@sema-agent/server 7.141.0 → 7.142.0

package/dist/boot/runner-deps.js

@@ -21,7 +21,9 @@ import { coreFileHistoryCaptureSeat } from "../file-history-capture.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { rewindFailureCode } from "../file-history-disclosure.js";
 import { errorKindOf } from "../observability/err-text.js";
+import { codeFieldOf } from "../terminal.js";
 import { buildShownUrlsInText } from "../url-refusal.js";
+import { seatText } from "../trace/exit-seat.js";
 export function createRunnerDepsOnAsk(toolApproval) {
     if (!toolApproval)
         return undefined;
@@ -178,7 +180,7 @@ export function createRunnerDeps(ctx) {
                         }
                     }
                     catch (err) {
-                        logger.warn("workflow_ack_served_failed", { runId: input.runId, err: String(err) });
+                        logger.warn("workflow_ack_served_failed", { runId: input.runId, err: seatText("operator-log-text", String(err)) });
                     }
                 },
             },
@@ -199,7 +201,7 @@ export function createRunnerDeps(ctx) {
         onTaskOutcome: outcomeSink
             ? (o) => {
                 metrics.inc("task_outcomes_total", { status: o.status, green: String(o.oracle?.green ?? "unknown") });
-                void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: String(err) }));
+                void outcomeSink.recordCore(o).catch((err) => logger.warn("task_outcome_record_failed", { runId: o.runId, err: seatText("operator-log-text", String(err)) }));
             }
             : undefined,
         onElicit: elicitation ? elicitation.elicit : undefined,
@@ -249,17 +251,18 @@ export function createRunnerDeps(ctx) {
             : undefined,
         ...selfOrchestrationDeps,
         onError: (err, ctx) => {
+            const codeField = codeFieldOf(err);
             if (ctx.phase === "degraded") {
-                logger.warn("task_degraded", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("task_degraded", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
                 return;
             }
             if (ctx.phase === "prompt-constitution") {
-                logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, info: String(err) });
+                logger.warn("prompt_composition_warning", { sessionId: ctx.sessionId, ...codeField, info: seatText("operator-log-text", String(err)) });
                 return;
             }
             if (ctx.phase === "rewind") {
                 const code = rewindFailureCode(err);
-                logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: String(err) });
+                logger.warn("rewind_snapshot_failed", { sessionId: ctx.sessionId, code, info: seatText("operator-log-text", String(err)) });
                 metrics.inc("rewind_snapshot_failed_total", { code });
                 return;
             }
@@ -268,12 +271,12 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "mcp") {
-                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
+                logger.warn("mcp_server_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
                 metrics.inc("mcp_server_unavailable_total");
                 return;
             }
             if (ctx.phase === "a2a") {
-                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), info: buildShownUrlsInText(String(err)) });
+                logger.warn("a2a_peer_unavailable", { sessionId: ctx.sessionId, kind: errorKindOf(err), ...codeField, info: seatText("operator-log-text", buildShownUrlsInText(String(err))) });
                 metrics.inc("a2a_peer_unavailable_total");
                 return;
             }
@@ -285,7 +288,8 @@ export function createRunnerDeps(ctx) {
                     sessionId: ctx.sessionId,
                     confirmed: classification !== undefined,
                     ...(classification !== undefined ? { classification, classificationKnown: causeLevel !== undefined } : {}),
-                    err: String(err),
+                    ...codeField,
+                    err: seatText("operator-log-text", String(err)),
                 };
                 metrics.inc("prompt_cache_low_hit_total", {
                     ...(classification !== undefined ? { classification: causeLevel !== undefined ? classification : "unknown" } : {}),
@@ -298,25 +302,24 @@ export function createRunnerDeps(ctx) {
                 return;
             }
             if (ctx.phase === "config") {
-                const code = typeof err?.code === "string" ? err.code : undefined;
                 const classification = ctx.classification;
                 const classificationKnown = classification === undefined ? undefined : CONFIG_ADVISORY_CLASSIFICATIONS.has(classification);
                 const fields = {
                     sessionId: ctx.sessionId,
-                    ...(code !== undefined ? { code } : {}),
+                    ...codeField,
                     ...(classification !== undefined ? { classification, classificationKnown } : {}),
-                    info: String(err),
+                    info: seatText("operator-log-text", String(err)),
                 };
                 logger.warn("runner_config_advisory", fields);
                 metrics.inc("runner_config_advisory_total", {
-                    ...(code !== undefined ? { code } : {}),
+                    ...codeField,
                     ...(classification !== undefined ? { classification: classificationKnown ? classification : "unknown" } : {}),
                     level: "warn",
                 });
                 return;
             }
             metrics.inc("runner_error_total", { phase: ctx.phase });
-            logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, err: String(err) });
+            logger.error("runner_error", { phase: ctx.phase, sessionId: ctx.sessionId, ...codeField, err: seatText("operator-log-text", String(err)) });
         },
         ...(ctx.consolidationSeat !== undefined
             ? {

