@sema-agent/server 7.142.0 → 7.144.0

package/dist/plugins/remote-env-device.d.ts

@@ -314,21 +314,18 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
  * 🔴 **工厂认设备不认住客**(读口一只 = 会话店执行席 `seat.read(root)`,与解析器 / 换绑门 / 执行放置读面 / 准入链同一只读):按 placement 根读**当前**格,
  * 与这条腿带来的设备句柄 `honor` 比,不同即 typed 拒。判序(一次行读):
  *   root  = ctx.placementRootSessionId                       // 空 ⇒ config.placement_root_invalid
- *   honor = ctx.resumeWorkspace?.deviceId
+ *   honor = ctx.placementTarget?.deviceId                    // 引擎交来的放置围栏(这条腿必须落在哪台设备上)
  *   cell  = seat.read(root).cell                             // 行不在 / 格缺 / mirror / writer(device, ∅) ⇒ device.not_bound(唯一读法 `boundDeviceOf`)
  *   honor ≠ undefined ∧ 格上设备 ≠ honor                    ⇒ device.identity_mismatch(句点名两台,零连接)
  *   readDeviceForAdmission(格上设备, 格上属主)
  * 工厂**不**读 `task_run`、不读子代分区行、不按 `ctx.taskId`、不比化身、不比属主(住客谓词只用于写与 judged 复核,不是工厂的读者)。
- * 续跑腿(core 7.54.0 [ref] r3 / [ref],`ExecutionEnvFactoryContext.resumeWorkspace`):行记下了设备 ⇒ 本工厂**只**在那台设备上铸 —— 根此刻绑的不是它(换绑过)
- * ⇒ `device.identity_mismatch`(换绑后赎回的同一个词,零新码);不连另一台、不改道(新设备没有那个工作区)。「绑的就是它但现在不在线」与新跑同形:
- * 构造成功、`connect()` 回 typed `device.offline`(从不连别的设备)。行没记设备(早于该字段的行)⇒ 引擎已命名的「行未记设备 ⇒ 普通路由」臂,按根读当前格。
- * 句柄(`workspaceHandle()`)恒报连接真到达的设备,不抄 `resumeWorkspace`。
- *
- * 🔴 **过渡期(条件句)**:新派后代腿的放置句柄(引擎在 `ExecutionEnvFactoryContext` 上的放置工作区字段,`honor` 的第二来源)**只在本仓所基的引擎版本带它时**
- * 进判序;本仓今天所基的引擎上下文没有这个字段 ⇒ `honor` 只取续跑腿的 `resumeWorkspace`,新派后代腿按根读当前格。本仓**不**注入任何替代见证、不造任何行
- * (修在源头)。敞口(在那个字段到货之前成立):活过父 turn 的后台子代,在根换绑之后新派的腿会落到根当前设备 —— 换绑半边由换绑门的子代活性判关闭(归换绑门那一车),
- * 删除半边另有票。字段到货后的形:`honor = ctx.resumeWorkspace?.deviceId ?? <放置句柄>.deviceId`,放置句柄的 provider 不是本车道 ⇒ 装配拒(`config.placement_root_invalid` 同级)。
- * 本仓任何文本不得宣称工厂「一律按住客定址」。
+ * 围栏(`ExecutionEnvFactoryContext.placementTarget`,引擎每条腿一个答案):派生它的那条腿的环境报过的目标 —— 委派子代 / 工作流 agent / 被唤醒的
+ * 保留 agent 带唤醒腿的目标,级联后续阶 / 验证腿带第一条腿的目标,续跑腿带检查点行记下的目标。围栏点名了设备 ⇒ 本工厂**只**在那台设备上铸 ——
+ * 根此刻绑的不是它(换绑过)⇒ `device.identity_mismatch`(换绑后赎回的同一个词,零新码);不连另一台、不改道(新设备没有那个工作区)。
+ * 「绑的就是它但现在不在线」与新跑同形:构造成功、`connect()` 回 typed `device.offline`(从不连别的设备)。围栏缺席(顶层首腿,或派生它的腿
+ * 不是远端环境)或不点名设备 ⇒ 普通路由,按根读当前格。围栏的 `provider` 不进判序(引擎的回执也只比设备)。
+ * 句柄(`workspaceHandle()`)恒报连接真到达的设备,不抄围栏;引擎拿这份报告复核每条带围栏的腿(不符 ⇒ 续跑腿 `resume.env_failed`、
+ * 其余腿 `config.placement_not_honored`,都在腿跑之前)—— 本工厂在连接之前就拒,那两个词只在报告与围栏真不一致时出现。
  */
 export declare function deviceExecutionEnvFactory(deps: DeviceEnvFactoryDeps): ExecutionEnvFactory;
 /**

