@sema-agent/server 7.140.0 → 7.142.0

package/dist/boot/execution-env.js

@@ -11,10 +11,11 @@ import { PerTaskImageRegistry } from "../per-task-image.js";
 import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
+import { createWorkspaceFill } from "../plugins/workspace-fill.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
 import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
-import { judgeSandboxGitPlane, runIdentitySourceOf, sandboxBrokerSeatOf, sandboxGitPlaneAsksSecretSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
+import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
@@ -30,13 +31,15 @@ import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
 import { sessionFaceOfHead } from "../session-incarnation.js";
+import { isCodeToken } from "../terminal.js";
 import { createCacheMissMemory } from "../workspace-cache.js";
 import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
-import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated } from "../execution-lane-caps.js";
+import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
 import { warnReadDenyFloorUnkept } from "./execution-lane.js";
+import { seatText } from "../trace/exit-seat.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -104,15 +107,19 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         dropSession,
     };
 }
+export function ownsItsWorkspace(ctx) {
+    return ctx.placementRootSessionId === ctx.sessionId;
+}
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
-        const child = ctx.placementRootSessionId !== ctx.sessionId;
+        const child = !ownsItsWorkspace(ctx);
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
         const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId, rpcTimeoutMsOf(k8sCfg));
         const runId = !child && ctx.taskId !== undefined ? ctx.taskId : undefined;
         const sandboxBroker = await seats.brokerSeatOf?.(runId);
+        const workspaceFill = seats.workspaceFillOf?.(ctx);
         const { cache, ...deploymentCfg } = k8sCfg;
         return k8sExecutionEnvFactory({
             ...deploymentCfg,
@@ -122,11 +129,11 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
             ...(spaceOccupant !== undefined ? { spaceOccupant } : {}),
             ...(runId !== undefined ? { runId } : {}),
             ...(sandboxBroker !== undefined ? { sandboxBroker } : {}),
+            ...(workspaceFill !== undefined ? { workspaceFill } : {}),
             onWorkspaceSnapshot,
         }, deps)(ctx);
     };
 }
-const STORE_ERROR_CODE = /^[A-Za-z0-9_.:-]{1,64}$/;
 const INCARNATION_READ_TIMEOUT = "incarnation_read_timeout";
 async function occupantOf(seats, sessionId, taskId, boundMs) {
     let answer;
@@ -142,7 +149,7 @@ async function occupantOf(seats, sessionId, taskId, boundMs) {
     }
     catch (e) {
         const code = e?.code;
-        return { fault: typeof code === "string" && STORE_ERROR_CODE.test(code) ? code : "incarnation_read_failed" };
+        return { fault: isCodeToken(code) ? code : "incarnation_read_failed" };
     }
     if (answer === undefined)
         return { unread: "incarnation_unknown" };
@@ -171,7 +178,7 @@ export async function ensureSandboxSecretSeat(k8sCfg, logger, deps, read = () =>
             recordFailOpen("server.sandbox-secret.seat-unverified", `namespace=${namespace} ${seat.detail}`);
             logger.warn("sandbox_secret_seat_unverified", {
                 namespace,
-                detail: seat.detail,
+                detail: seatText("operator-log-text", seat.detail),
                 effect: `the boot could not confirm the sandbox Secret RBAC (secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")}) — the service starts; if the Role lacks them, the first run that forwards K8S_SANDBOX_ENV is refused at connect (auth_failed) and its pod deleted — the values never go into the pod spec`,
             });
             return;
@@ -239,9 +246,9 @@ export function createExecutionEnv(ctx) {
     let spaceReclaimer;
     let sandboxSecretSeatGate;
     let sandboxPodReaper;
-    const planeCell = {};
-    let readSandboxGitPlane = async () => (planeCell.current = judgeSandboxGitPlane(sandboxGitPlanePremisesOf(config, {})));
+    let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
     let worktreeReap;
+    const workspaceFillOf = taskAttachmentStore === undefined ? undefined : (fctx) => createWorkspaceFill({ store: taskAttachmentStore, sessionId: fctx.sessionId, seeds: ownsItsWorkspace(fctx), logger });
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
@@ -252,9 +259,11 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.allowInternetAccess != null ? { allowInternetAccess: config.remoteExec.allowInternetAccess } : {}),
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...((env) => (env !== undefined ? { sandboxEnv: env } : {}))(sandboxLaneEnvMerged(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv))),
