@sema-agent/server 7.141.0 → 7.143.0

package/dist/approval-reconciler.js

@@ -21,7 +21,7 @@ function withDeadline(op, label, timeoutMs = RECONCILE_STORE_TIMEOUT_MS) {
     });
 }
 export function isAncestorFoldMint(ask) {
-    return ask.parentToolCallId === null && ask.sourceTaskId !== ask.sessionId;
+    return ask.parentToolCallId === null && ask.sourceSessionId !== ask.sessionId;
 }
 export function classifyGateMatch(ask, candidates) {
     const outcome = classifyGateMatchBeforeFoldVeto(ask, candidates);
@@ -30,7 +30,7 @@ export function classifyGateMatch(ask, candidates) {
     return outcome;
 }
 function classifyGateMatchBeforeFoldVeto(ask, candidates) {
-    const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceTaskId !== null && c.sourceTaskId === ask.sourceTaskId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
+    const sameIdentity = candidates.filter((c) => c.unparseable !== true && c.sourceSessionId !== null && c.sourceSessionId === ask.sourceSessionId && c.boundCallId === ask.toolCallId && c.createdAtMs >= ask.createdAtMs);
     const askHash = ask.boundInputHash;
     if (sameIdentity.length === 0) {
         if (candidates.length > 0)
@@ -79,6 +79,45 @@ export function decideReconcileAction(input) {
     void candidates;
     return { kind: "hold" };
 }
+export async function bindParkingAskAtGate(deps, ask, nowMs, deadlineMs) {
+    const { askStore, checkpoints, warn, revoke } = deps;
+    const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
+    const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
+    let batchState = batchRow?.state ?? "MISSING";
+    let batchBoundAskId = batchRow?.boundAskId ?? null;
+    const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
+    let gateMatch;
+    if (checkpoints && !irreversibleBatch && !expired()) {
+        const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
+        gateMatch = classifyGateMatch(ask, candidates);
+        if (gateMatch.kind === "hash_mismatch") {
+            warn("approval_reconcile_hash_mismatch", {
+                askId: ask.askId,
+                taskId: ask.taskId,
+                toolCallId: ask.toolCallId,
+                candidates: gateMatch.candidates,
+                reason: "ask and checkpoint minted the same bound input under the same (sourceSessionId, toolCallId) identity but the digests differ — " +
+                    "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
+                    "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
+            });
+        }
+        const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
+        if (match && !expired()) {
+            const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
+                gateToken: match.token,
+                gateBoundCallId: match.boundCallId,
+                gateBoundInputHash: match.boundInputHash,
+            }), "bindBatch");
+            if (res.ok) {
+                revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
+                return { bound: true, match: gateMatch };
+            }
+            batchState = res.batchState;
+            batchBoundAskId = res.boundAskId ?? null;
+        }
+    }
+    return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
+}
 export function createApprovalReconciler(deps) {
     const { askStore, checkpoints, runs, logger, metrics, batchLimit, pendingGraceMs, adhocGraceMs, orphanTtlMs, unattendedPolicy, emitRevoke } = deps;
     const warn = (event, fields) => {
@@ -98,44 +137,8 @@ export function createApprovalReconciler(deps) {
             warn("approval_revoke_emit_failed", { batchId: row.batchId, count: askIds.length, err: err instanceof Error ? err.message : String(err) });
         }
     };
-    const bindAtGate = async (ask, nowMs, deadlineMs) => {
-        const expired = () => deadlineMs !== undefined && Date.now() >= deadlineMs;
-        const batchRow = await withDeadline(askStore.getBatch(ask.batchId), "getBatch");
-        let batchState = batchRow?.state ?? "MISSING";
-        let batchBoundAskId = batchRow?.boundAskId ?? null;
-        const irreversibleBatch = batchState === "ABORTED" || (batchState === "ROUTING_BOUND" && batchBoundAskId !== null && batchBoundAskId !== ask.askId);
-        let gateMatch;
-        if (checkpoints && !irreversibleBatch && !expired()) {
-            const candidates = await withDeadline(checkpoints.findCheckpointCandidatesForAsk(encodeCheckpointScope(ask.owner), ask.sessionId, ask.toolCallId, ask.createdAtMs), "findCheckpointCandidatesForAsk");
-            gateMatch = classifyGateMatch(ask, candidates);
-            if (gateMatch.kind === "hash_mismatch") {
-                warn("approval_reconcile_hash_mismatch", {
-                    askId: ask.askId,
-                    taskId: ask.taskId,
-                    toolCallId: ask.toolCallId,
-                    candidates: gateMatch.candidates,
-                    reason: "ask and checkpoint minted the same bound input under the same (sourceTaskId, toolCallId) identity but the digests differ — " +
-                        "the known causes are deployment-side (a hook/policy mutating an object it still holds a reference to between the two mints, " +
-                        "or a stateful getter returning a fresh value per read), not out-of-band interference; this ask keeps its fail-safe route (no park, no denial)",
-                });
-            }
-            const match = gateMatch.kind === "match" ? gateMatch.candidate : undefined;
-            if (match && !expired()) {
-                const res = await withDeadline(askStore.bindBatch(ask.batchId, ask.askId, {
-                    gateToken: match.token,
-                    gateBoundCallId: match.boundCallId,
-                    gateBoundInputHash: match.boundInputHash,
-                }), "bindBatch");
-                if (res.ok) {
-                    revoke(ask, res.voidedSiblings, "superseded_by_park", nowMs);
-                    return { bound: true, match: gateMatch };
-                }
-                batchState = res.batchState;
-                batchBoundAskId = res.boundAskId ?? null;
-            }
-        }
-        return { bound: false, ...(gateMatch !== undefined ? { match: gateMatch } : {}), batchState, batchBoundAskId, irreversibleBatch };
-    };
+    const gate = { askStore, checkpoints, warn, revoke };
+    const bindAtGate = (ask, nowMs, deadlineMs) => bindParkingAskAtGate(gate, ask, nowMs, deadlineMs);
     const reconcileOne = async (ask, nowMs) => {
         const attempt = await bindAtGate(ask, nowMs);
         if (attempt.bound)
@@ -150,11 +153,11 @@ export function createApprovalReconciler(deps) {
                 return { outcome: "held", match: gateMatch };
             }
             case "deny": {
-                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
+                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "DENIED", { endingCause: action.reason, updatedAtMs: nowMs }), "transitionAsk(DENIED)");
                 return { outcome: won ? "denied" : "held", match: gateMatch };
             }
             case "void": {
-                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { deniedReason: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
+                const won = await withDeadline(askStore.transitionAsk(ask.askId, "PARKING", "VOID", { endingCause: action.reason, updatedAtMs: nowMs }), "transitionAsk(VOID)");
                 if (!won)
                     return { outcome: "held", match: gateMatch };
                 if (action.reason === APPROVAL_ENDING_CAUSES.ORPHAN_TTL_EXCEEDED) {

