@sema-agent/server 7.141.0 → 7.142.0

package/dist/boot/budget-tracing.js

@@ -6,19 +6,23 @@ import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import { buildQuotaBounds } from "./limit-sync.js";
 import { assembleFileHistory } from "../file-history-capture.js";
-export function createBudgetAndTracing(ctx) {
-    const { config, logger, metrics, backend, breakerState } = ctx;
-    const { brain, degradeRoute: degradeRouteWatch } = createBrainAssembly(config, { breakerState });
-    const pricing = buildPricing(config.models);
-    const counterDegradeHook = (info) => {
+import { seatText } from "../trace/exit-seat.js";
+export function createCounterDegradeHook({ logger, metrics }) {
+    return (info) => {
         metrics.setGauge("counter_flush_fail_streak", info.streak, { table: info.table, kind: info.kind });
         if (info.streak > 0)
             metrics.inc("counter_flush_failed_total", { table: info.table, kind: info.kind });
         if (info.streak === 3)
-            logger.warn("counter_flush_degraded", { table: info.table, kind: info.kind, streak: info.streak, ...(info.error ? { error: info.error } : {}) });
+            logger.warn("counter_flush_degraded", { table: info.table, kind: info.kind, streak: info.streak, ...(info.error ? { error: seatText("operator-log-text", info.error) } : {}) });
         else if (info.streak === 0 && info.prevStreak >= 3)
             logger.info("counter_flush_recovered", { table: info.table, kind: info.kind, prevStreak: info.prevStreak });
     };
+}
+export function createBudgetAndTracing(ctx) {
+    const { config, logger, metrics, backend, breakerState } = ctx;
+    const { brain, degradeRoute: degradeRouteWatch } = createBrainAssembly(config, { breakerState });
+    const pricing = buildPricing(config.models);
+    const counterDegradeHook = createCounterDegradeHook({ logger, metrics });
     const bounds = buildQuotaBounds(config);
     const costQuota = backend?.costQuota
         ? backend.costQuota(bounds.limitMicroUsd, bounds.windowMs, counterDegradeHook).startRefresh()

package/dist/boot/device-lane.d.ts

@@ -77,7 +77,7 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  */
 export declare function assertDeviceLaneWired(isDeviceLane: boolean, lane: DeviceLane | undefined, hasFactory: boolean): void;
 /**
- * 设备入口 × 已绑设备的起服一行(拒的那一半在配置期:device 车道上 `DEVICE_RELAY_URL` 必填,缺席拒起 —— `config.ts` `parseDeviceRelayUrlEnv`;
+ * 设备入口 × 已绑设备的起服一行(拒的那一半在配置期:device 车道上 `DEVICE_RELAY_URL` 必填 —— 缺席拒起是车道必需 env 门(`config.ts` `declaredExecutionLane` → `laneMissingEnv`),坏形 / 带凭据形拒启是 `parseDeviceRelayUrlEnv`;
  * 起不起服不随表里有几条绑定变)。
  *
  * 字面 `none` = 运维声明「设备拨本引擎自己的地址 + `wsPath`」。此刻根会话行上若有设备绑定(writer(device, D) 的格),这些会话的设备从此只能拨那个入口 ——