+            sandboxReadFloor: config.sandboxReadFloor,
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
             logger,
             metrics,
-        });
+        }, ctx.laneDeps?.e2b);
     }
     else if (config.remoteExec?.provider === "k8s") {
         const k8sCfg = {
@@ -278,31 +287,26 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.workspaceSnapshotExclude ? { snapshotExclude: config.remoteExec.workspaceSnapshotExclude } : {}),
             logger,
             ...((lane) => ({ ...(lane.env !== undefined ? { podEnv: lane.env } : {}), ...(lane.secretEnv !== undefined ? { podSecretEnv: lane.secretEnv } : {}) }))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
+            sandboxReadFloor: config.sandboxReadFloor,
         };
-        const brokerImage = config.remoteExec.brokerImage;
+        sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {
+            patchRefusal: podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch),
+            askSecretSeat: () => readSandboxSecretSeat(k8sCfg, "lease"),
+        });
         executionEnvFactory = createK8sRunEnvFactory(k8sCfg, {
             imageOf: (sid) => perTaskImage.get(sid),
             headOf: ctx.headOf,
             spaceCommits: ctx.spaceCommits ?? (() => undefined),
-            brokerSeatOf: async (runId) => {
-                const plane = planeCell.current;
-                if (plane === undefined || plane.state !== "on")
-                    return undefined;
-                return sandboxBrokerSeatOf(plane, brokerImage, await runIdentitySourceOf(runId, ctx.runRows?.(), logger));
-            },
-        });
+            brokerSeatOf: createSandboxBrokerSeatOf(sandboxGitPlane.now, config.remoteExec.brokerImage, ctx.runRows, logger),
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+        }, ctx.laneDeps?.k8s);
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
-        readSandboxGitPlane = async () => {
-            const premises = sandboxGitPlanePremisesOf(config, { ...((r) => (r !== undefined ? { patchRefusal: r } : {}))(podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch)) });
-            const secretSeat = sandboxGitPlaneAsksSecretSeat(premises) ? await readSandboxSecretSeat(k8sCfg, "lease") : undefined;
-            return (planeCell.current = judgeSandboxGitPlane({ ...premises, secretSeat }));
-        };
         sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
-            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
     else if (config.remoteExec?.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
@@ -394,7 +398,9 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.network ? { network: config.remoteExec.network } : {}),
             ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
-        });
+            sandboxReadFloor: config.sandboxReadFloor,
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+        }, ctx.laneDeps?.localDocker);
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
         executionEnvFactory = withRemoteScratchpad(executionEnvFactory, logger);
@@ -448,7 +454,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = registry.wrapFactory(executionEnvFactory);
         return registry;
     })();
-    if (taskAttachmentStore && executionEnvFactory) {
+    if (taskAttachmentStore && executionEnvFactory && !laneIsolated(executionLaneOf(config.remoteExec.provider))) {
         const inner = executionEnvFactory;
         const attStore = taskAttachmentStore;
         executionEnvFactory = async (ctx) => {
@@ -466,8 +472,9 @@ export function createExecutionEnv(ctx) {
         const isolated = laneIsolated(executionLaneOf(config.remoteExec.provider));
         const suspendable = DEPLOYMENT_SHAPE_PREDICATES.suspendableHands.holds(config);
         const keepsReadFloor = capabilitiesFor(config).keepsReadFloor;
+        const sandboxReadFloor = laneSandboxReadFloorState(config);
         const sandboxEnvKeys = [...sandboxEnvNamesInForce(config)].sort();
-        logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, keepsReadFloor, ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
+        logger.info("remote_exec_enabled", { provider: config.remoteExec.provider, isolated, suspendable, keepsReadFloor, ...(sandboxReadFloor !== undefined ? { sandboxReadFloor } : {}), ...(sandboxEnvKeys.length > 0 ? { sandboxEnvKeys } : {}) });
         if (!isolated)
             logger.warn("remote_exec_real_system", { provider: config.remoteExec.provider, note: buildRealSystemNote(config.remoteExec) });
         const homeLine = buildLaneHomeBootNote(config);
@@ -503,7 +510,7 @@ export function createExecutionEnv(ctx) {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, readSandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane,
     };
 }
 //# sourceMappingURL=execution-env.js.map