package/dist/boot/runtime-caps.js

@@ -1,6 +1,7 @@
 import { applyGovernedVerdictAbsenceWarning, applyLocalAutoModeDeny, applyMemoryOptOutGrant, applyObserverEnvOptIn, centerEntitlementSourceWired, createPrincipalEntitlementsClient, } from "../runtime-caps-resolver.js";
 import { scopedTokenNeedsWorker } from "../center-credential.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
+import { seatText } from "../trace/exit-seat.js";
 export function assertMemoryCapturePolicyWirable(input) {
     if (input.policy !== "governed")
         return;
@@ -47,7 +48,7 @@ export function createRuntimeCaps(ctx) {
         ? createPrincipalEntitlementsClient({
             center: config.webAdmin,
             ...(config.webAdmin.worker ? { worker: config.webAdmin.worker } : {}),
-            onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }),
+            onError: (err, principal) => logger.warn("runtime_caps_resolve_failed", { principal, err: seatText("operator-log-text", String(err)) }),
         })
         : undefined;
     const centerRuntimeCapsResolver = principalCaps?.resolveRuntimeCaps;
@@ -60,7 +61,7 @@ export function createRuntimeCaps(ctx) {
         const withMemoryGrant = applyMemoryOptOutGrant(withObservers, ctx.memoryOptOutGrant, {
             onFault: (err, principal) => logger.warn("memory_optout_grant_resolve_failed", {
                 principal,
-                err: String(err),
+                err: seatText("operator-log-text", String(err)),
                 ...(observability ? {} : { face: "capabilities-read" }),
                 effect: "allowMemoryOptOut left ABSENT for this resolve (never coined as false): open posture ⇒ the opt-out takes effect; governed ⇒ core refuses the run (verdict absent)",
             }),

package/dist/boot/session-faces.js

@@ -11,6 +11,7 @@ import { probeSessionChildren, retireSessionChildren, sessionChildrenScope, Sess
 import { SessionActiveRunError } from "../execution-placement.js";
 import { headReadOf, redactIncarnations } from "../session-incarnation.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { seatText } from "../trace/exit-seat.js";
 export function createSessionFaces(ctx) {
     const { config, logger, metrics, localRoot, backend, sessionStore, runStore, checkpointStore, toolResultStore, resumeAnchorStore, approvalExemptionStore, sessionPolicyStore, taskAttachmentStore, fileHistoryErasure, workflowCompletionInbox, taskListLane, dropSessionScoped, mailboxStore, mailboxRecipientLifecycle, backgroundAgentStore, userInputLedgerStore, spaceReclaimer, } = ctx;
     const mysqlPool = backend?.mysqlPool();
@@ -106,7 +107,7 @@ export function createSessionFaces(ctx) {
                 }
             }
             if (workflowCompletionInbox)
-                await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: String(err) }));
+                await workflowCompletionInbox.purge(sessionId, owner ?? null).catch((err) => logger.warn("workflow_completion_inbox_purge_failed", { sessionId, err: seatText("operator-log-text", String(err)) }));
             const peerBox = mailboxStore !== undefined && mailboxRecipientLifecycle !== undefined
                 ? { store: mailboxStore, lifecycle: mailboxRecipientLifecycle, scope: owner ?? "default", handle: peerSessionBoxHandle(sessionId) }
                 : undefined;
@@ -118,7 +119,7 @@ export function createSessionFaces(ctx) {
                 await reapSessionBackgroundHard(sessionId, owner ?? "default", { includeRetained: false, reason: "session_deleted" }, logger);
             }
             catch (err) {
-                logger.warn("session_background_reap_failed", { sessionId, err: String(err) });
+                logger.warn("session_background_reap_failed", { sessionId, err: seatText("operator-log-text", String(err)) });
             }
             if (peerBox !== undefined)
                 await peerBox.store.drop(peerBox.scope, peerBox.handle);
@@ -138,7 +139,7 @@ export function createSessionFaces(ctx) {
                     logger.warn("workspace_space_reclaim_failed", {
                         sessionId,
                         stage: "seat_threw",
-                        error: redactIncarnations(String(err)),
+                        error: seatText("operator-log-text", redactIncarnations(String(err))),
                         effect: "the ended space's cache volume and snapshot objects may stay (the reclaim seat threw, which its contract forbids; the session delete went ahead) — the bucket's lifecycle rule is the fallback for objects, the volume is deleted by label sema.space",
                     });
                 });