package/dist/boot/execution-env.d.ts

@@ -8,10 +8,13 @@ import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
+import { type RemoteContainerEnvDeps } from "../plugins/remote-env-e2b.js";
+import { type WorkspaceFillOf } from "../plugins/workspace-fill.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
-import { type SandboxGitPlane, type SandboxGitRunRows } from "../sandbox-git-plane.js";
+import { type SandboxGitPlaneSeat, type SandboxGitRunRows } from "../sandbox-git-plane.js";
 import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { type SpaceCommitRows } from "../workspace-space-commit.js";
+import { type LocalDockerEnvDeps } from "../plugins/remote-env-local-docker.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { TaskInheritEnv } from "../request-value-closure.js";
@@ -77,10 +80,19 @@ export declare function createSessionScopedRegistries(maxEntries?: number): Sess
  *  · 运维行座(`logger`)随部署级配置走。
  * `deps` = 适配器自己的测试缝(假集群 / 假对象存储),生产装配不传。返回的是工厂闭包 ⇒ `create*`。
  */
+/**
+ * 一条 run 是不是它工作区的属主:它的放置根就是它自己的会话(core `ExecutionEnvFactoryContext.placementRootSessionId`)。委派子代 / 后台代理与父 run 并发
+ * (一只工作区两个写者)、本服务为自己起的 run(放置根 = `INTERNAL_RUN_PLACEMENT_ROOT`)都不是。两个读者同一判:k8s 工作区空间(子代依律关)与
+ * 恢复点的播种(只有属主播种)。
+ */
+export declare function ownsItsWorkspace(ctx: {
+    readonly sessionId: string;
+    readonly placementRootSessionId: string;
+}): boolean;
 export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     imageOf(sessionId: string): string | undefined;
     /** The member git-credential broker seat for the pod's run (`runId` = the one reading of the run that owns the pod, the same value its
-     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `sandboxBrokerSeatOf` over the boot's plane reading and the run row's identity);
+     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `createSandboxBrokerSeatOf` over the plane seat's reading at that pod and the run row's identity);
      *  absent seat / `undefined` answer ⇒ the pod carries no broker. */
     brokerSeatOf?(runId: string | undefined): Promise<K8sEnvConfig["sandboxBroker"]>;
     /** The session store's by-id head read (`SessionStore.headOf`, picked once by `headReadOf`); the occupant is its live-occupant projection
@@ -90,11 +102,13 @@ export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     /** The run store's commit-fence rows (`workspace_space_commit`); answers `undefined` only before stage 7 binds the run store
      *  or without a store backend — the latter `assertWorkspaceSpaceReadable` refuses together with `space`. */
     spaceCommits(): SpaceCommitRows | undefined;
+    /** The restore point's fill seat of the run (`workspace-fill.ts`; `createExecutionEnv` mints the one reading). Absent / `undefined` ⇒ the pod as it comes. */
+    workspaceFillOf?: WorkspaceFillOf;
 }, deps?: K8sEnvDeps): ReturnType<typeof k8sExecutionEnvFactory>;
 /**
  * k8s 车道沙箱秘密座的**起服前提**(装配后的真门,第 5 段 await)。法只有一条:**秘密座非空(`K8S_SANDBOX_ENV` 点到了本进程环境里有的键)⇒
  * 问一次 SelfSubjectAccessReview(env 座那一行动词 {@link SANDBOX_SECRET_SEAT_VERBS}`.env`,沙箱命名空间)** —— 只问这一座自己发的调用,
- * 不问租约座的 `patch`(那一座由凭据平面的判官在它的前提都成立时另问,见 `readSandboxGitPlane`):
+ * 不问租约座的 `patch`(那一座由凭据平面座在它的前提都成立时另问一次,见 `sandbox-git-plane.ts` 的 `createSandboxGitPlaneSeat` 的 `settle`):
  *  · 答了「不许」(任一动词)⇒ 拒启,一行拒句点名缺的动词、命名空间、Role 规则原文与出路(`[sandbox-secret-rbac]`)—— 不等第一个 run 才失败;
  *  · 问不到(请求失败 / 审查本身被拒 / 答复没有 `status.allowed`)⇒ 照常起服:F 类兜底口 `server.sandbox-secret.seat-unverified` 计数 + 一行
  *    `sandbox_secret_seat_unverified`。放行的最坏后果:RBAC 真缺时第一个要建 Secret 的 run 连接即拒(`auth_failed`,pod 被删)—— 秘密值仍然
@@ -141,6 +155,12 @@ export interface ExecutionEnvCtx {
     /** run 店的按 id 读(成员凭据代理座读 run 行上受理时记下的身份元组 `RunRecord.identity`)。取值闭包:run 店第 7 段才绑(`late-binds.ts`),
      *  平面开着时每个 run 的 pod 建起前求值一次。不传 / 答 `undefined`(没有存储后端)⇒ 读不到身份 ⇒ 不挂代理。 */
     runRows?: () => SandboxGitRunRows | undefined;
+    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。 */
+    laneDeps?: {
+        readonly e2b?: RemoteContainerEnvDeps;
+        readonly k8s?: K8sEnvDeps;
+        readonly localDocker?: LocalDockerEnvDeps;
+    };
 }
 export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perTaskImage: PerTaskImageRegistry;
@@ -158,6 +178,6 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     spaceReclaimer: SpaceReclaimer | undefined;
     sandboxSecretSeatGate: (() => Promise<void>) | undefined;
     sandboxPodReaper: SandboxPodReaper | undefined;
-    readSandboxGitPlane: () => Promise<SandboxGitPlane>;
+    sandboxGitPlane: SandboxGitPlaneSeat;
 };
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/boot/execution-env.js