package/dist/boot/execution-lane.js

@@ -4,6 +4,7 @@ import { crossInvariant } from "../config-invariants.js";
 import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
+import { seatText } from "../trace/exit-seat.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
 export async function composeExecutionLane(config, ctx) {
     if (ctx.configSource === "local")
@@ -55,7 +56,7 @@ async function applyRemoteExecFile(config, ctx) {
         fileRx = await loadRemoteExec(localRoot);
     }
     catch (err) {
-        logger.error("remote_exec_file_invalid", { root: localRoot, err: String(err) });
+        logger.error("remote_exec_file_invalid", { root: localRoot, err: seatText("operator-log-text", String(err)) });
         throw new Error(`config.d/remote-exec.json under ${localRoot} is invalid: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
     }
     if (!fileRx)

package/dist/boot/exit-boundary.js

@@ -2,6 +2,7 @@ import { defaultTaskRegistry } from "@sema-agent/core";
 import { reportHardKillReceipts } from "../background-session-reap.js";
 import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
+import { seatText } from "../trace/exit-seat.js";
 const PROCESS_EXIT_INCLUDES_RETAINED = false;
 export function installProcessExitBoundary({ logger }) {
     const reapOwnChildProcesses = () => {
@@ -13,7 +14,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.info("shutdown_background_reaped", { reaped });
         }
         catch (err) {
-            logger.warn("shutdown_background_reap_failed", { err: String(err) });
+            logger.warn("shutdown_background_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
         try {
             const fg = reapHostForegroundChildren();
@@ -23,7 +24,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_foreground_reap_incomplete", { groups: fg.failed });
         }
         catch (err) {
-            logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
+            logger.warn("shutdown_foreground_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
         return backgroundSoftStopped;
     };
@@ -33,7 +34,7 @@ export function installProcessExitBoundary({ logger }) {
             reportHardKillReceipts(logger, receipts, "process_exit");
         }
         catch (err) {
-            logger.warn("shutdown_background_hard_kill_failed", { err: String(err) });
+            logger.warn("shutdown_background_hard_kill_failed", { err: seatText("operator-log-text", String(err)) });
         }
     };
     const reapOwnHostWorkspaces = () => {
@@ -45,7 +46,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_host_workspace_reap_incomplete", { dirs: failed.map((f) => f.dir) });
         }
         catch (err) {
-            logger.warn("shutdown_host_workspace_reap_failed", { err: String(err) });
+            logger.warn("shutdown_host_workspace_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
     };
     const onProcessExit = () => {