package/dist/boot/shutdown.js

@@ -9,6 +9,7 @@ import { createEngineLeaseTracker } from "./engine-lease.js";
 import { writeExitLast, readExitLast, clearExitLast } from "./exit-last.js";
 import { isScriptRealmRejection, describeRejectionReason } from "../orchestration/hardened-vm-runner.js";
 import { DRAIN_CAUSE_COUNTS_AS_FIRST_STOP_SIGNAL, HARD_STOP_ACTION_ID, drainDeadlineBeyondBound } from "../fleet/drain-entry.js";
+import { seatText } from "../trace/exit-seat.js";
 const HARD_STOP_GRACE_MS = 10_000;
 const FINAL_EXIT_MS = 15_000;
 export function backgroundGraceRemainingMs(a) {
@@ -91,7 +92,7 @@ export function installShutdownHandlers(ctx) {
                 for (const p of uncommittedParks)
                     logger.warn("approval_park_uncommitted_at_shutdown", { approvalId: p.approvalId, taskId: p.taskId });
             })
-                .catch((err) => logger.warn("approval_drain_for_shutdown_failed", { err: String(err) }));
+                .catch((err) => logger.warn("approval_drain_for_shutdown_failed", { err: seatText("operator-log-text", String(err)) }));
         clearInterval(reaper);
         clearInterval(fleetReconcile.timer);
         const retentionTeardown = retentionLane === undefined
@@ -107,7 +108,7 @@ export function installShutdownHandlers(ctx) {
         engineLease?.stop();
         storeLiveProbe?.stop();
         servingLease?.stop();
-        void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: String(err) }));
+        void deviceHub?.close().catch((err) => logger.warn("device_hub_close_failed", { err: seatText("operator-log-text", String(err)) }));
         webAdmin?.stopRefreshLoop();
         otelExporter?.stop();
         breakerState?.stop();

package/dist/boot/stage-04-stores.js

@@ -6,18 +6,19 @@ import { auditDormantPermissionRules } from "./permission-rules-audit.js";
 import { createBudgetAndTracing } from "./budget-tracing.js";
 import { createRuleConsentLane } from "../rules-consent.js";
 import { createConsolidationValve } from "./memory-consolidation.js";
+import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage04(ctx) {
     const { backend, breakerState, config, logger, memoryEngine, metrics, sessionCaptureRecords } = ctx;
     const memoryBundleFaces = memoryEngine ? createMemoryBundleFaces(memoryEngine, { ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}) }) : undefined;
     const memoryComplianceFaces = memoryEngine
         ? createMemoryComplianceFaces(memoryEngine, {
-            onIncident: (err) => logger.warn("memory_compliance_incident", { code: err.code ?? null, detail: err.message }),
+            onIncident: createOperatorFaceIncidentSink({ logger }, "memory_compliance_incident"),
             ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
         })
         : undefined;
     const memoryOriginFaces = memoryEngine
         ? createMemoryOriginFaces(memoryEngine, {
-            onIncident: (err) => logger.warn("memory_origin_incident", { code: err.code ?? null, detail: err.message }),
+            onIncident: createOperatorFaceIncidentSink({ logger }, "memory_origin_incident"),
             ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
         })
         : undefined;

package/dist/boot/stage-05-execution-env.d.ts

@@ -10,7 +10,7 @@ export declare function runStage05(ctx: Awaited<ReturnType<typeof runStage04>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-05-execution-env.js

@@ -13,18 +13,20 @@ export async function runStage05(ctx) {
     const deviceLane = config.remoteExec?.provider === "device" ? createDeviceLane({ config, logger, metrics, backend, seat: sessionStore.executionPlacement, replicaId: instanceId }) : undefined;
     const headOf = headReadOf(sessionStore);
     const spaceCommits = backend !== undefined ? () => runStore : undefined;
-    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, readSandboxGitPlane, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
+    const { perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv, fenceSessionOwner, dropSessionScoped, executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane: sandboxGitPlaneSeat, } = createExecutionEnv({ config, logger, metrics, taskAttachmentStore, ...(deviceLane ? { deviceLane } : {}), ...(spaceCommits !== undefined ? { spaceCommits } : {}), ...(headOf !== undefined ? { headOf } : {}), ...(backend !== undefined ? { runRows: () => runStore } : {}) });
     assertDeviceLaneWired(config.remoteExec?.provider === "device", deviceLane, executionEnvFactory !== undefined);
     if (deviceLane !== undefined && config.remoteExec?.provider === "device")
         await noteDeviceRelayBindings(config.remoteExec.relay, deviceLane.store, logger);
     assertWorkspaceSpaceReadable(facts.workspaceSpace(config), { headOf, spaceCommits }, facts.workspaceCache(config), sessionStoreLabelOf(config.sessionBackend, backend?.kind));
     if (sandboxSecretSeatGate !== undefined)
         await sandboxSecretSeatGate();
-    const sandboxGitPlane = await readSandboxGitPlane();
-    if (sandboxGitPlane.state === "on")
-        logger.info("credential_plane_sandbox_git", { state: "on", origins: sandboxGitPlane.origins });
-    else if (sandboxGitPlane.reason !== "single_user" && sandboxGitPlane.reason !== "lane_without_boundary") {
-        logger.info("credential_plane_sandbox_git", { state: "off", reason: sandboxGitPlane.reason, why: SANDBOX_GIT_PLANE_OFF_TEXT[sandboxGitPlane.reason] });
+    await sandboxGitPlaneSeat.settle();
+    const sandboxGitPlane = sandboxGitPlaneSeat.now;
+    const bootPlane = sandboxGitPlane();
+    if (bootPlane.state === "on")
+        logger.info("credential_plane_sandbox_git", { state: "on", origins: bootPlane.origins });
+    else if (bootPlane.reason !== "single_user" && bootPlane.reason !== "lane_without_boundary") {
+        logger.info("credential_plane_sandbox_git", { state: "off", reason: bootPlane.reason, why: SANDBOX_GIT_PLANE_OFF_TEXT[bootPlane.reason] });
     }
     if (config.toolTrace)
         logger.info("tool_trace_enabled", {});

package/dist/boot/stage-06-runners.d.ts

@@ -71,7 +71,7 @@ export declare function runStage06(ctx: Awaited<ReturnType<typeof runStage05>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-06-runners.js