@@ -11,10 +11,11 @@ import { PerTaskImageRegistry } from "../per-task-image.js";
 import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
+import { createWorkspaceFill } from "../plugins/workspace-fill.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
 import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
-import { judgeSandboxGitPlane, runIdentitySourceOf, sandboxBrokerSeatOf, sandboxGitPlaneAsksSecretSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
+import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
@@ -38,6 +39,7 @@ import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
 import { warnReadDenyFloorUnkept } from "./execution-lane.js";
+import { seatText } from "../trace/exit-seat.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -105,15 +107,19 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         dropSession,
     };
 }
+export function ownsItsWorkspace(ctx) {
+    return ctx.placementRootSessionId === ctx.sessionId;
+}
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
-        const child = ctx.placementRootSessionId !== ctx.sessionId;
+        const child = !ownsItsWorkspace(ctx);
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
         const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId, rpcTimeoutMsOf(k8sCfg));
         const runId = !child && ctx.taskId !== undefined ? ctx.taskId : undefined;
         const sandboxBroker = await seats.brokerSeatOf?.(runId);
+        const workspaceFill = seats.workspaceFillOf?.(ctx);
         const { cache, ...deploymentCfg } = k8sCfg;
         return k8sExecutionEnvFactory({
             ...deploymentCfg,
@@ -123,6 +129,7 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
             ...(spaceOccupant !== undefined ? { spaceOccupant } : {}),
             ...(runId !== undefined ? { runId } : {}),
             ...(sandboxBroker !== undefined ? { sandboxBroker } : {}),
+            ...(workspaceFill !== undefined ? { workspaceFill } : {}),
             onWorkspaceSnapshot,
         }, deps)(ctx);
     };
@@ -171,7 +178,7 @@ export async function ensureSandboxSecretSeat(k8sCfg, logger, deps, read = () =>
             recordFailOpen("server.sandbox-secret.seat-unverified", `namespace=${namespace} ${seat.detail}`);
             logger.warn("sandbox_secret_seat_unverified", {
                 namespace,
-                detail: seat.detail,
+                detail: seatText("operator-log-text", seat.detail),
                 effect: `the boot could not confirm the sandbox Secret RBAC (secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")}) — the service starts; if the Role lacks them, the first run that forwards K8S_SANDBOX_ENV is refused at connect (auth_failed) and its pod deleted — the values never go into the pod spec`,
             });
             return;
@@ -239,9 +246,9 @@ export function createExecutionEnv(ctx) {
     let spaceReclaimer;
     let sandboxSecretSeatGate;
     let sandboxPodReaper;
-    const planeCell = {};
-    let readSandboxGitPlane = async () => (planeCell.current = judgeSandboxGitPlane(sandboxGitPlanePremisesOf(config, {})));
+    let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
     let worktreeReap;
+    const workspaceFillOf = taskAttachmentStore === undefined ? undefined : (fctx) => createWorkspaceFill({ store: taskAttachmentStore, sessionId: fctx.sessionId, seeds: ownsItsWorkspace(fctx), logger });
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
@@ -253,9 +260,10 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...((env) => (env !== undefined ? { sandboxEnv: env } : {}))(sandboxLaneEnvMerged(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv))),