package/dist/boot/memory-boundary.d.ts

@@ -40,7 +40,7 @@
  * `memory_harvest_rejections_total{code}` + 一条 warn,见 `boot/runner-deps.ts` 的 harvest 报告站点),
  * 等下一次非受限会话走正常门收编。
  * ⚠️ **这一层只在 file 记忆引擎上**(受限视图 = `FileMemoryEngineBackend` 的实装,`materialize` 取它是
- * `?? this.backend` 的可选 seam):`MEMORY_ENGINE_BACKEND=pg|tidb` 的两条腿读侧走库、盘上只是每任务投影,
+ * `?? this.backend` 的可选 seam):`MEMORY_ENGINE_BACKEND=pg|mysql` 的两条腿读侧走库、盘上只是每任务投影,
  * 没有「读磁盘即收编」的通道,`false` 在它们上仍买到披露/写门/零收编 harvest 三件。
  * ⚠️ **口径别混**:受限 = **会话级 verdict 单键**(declared-false 那一个键);`writeScope:null` 的只读
  * **平面**(请求键 `memoryWrite:false` 的 per-run 暂停 / org 层默认只读 / 双根非写面)**保持 adopt-on-read
@@ -75,7 +75,7 @@ export interface MemoryWriteBoundaryFacts {
     declaredCapable: boolean | undefined;
     /** 本部署的记忆引擎后端(`config.memoryEngineBackend`)。**只进文案**,不参与任何判决 —— 它在这里的
      *  唯一作用是把「怎么把根挪进围栏」这句话指向**在该腿上真的有效**的那个旋钮:`MEMORY_ENGINE_DIR` 只被
-     *  file 腿读(memory-scope 的 `resolveMemoryEngineRoot`),pg/tidb 腿的根是
+     *  file 腿读(memory-scope 的 `resolveMemoryEngineRoot`),pg/mysql 腿的根是
      *  `<LOCAL_DATA_ROOT|数据根>/memory-work`(boot/stores.ts 两支),那条腿上指 MEMORY_ENGINE_DIR 是让
      *  operator 去拧一个不接线的旋钮 —— 修不好还以为自己修了。 */
     engineBackend: MemoryEngineBackend;

package/dist/boot/memory-consolidation.d.ts

@@ -210,7 +210,7 @@ export declare function consolidationSeatBillingOf(plane: ConsolidationSeatPlane
  *    (结构上跑不起来由下游 D1 三条拒启臂照拒,本判决不吞);开而座落主模型 ⇒ 开 + 一行
  *    `memory_consolidation_on_main_model`(部署方显式承担,但必须知道账按主模型记)。
  *  · **未设 = 出厂缺省派生**([ref] 取代 [ref] ① 的「出厂 off」实况):
- *      结构上跑不起来(判官 {@link consolidationDriverUnwirable} 有成因:多租户 / `MEMORY_ENGINE=off` / pg·tidb
+ *      结构上跑不起来(判官 {@link consolidationDriverUnwirable} 有成因:多租户 / `MEMORY_ENGINE=off` / pg·mysql
  *      记忆后端 / `MEMORY_PROVENANCE=off`)⇒ **恒关、零提示、零探针** —— 派生开撞上 D1 拒启臂 = 每台配了便宜模型的
  *      多租户 worker 升级即起不来;而配不配便宜模型它都开不了,一句指向 `MODEL_CHEAP_ID` 的提示是误导;
  *      座不落主模型({@link consolidationSeatBillingOf} = `own-model`)⇒ **开**;