@@ -29,6 +29,7 @@ import { mountOrgDeliveryGate } from "./org-delivery.js";
 import { parkedAskRedeem, runStore } from "./late-binds.js";
 import { withInternalRunEnvs } from "../internal-run-env.js";
 import { retentionSweepRuns } from "../plugins/retention-store-sql.js";
+import { createOperatorFaceIncidentSink } from "../memory-incident-sink.js";
 export async function runStage06(ctx) {
     const { backend, backgroundAgentStore, brain, engineDataRoot, peerDesk, config, webAdmin, consolidationValve, deploymentMods, executionEnvFactory, fileHistoryStore, localRoot, logger, lspManager, mailboxRecipientLifecycle, mailboxStore, memoryEngine, memorySyncRunner, metrics, perSessionCwd, permissionRuleProvider, pricing, rosterStore, ruleConsent, sendUserFileTaskEnvs, sessionCaptureRecords, sessionPolicyStore, sessionStore, taskAttachmentStore, taskListLane, toolResultStore, tracer, usageWindowStore } = ctx;
     const { sqlWorkflowRunStore, workflowNotifyJournal, workflowCompletionInbox, deliverWorkflowCompletion, workflowNotifyGate, fleetBus, workflowRunStore, workflowJournalStore, outcomeSink, workflowRecoverOpts, workflowAgentRegistry, subagentSteerRegistry, workflowAgentSessionIndex, workflowParkDecisions, } = createWorkflowOrchestration({ config, logger, metrics, localRoot, backend, getRunStore: () => runStore });
@@ -92,7 +93,7 @@ export async function runStage06(ctx) {
             seat: consolidationSeat,
             scopes: config.memoryConsolidationDriver.scopes,
             ...(config.memoryProvenance !== undefined ? { provenance: config.memoryProvenance } : {}),
-            onIncident: (err) => logger.warn("memory_consolidation_incident", { code: err.code ?? null, detail: err.message }),
+            onIncident: createOperatorFaceIncidentSink({ logger }, "memory_consolidation_incident"),
             onStopDetail: (audit) => logger.warn("memory_consolidation_stop_detail", audit),
             ...(sessionCaptureRecords !== undefined ? { captureRecords: sessionCaptureRecords } : {}),
             writeJudge: createOperatorValveWriteJudge({ ruleStoreProvider: permissionRuleProvider, config }),

package/dist/boot/stage-07-capability-layer.d.ts

@@ -88,7 +88,7 @@ export declare function runStage07(ctx: Awaited<ReturnType<typeof runStage06>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-07-capability-layer.js

@@ -28,6 +28,7 @@ import { bindRateLimiter, bindRunStore } from "./late-binds.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
 import * as facts from "../capability-facts.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
+import { seatText } from "../trace/exit-seat.js";
 export async function runStage07(ctx) {
     const { approvalAskAudit, approvalExemptionStore, backend, backgroundAgentStore, brain, checkpointStore, config, webAdmin, counterDegradeHook, peerDesk, durableEnabled, instanceId, localRoot, logger, question, runner, runnerDeps, sendUserFileToolSpec, sessionEnvSelection, sessionStore, subRunner, taskListLane, toolApproval } = ctx;
     const authorize = createAuthorizer(config, sessionStore);
@@ -165,7 +166,7 @@ export async function runStage07(ctx) {
             else
                 logger.warn("web_search_probe_failed", { provider: webSearchCfg.provider, error: r.error, note: "WebSearch stays mounted — the tool will fail per-call until this is fixed; the service is not blocked by it." });
         })
-            .catch((e) => logger.warn("web_search_probe_failed", { provider: webSearchCfg.provider, error: e instanceof Error ? e.message : String(e) }));
+            .catch((e) => logger.warn("web_search_probe_failed", { provider: webSearchCfg.provider, error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)) }));
     }
     const ensureChildSessionDurable = checkpointStore && resolveSubagentTranscriptTier(backgroundAgentStore !== undefined, sessionStore) === "full"
         ? (sessionId, root) => attestChildSessionDurable(sessionStore, sessionId, root, logger)

package/dist/boot/stage-08-reapers.d.ts

@@ -101,7 +101,7 @@ export declare function runStage08(ctx: Awaited<ReturnType<typeof runStage07>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-08-reapers.js

