         abortSignal?: AbortSignal;
     }): Promise<Result<string[], FileError>>;
-    /** 父目录自建(与 host/local-docker/adb/ssh 同口径)。抽成共用是因为 `appendFile` 曾**跳过**它:
-     *  🔴 2026-07-25 实测的跨腿分叉 —— `appendFile` 直接调 `writeChunked`,整条路上没有 `mkdir -p`,于是
-     *  「直接 append 建一个新日志路径」在 k8s 腿上返 `not_found`,而其余 5 腿都成功(host/local-docker/adb 实测,
-     *  ssh/e2b 由方法体判据)。core 的后台输出镜像正是"每拍 append 一次"的形,这条分叉会让它在 k8s 腿上从第一拍
-     *  就失败,而 `mirrorFailed` 只会表现成一句「output file is INCOMPLETE」。 */
-    private ensureParentDir;
     writeFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
+    /** 暂存写的两只面(规则与提交脚本的唯一属主 = `remote-shell.ts`;父目录与私有暂存目录由编排的准备那一步建):上传 = 分块整份写进私有目录里的暂存件;
+     *  提交 = 文件面探针 exec。两者同一身份(同一只容器里的 exec)。 */
+    private stagedLane;
     appendFile(p: string, content: string | Uint8Array, abortSignal?: AbortSignal): Promise<Result<void, FileError>>;
     /**
      * Write `content` to `abs` via argv-embedded base64, chunked at WRITE_CHUNK_BYTES (no stdin on the exec
      * channel we use; v4 has no per-channel close). `truncateFirst` → the FIRST chunk uses `>` (overwrite),
      * the rest `>>` (append); `false` → all chunks `>>`. Empty content still runs exactly one command so an
      * empty file is created (write) / left intact (append). Shared by writeFile/appendFile (council DESIGN#2).
+     * Both file faces point this at a STAGING name (`writeFileStaged` / `appendFileStaged`), so a cut mid-way never reaches
+     * the target; the direct uses are the fallbacks of both faces (writeFile passes truncateFirst, appendFile does not) when the target's directory refuses a new name or the private staging directory could not be made private.
      */
     private writeChunked;
     private posixFsInst?;

package/dist/plugins/remote-env-k8s.js

@@ -4,7 +4,7 @@ import https from "node:https";
 import http from "node:http";
 import { StringDecoder } from "node:string_decoder";
 import WebSocket from "ws";
-import { buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode, numEnvOr } from "./remote-shell.js";
+import { appendFileStaged, buildCwdEnvCommand, createCwdGuardedCall, shellQuote, kindFromMode, numEnvOr, writeFileStaged } from "./remote-shell.js";
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
 import { SNAPSHOT_BUCKET_MISSING, isNoSuchBucketAnswer } from "./s3-answer.js";
@@ -15,6 +15,7 @@ import { WORKSPACE_CACHE_SPACE_LABEL, workspaceCacheClaimOf, workspaceCacheEnv }
 import { recordFailOpen } from "../observability/fail-open.js";
 import { PodDeleteRefused, reportPodDeleteFailed } from "./k8s-pod-delete-failure.js";
 import { buildLivenessCut, commandBoundsOf, laneLivenessOf, LIVENESS_MS_DEFAULT } from "../exec-bounds.js";
+import { buildCapturedOutput, createCutError } from "../exec-cut.js";
 import { SANDBOX_IPV6_DEFAULT, sandboxEgressGaps, sandboxPodSysctls } from "../sandbox-egress-policy.js";
 import { FileError, ExecutionError, RemoteExecutionError, withRetry, RollingTailBuffer, markTruncated, } from "@sema-agent/core";
 import { fileErrorFromExec, classifyFsStderr } from "./remote-env-file-error.js";
@@ -171,7 +172,6 @@ export function errorMessageOf(e) {
     return typeof m === "string" && m ? m : String(e);
 }
 export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
-export const K8S_SANDBOX_NAMESPACE_DEFAULT = "sandboxes";
 const SANDBOX_SECRET_NAME_PREFIX = "sbx-env-";
 const SANDBOX_SECRET_LABEL = "sema.io/sandbox-secret";
 const secretEnvKey = (name) => `env.${name}`;
@@ -235,7 +235,7 @@ export class RemoteK8sExecutionEnv {
             token: config.token,
             caCert: config.caCert,
             insecureTls: config.insecureTls ?? false,
-            namespace: config.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT,
+            namespace: config.namespace,
             image: config.image,
             runtimeClass: config.runtimeClass ?? "kata-qemu",
             mountPath: config.mountPath ?? K8S_WORKSPACE_MOUNT_DEFAULT,
@@ -268,7 +268,7 @@ export class RemoteK8sExecutionEnv {
         this.logger = config.logger;
         this.onWorkspaceSnapshot = config.onWorkspaceSnapshot;
         this.cacheMisses = config.cacheMisses;
-        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true, sharesProcessTable: false };
+        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true, sharesProcessTable: false, hostLocalPaths: false, externalContentTarget: false, io: true, keepsReadFloor: false };
         const bgMax = Math.max(1, Math.min(K8S_BG_MAX_TIMEOUT_SEC, Math.floor(this.cfg.timeoutMs / 1000)));
         this.backgroundCapabilities = {
             supported: true,
@@ -1498,10 +1498,11 @@ export class RemoteK8sExecutionEnv {