package/dist/boot/memory-consolidation.js

@@ -7,6 +7,7 @@ import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
 import { backendOwnsControlPlane, captureRecordStoreOf } from "../memory-operator-faces.js";
 import { memoryStoreForRequest } from "../memory-scope-stores.js";
 import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, modelOriginOf, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { seatText } from "../trace/exit-seat.js";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -114,7 +115,7 @@ function unwirableRefusal(code, facts) {
                 `(MEMORY_ENGINE_BACKEND=${facts.memoryEngineBackend}) does NOT own an engine control plane (controlPlaneRoot) — ` +
                 `core would derive one on THIS replica's local disk, and a consolidation run's resumable account would die with ` +
                 `the pod (a lost run re-mints the whole library at full model cost on the next attempt). The file memory backend ` +
-                `owns a control plane; the pg/tidb memory backends do not. Set MEMORY_ENGINE_BACKEND=file, or set ` +
+                `owns a control plane; the pg/mysql memory backends do not. Set MEMORY_ENGINE_BACKEND=file, or set ` +
                 `MEMORY_CONSOLIDATION_DRIVER=off.`);
         case "provenance-off":
             return (`MEMORY_CONSOLIDATION_DRIVER=on is incompatible with MEMORY_PROVENANCE=off — core refuses to enable consolidation ` +
@@ -238,7 +239,7 @@ function decideConsolidationValve(input) {
                 return { valve: { enabled: true, source: "derived", catalogDependent: true } };
             const seatFact = billing.kind === "main-model"
                 ? `Here the seat resolves to the main model "${billing.mainModel}" (no MODEL_CHEAP_ID naming another model, and no catalog roles.consolidate / roles.summarize / "flash" tier binding to another model)`
-                : `Here no consolidation seat resolves at all (${billing.fault})`;
+                : `Here no consolidation seat resolves at all (${seatText("operator-log-text", billing.fault)})`;
             return {
                 valve: {
                     enabled: false,

package/dist/boot/parked-revive-gate.js

@@ -8,6 +8,7 @@ import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { createDeploymentListExemption } from "../approval.js";
+import { seatText } from "../trace/exit-seat.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
@@ -63,7 +64,7 @@ async function resolveCapsFor(deps, identity) {
         return await deps.resolveRuntimeCaps(identity.principal);
     }
     catch (err) {
-        deps.logger.warn("parked_revive_caps_unresolved", { principal: identity.principal ?? null, err: err instanceof Error ? err.message : String(err) });
+        deps.logger.warn("parked_revive_caps_unresolved", { principal: identity.principal ?? null, err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
         return undefined;
     }
 }

package/dist/boot/permission-rules-audit.d.ts

@@ -1,31 +1,3 @@
-/**
- * [ref] §3([ref] v2 §6 F4 的**残余采纳**)—— 默认 ON 的**休眠行审计**。
- *
- * 🔴 这条审计存在的唯一理由:`PERMISSION_RULES_ENABLED` 的默认值在本车从 OFF 翻成 ON,而**旋钮翻转
- * 与规则行的寿命是两条独立的时间线**。三张表自 [ref] 车二起就随中央 `ensureSchema` 建、并且从来没有被
- * 清过,所以下面这两类部署在升级的那一刻会突然带着**既有**规则行开始放行:
- *   · 曾经把旋钮开过一段时间又关掉的部署(行留在库里,只是没人读);
- *   · 从旧库恢复/克隆出来的部署(行跟着数据一起来的)。
- * 对运维来说,这是「我什么都没改,worker 却开始少问我了」——一次**放宽面**上的静默变化。审计做的事
- * 很小但是承重:在启动日志里把它说出来,让「少问」是一条能被读到的因果,而不是一次玄学。
- *
- * ── 三条判据,逐条有理由 ────────────────────────────────────────────────────────────────────────
- *  ① **店缺席 ⇒ 整条不上场**(零 I/O、零行)。店缺席包括:显式关旋钮、`local` 车道没接 File 店的旧
- *     部署、以及压根没有 backend 的 env-only worker。没有店就没有行,谈不上唤醒。
- *  ② **零桶 ⇒ 不打行**。一条「0 条既有规则随默认 ON 激活」的行是纯噪音:它对读日志的人不传递任何
- *     可行动的信息,却让真正有东西被唤醒的那一行变得不显眼。
- *  ③ **运维**显式**表过态(`PERMISSION_RULES_ENABLED` 被设成 true 或 false)⇒ 不打行**。那些行本来
- *     就是活的(或者旋钮被显式关着、店根本没装配),默认值翻不翻转对它们零影响 —— 说「随默认 ON
- *     激活」是**假话**,而在启动日志里说假话比不说更坏。判据用 `permissionRulesEnabledExplicit`
- *     (config.ts 与 `dbBackendExplicit` 同姿势),不是猜。
- *
- * ── 失败方向 ────────────────────────────────────────────────────────────────────────────────────
- * 数不出来(库抖动 / 文件读不了)⇒ **不拒启、也不编一个 0 出来**:返回 `undefined` + 一条 warn。
- * 这是一条纯诊断面(它不参与任何放行/拒绝判决),所以它的降级方向是「安静地不知道」而不是「谎报
- * 零」——`{ buckets: 0 }` 会被下游读成「确认没有休眠行」,那是把一次读失败伪装成一个结论。
- * 因为它零判决,这条 fail-open 不属于 `docs/FAIL-OPEN-CENSUS.md` 的安全轴 P 类,故不占 `recordFailOpen`
- * 的标签;它的可见性由那条 warn 承担。
- */
 /** 审计只需要一只桶计数口——**刻意**不吃整个 `PermissionRuleStoreBundle`:诊断面对店的其余能力
  *  一无所知也不该知道,窄口让测试能用四行 fixture 驱动真实现同一段代码。 */
 export interface DormantRuleCounter {