             sandboxReadFloor: config.sandboxReadFloor,
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
             logger,
             metrics,
-        });
+        }, ctx.laneDeps?.e2b);
     }
     else if (config.remoteExec?.provider === "k8s") {
         const k8sCfg = {
@@ -281,30 +289,24 @@ export function createExecutionEnv(ctx) {
             ...((lane) => ({ ...(lane.env !== undefined ? { podEnv: lane.env } : {}), ...(lane.secretEnv !== undefined ? { podSecretEnv: lane.secretEnv } : {}) }))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
             sandboxReadFloor: config.sandboxReadFloor,
         };
-        const brokerImage = config.remoteExec.brokerImage;
+        sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {
+            patchRefusal: podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch),
+            askSecretSeat: () => readSandboxSecretSeat(k8sCfg, "lease"),
+        });
         executionEnvFactory = createK8sRunEnvFactory(k8sCfg, {
             imageOf: (sid) => perTaskImage.get(sid),
             headOf: ctx.headOf,
             spaceCommits: ctx.spaceCommits ?? (() => undefined),
-            brokerSeatOf: async (runId) => {
-                const plane = planeCell.current;
-                if (plane === undefined || plane.state !== "on")
-                    return undefined;
-                return sandboxBrokerSeatOf(plane, brokerImage, await runIdentitySourceOf(runId, ctx.runRows?.(), logger));
-            },
-        });
+            brokerSeatOf: createSandboxBrokerSeatOf(sandboxGitPlane.now, config.remoteExec.brokerImage, ctx.runRows, logger),
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+        }, ctx.laneDeps?.k8s);
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
-        readSandboxGitPlane = async () => {
-            const premises = sandboxGitPlanePremisesOf(config, { ...((r) => (r !== undefined ? { patchRefusal: r } : {}))(podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch)) });
-            const secretSeat = sandboxGitPlaneAsksSecretSeat(premises) ? await readSandboxSecretSeat(k8sCfg, "lease") : undefined;
-            return (planeCell.current = judgeSandboxGitPlane({ ...premises, secretSeat }));
-        };
         sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
-            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
     else if (config.remoteExec?.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
@@ -397,7 +399,8 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
             sandboxReadFloor: config.sandboxReadFloor,
-        });
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+        }, ctx.laneDeps?.localDocker);
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
         executionEnvFactory = withRemoteScratchpad(executionEnvFactory, logger);
@@ -451,7 +454,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = registry.wrapFactory(executionEnvFactory);
         return registry;
     })();
-    if (taskAttachmentStore && executionEnvFactory) {
+    if (taskAttachmentStore && executionEnvFactory && !laneIsolated(executionLaneOf(config.remoteExec.provider))) {
         const inner = executionEnvFactory;
         const attStore = taskAttachmentStore;
         executionEnvFactory = async (ctx) => {
@@ -507,7 +510,7 @@ export function createExecutionEnv(ctx) {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, readSandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane,
     };
 }
 //# sourceMappingURL=execution-env.js.map