@@ -4,6 +4,7 @@ import { startReapers } from "./reapers.js";
 import { startRetentionLane, RETENTION_LEASE_TTL_FACTOR } from "./retention-lane.js";
 import { createLimitSync } from "./limit-sync.js";
 import { runDenySweep } from "./late-binds.js";
+import { seatText } from "../trace/exit-seat.js";
 export function runStage08(ctx) {
     const { approvalAskAudit, approvalNonceStore, backend, backgroundAgentStore, ceilingVerdict, checkpointStore, parkCommits, config, webAdmin, consolidationSeatWatch, costQuota, degradeRouteWatch, fileHistoryErasure, spaceReclaimer, sandboxPodReaper, handslessRunner, hookAgentRunner, imageBakes, instanceId, localRoot, logger, mailboxStore, metrics, permissionRuleStores, pricing, rateLimiter, retentionExecutor, retentionLaneStore, rosterStore, runStore, runner, sqlWorkflowRunStore, subRunner, taskAttachmentStore, toolApproval, toolResultStore, userInputLedger, workflowJournalStore, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, worktreeReap } = ctx;
     const reaper = startReapers({
@@ -48,7 +49,7 @@ export function runStage08(ctx) {
     const otelExporter = config.otel
         ? startOtlpExporter(metrics, {
             ...config.otel,
-            onError: (err) => logger.warn("otel_export_failed", { err: String(err) }),
+            onError: (err) => logger.warn("otel_export_failed", { err: seatText("operator-log-text", String(err)) }),
         })
         : undefined;
     const limitSync = createLimitSync({ config, rateGate: rateLimiter, quota: costQuota, logger });
@@ -67,7 +68,7 @@ export function runStage08(ctx) {
             }
             catch (err) {
                 if (i > 0)
-                    logger.error("runner_deps_swap_split", { failedAt: name, seats: Object.keys(next), swapped: bootRunners.slice(0, i).map(([n]) => n), err: String(err) });
+                    logger.error("runner_deps_swap_split", { failedAt: name, seats: Object.keys(next), swapped: bootRunners.slice(0, i).map(([n]) => n), err: seatText("operator-log-text", String(err)) });
                 throw err;
             }
         }

package/dist/boot/stage-09-leader.d.ts

@@ -125,7 +125,7 @@ export declare function runStage09(ctx: Awaited<ReturnType<typeof runStage08>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-10-http-server.d.ts

@@ -124,7 +124,7 @@ export declare function runStage10(ctx: Awaited<ReturnType<typeof runStage09>>):
     lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
     spaceReclaimer: import("../workspace-space.js").SpaceReclaimer | undefined;
     sandboxPodReaper: import("../plugins/k8s-pod-reaper.js").SandboxPodReaper | undefined;
-    sandboxGitPlane: import("../sandbox-git-plane.js").SandboxGitPlane;
+    sandboxGitPlane: () => import("../sandbox-git-plane.js").SandboxGitPlane;
     perSessionCwd: Map<string, string>;
     perTaskImage: import("../per-task-image.js").PerTaskImageRegistry;
     sendUserFileTaskEnvs: import("../capabilities/sandbox-file-send.js").TaskEnvRegistry | undefined;

package/dist/boot/stage-10-http-server.js

@@ -29,6 +29,7 @@ import { installShutdownHandlers } from "./shutdown.js";
 import { bindServerLateSeats } from "./late-binds.js";
 import { serviceVersion } from "../service-version.js";
 import { buildDisplaySafeUrl } from "../trace/redact.js";
+import { seatText } from "../trace/exit-seat.js";
 export async function runStage10(ctx) {
     const { peerDesk, approvalAskAudit, approvalExemptionStore, approvalNonceStore, authorize, backend, backgroundAgentStore, brain, breakerState, centerRuntimeCapsResolver, checkpointStore, checkpointCtxSealing, parkCommits, config, webAdmin, consolidationValve, costQuota, deploymentModsLoaded, deviceLane, drainState, durableEnabled, elicitation, fenceSessionOwner, fileHistoryStore, fleetBus, fleetLease, fleetUsage, governanceSeams, handslessRunner, hookAgent, hookLlm, hookWakeBus, imageBakes, imageIndex, instanceId, instrumentDegenerate, leaderEndpoint, loadedSkills, localRoot, logger, lspManager, mcpRevocations, memoryBundleFaces, memoryComplianceFaces, memoryConsolidationFaces, memoryEngine, memoryExportStores, memoryOptOutGrantStore, memoryOriginFaces, memoryPosture, memorySyncCursors, memorySyncRunner, metrics, modelUsageTracker, orgMemoryAdmission, otelExporter, outcomeSink, ownerAware, parkedReviveInheritedGate, parkedReviveSurface, perSessionCwd, perTaskImage, planCacheProbe, pricing, principalCaps, promptManifestTracker, purgeSession, question, rateLimiter, reaper, webAdminJwtVerifier, resumeAnchorStore, retentionLaneStarted, retentionLaneStore, ruleConsent, runStore, runner, runnerDeps, runtimeCapsPeekResolver, sandboxGitPlane, scenarioDetails, scenarios, selectEnvTool, sendFileLedger, sendUserFileEmitter, sendUserFileToolSpec, sessionAudit, sessionEnvSelection, sessionMemoryStatusFace, sessionPolicyStore, sessionTitler, sessionWatchRegistry, setSessionCwd, setSessionInheritEnv, setSessionShellEnv, sharedMemoryStore, sideQueryAccounting, sqlEngine, sqlWorkflowRunStore, staticWiring, storePosture, subRunner, subagentSteerRegistry, taskAttachmentStore, taskLimitCaps, taskTimeoutSec, toolApproval, toolResultStore, usageWindowStore, userInputLedger, webSearchProvider, workflowAgentRegistry, workflowAgentSessionIndex, workflowParkDecisions, workflowCompletionInbox, workflowJournalStore, workflowModelAllowlistSnapshot, workflowNotifyGate, workflowNotifyJournal, workflowRecoverOpts, workflowRunStore, workflowsCapable, orgDeliveryGate } = ctx;
     const stores = {
@@ -132,7 +133,7 @@ export async function runStage10(ctx) {
             classifierModel: () => {
                 const route = classifierRouteFor(runnerDeps);
                 if (route.fault !== undefined)
-                    logger.debug("auto_mode_classifier_route_unresolved", { fault: route.fault });
+                    logger.debug("auto_mode_classifier_route_unresolved", { fault: seatText("operator-log-text", route.fault) });
                 return route.id;
             },
         },
@@ -257,7 +258,7 @@ export async function runStage10(ctx) {
             bindHost: bindHost ?? "0.0.0.0/::(all interfaces)",
             ...(config.bindHostSource ? { bindHostSource: config.bindHostSource } : {}),
             ...(config.bindHostSource === "HOST" ? { note: "bind failed for a host inherited from the HOST env var — set BIND_HOST explicitly (e.g. BIND_HOST=127.0.0.1)." } : {}),
-            error: e instanceof Error ? e.message : String(e),
+            error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)),
         });
         throw e;
     }
@@ -267,7 +268,7 @@ export async function runStage10(ctx) {
     }
     server.on("error", (e) => {
         logger.error("server_error", {
-            error: e.message,
+            error: seatText("operator-log-text", e.message),
             ...("code" in e ? { code: String(e.code) } : {}),
         });
     });
@@ -324,7 +325,7 @@ export async function runStage10(ctx) {
         void workflowNotifyGate
             .recover(workflowRecoverOpts)
             .then((tally) => logger.info("workflow_notify_recovered", tally))
-            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: String(err) }))
+            .catch((err) => logger.warn("workflow_notify_recover_failed", { err: seatText("operator-log-text", String(err)) }))
             .finally(() => resolveFleetRecovery());
     }
     else {