package/dist/boot/permission-rules-audit.js

@@ -1,3 +1,4 @@
+import { seatText } from "../trace/exit-seat.js";
 export async function auditDormantPermissionRules(ctx) {
     if (ctx.stores === undefined)
         return undefined;
@@ -7,7 +8,7 @@ export async function auditDormantPermissionRules(ctx) {
     }
     catch (err) {
         ctx.logger.warn?.("permission_rules_dormant_audit_failed", {
-            error: err instanceof Error ? err.message : String(err),
+            error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
             note: "the boot audit could not count pre-existing permission-rule buckets; the lane itself is unaffected",
         });
         return undefined;

package/dist/boot/read-deny-anchor-audit.js

@@ -1,5 +1,6 @@
 import { compileReadDeny, readDenyRowAnchor } from "@sema-agent/core";
 import { echoCallerText } from "../caller-text-echo.js";
+import { seatText } from "../trace/exit-seat.js";
 export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
 const NAMED_ROW_ECHO_CHARS = 200;
 function isAnchoredCanonicalRow(canonical) {
@@ -14,7 +15,7 @@ export function auditReadDenyAnchoring(ctx) {
     }
     catch (err) {
         ctx.logger.warn("read_deny_anchor_audit_failed", {
-            error: echoCallerText(err instanceof Error ? err.message : String(err), { maxChars: 400 }),
+            error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
             note: "the boot audit could not read the deployment read-deny rows, so it names none and changes nothing; the engine itself refuses a row it cannot read when the Runner is built",
         });
         return [];

package/dist/boot/reapers.d.ts

@@ -167,8 +167,8 @@ interface ReapSessionsInputs {
  * 的那条臂**结构上看不见**它(它从行出发枚举),只有从会话侧枚举才找得到。
  *
  * 两只面必须落在**host durable 店**上,而 release 这一格是承重的:
- *  · `listPlaced` = host 店的分区枚举(SQL 孪生实装;local/File 后端无此面 ⇒ 键**不设**,core 那条腿
- *    如实不可用 —— 绝不给一个恒返回 `[]` 的假面,那会把「枚不了」读成「没有孤儿」);
+ *  · `listPlaced` = host 店的分区枚举(三只持久会话店都实装:SQL 两孪生读 `session_meta`,local 读会话存档行头;
+ *    店上没有这只面 ⇒ 键**不设**,core 那条腿如实不可用 —— 绝不给一个恒返回 `[]` 的假面,那会把「枚不了」读成「没有孤儿」);
  *  · `release` 对 **placed id** 必须走 host 店:路由店(`ForkRoutingSessionStore`)对一个重启后不认识
  *    的 id 会回落 transient(进程内 no-op),那会让 core 数出一次**从未发生**的 release
  *    (`orphanPlacedReleased` 当场变成谎)而字节还在库里。故先按**持久化元组**判(一次 PK 探针),