package/dist/audit.js

@@ -129,8 +129,9 @@ const MESSAGE_READ_TREATMENT = {
         runOrigin: "verbatim",
         taskId: "verbatim",
         attachment: "verbatim",
+        rewrittenBy: "verbatim",
     },
-    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim" },
+    custom: { role: "verbatim", customType: "verbatim", content: "verbatim", display: "verbatim", details: "verbatim", provenance: "verbatim", timestamp: "verbatim", rewrittenBy: "verbatim" },
     assistant: {
         role: "verbatim", content: "parts", errorMessage: "text", diagnostics: "structure", repetition: "structure",
         api: "verbatim", provider: "verbatim", model: "verbatim", responseModel: "verbatim", responseId: "verbatim", requestId: "verbatim",
@@ -139,8 +140,9 @@ const MESSAGE_READ_TREATMENT = {
         staticReasoningCut: "verbatim", timestamp: "verbatim",
         providerCondition: "verbatim", providerConditionSource: "verbatim", providerResetAtMs: "verbatim", apiErrorRoute: "verbatim",
         errorBodyIncomplete: "verbatim", modelOutputInvalid: "verbatim", finishReasonUnknown: "verbatim", streamEndIgnored: "verbatim",
+        refusedTool: "verbatim", rewrittenBy: "verbatim",
     },
-    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "toolCard", isError: "verbatim", timestamp: "verbatim" },
+    toolResult: { role: "verbatim", toolCallId: "verbatim", toolName: "verbatim", content: "parts", details: "toolCard", isError: "verbatim", timestamp: "verbatim", rewrittenBy: "verbatim" },
     bashExecution: {
         role: "verbatim", command: "text", output: "text", exitCode: "verbatim", cancelled: "verbatim", truncated: "verbatim",
         fullOutputPath: "verbatim", timestamp: "verbatim", excludeFromContext: "verbatim",