package/dist/boot/stores.js

@@ -42,6 +42,7 @@ import { buildMemoryPosture } from "../memory-posture.js";
 import { headReadOf } from "../session-incarnation.js";
 import { establishSqlEnginePosture, sqlPoolsOf } from "../sql-engine-posture.js";
 import { buildStorePosture } from "../store-posture.js";
+import { seatText } from "../trace/exit-seat.js";
 const DARK_REASON_PROSE = {
     engine_off: () => "MEMORY_ENGINE=off",
     multi_tenant_file_backend: () => "multi-tenant on the FILE backend (no tenant isolation; set MEMORY_ENGINE_BACKEND=pg|mysql to light up)",
@@ -153,7 +154,7 @@ export async function openStores(ctx) {
                     metrics.inc("memory_embed_failed_total", { backend: dialect });
                     logger.warn("memory_embedder_failed", {
                         model: config.memoryEmbedder?.model,
-                        err: String(err).slice(0, 300),
+                        err: seatText("operator-log-text", String(err)),
                         note: "memory writes for this batch report an io-error conflict and retrieval falls back to the lexical floor until the embedder recovers",
                     });
                 },
@@ -277,7 +278,7 @@ export async function openStores(ctx) {
                 if (pgPool) {
                     const q = async (text, params) => { const r = await pgPool.query(text, params); return { rows: r.rows }; };
                     await ensurePgTaskAttachmentSchema(q);
-                    taskAttachmentStore = new PgTaskAttachmentStore(q, bytes);
+                    taskAttachmentStore = new PgTaskAttachmentStore(pgPool, bytes);
                 }
                 else {
                     await ensureTiDBTaskAttachmentSchema(mysqlPool);