package/dist/boot/reapers.js

@@ -6,6 +6,7 @@ import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
 import { SANDBOX_POD_REAP_PERIOD_MS } from "../plugins/k8s-pod-reaper.js";
 import { APPROVAL_ASK_RETENTION_PASS_MS, runApprovalAskRetentionPass } from "../approval-ask-retention.js";
+import { seatText } from "../trace/exit-seat.js";
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
     let streak = 0;
@@ -21,7 +22,7 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
                 logger.warn("reaper_leg_repeated_failure", {
                     reaper: name,
                     consecutiveFailures: streak,
-                    lastError: err instanceof Error ? err.message : String(err),
+                    lastError: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
                 });
             }
             catch {
@@ -169,7 +170,7 @@ export function startReapers(ctx) {
                 catch (err) {
                     failedScopes++;
                     try {
-                        logger.warn("bg_agent_reap_scope_failed", { scope, err: err instanceof Error ? err.message : String(err) });
+                        logger.warn("bg_agent_reap_scope_failed", { scope, err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                     }
                     catch {
                     }
@@ -266,7 +267,7 @@ export function startReapers(ctx) {
             } })
                 .catch((err) => {
                 try {
-                    logger.warn("attachment_orphan_sweep_failed", { err: err instanceof Error ? err.message : String(err) });
+                    logger.warn("attachment_orphan_sweep_failed", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                 }
                 catch {
                 }

package/dist/boot/resolve-spec.js

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, modePolicyOf, resolveAskSeamForm } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, resolveAskSeamForm } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -14,14 +14,14 @@ import { createDeploymentListExemption, gateIntentUnserviceableReason, singleUse
 import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { createSettingsHooksRegistration, settingsHooksBudgetMs } from "../hooks/hook-runner.js";
-import { HOST_POSTURE_REFUSED_CODE, taskInheritEnvRefusal, taskWriteFaceRefusal } from "../hosted-posture.js";
+import { HOST_POSTURE_REFUSED_CODE, permissionModeWriteFaceRefusal, taskInheritEnvRefusal } from "../hosted-posture.js";
 import { headerStr } from "../http/principal-gate.js";
 import { explicitOperatorOk } from "../http/server.js";
 import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, resolveTaskModel, selectableCatalog, terminalCatalogName } from "../model-select.js";
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
-import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
+import { attachmentBindRefusalAnswer, bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
 import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
@@ -50,7 +50,8 @@ import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { fieldConflictFacts } from "../field-conflict.js";
 function unrooted(spec) {
@@ -160,8 +161,8 @@ export function createResolveSpec(ctx) {
             assertRequestImageUrls(body.images);
         const gated = await gateScenarioAndAppend(body, auth, opts);
         const effMode = effectivePermissionMode(body, gated.parsedSettings.settings);
-        if (effMode !== undefined && modePolicyOf(effMode).writeFace === "open") {
-            const why = taskWriteFaceRefusal(config);
+        {
+            const why = permissionModeWriteFaceRefusal(effMode, config);
             if (why !== undefined)
                 throw new HttpError(422, why, { code: HOST_POSTURE_REFUSED_CODE });
         }
@@ -216,11 +217,13 @@ export function createResolveSpec(ctx) {
                     if (!auth?.sessionId)
                         throw new HttpError(400, "`attachmentIds` requires a session-resolving deployment (no authorizer session)");
                     const sid = auth.sessionId;
+                    const lane = opts.execution.lane;
                     const r = await bindAttachmentsForTask({
                         store: taskAttachmentStore,
                         owner: auth?.principal ?? "default",
                         ids: reqAtt,
                         sessionId: sid,
+                        lane: { word: lane, isolated: laneIsolated(lane) },
                         leg: opts?.leg === "fresh" ? "fresh" : "resume",
                         nowMs: Date.now(),
                         onMissing: (id) => {
@@ -228,6 +231,12 @@ export function createResolveSpec(ctx) {
                                 throw new HttpError(400, `attachment not found: ${id}`);
                             logger.warn("attachment_missing_on_resume", { sessionId: sid, id });
                         },
+                        onRefused: (refusal) => {
+                            const answer = attachmentBindRefusalAnswer(refusal);
+                            if (opts?.leg === "fresh")
+                                throw createCodedHttpError(answer.status, answer.errorCode, answer.message, answer.extra);
+                            logger.warn("attachment_refused_on_resume", { sessionId: sid, errorCode: answer.errorCode, ...answer.extra });
+                        },
                     });
                     attachmentNotice = r.notice;
                 }
@@ -276,6 +285,7 @@ export function createResolveSpec(ctx) {
                 sessionId: auth?.sessionId ?? "",
                 cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
+                httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
                 hookLlm,
                 hookAgent,
                 onHookNotice: (n) => fleetBus.publishHookNotice({
@@ -579,9 +589,11 @@ export function createResolveSpec(ctx) {
                 ? await ensureScratchpadDir(config.localDataRoot ?? localRoot, auth.sessionId, (msg, meta) => logger.warn(msg, { ...(meta ?? {}), sessionId: auth.sessionId }))
                 : undefined);
         if (effectiveSettings) {
+            const configRoot = executionConfigRootOf(config);
             const ruleBases = {
                 ...(pathAdjudication.taskRoot !== undefined ? { taskRoot: pathAdjudication.taskRoot } : {}),
                 ...(pathAdjudication.taskHome !== undefined ? { taskHome: pathAdjudication.taskHome } : {}),
+                ...(configRoot !== undefined ? { configRoot } : {}),
             };
             try {
                 governed = applyTaskSettings(governedBase, effectiveSettings, ruleBases);