package/dist/boot/execution-lane.js

@@ -4,6 +4,7 @@ import { crossInvariant } from "../config-invariants.js";
 import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
+import { seatText } from "../trace/exit-seat.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
 export async function composeExecutionLane(config, ctx) {
     if (ctx.configSource === "local")
@@ -55,7 +56,7 @@ async function applyRemoteExecFile(config, ctx) {
         fileRx = await loadRemoteExec(localRoot);
     }
     catch (err) {
-        logger.error("remote_exec_file_invalid", { root: localRoot, err: String(err) });
+        logger.error("remote_exec_file_invalid", { root: localRoot, err: seatText("operator-log-text", String(err)) });
         throw new Error(`config.d/remote-exec.json under ${localRoot} is invalid: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
     }
     if (!fileRx)

package/dist/boot/exit-boundary.js

@@ -2,6 +2,7 @@ import { defaultTaskRegistry } from "@sema-agent/core";
 import { reportHardKillReceipts } from "../background-session-reap.js";
 import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
+import { seatText } from "../trace/exit-seat.js";
 const PROCESS_EXIT_INCLUDES_RETAINED = false;
 export function installProcessExitBoundary({ logger }) {
     const reapOwnChildProcesses = () => {
@@ -13,7 +14,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.info("shutdown_background_reaped", { reaped });
         }
         catch (err) {
-            logger.warn("shutdown_background_reap_failed", { err: String(err) });
+            logger.warn("shutdown_background_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
         try {
             const fg = reapHostForegroundChildren();
@@ -23,7 +24,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_foreground_reap_incomplete", { groups: fg.failed });
         }
         catch (err) {
-            logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
+            logger.warn("shutdown_foreground_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
         return backgroundSoftStopped;
     };
@@ -33,7 +34,7 @@ export function installProcessExitBoundary({ logger }) {
             reportHardKillReceipts(logger, receipts, "process_exit");
         }
         catch (err) {
-            logger.warn("shutdown_background_hard_kill_failed", { err: String(err) });
+            logger.warn("shutdown_background_hard_kill_failed", { err: seatText("operator-log-text", String(err)) });
         }
     };
     const reapOwnHostWorkspaces = () => {
@@ -45,7 +46,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_host_workspace_reap_incomplete", { dirs: failed.map((f) => f.dir) });
         }
         catch (err) {
-            logger.warn("shutdown_host_workspace_reap_failed", { err: String(err) });
+            logger.warn("shutdown_host_workspace_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
     };
     const onProcessExit = () => {

package/dist/boot/memory-consolidation.js

@@ -7,6 +7,7 @@ import { DEFAULT_MODEL_REF, resolveMainModel } from "../model-select.js";
 import { backendOwnsControlPlane, captureRecordStoreOf } from "../memory-operator-faces.js";
 import { memoryStoreForRequest } from "../memory-scope-stores.js";
 import { createConsolidationWriteJudge, deliverWriteRefusal, expandTiers, MemoryEngine, modelOriginOf, readConsolidationDriverRun, resolveMemoryConsolidationDriver, runMemoryConsolidationDriver, } from "@sema-agent/core";
+import { seatText } from "../trace/exit-seat.js";
 export function resolveConsolidationDriverSeat(deps) {
     let options;
     try {
@@ -238,7 +239,7 @@ function decideConsolidationValve(input) {
                 return { valve: { enabled: true, source: "derived", catalogDependent: true } };
             const seatFact = billing.kind === "main-model"
                 ? `Here the seat resolves to the main model "${billing.mainModel}" (no MODEL_CHEAP_ID naming another model, and no catalog roles.consolidate / roles.summarize / "flash" tier binding to another model)`
-                : `Here no consolidation seat resolves at all (${billing.fault})`;
+                : `Here no consolidation seat resolves at all (${seatText("operator-log-text", billing.fault)})`;
             return {
                 valve: {
                     enabled: false,

package/dist/boot/parked-revive-gate.js

@@ -8,6 +8,7 @@ import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { executionLaneHomeDir } from "../execution-lane-caps.js";
 import { createDeploymentListExemption } from "../approval.js";
+import { seatText } from "../trace/exit-seat.js";
 function hostGateCwd(config, localRoot) {
     return join(config.localDataRoot ?? localRoot, "parked-revive-unrooted");
 }
@@ -63,7 +64,7 @@ async function resolveCapsFor(deps, identity) {
         return await deps.resolveRuntimeCaps(identity.principal);
     }
     catch (err) {
-        deps.logger.warn("parked_revive_caps_unresolved", { principal: identity.principal ?? null, err: err instanceof Error ? err.message : String(err) });
+        deps.logger.warn("parked_revive_caps_unresolved", { principal: identity.principal ?? null, err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
         return undefined;
     }
 }