package/dist/auth-bridge.d.ts

@@ -1,4 +1,4 @@
-import { type AuthBridgeErrorCode, type VerifiedIdentity } from "@sema-agent/settings-schema/api/auth-bridge";
+import { VerifiedIdentity, type AuthBridgeErrorCode } from "@sema-agent/settings-schema/api/auth-bridge";
 import { type TokenScopeRefusal } from "@sema-agent/settings-schema/api/scopes";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
@@ -52,12 +52,13 @@ type BridgeSinks = {
     readonly logger?: Logger | undefined;
     readonly metrics?: Pick<Metrics, "inc"> | undefined;
 };
-/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 是 `unknown` —— 这一位正是边界要判的形,它不信型面
- *  (席是嵌入方可换的:`""` 过得了 `scope: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
+/** 注入边界收的结局:与 {@link VerifyOutcome} 同形,只是成功身份的 `scope` 与 `principalInc` 是 `unknown` —— 这两位正是边界要判的形,它不信型面
+ *  (席是嵌入方可换的:`""` 过得了 `scope: string` / `principalInc?: string`,JS 侧连缺省 / 非串都交得进来)。`VerifyOutcome` 可赋给它,调用方零改动。 */
 type ReportedOutcome = {
     ok: true;
-    identity: Omit<BridgeIdentity, "scope"> & {
+    identity: Omit<BridgeIdentity, "scope" | "principalInc"> & {
         scope?: unknown;
+        principalInc?: unknown;
     };
 } | {
     ok: false;
@@ -65,8 +66,10 @@ type ReportedOutcome = {
 };
 /**
  * 注入边界:任何验证器(内建 {@link createWebAdminJwtVerifier},或嵌入方注入的 `ServiceDeps.webAdminJwtVerifier`)交来的结局,在这里定「装不装身份」。
- * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次(入参型见 {@link ReportedOutcome})。
- * 读不出 ⇒ 同一只记账口、不交身份(调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
+ * 成功身份的 scope 经**同一只** `readTokenScope` 再读一次;化身号经契约的**同一只**判官 `VerifiedIdentity.shape.principalInc`(= `PrincipalIncarnation.optional()`,
+ * 契约验证器读 `sub_inc` 用的就是它)再判一次(入参型见 {@link ReportedOutcome})。
+ * 读不出 scope ⇒ 记 `readTokenScope` 的拒词;化身号在场而不合形 ⇒ 记 `malformed`(与契约验证器同一条律:声明在场坏形 ⇒ 令牌 malformed)。两种都经同一只记账口、不交身份
+ * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
 /** The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache. */

package/dist/auth-bridge.js

@@ -1,5 +1,5 @@
 import { createPublicKey, verify as cryptoVerify } from "node:crypto";
-import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
+import { AUTH_BRIDGE_ALGS, DEFAULT_CLOCK_SKEW_SEC, DEFAULT_JWKS_REFRESH_MIN_INTERVAL_SEC, DEFAULT_OFFLINE_GRACE_SEC, WEB_ADMIN_JWKS_PATH, WebAdminJwks, classifyTimeClaims, jwksWithinOfflineGrace, shouldForceJwksRefresh, toVerifiedIdentity, VerifiedIdentity, } from "@sema-agent/settings-schema/api/auth-bridge";
 import { readTokenScope } from "@sema-agent/settings-schema/api/scopes";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { centerJwksFetch } from "./web-admin-client/center-request.js";
@@ -17,12 +17,18 @@ function recordBridgeRefusal(sinks, error, at = {}) {
 export function admitBridgeIdentity(outcome, sinks) {
     if (!outcome.ok)
         return undefined;
-    const scoped = readTokenScope({ scope: outcome.identity.scope });
+    const { scope, principalInc, ...rest } = outcome.identity;
+    const scoped = readTokenScope({ scope });
     if ("refused" in scoped) {
         recordBridgeRefusal(sinks, scoped.refused);
         return undefined;
     }
-    return { ...outcome.identity, scope: scoped.scope };
+    const inc = VerifiedIdentity.shape.principalInc.safeParse(principalInc);
+    if (!inc.success) {
+        recordBridgeRefusal(sinks, "malformed");
+        return undefined;
+    }
+    return { ...rest, scope: scoped.scope, ...(inc.data !== undefined ? { principalInc: inc.data } : {}) };
 }
 export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 export const JWKS_FETCH_TIMEOUT_MS = 10_000;