             let sinkClosed = false;
             let removeDetachListener;
             const detachTee = opts?.detach?.tee;
-            const finish = (r) => {
+            const finish = (outcome) => {
                 if (settled)
-                    return;
+                    return false;
                 settled = true;
+                const r = outcome();
                 clearTimeout(wallTimer);
                 clearTimeout(livenessTimer);
                 opts?.signal?.removeEventListener("abort", onAbort);
@@ -1512,11 +1513,37 @@ export class RemoteK8sExecutionEnv {
                 catch {
                 }
                 resolvePromise(r);
+                return true;
             };
             const bounds = commandBoundsOf({ timeoutMs: opts?.timeoutMs, readTimeoutMs: opts?.readTimeoutMs }, this.laneLiveness);
             const capMs = opts?.capMs;
             const wallMs = bounds.wallMs === undefined ? capMs : capMs === undefined ? bounds.wallMs : Math.min(bounds.wallMs, capMs);
-            const wallTimer = wallMs !== undefined ? setTimeout(() => finish({ ok: false, error: new ExecutionError("timeout", `command exceeded ${wallMs}ms`) }), wallMs) : undefined;
+            const recordStderr = (bytes) => {
+                if (bytes.length === 0)
+                    return;
+                errBuf.push(bytes);
+                if (detachTee)
+                    feedMemStream(detachTee.err, bytes, K8S_BG_MEM_CAP);
+            };
+            const emitStderr = (bytes) => {
+                if (bytes.length > 0 && errDecoder)
+                    opts.onStderr(errDecoder.write(bytes));
+            };
+            const takeStderr = (bytes) => {
+                recordStderr(bytes);
+                emitStderr(bytes);
+            };
+            const heldStderr = () => opts?.stderrFilter?.endStderr();
+            const captured = () => {
+                const held = heldStderr();
+                if (held)
+                    recordStderr(held);
+                return buildCapturedOutput(outTail, errBuf);
+            };
+            const cut = (c) => {
+                finish(() => ({ ok: false, error: createCutError(c, captured()) }));
+            };
+            const wallTimer = wallMs !== undefined ? setTimeout(() => cut({ code: "timeout", message: `command exceeded ${wallMs}ms` }), wallMs) : undefined;
             let livenessTimer;
             const liveness = bounds.liveness;
             const armLiveness = () => {
@@ -1525,28 +1552,18 @@ export class RemoteK8sExecutionEnv {
                 clearTimeout(livenessTimer);
                 const idle = Date.now() - lastProgress;
                 if (idle >= liveness.ms) {
-                    const cut = buildLivenessCut(liveness);
-                    finish({ ok: false, error: new ExecutionError(cut.code, cut.message, undefined, undefined, cut.noOutputSec) });
+                    cut(buildLivenessCut(liveness));
                     return;
                 }
                 livenessTimer = setTimeout(armLiveness, liveness.ms - idle);
             };
             armLiveness();
-            const onAbort = () => finish({ ok: false, error: new ExecutionError("aborted", "command aborted") });
+            const onAbort = () => cut({ code: "aborted", message: "command aborted" });
             if (opts?.signal) {
                 if (opts.signal.aborted)
                     return onAbort();
                 opts.signal.addEventListener("abort", onAbort, { once: true });
             }
-            const takeStderr = (bytes) => {
-                if (bytes.length === 0)
-                    return;
-                errBuf.push(bytes);
-                if (detachTee)
-                    feedMemStream(detachTee.err, bytes, K8S_BG_MEM_CAP);
-                if (errDecoder)
-                    opts.onStderr(errDecoder.write(bytes));
-            };
             sock.on("message", (...args) => {
                 const data = args[0];
                 const buf = Buffer.isBuffer(data) ? data : Buffer.from(data);
@@ -1588,7 +1605,7 @@ export class RemoteK8sExecutionEnv {
                     }
                     return;
                 }
-                finish({ ok: false, error: new ExecutionError("transport_lost", `exec socket error: ${errorMessageOf(e)}`, e instanceof Error ? e : undefined) });
+                finish(() => ({ ok: false, error: new ExecutionError("transport_lost", `exec socket error: ${errorMessageOf(e)}`, e instanceof Error ? e : undefined) }));
             });
             sock.on("close", () => {
                 if (spliceSink) {