package/dist/boot/permission-rules-audit.d.ts

@@ -1,31 +1,3 @@
-/**
- * [ref] §3([ref] v2 §6 F4 的**残余采纳**)—— 默认 ON 的**休眠行审计**。
- *
- * 🔴 这条审计存在的唯一理由:`PERMISSION_RULES_ENABLED` 的默认值在本车从 OFF 翻成 ON,而**旋钮翻转
- * 与规则行的寿命是两条独立的时间线**。三张表自 [ref] 车二起就随中央 `ensureSchema` 建、并且从来没有被
- * 清过,所以下面这两类部署在升级的那一刻会突然带着**既有**规则行开始放行:
- *   · 曾经把旋钮开过一段时间又关掉的部署(行留在库里,只是没人读);
- *   · 从旧库恢复/克隆出来的部署(行跟着数据一起来的)。
- * 对运维来说,这是「我什么都没改,worker 却开始少问我了」——一次**放宽面**上的静默变化。审计做的事
- * 很小但是承重:在启动日志里把它说出来,让「少问」是一条能被读到的因果,而不是一次玄学。
- *
- * ── 三条判据,逐条有理由 ────────────────────────────────────────────────────────────────────────
- *  ① **店缺席 ⇒ 整条不上场**(零 I/O、零行)。店缺席包括:显式关旋钮、`local` 车道没接 File 店的旧
- *     部署、以及压根没有 backend 的 env-only worker。没有店就没有行,谈不上唤醒。
- *  ② **零桶 ⇒ 不打行**。一条「0 条既有规则随默认 ON 激活」的行是纯噪音:它对读日志的人不传递任何
- *     可行动的信息,却让真正有东西被唤醒的那一行变得不显眼。
- *  ③ **运维**显式**表过态(`PERMISSION_RULES_ENABLED` 被设成 true 或 false)⇒ 不打行**。那些行本来
- *     就是活的(或者旋钮被显式关着、店根本没装配),默认值翻不翻转对它们零影响 —— 说「随默认 ON
- *     激活」是**假话**,而在启动日志里说假话比不说更坏。判据用 `permissionRulesEnabledExplicit`
- *     (config.ts 与 `dbBackendExplicit` 同姿势),不是猜。
- *
- * ── 失败方向 ────────────────────────────────────────────────────────────────────────────────────
- * 数不出来(库抖动 / 文件读不了)⇒ **不拒启、也不编一个 0 出来**:返回 `undefined` + 一条 warn。
- * 这是一条纯诊断面(它不参与任何放行/拒绝判决),所以它的降级方向是「安静地不知道」而不是「谎报
- * 零」——`{ buckets: 0 }` 会被下游读成「确认没有休眠行」,那是把一次读失败伪装成一个结论。
- * 因为它零判决,这条 fail-open 不属于 `docs/FAIL-OPEN-CENSUS.md` 的安全轴 P 类,故不占 `recordFailOpen`
- * 的标签;它的可见性由那条 warn 承担。
- */
 /** 审计只需要一只桶计数口——**刻意**不吃整个 `PermissionRuleStoreBundle`:诊断面对店的其余能力
  *  一无所知也不该知道,窄口让测试能用四行 fixture 驱动真实现同一段代码。 */
 export interface DormantRuleCounter {

package/dist/boot/permission-rules-audit.js

@@ -1,3 +1,4 @@
+import { seatText } from "../trace/exit-seat.js";
 export async function auditDormantPermissionRules(ctx) {
     if (ctx.stores === undefined)
         return undefined;
@@ -7,7 +8,7 @@ export async function auditDormantPermissionRules(ctx) {
     }
     catch (err) {
         ctx.logger.warn?.("permission_rules_dormant_audit_failed", {
-            error: err instanceof Error ? err.message : String(err),
+            error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
             note: "the boot audit could not count pre-existing permission-rule buckets; the lane itself is unaffected",
         });
         return undefined;

package/dist/boot/read-deny-anchor-audit.js

@@ -1,5 +1,6 @@
 import { compileReadDeny, readDenyRowAnchor } from "@sema-agent/core";
 import { echoCallerText } from "../caller-text-echo.js";
+import { seatText } from "../trace/exit-seat.js";
 export const READ_DENY_AUDIT_MAX_NAMED_ROWS = 20;
 const NAMED_ROW_ECHO_CHARS = 200;
 function isAnchoredCanonicalRow(canonical) {
@@ -14,7 +15,7 @@ export function auditReadDenyAnchoring(ctx) {
     }
     catch (err) {
         ctx.logger.warn("read_deny_anchor_audit_failed", {
-            error: echoCallerText(err instanceof Error ? err.message : String(err), { maxChars: 400 }),
+            error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
             note: "the boot audit could not read the deployment read-deny rows, so it names none and changes nothing; the engine itself refuses a row it cannot read when the Runner is built",
         });
         return [];