package/dist/boot/adoption.js

@@ -1,4 +1,5 @@
 import { createAdoptionRunner } from "../adoption/runner.js";
+import { seatText } from "../trace/exit-seat.js";
 export async function runAdoptionBootScan(ctx) {
     const store = ctx.backend?.adoptionLog?.();
     if (!store)
@@ -29,7 +30,7 @@ export async function runAdoptionBootScan(ctx) {
         return reading;
     }
     catch (err) {
-        const error = err instanceof Error ? err.message : String(err);
+        const error = seatText("operator-log-text", err instanceof Error ? err.message : String(err));
         ctx.logger.error?.("adoption_boot_scan_failed", { error });
         return { scanned: 0, resumed: [], stalled: [], rejected: [], failed: [], error };
     }

package/dist/boot/budget-tracing.d.ts

@@ -11,6 +11,22 @@ export interface BudgetTracingCtx {
     backend: StoreBackend | undefined;
     breakerState: ReturnType<BreakerStateStore["startRefresh"]> | undefined;
 }
+/**
+ * S9 (SILENT-FALLBACK P0-e): write-behind flush/refresh failures previously vanished in a bare catch —
+ * the fleet silently degrades to per-replica counting (soft limits stop being fleet-wide). Every failure
+ * ticks the counter + streak gauge; warn once per episode (streak hits 3), info on the recovery edge.
+ * `info.error` is the client exception's text (the counter turns the rejection into it) ⇒ the warn's field passes the exit seat.
+ */
+export declare function createCounterDegradeHook({ logger, metrics }: {
+    logger: Pick<Logger, "warn" | "info">;
+    metrics: Pick<Metrics, "setGauge" | "inc">;
+}): (info: {
+    table: string;
+    kind: string;
+    streak: number;
+    prevStreak: number;
+    error?: string;
+}) => void;
 export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     brain: import("@sema-agent/core").Brain;
     degradeRouteWatch: import("../brain.js").DegradeRouteWatch;
@@ -29,7 +45,7 @@ export declare function createBudgetAndTracing(ctx: BudgetTracingCtx): {
     fleetLease: import("../fleet-lease.js").FleetLeaseManager | undefined;
     tracer: import("@sema-agent/core").TracerHook;
     sideQueryAccounting: import("../budget.js").SideQueryAccounting;
-    toolResultStore: import("../plugins/store-backend.js").ToolResultStoreFull | undefined;
+    toolResultStore: import("@sema-agent/core").ToolResultStore | undefined;
     sessionPolicyStore: import("@sema-agent/core").SessionPolicyStore | undefined;
     fileHistoryStore: import("../plugins/store-backend.js").ServiceFileHistoryStore | undefined;
     fileHistoryErasure: import("../file-history-capture.js").FileHistoryErasureFace | undefined;

package/dist/boot/budget-tracing.js

@@ -6,19 +6,23 @@ import { centerLaneConfigured } from "../web-admin-client/center-request.js";
 import { CostQuota } from "../observability/cost-quota.js";
 import { buildQuotaBounds } from "./limit-sync.js";
 import { assembleFileHistory } from "../file-history-capture.js";
-export function createBudgetAndTracing(ctx) {
-    const { config, logger, metrics, backend, breakerState } = ctx;
-    const { brain, degradeRoute: degradeRouteWatch } = createBrainAssembly(config, { breakerState });
-    const pricing = buildPricing(config.models);
-    const counterDegradeHook = (info) => {
+import { seatText } from "../trace/exit-seat.js";
+export function createCounterDegradeHook({ logger, metrics }) {
+    return (info) => {
         metrics.setGauge("counter_flush_fail_streak", info.streak, { table: info.table, kind: info.kind });
         if (info.streak > 0)
             metrics.inc("counter_flush_failed_total", { table: info.table, kind: info.kind });
         if (info.streak === 3)
-            logger.warn("counter_flush_degraded", { table: info.table, kind: info.kind, streak: info.streak, ...(info.error ? { error: info.error } : {}) });
+            logger.warn("counter_flush_degraded", { table: info.table, kind: info.kind, streak: info.streak, ...(info.error ? { error: seatText("operator-log-text", info.error) } : {}) });
         else if (info.streak === 0 && info.prevStreak >= 3)
             logger.info("counter_flush_recovered", { table: info.table, kind: info.kind, prevStreak: info.prevStreak });
     };
+}
+export function createBudgetAndTracing(ctx) {
+    const { config, logger, metrics, backend, breakerState } = ctx;
+    const { brain, degradeRoute: degradeRouteWatch } = createBrainAssembly(config, { breakerState });
+    const pricing = buildPricing(config.models);
+    const counterDegradeHook = createCounterDegradeHook({ logger, metrics });
     const bounds = buildQuotaBounds(config);
     const costQuota = backend?.costQuota
         ? backend.costQuota(bounds.limitMicroUsd, bounds.windowMs, counterDegradeHook).startRefresh()