package/dist/boot/web-admin.js

@@ -30,7 +30,7 @@ import { CONFIG_DOMAIN_INVALID_NOTE, buildCandidateRejectedFields, candidateReje
 import { SHA256_HEX_RE } from "../digest-form.js";
 import { BOOT_REJUDGE_OF_REFUSED_GROUP, createConfigApplyLedger, modelPlaneCommitted, refusedGroups } from "../web-admin-client/apply-ledger.js";
 import { announceReadDenyRows, buildDeploymentPostureSeats } from "./runner-deps.js";
-import { echoCallerText } from "../caller-text-echo.js";
+import { seatText } from "../trace/exit-seat.js";
 const MODELS_REJECTION_PHRASE = {
     domain_invalid: "models 域判形失败",
     empty: "读不出(空 / 纯空白:半写或截断)",
@@ -161,14 +161,14 @@ export async function createWebAdminRuntime(ctx) {
                 `refusing to start rather than run with every sealed model unusable (no_key_store). Make that directory creatable, owned by ` +
                 `the service user and chmod-able to 0700 on a writable filesystem, or unset SEALED_KEY_DIR to use <data root>/sealed-key.`);
         }
-        logger.warn("sealed_key_store_unavailable", { err: String(err), note: "sealed api keys cannot be unsealed on this host — models carrying sealedApiKey will fail loud per-model" });
+        logger.warn("sealed_key_store_unavailable", { err: seatText("operator-log-text", String(err)), note: "sealed api keys cannot be unsealed on this host — models carrying sealedApiKey will fail loud per-model" });
     }
     let checkpointCtxSealing;
     try {
         checkpointCtxSealing = await ensureCheckpointCtxSealing(sealedKeyDir, logger);
     }
     catch (err) {
-        logger.warn("checkpoint_ctx_sealing_unavailable", { err: err instanceof Error ? err.message : String(err), dir: join(sealedKeyDir, "checkpoint-ctx-keys"), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make that directory (under the sealed-key custody directory: SEALED_KEY_DIR, default <data root>/sealed-key) creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
+        logger.warn("checkpoint_ctx_sealing_unavailable", { err: seatText("operator-log-text", err instanceof Error ? err.message : String(err)), dir: join(sealedKeyDir, "checkpoint-ctx-keys"), note: "suspended tasks' request credentials cannot be sealed on this host; with durable approvals on the boot refuses — make that directory (under the sealed-key custody directory: SEALED_KEY_DIR, default <data root>/sealed-key) creatable and chmod-able by the service, or repair / remove a key file there whose public and private halves do not belong together" });
     }
     const configProvider = configSourceKind(config) !== undefined
         ? createConfigProvider({
@@ -234,7 +234,7 @@ export async function createWebAdminRuntime(ctx) {
                 listener(changed);
             }
             catch (err) {
-                logger.warn("self_report_listener_failed", { changed, error: err instanceof Error ? err.message : String(err), note: "a self-report subscriber threw; the state change stands regardless and the next fleet heartbeat carries it" });
+                logger.warn("self_report_listener_failed", { changed, error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)), note: "a self-report subscriber threw; the state change stands regardless and the next fleet heartbeat carries it" });
             }
         }
     };
@@ -326,7 +326,7 @@ export async function createWebAdminRuntime(ctx) {
             });
         }
         catch (e) {
-            logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: String(e), note: "file-backed prompt-epoch store unavailable — memory fallback (the center candidate is not restart-durable); built-ins unaffected" });
+            logger.warn("center_prompts_store_unwritable", { dir: promptEpochDir, err: seatText("operator-log-text", String(e)), note: "file-backed prompt-epoch store unavailable — memory fallback (the center candidate is not restart-durable); built-ins unaffected" });
             return new CenterPromptSource({
                 store: withByDigestBackfill(new MemoryPromptArtifactStore()),
                 stateStore: recordingStateStore(binnedPromptStateStore(storePerBin(() => new MemoryPromptSourceStateStore()))),
@@ -349,7 +349,7 @@ export async function createWebAdminRuntime(ctx) {
             await promptSource.restore();
         }
         catch (e) {
-            logger.warn("center_prompts_catalog_restore_failed", { phase, err: String(e), note: "the persisted center-layer state for this credential identity could not be loaded — the center candidate is absent until the next adopt; built-ins unaffected" });
+            logger.warn("center_prompts_catalog_restore_failed", { phase, err: seatText("operator-log-text", String(e)), note: "the persisted center-layer state for this credential identity could not be loaded — the center candidate is absent until the next adopt; built-ins unaffected" });
         }
         if (cc !== undefined && identity !== undefined && currentIdentity() !== identity) {
             promptStateIdentity = undefined;
@@ -474,7 +474,7 @@ export async function createWebAdminRuntime(ctx) {
             return lkgSurvivesRestart;
         }
         catch (err) {
-            logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "durable persist failed — restart signal proceeds anyway (a dead disk + dead center double-fault can re-loop; fix the disk)" });
+            logger.warn("config_lkg_save_failed", { path: lkgPath, err: seatText("operator-log-text", String(err)), note: "durable persist failed — restart signal proceeds anyway (a dead disk + dead center double-fault can re-loop; fix the disk)" });
             return false;
         }
     };
@@ -511,7 +511,7 @@ export async function createWebAdminRuntime(ctx) {
                     await saveLkg(lkgPath, cc?.worker, identity, read.lkg.effective, read.lkg.etag);
                 }
                 catch (err) {
-                    logger.warn("config_lkg_save_failed", { path: lkgPath, err: String(err), note: "the migrated LKG is used from memory this boot; the on-disk copy is migrated again on the next read-back and replaced by the next clean candidate" });
+                    logger.warn("config_lkg_save_failed", { path: lkgPath, err: seatText("operator-log-text", String(err)), note: "the migrated LKG is used from memory this boot; the on-disk copy is migrated again on the next read-back and replaced by the next clean candidate" });
                 }
             }
             logger.info("config_loaded_lkg", { path: lkgPath, savedAt: read.lkg.savedAt, why, scope, note: lkgReadNote(scope) });