package/dist/plugins/remote-env-device.js

@@ -17,6 +17,7 @@ export const DEVICE_OUTCOME_TO_FILE_ERROR = {
     is_directory: "is_directory",
     liveness_no_output: "unknown",
     name_too_long: "name_too_long",
+    symlink_loop: "symlink_loop",
     not_directory: "not_directory",
     not_found: "not_found",
     not_supported: "not_supported",
@@ -40,6 +41,7 @@ export const DEVICE_OUTCOME_TO_EXEC_ERROR = {
     is_directory: "unknown",
     liveness_no_output: "liveness_no_output",
     name_too_long: "unknown",
+    symlink_loop: "unknown",
     not_directory: "unknown",
     not_found: "unknown",
     not_supported: "shell_unavailable",
@@ -771,6 +773,7 @@ const OUTCOME_TO_REMOTE_ERROR = {
     is_directory: "unknown",
     liveness_no_output: "liveness_no_output",
     name_too_long: "unknown",
+    symlink_loop: "unknown",
     not_directory: "unknown",
     not_found: "unknown",
     not_supported: "unsupported",
@@ -806,10 +809,10 @@ export function deviceExecutionEnvFactory(deps) {
             throw deviceFactoryRefusal(DEVICE_ERROR_CODES.NOT_BOUND, `device lane: no device binding for placement root ${rootSessionId} [${DEVICE_ERROR_CODES.NOT_BOUND}] — ` +
                 "the submit-time admission chain must bind the root session to a device before a run reaches the factory (v2 §4.3.2)");
         }
-        const honor = ctx.resumeWorkspace?.deviceId;
+        const honor = ctx.placementTarget?.deviceId;
         if (honor !== undefined && honor !== binding.id) {
-            throw deviceFactoryRefusal(DEVICE_ERROR_CODES.IDENTITY_MISMATCH, `device lane: this resume rebuilds the workspace on device ${honor}, but placement root ${rootSessionId} is now bound to ${binding.id} [${DEVICE_ERROR_CODES.IDENTITY_MISMATCH}] — ` +
-                "a parked call does not follow a rebind (the new device has no copy of that workspace); finish or cancel the parked task, then start it again on the device now bound");
+            throw deviceFactoryRefusal(DEVICE_ERROR_CODES.IDENTITY_MISMATCH, `device lane: this leg is placed on device ${honor} (the device the work it continues ran on), but placement root ${rootSessionId} is now bound to ${binding.id} [${DEVICE_ERROR_CODES.IDENTITY_MISMATCH}] — ` +
+                "work already under way does not follow a rebind (the new device has no copy of that workspace); finish or cancel the running or parked task, then start it again on the device now bound");
         }
         const view = await deps.store.readDeviceForAdmission(binding.id, binding.owner);
         if (!view) {

package/dist/plugins/remote-env-host.d.ts

@@ -71,11 +71,8 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
     cwd: string;
     /** core `ExecutionEnv.homeDir`([ref]):本机执行用户的 home —— 主张在场 ⇒ 主张(构造时与子进程拿到的 `HOME` 对证过),否则构造时读到的那个 `HOME`,见 {@link LaneHomeSeat}。 */
     get homeDir(): string | undefined;
-    /** 家目录的座(主张在场 ⇒ 构造时对证 · 否则构造时实测)。读数 = {@link childHome}:本类自己组合给子进程的那份 env,不 spawn。 */
+    /** 家目录的座(主张在场 ⇒ 构造时对证,证不了 ⇒ 构造抛、环境不铸 · 否则构造时实测)。读数 = {@link childHome}:本类自己组合给子进程的那份 env,不 spawn。 */
     private readonly homeSeat;
-    /** 家目录:主张与子进程拿到的 `HOME` 对不上 ⇒ 这只环境的拒句;`shellReady` / `fsReady` / `connect` 三道门原样回它,一条命令、一次文件动作都不做。
-     *  读数是本类自己组合的 env(纯函数,同一份输入同一个答案)⇒ 构造时判一次、记一辈子。 */
-    private readonly homeRefusal;
     /**
      * core 7.49.0 [ref]:shell 子进程**真拿到的** `CDPATH` 条目(`[]` = 没有)—— 删除守卫按它解裸 `cd <dir>`。本车道的命令就是本机子进程,
      * env 是本类自己组合的(继承姿态 + `cfg.env`),所以说得出:读同一只组合({@link childEnv} 的**读面**,不披露、不钉 shell),切法与 core
@@ -84,6 +81,13 @@ export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, Sched
      * {@link hostShell}(win32 上未落定同步抛 —— 修前每条 Bash 的策略链都因此被拒)。
      */
     get cdPath(): readonly string[];
+    /**
+     * core 7.62.0 [ref]([ref]):shell 子进程**收到的**环境变量名(从不带值)—— 引擎判「git 会不会读一只文本没绑的 `GIT_*`」的唯一来源(声明且没有 `GIT_*`
+     * ⇒ `git show HEAD:<path>` 的对象路径只在仓库顶判;缺席 ⇒ 每层祖先照判)。与 {@link cdPath} 同一只组合的读面(继承姿态 + `cfg.env`,不 spawn、不记剥除、不碰 shell);
+     * 逐命令的 `options.env` 由引擎自己交,它知道(core 残余:逐命令 env 加一个名)。win32 spawn 层钉的 `SHELL` 不在这一读里(不是 `GIT_*`,不改这一判)。
+     * 只有本车道声明:远端车道的 shell 跑在对方自己构建的环境里,适配器说不出(缺席)。
+     */
+    get receivedEnvNames(): readonly string[];
     /**
      * core 7.56.0 [ref]:shell 子进程继承的环境里**收不到**的条目(名 + 规则,从不带值)—— 与 {@link cdPath} 同一只组合的读面
      * (`server-secret-env.ts` 的 `withheldFromHostSubprocess`:继承组合扣下的发现,减去 `cfg.env` 这条显式授予重供的键)。逐命令的 `options.env`