package/dist/boot/device-lane.d.ts

@@ -77,7 +77,7 @@ export declare function createDeviceLane(ctx: DeviceLaneCtx): DeviceLane | undef
  */
 export declare function assertDeviceLaneWired(isDeviceLane: boolean, lane: DeviceLane | undefined, hasFactory: boolean): void;
 /**
- * 设备入口 × 已绑设备的起服一行(拒的那一半在配置期:device 车道上 `DEVICE_RELAY_URL` 必填,缺席拒起 —— `config.ts` `parseDeviceRelayUrlEnv`;
+ * 设备入口 × 已绑设备的起服一行(拒的那一半在配置期:device 车道上 `DEVICE_RELAY_URL` 必填 —— 缺席拒起是车道必需 env 门(`config.ts` `declaredExecutionLane` → `laneMissingEnv`),坏形 / 带凭据形拒启是 `parseDeviceRelayUrlEnv`;
  * 起不起服不随表里有几条绑定变)。
  *
  * 字面 `none` = 运维声明「设备拨本引擎自己的地址 + `wsPath`」。此刻根会话行上若有设备绑定(writer(device, D) 的格),这些会话的设备从此只能拨那个入口 ——

package/dist/boot/execution-env.d.ts

@@ -8,10 +8,13 @@ import type { DeviceEnrollment } from "../device-enrollment.js";
 import type { DeviceStore } from "../device-store.js";
 import type { ExecutionPlacementSeat } from "../execution-placement.js";
 import type { DeviceWsHub } from "../device-ws-hub.js";
+import { type RemoteContainerEnvDeps } from "../plugins/remote-env-e2b.js";
+import { type WorkspaceFillOf } from "../plugins/workspace-fill.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
-import { type SandboxGitPlane, type SandboxGitRunRows } from "../sandbox-git-plane.js";
+import { type SandboxGitPlaneSeat, type SandboxGitRunRows } from "../sandbox-git-plane.js";
 import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { type SpaceCommitRows } from "../workspace-space-commit.js";
+import { type LocalDockerEnvDeps } from "../plugins/remote-env-local-docker.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { TaskInheritEnv } from "../request-value-closure.js";
@@ -77,10 +80,19 @@ export declare function createSessionScopedRegistries(maxEntries?: number): Sess
  *  · 运维行座(`logger`)随部署级配置走。
  * `deps` = 适配器自己的测试缝(假集群 / 假对象存储),生产装配不传。返回的是工厂闭包 ⇒ `create*`。
  */
+/**
+ * 一条 run 是不是它工作区的属主:它的放置根就是它自己的会话(core `ExecutionEnvFactoryContext.placementRootSessionId`)。委派子代 / 后台代理与父 run 并发
+ * (一只工作区两个写者)、本服务为自己起的 run(放置根 = `INTERNAL_RUN_PLACEMENT_ROOT`)都不是。两个读者同一判:k8s 工作区空间(子代依律关)与
+ * 恢复点的播种(只有属主播种)。
+ */
+export declare function ownsItsWorkspace(ctx: {
+    readonly sessionId: string;
+    readonly placementRootSessionId: string;
+}): boolean;
 export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     imageOf(sessionId: string): string | undefined;
     /** The member git-credential broker seat for the pod's run (`runId` = the one reading of the run that owns the pod, the same value its
-     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `sandboxBrokerSeatOf` over the boot's plane reading and the run row's identity);
+     *  `sema.io/run` label carries; `sandbox-git-plane.ts` `createSandboxBrokerSeatOf` over the plane seat's reading at that pod and the run row's identity);
      *  absent seat / `undefined` answer ⇒ the pod carries no broker. */
     brokerSeatOf?(runId: string | undefined): Promise<K8sEnvConfig["sandboxBroker"]>;
     /** The session store's by-id head read (`SessionStore.headOf`, picked once by `headReadOf`); the occupant is its live-occupant projection
@@ -90,11 +102,13 @@ export declare function createK8sRunEnvFactory(k8sCfg: K8sEnvConfig, seats: {
     /** The run store's commit-fence rows (`workspace_space_commit`); answers `undefined` only before stage 7 binds the run store
      *  or without a store backend — the latter `assertWorkspaceSpaceReadable` refuses together with `space`. */
     spaceCommits(): SpaceCommitRows | undefined;
+    /** The restore point's fill seat of the run (`workspace-fill.ts`; `createExecutionEnv` mints the one reading). Absent / `undefined` ⇒ the pod as it comes. */
+    workspaceFillOf?: WorkspaceFillOf;
 }, deps?: K8sEnvDeps): ReturnType<typeof k8sExecutionEnvFactory>;
 /**
  * k8s 车道沙箱秘密座的**起服前提**(装配后的真门,第 5 段 await)。法只有一条:**秘密座非空(`K8S_SANDBOX_ENV` 点到了本进程环境里有的键)⇒
  * 问一次 SelfSubjectAccessReview(env 座那一行动词 {@link SANDBOX_SECRET_SEAT_VERBS}`.env`,沙箱命名空间)** —— 只问这一座自己发的调用,
- * 不问租约座的 `patch`(那一座由凭据平面的判官在它的前提都成立时另问,见 `readSandboxGitPlane`):
+ * 不问租约座的 `patch`(那一座由凭据平面座在它的前提都成立时另问一次,见 `sandbox-git-plane.ts` 的 `createSandboxGitPlaneSeat` 的 `settle`):
  *  · 答了「不许」(任一动词)⇒ 拒启,一行拒句点名缺的动词、命名空间、Role 规则原文与出路(`[sandbox-secret-rbac]`)—— 不等第一个 run 才失败;
  *  · 问不到(请求失败 / 审查本身被拒 / 答复没有 `status.allowed`)⇒ 照常起服:F 类兜底口 `server.sandbox-secret.seat-unverified` 计数 + 一行
  *    `sandbox_secret_seat_unverified`。放行的最坏后果:RBAC 真缺时第一个要建 Secret 的 run 连接即拒(`auth_failed`,pod 被删)—— 秘密值仍然
@@ -141,6 +155,12 @@ export interface ExecutionEnvCtx {
     /** run 店的按 id 读(成员凭据代理座读 run 行上受理时记下的身份元组 `RunRecord.identity`)。取值闭包:run 店第 7 段才绑(`late-binds.ts`),
      *  平面开着时每个 run 的 pod 建起前求值一次。不传 / 答 `undefined`(没有存储后端)⇒ 读不到身份 ⇒ 不挂代理。 */
     runRows?: () => SandboxGitRunRows | undefined;
+    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。 */
+    laneDeps?: {
+        readonly e2b?: RemoteContainerEnvDeps;
+        readonly k8s?: K8sEnvDeps;
+        readonly localDocker?: LocalDockerEnvDeps;
+    };
 }
 export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perTaskImage: PerTaskImageRegistry;
@@ -158,6 +178,6 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     spaceReclaimer: SpaceReclaimer | undefined;
     sandboxSecretSeatGate: (() => Promise<void>) | undefined;
     sandboxPodReaper: SandboxPodReaper | undefined;
-    readSandboxGitPlane: () => Promise<SandboxGitPlane>;
+    sandboxGitPlane: SandboxGitPlaneSeat;
 };
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/boot/execution-env.js