@@ -562,7 +562,7 @@ export async function createWebAdminRuntime(ctx) {
             }
             catch (applyErr) {
                 lkgBooted = false;
-                logger.warn("config_lkg_apply_failed", { err: String(applyErr), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
+                logger.warn("config_lkg_apply_failed", { err: seatText("operator-log-text", String(applyErr)), note: "persisted LKG failed to apply — env fallback serves; the cache rewrites on the next clean candidate" });
             }
         };
         const warnLocalNoModels = (r, verdict) => {
@@ -681,10 +681,10 @@ export async function createWebAdminRuntime(ctx) {
             if (err instanceof ConfigDirUntrustedError)
                 throw err;
             if (bootApplyPhase)
-                logger.warn("config_apply_refused", { source: configProvider.kind, err: String(err), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
+                logger.warn("config_apply_refused", { source: configProvider.kind, err: seatText("operator-log-text", String(err)), note: "the pulled candidate failed to apply at boot — falling back to the LKG / env; this is not a reachability failure" });
             else
-                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: String(err) });
-            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${echoCallerText(String(err), { maxChars: 120 })}`);
+                logger.warn("config_source_unreachable_using_env", { source: configProvider.kind, err: seatText("operator-log-text", String(err)) });
+            await bootFallBackWhole(`${bootApplyPhase ? "boot apply refused" : "boot fetch failed"}: ${seatText("operator-log-text", String(err))}`);
         }
         if (!dryRun && cc !== undefined && currentIdentity() !== promptStateIdentity)
             await rebasePromptState(currentIdentity(), "boot-end");
@@ -770,7 +770,7 @@ export async function createWebAdminRuntime(ctx) {
                     toolsShareThisFilesystem: DEPLOYMENT_SHAPE_PREDICATES.toolsOnThisHost.holds(config),
                     logger,
                 }).catch((err) => {
-                    logger.warn("center_plugins_apply_failed", { error: err instanceof Error ? err.message : String(err) });
+                    logger.warn("center_plugins_apply_failed", { error: seatText("operator-log-text", err instanceof Error ? err.message : String(err)) });
                     return undefined;
                 });
                 if (pluginOut) {
@@ -782,7 +782,7 @@ export async function createWebAdminRuntime(ctx) {
             }
             if (bootLkgCandidate && lkgEnabled) {
                 const bootPublished = await persistLkgDurable(bootLkgCandidate.effective, bootLkgCandidate.etag).catch((err) => {
-                    logger.warn("config_lkg_save_failed", { err: String(err), note: "boot LKG persist failed — retained for the per-tick retry" });
+                    logger.warn("config_lkg_save_failed", { err: seatText("operator-log-text", String(err)), note: "boot LKG persist failed — retained for the per-tick retry" });
                     return false;
                 });
                 {
@@ -1054,7 +1054,7 @@ export async function createWebAdminRuntime(ctx) {
                         }
                     }
                     catch (err) {
-                        logger.warn("web_admin_refresh_failed", { err: String(err), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
+                        logger.warn("web_admin_refresh_failed", { err: seatText("operator-log-text", String(err)), note: "etag NOT advanced — the same candidate is re-fetched and re-applied next poll" });
                         return "failed";
                     }
                     finally {
@@ -1113,7 +1113,7 @@ export async function createWebAdminRuntime(ctx) {
                             lastPull = "ok";
                     }
                     catch (err) {
-                        logger.warn("web_admin_refresh_failed", { err: String(err), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
+                        logger.warn("web_admin_refresh_failed", { err: seatText("operator-log-text", String(err)), leg: "boot-deferred", note: "etag NOT advanced — the refresh cadence re-fetches and re-applies the same candidate" });
                     }
                     finally {
                         refreshInFlight = false;
@@ -1164,7 +1164,7 @@ export async function createWebAdminRuntime(ctx) {
                     void bootConfigPending.then((r) => {
                         if (r !== null && configProvider.kind === "remote" && candidateIdentityOf(r.effective) !== currentIdentity()) {
                             logger.warn("config_boot_arrival_identity_changed", { note: "the late boot pull landed under a center credential that is no longer current — not adopted; re-pulling once under the current credential" });
-                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { err: String(err), note: "the refresh cadence retries under the current credential" }));
+                            void pullEffective(configProvider, undefined).then(continueArrival, (err) => logger.warn("config_boot_arrival_repull_failed", { err: seatText("operator-log-text", String(err)), note: "the refresh cadence retries under the current credential" }));
                             return;
                         }
                         continueArrival(r);

package/dist/boot/webfetch-summarize-lane.js

@@ -1,5 +1,6 @@
 import { createWebFetchSummarizer, resolveTaskModel as coreResolveTaskModel } from "@sema-agent/core";
 import { createPerModelAuthSeat } from "./side-query-lane.js";
+import { seatText } from "../trace/exit-seat.js";
 export function createWebFetchSummarizeLane(ctx) {
     return async (content, prompt, signal) => {
         const model = (() => {
@@ -7,7 +8,7 @@ export function createWebFetchSummarizeLane(ctx) {
                 return coreResolveTaskModel({ modelRole: "summarize" }, { models: ctx.config.models, roles: ctx.config.roles }).model;
             }
             catch (err) {
-                ctx.logger.warn("webfetch_summarizer_model_unresolved", { err: String(err), note: "this fetch falls back to raw page content" });
+                ctx.logger.warn("webfetch_summarizer_model_unresolved", { err: seatText("operator-log-text", String(err)), note: "this fetch falls back to raw page content" });
                 return undefined;
             }
         })();