package/dist/plugins/remote-env-host.js

@@ -13,7 +13,7 @@ import { IS_WIN32, resolveHostShell, hostShell, pinHostShell, spawnGroupOptions,
 import { BackgroundShellManager, seedMemStream, feedMemStream, drainMemStream } from "./background-shell-support.js";
 import { FileError, NodeExecutionEnv, inheritEnvPolicyProblem, ExecutionError, RemoteExecutionError, RollingTailBuffer, walkSymlinkChain, markTruncated, SchedulerError, BackgroundShellError, } from "@sema-agent/core";
 import { capabilitiesFor } from "../execution-lane-caps.js";
-import { LaneHomeSeat } from "../lane-home-probe.js";
+import { LaneHomeSeat, laneHomeRefusal } from "../lane-home-probe.js";
 import { composeHostSubprocessEnv, hostSubprocessEnv, withheldFromHostSubprocess } from "../server-secret-env.js";
 import { nameTooLongCode } from "./remote-env-file-error.js";
 import { trackEphemeralHostWorkspace, untrackEphemeralHostWorkspace } from "./host-workspace-registry.js";
@@ -64,11 +64,13 @@ export class RemoteHostExecutionEnv {
         return this.homeSeat.home;
     }
     homeSeat;
-    homeRefusal;
     get cdPath() {
         const value = this.childEnv(undefined, undefined).CDPATH;
         return value === undefined || value === "" ? [] : value.split(":");
     }
+    get receivedEnvNames() {
+        return Object.entries(this.childEnv(undefined, undefined)).flatMap(([name, value]) => (value === undefined ? [] : [name]));
+    }
     get withheldEnv() {
         return withheldFromHostSubprocess({ policy: this.cfg.inheritEnv, allow: [] }, this.cfg.env);
     }
@@ -148,7 +150,9 @@ export class RemoteHostExecutionEnv {
         this.cwd = this.workspaceDir;
         this.handle = { sandboxId: this.workspaceDir, provider: PROVIDER, mountPath: this.workspaceDir };
         this.homeSeat = new LaneHomeSeat(PROVIDER, config, IS_WIN32 ? "win32" : "posix");
-        this.homeRefusal = this.homeSeat.settle(this.childHome())?.refusal;
+        const homeVerdict = this.homeSeat.settle(this.childHome());
+        if (homeVerdict !== undefined)
+            throw laneHomeRefusal(homeVerdict);
     }
     workspaceHandle() {
         return this.handle;
@@ -158,8 +162,6 @@ export class RemoteHostExecutionEnv {
             return unsupported("connect(snapshotId)");
         if (this.destroyed)
             return { ok: false, error: new RemoteExecutionError("connect_failed", "execution env already destroyed") };
-        if (this.homeRefusal !== undefined)
-            return { ok: false, error: new RemoteExecutionError("connect_failed", this.homeRefusal) };
         if (config?.abortSignal?.aborted)
             return { ok: false, error: new RemoteExecutionError("aborted", "connect aborted") };
         try {
@@ -1262,8 +1264,6 @@ export class RemoteHostExecutionEnv {
     async shellReady() {
         if (this.destroyed)
             return { ok: false, error: new ExecutionError("shell_unavailable", "execution env already destroyed") };
-        if (this.homeRefusal !== undefined)
-            return { ok: false, error: new ExecutionError("shell_unavailable", this.homeRefusal) };
         try {
             try {
                 await resolveHostShell();
@@ -1295,8 +1295,6 @@ export class RemoteHostExecutionEnv {
         return (this.spoolRootDir !== undefined && inside(this.spoolRootDir)) || (this.persistent && inside(this.workspaceDir));
     }
     async fsReady(p, opts) {
-        if (this.homeRefusal !== undefined)
-            return { ok: false, error: new FileError("target_unavailable", this.homeRefusal, this.resolve(p)) };
         if (this.destroyed) {
             const lingering = opts?.lingeringBgWrite === true && this._bgManager?.hasShells() === true && this.isLingeringMirrorTarget(p);
             if (!lingering)