@@ -11,10 +11,11 @@ import { PerTaskImageRegistry } from "../per-task-image.js";
 import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
 import { deviceExecutionEnvFactory } from "../plugins/remote-env-device.js";
 import { e2bExecutionEnvFactory } from "../plugins/remote-env-e2b.js";
+import { createWorkspaceFill } from "../plugins/workspace-fill.js";
 import { hostExecutionEnvFactory, RemoteHostExecutionEnv } from "../plugins/remote-env-host.js";
 import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, createSpaceReclaimer, k8sExecutionEnvFactory, readSandboxSecretSeat, rpcTimeoutMsOf } from "../plugins/remote-env-k8s.js";
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
-import { judgeSandboxGitPlane, runIdentitySourceOf, sandboxBrokerSeatOf, sandboxGitPlaneAsksSecretSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
+import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
@@ -38,6 +39,7 @@ import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
 import { REMOTE_EXEC_PROVIDER_WORDS, buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
 import { warnReadDenyFloorUnkept } from "./execution-lane.js";
+import { seatText } from "../trace/exit-seat.js";
 function boundedSessionSetter(map, maxEntries) {
     return (sid, value) => {
         map.delete(sid);
@@ -105,15 +107,19 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         dropSession,
     };
 }
+export function ownsItsWorkspace(ctx) {
+    return ctx.placementRootSessionId === ctx.sessionId;
+}
 export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
     const cacheMisses = createCacheMissMemory();
     return async (ctx) => {
         const onWorkspaceSnapshot = createRunWorkspaceSnapshotSeat(ctx.sessionId);
-        const child = ctx.placementRootSessionId !== ctx.sessionId;
+        const child = !ownsItsWorkspace(ctx);
         const s3Snapshot = child && k8sCfg.s3Snapshot !== undefined ? spaceOff(k8sCfg.s3Snapshot) : k8sCfg.s3Snapshot;
         const spaceOccupant = child ? undefined : await occupantOf(seats, ctx.sessionId, ctx.taskId, rpcTimeoutMsOf(k8sCfg));
         const runId = !child && ctx.taskId !== undefined ? ctx.taskId : undefined;
         const sandboxBroker = await seats.brokerSeatOf?.(runId);
+        const workspaceFill = seats.workspaceFillOf?.(ctx);
         const { cache, ...deploymentCfg } = k8sCfg;
         return k8sExecutionEnvFactory({
             ...deploymentCfg,
@@ -123,6 +129,7 @@ export function createK8sRunEnvFactory(k8sCfg, seats, deps) {
             ...(spaceOccupant !== undefined ? { spaceOccupant } : {}),
             ...(runId !== undefined ? { runId } : {}),
             ...(sandboxBroker !== undefined ? { sandboxBroker } : {}),
+            ...(workspaceFill !== undefined ? { workspaceFill } : {}),
             onWorkspaceSnapshot,
         }, deps)(ctx);
     };
@@ -171,7 +178,7 @@ export async function ensureSandboxSecretSeat(k8sCfg, logger, deps, read = () =>
             recordFailOpen("server.sandbox-secret.seat-unverified", `namespace=${namespace} ${seat.detail}`);
             logger.warn("sandbox_secret_seat_unverified", {
                 namespace,
-                detail: seat.detail,
+                detail: seatText("operator-log-text", seat.detail),
                 effect: `the boot could not confirm the sandbox Secret RBAC (secrets ${SANDBOX_SECRET_SEAT_VERBS.env.join(" / ")}) — the service starts; if the Role lacks them, the first run that forwards K8S_SANDBOX_ENV is refused at connect (auth_failed) and its pod deleted — the values never go into the pod spec`,
             });
             return;
@@ -239,9 +246,9 @@ export function createExecutionEnv(ctx) {
     let spaceReclaimer;
     let sandboxSecretSeatGate;
     let sandboxPodReaper;
-    const planeCell = {};
-    let readSandboxGitPlane = async () => (planeCell.current = judgeSandboxGitPlane(sandboxGitPlanePremisesOf(config, {})));
+    let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
     let worktreeReap;
+    const workspaceFillOf = taskAttachmentStore === undefined ? undefined : (fctx) => createWorkspaceFill({ store: taskAttachmentStore, sessionId: fctx.sessionId, seeds: ownsItsWorkspace(fctx), logger });