@@ -1601,25 +1618,30 @@ export class RemoteK8sExecutionEnv {
                     return spliceSink.closed("error" in parsed ? { failed: true } : { failed: false, exitCode: parsed.exitCode });
                 }
                 if (statusFrame === undefined) {
-                    finish({ ok: false, error: new ExecutionError("transport_lost", "exec socket closed without status — k8s transport lost mid-command") });
+                    finish(() => ({ ok: false, error: new ExecutionError("transport_lost", "exec socket closed without status — k8s transport lost mid-command") }));
                     return;
                 }
                 const parsed = exitCodeFromStatus(statusFrame);
                 if ("error" in parsed) {
-                    finish({ ok: false, error: new ExecutionError("spawn_error", parsed.error) });
+                    const said = parsed.error;
+                    finish(() => ({ ok: false, error: new ExecutionError("spawn_error", said) }));
                     return;
                 }
-                if (opts?.stderrFilter)
-                    takeStderr(opts.stderrFilter.endStderr());
-                const err = errBuf.result();
-                const stderr = markTruncated(err.text, err.droppedBytes);
-                if (boundOutput) {
-                    const out = outTail.result();
-                    finish(ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode: parsed.exitCode }));
-                }
-                else {
-                    finish(ok({ stdout: Buffer.concat(outBufs).toString("utf8"), stderr, exitCode: parsed.exitCode }));
-                }
+                const exitCode = parsed.exitCode;
+                const held = heldStderr();
+                const won = finish(() => {
+                    if (held)
+                        recordStderr(held);
+                    const err = errBuf.result();
+                    const stderr = markTruncated(err.text, err.droppedBytes);
+                    if (boundOutput) {
+                        const out = outTail.result();
+                        return ok({ stdout: markTruncated(out.text, out.droppedBytes), stderr, exitCode });
+                    }
+                    return ok({ stdout: Buffer.concat(outBufs).toString("utf8"), stderr, exitCode });
+                });
+                if (won && held)
+                    emitStderr(held);
             });
             const detach = opts?.detach;
             if (detach) {
@@ -1925,30 +1947,15 @@ export class RemoteK8sExecutionEnv {
             lines = lines.slice(0, options.maxLines);
         return ok(lines);
     }
-    async ensureParentDir(abs, abortSignal) {
-        const dir = path.posix.dirname(abs);
-        if (!dir || dir === "." || dir === "/")
-            return undefined;
-        const mk = await this.fsExec(`mkdir -p ${shellQuote(dir)}`, abortSignal);
-        if (!mk.ok)
-            return { ok: false, error: fileErrorFromExec(mk.error, dir) };
-        if (mk.value.exitCode !== 0)
-            return { ok: false, error: classifyFsStderr(mk.value.stderr, dir) };
-        return undefined;
-    }
     async writeFile(p, content, abortSignal) {
-        const abs = this.resolve(p);
-        const bad = await this.ensureParentDir(abs, abortSignal);
-        if (bad)
-            return bad;
-        return this.writeChunked(abs, content, true, abortSignal);
+        return writeFileStaged(this.stagedLane(content), this.resolve(p), abortSignal);
+    }
+    stagedLane(content) {
+        return { upload: (dest, signal) => this.writeChunked(dest, content, true, signal), run: (cmd, signal) => this.fsExec(cmd, signal) };
     }
     async appendFile(p, content, abortSignal) {
         const abs = this.resolve(p);
-        const bad = await this.ensureParentDir(abs, abortSignal);
-        if (bad)
-            return bad;
-        return this.writeChunked(abs, content, false, abortSignal);
+        return appendFileStaged(this.stagedLane(content), abs, abortSignal, (ctx) => ctx.inPlace((signal) => this.writeChunked(abs, content, false, signal)));
     }
     async writeChunked(abs, content, truncateFirst, abortSignal) {
         const bytes = typeof content === "string" ? Buffer.from(content, "utf8") : Buffer.from(content);
@@ -2119,7 +2126,7 @@ export function createSandboxPodApi(config, deps) {
     let env;
     const control = () => (env ??= new RemoteK8sExecutionEnv(config, deps));
     return {
-        namespace: config.namespace ?? K8S_SANDBOX_NAMESPACE_DEFAULT,
+        namespace: config.namespace,
         list: () => control().listSandboxPods(),
         delete: (name) => control().deletePod(name),
     };