package/dist/boot/retention-lane.js

@@ -1,4 +1,5 @@
 import { recordFailOpen } from "../observability/fail-open.js";
+import { seatText } from "../trace/exit-seat.js";
 export const RETENTION_SWEEP_STUCK_THRESHOLD = 5;
 export const RETENTION_LEASE_TTL_FACTOR = 2;
 const DAY_MS = 86_400_000;
@@ -137,15 +138,16 @@ async function recordDomainFailure(ctx, d) {
     }
     const streaks = ctx.streaks;
     const streak = (streaks?.get(d.domain) ?? 0) + 1;
+    const shown = seatText("operator-log-text", message);
     streaks?.set(d.domain, streak);
     try {
-        ctx.logger.warn("retention_sweep_domain_failed", { domain: d.domain, fencingToken: d.fencingToken, consecutiveFailures: streak, auditRowWritten, err: message });
+        ctx.logger.warn("retention_sweep_domain_failed", { domain: d.domain, fencingToken: d.fencingToken, consecutiveFailures: streak, auditRowWritten, err: shown });
         if (streak >= RETENTION_SWEEP_STUCK_THRESHOLD) {
             ctx.metrics.inc("retention_sweep_stuck", {}, 1);
             ctx.logger.warn("retention_sweep_stuck", {
                 domain: d.domain,
                 consecutiveFailures: streak,
-                lastError: message,
+                lastError: shown,
                 note: "this retention domain has failed its sweep for RETENTION_SWEEP_STUCK_THRESHOLD consecutive rounds — its data is NOT being retained per policy. Check retention_audit rows with action='failed' for this domain.",
             });
             streaks?.set(d.domain, 0);
@@ -168,7 +170,7 @@ export function startRetentionLane(ctx) {
             .then(() => undefined)
             .catch((err) => {
             try {
-                ctx.logger.warn("retention_sweep_round_failed", { err: err instanceof Error ? err.message : String(err) });
+                ctx.logger.warn("retention_sweep_round_failed", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
             }
             catch {
                 recordFailOpen("server.retention.sweep-report-dropped", "round");