package/dist/boot/reapers.js

@@ -6,6 +6,7 @@ import { createApprovalReconciler } from "../approval-reconciler.js";
 import { createE2bOrphanSandboxProvider, reclaimOrphanE2bSandboxes, E2B_ORPHAN_GRACE_MS } from "../plugins/e2b-orphan-reclaim.js";
 import { SANDBOX_POD_REAP_PERIOD_MS } from "../plugins/k8s-pod-reaper.js";
 import { APPROVAL_ASK_RETENTION_PASS_MS, runApprovalAskRetentionPass } from "../approval-ask-retention.js";
+import { seatText } from "../trace/exit-seat.js";
 export const REAPER_FAILURE_WARN_THRESHOLD = 5;
 export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAILURE_WARN_THRESHOLD) {
     let streak = 0;
@@ -21,7 +22,7 @@ export function createThrottledReaperCatch(name, logger, threshold = REAPER_FAIL
                 logger.warn("reaper_leg_repeated_failure", {
                     reaper: name,
                     consecutiveFailures: streak,
-                    lastError: err instanceof Error ? err.message : String(err),
+                    lastError: seatText("operator-log-text", err instanceof Error ? err.message : String(err)),
                 });
             }
             catch {
@@ -169,7 +170,7 @@ export function startReapers(ctx) {
                 catch (err) {
                     failedScopes++;
                     try {
-                        logger.warn("bg_agent_reap_scope_failed", { scope, err: err instanceof Error ? err.message : String(err) });
+                        logger.warn("bg_agent_reap_scope_failed", { scope, err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                     }
                     catch {
                     }
@@ -266,7 +267,7 @@ export function startReapers(ctx) {
             } })
                 .catch((err) => {
                 try {
-                    logger.warn("attachment_orphan_sweep_failed", { err: err instanceof Error ? err.message : String(err) });
+                    logger.warn("attachment_orphan_sweep_failed", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                 }
                 catch {
                 }