     if (config.remoteExec?.provider === "e2b") {
         executionEnvFactory = e2bExecutionEnvFactory({
             apiKey: config.remoteExec.apiKey,
@@ -253,9 +260,10 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...((env) => (env !== undefined ? { sandboxEnv: env } : {}))(sandboxLaneEnvMerged(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv))),
             sandboxReadFloor: config.sandboxReadFloor,
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
             logger,
             metrics,
-        });
+        }, ctx.laneDeps?.e2b);
     }
     else if (config.remoteExec?.provider === "k8s") {
         const k8sCfg = {
@@ -281,30 +289,24 @@ export function createExecutionEnv(ctx) {
             ...((lane) => ({ ...(lane.env !== undefined ? { podEnv: lane.env } : {}), ...(lane.secretEnv !== undefined ? { podSecretEnv: lane.secretEnv } : {}) }))(buildSandboxLaneEnv(config, config.remoteExec.sandboxEnv)),
             sandboxReadFloor: config.sandboxReadFloor,
         };
-        const brokerImage = config.remoteExec.brokerImage;
+        sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {
+            patchRefusal: podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch),
+            askSecretSeat: () => readSandboxSecretSeat(k8sCfg, "lease"),
+        });
         executionEnvFactory = createK8sRunEnvFactory(k8sCfg, {
             imageOf: (sid) => perTaskImage.get(sid),
             headOf: ctx.headOf,
             spaceCommits: ctx.spaceCommits ?? (() => undefined),
-            brokerSeatOf: async (runId) => {
-                const plane = planeCell.current;
-                if (plane === undefined || plane.state !== "on")
-                    return undefined;
-                return sandboxBrokerSeatOf(plane, brokerImage, await runIdentitySourceOf(runId, ctx.runRows?.(), logger));
-            },
-        });
+            brokerSeatOf: createSandboxBrokerSeatOf(sandboxGitPlane.now, config.remoteExec.brokerImage, ctx.runRows, logger),
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+        }, ctx.laneDeps?.k8s);
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
-        readSandboxGitPlane = async () => {
-            const premises = sandboxGitPlanePremisesOf(config, { ...((r) => (r !== undefined ? { patchRefusal: r } : {}))(podSpecPatchBrokerRefusal(k8sCfg.podSpecPatch)) });
-            const secretSeat = sandboxGitPlaneAsksSecretSeat(premises) ? await readSandboxSecretSeat(k8sCfg, "lease") : undefined;
-            return (planeCell.current = judgeSandboxGitPlane({ ...premises, secretSeat }));
-        };
         sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
-            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: e instanceof Error ? e.message : String(e), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
+            .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
     }
     else if (config.remoteExec?.provider === "ssh") {
         executionEnvFactory = sshExecutionEnvFactory({
@@ -397,7 +399,8 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
             sandboxReadFloor: config.sandboxReadFloor,
-        });
+            ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+        }, ctx.laneDeps?.localDocker);
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
         executionEnvFactory = withRemoteScratchpad(executionEnvFactory, logger);
@@ -451,7 +454,7 @@ export function createExecutionEnv(ctx) {
         executionEnvFactory = registry.wrapFactory(executionEnvFactory);
         return registry;
     })();
-    if (taskAttachmentStore && executionEnvFactory) {
+    if (taskAttachmentStore && executionEnvFactory && !laneIsolated(executionLaneOf(config.remoteExec.provider))) {
         const inner = executionEnvFactory;
         const attStore = taskAttachmentStore;
         executionEnvFactory = async (ctx) => {
@@ -507,7 +510,7 @@ export function createExecutionEnv(ctx) {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, readSandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane,
     };
 }
 //# sourceMappingURL=execution-env.js.map

package/dist/boot/execution-lane.js

@@ -4,6 +4,7 @@ import { crossInvariant } from "../config-invariants.js";
 import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
+import { seatText } from "../trace/exit-seat.js";
 export const FILE_SOURCED_LANES = ["host", "local-docker"];
 export async function composeExecutionLane(config, ctx) {
     if (ctx.configSource === "local")
@@ -55,7 +56,7 @@ async function applyRemoteExecFile(config, ctx) {
         fileRx = await loadRemoteExec(localRoot);
     }
     catch (err) {
-        logger.error("remote_exec_file_invalid", { root: localRoot, err: String(err) });
+        logger.error("remote_exec_file_invalid", { root: localRoot, err: seatText("operator-log-text", String(err)) });
         throw new Error(`config.d/remote-exec.json under ${localRoot} is invalid: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
     }
     if (!fileRx)

package/dist/boot/exit-boundary.js

@@ -2,6 +2,7 @@ import { defaultTaskRegistry } from "@sema-agent/core";
 import { reportHardKillReceipts } from "../background-session-reap.js";
 import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
+import { seatText } from "../trace/exit-seat.js";
 const PROCESS_EXIT_INCLUDES_RETAINED = false;
 export function installProcessExitBoundary({ logger }) {
     const reapOwnChildProcesses = () => {
@@ -13,7 +14,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.info("shutdown_background_reaped", { reaped });
         }
         catch (err) {
-            logger.warn("shutdown_background_reap_failed", { err: String(err) });
+            logger.warn("shutdown_background_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
         try {
             const fg = reapHostForegroundChildren();
@@ -23,7 +24,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_foreground_reap_incomplete", { groups: fg.failed });
         }
         catch (err) {
-            logger.warn("shutdown_foreground_reap_failed", { err: String(err) });
+            logger.warn("shutdown_foreground_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
         return backgroundSoftStopped;
     };
@@ -33,7 +34,7 @@ export function installProcessExitBoundary({ logger }) {
             reportHardKillReceipts(logger, receipts, "process_exit");
         }
         catch (err) {
-            logger.warn("shutdown_background_hard_kill_failed", { err: String(err) });
+            logger.warn("shutdown_background_hard_kill_failed", { err: seatText("operator-log-text", String(err)) });
         }
     };
     const reapOwnHostWorkspaces = () => {
@@ -45,7 +46,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_host_workspace_reap_incomplete", { dirs: failed.map((f) => f.dir) });
         }
         catch (err) {
-            logger.warn("shutdown_host_workspace_reap_failed", { err: String(err) });
+            logger.warn("shutdown_host_workspace_reap_failed", { err: seatText("operator-log-text", String(err)) });
         }
     };
     const onProcessExit = () => {