package/dist/boot/resolve-spec.js

@@ -21,7 +21,7 @@ import { isAtMentionable, matchCatalogModel, refusedCatalogEntry, resolveTaskMod
 import { echoModelRef, modelUnavailableMessage } from "../model-entry-refusal.js";
 import { PerTaskImageRegistry, resolveSandboxImageRef } from "../per-task-image.js";
 import { remoteScratchpadDirFor } from "../plugins/remote-scratchpad.js";
-import { bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
+import { attachmentBindRefusalAnswer, bindAttachmentsForTask } from "../plugins/task-attachment-store.js";
 import { resourceSuspendOptIn } from "../resource-suspend.js";
 import { routeServiceTask, supPostureOverrides } from "../router/route-orchestration.js";
 import { tightenGoverned } from "../governance-overrides.js";
@@ -50,7 +50,7 @@ import { inertToolListEntryOf } from "../rule-entry-list.js";
 import { TENANCY_WALL_CLOCK_BASE_SEC, enableForkFromBody, normalizeRetainSubagentSessions, selfOrchestrationFromBody } from "../task-workflow.js";
 import { redactSecrets } from "../trace/redact.js";
 import { DeferredSandboxPathEnv, sandboxPathEnvSlots } from "./deferred-sandbox-path-env.js";
-import { executionLaneHomeDir, executionLaneOf, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { executionLaneHomeDir, executionLaneOf, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { executionConfigRootOf } from "../execution-config-root.js";
 import { withUnattendedLeg } from "../unattended-permission-mode.js";
 import { fieldConflictFacts } from "../field-conflict.js";
@@ -217,11 +217,13 @@ export function createResolveSpec(ctx) {
                     if (!auth?.sessionId)
                         throw new HttpError(400, "`attachmentIds` requires a session-resolving deployment (no authorizer session)");
                     const sid = auth.sessionId;
+                    const lane = opts.execution.lane;
                     const r = await bindAttachmentsForTask({
                         store: taskAttachmentStore,
                         owner: auth?.principal ?? "default",
                         ids: reqAtt,
                         sessionId: sid,
+                        lane: { word: lane, isolated: laneIsolated(lane) },
                         leg: opts?.leg === "fresh" ? "fresh" : "resume",
                         nowMs: Date.now(),
                         onMissing: (id) => {
@@ -229,6 +231,12 @@ export function createResolveSpec(ctx) {
                                 throw new HttpError(400, `attachment not found: ${id}`);
                             logger.warn("attachment_missing_on_resume", { sessionId: sid, id });
                         },
+                        onRefused: (refusal) => {
+                            const answer = attachmentBindRefusalAnswer(refusal);
+                            if (opts?.leg === "fresh")
+                                throw createCodedHttpError(answer.status, answer.errorCode, answer.message, answer.extra);
+                            logger.warn("attachment_refused_on_resume", { sessionId: sid, errorCode: answer.errorCode, ...answer.extra });
+                        },
                     });
                     attachmentNotice = r.notice;
                 }
@@ -277,6 +285,7 @@ export function createResolveSpec(ctx) {
                 sessionId: auth?.sessionId ?? "",
                 cwd: (auth?.sessionId ? perSessionCwd.get(auth.sessionId) : undefined) ?? process.cwd(),
                 ...(parsedSettings.settings?.shellEnv ? { shellEnv: parsedSettings.settings.shellEnv } : {}),
+                httpHookAllowlistLayers: parsedSettings.settings?.httpHookAllowlist !== undefined ? [parsedSettings.settings.httpHookAllowlist] : [],
                 hookLlm,
                 hookAgent,
                 onHookNotice: (n) => fleetBus.publishHookNotice({

package/dist/boot/retention-lane.js

@@ -1,4 +1,5 @@
 import { recordFailOpen } from "../observability/fail-open.js";
+import { seatText } from "../trace/exit-seat.js";
 export const RETENTION_SWEEP_STUCK_THRESHOLD = 5;
 export const RETENTION_LEASE_TTL_FACTOR = 2;
 const DAY_MS = 86_400_000;
@@ -137,15 +138,16 @@ async function recordDomainFailure(ctx, d) {
     }
     const streaks = ctx.streaks;
     const streak = (streaks?.get(d.domain) ?? 0) + 1;
+    const shown = seatText("operator-log-text", message);
     streaks?.set(d.domain, streak);
     try {
-        ctx.logger.warn("retention_sweep_domain_failed", { domain: d.domain, fencingToken: d.fencingToken, consecutiveFailures: streak, auditRowWritten, err: message });
+        ctx.logger.warn("retention_sweep_domain_failed", { domain: d.domain, fencingToken: d.fencingToken, consecutiveFailures: streak, auditRowWritten, err: shown });
         if (streak >= RETENTION_SWEEP_STUCK_THRESHOLD) {
             ctx.metrics.inc("retention_sweep_stuck", {}, 1);
             ctx.logger.warn("retention_sweep_stuck", {
                 domain: d.domain,
                 consecutiveFailures: streak,
-                lastError: message,
+                lastError: shown,
                 note: "this retention domain has failed its sweep for RETENTION_SWEEP_STUCK_THRESHOLD consecutive rounds — its data is NOT being retained per policy. Check retention_audit rows with action='failed' for this domain.",
             });
             streaks?.set(d.domain, 0);
@@ -168,7 +170,7 @@ export function startRetentionLane(ctx) {
             .then(() => undefined)
             .catch((err) => {
             try {
-                ctx.logger.warn("retention_sweep_round_failed", { err: err instanceof Error ? err.message : String(err) });
+                ctx.logger.warn("retention_sweep_round_failed", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
             }
             catch {
                 recordFailOpen("server.retention.sweep-report-dropped", "round");