package/dist/plugins/remote-env-k8s.d.ts

@@ -386,6 +386,7 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
      * loud `workspace_latest_dangling`, the pointer deleted, an empty workspace); absent (404 — the key, with the bucket there) ⇒ a fresh pod; a read that
      * FAILS ⇒ a loud `connect_failed` — a 404 `NoSuchBucket` included ({@link refuseMissingBucket}) — never a silent fresh workspace (a run that believes it resumed while it did not is
      * the worst form). Once the pod holds the workspace, this env arms its fence seat (its destroy will commit).
+     * The same walk ({@link establish}) is the restore point of a parked run's resumed leg whose park packed nothing ({@link resumeVM}).
      * Persistence off / no store ⇒ a fresh pod, exactly as before. Persistence on but no such session (the occupant absent) ⇒ a
      * fresh pod and one `workspace_space_unavailable` line (no restore by any other key). The occupant read FAULTED ⇒ the same
      * loud `connect_failed` as a failed `latest` read, no pod ({@link provision} refuses it — every entry that would create one).
@@ -397,14 +398,16 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
      * as it stands to every later connect on every lane — the previous commit is not waited on again, `latest` is not read again, no pod is created.
      */
     connect(config?: RemoteConnectConfig): Promise<ConnectResult>;
-    /** The one walk of a connect ({@link connect} runs it once at a time). */
+    /** The one walk of a connect ({@link connect} runs it once at a time) — also the resumed leg's walk when its park packed nothing ({@link restorePointOf},
+     *  under the resume's own hold of the same gate). */
     private establish;
     /**
      * The restore point's fill (`workspace-fill.ts`): a pod whose workspace this env just minted or restored is handed over only once the fill seat placed
      * its content — through {@link fillChannel} (this adapter's own exec, never the public face: inside a connect the public face waits on that very connect).
      * A fill that does not complete releases the pod (no tool and no run-end snapshot may see a half-filled workspace); a refusal that would answer the same
      * again (`standing`) is held for the env ({@link holdRefusal}). No seat ⇒ the pod as it came. `origin` tells the seat whether the workspace was minted
-     * (a new pod with nothing restored: the space off / unavailable / without `latest`, or `latest` dangling) or restored (the space's `latest`, or a park snapshot whose archive came back; a park snapshot with no archive — a plan-only park — is minted).
+     * (a new pod with nothing restored: the space off / unavailable / without `latest`, or a dangling restore point — `latest` or a park snapshot whose archive is gone)
+     * or restored (the space's `latest`, or a park snapshot whose archive came back). A park that packed nothing resumes through a new connect, so it reads as that connect does.
      */
     private settle;
     /** The restore point's channel: a fixed command through the one start seam (start form `adapter`, the engine's commands' identity) and a write in
@@ -447,9 +450,11 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
      * never its text. Not a knob: there is no honest way to run a space we could not read — a retry of the run reads it again.
      */
     private refuseUnreadableOccupant;
-    /** Every space-lane operator line: the space is named by its incarnation's log prefix only, and free text (a curl
-     *  stderr, a fetch error) passes {@link redactIncarnations} — the full token never reaches a log body. */
+    /** Every space-lane operator line: the space is named by its incarnation's log prefix only ({@link snapshotLine} does the rest). */
     private spaceLine;
+    /** Every snapshot operator line, both lanes — the ONE redaction seat: each string field (a key, a curl stderr, a fetch error, an effect) passes
+     *  {@link redactIncarnations}, so a full incarnation-shaped token never reaches a log body, whatever text carried it there. */
+    private snapshotLine;
     /** A fresh pod (create → Running → workspace root), bounded retry — THE seat every pod of this env is created through
      *  ({@link connect} and, via {@link restoreSnapshot}, {@link resumeVM}). A lane keyed by an occupant read that faulted ⇒ refused
      *  here, before any request ({@link refuseUnreadableOccupant}): never retried (the reading is this env's, fixed at construction). */
@@ -651,11 +656,14 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
      */
     private uploadSnapshot;
     /**
-     * Resume a workspace snapshot onto a FRESH pod (resume = executionEnvFactory rebuild + resumeVM):
-     * provision a pod, then download + untar the snapshot into the workspace ({@link restoreSnapshot}, lane `park`). A
-     * missing object (a plan-only park: no pod was ever minted, so nothing was uploaded) resumes as a clean workspace whose origin is `minted` —
-     * no restorable tree — so the restore point seeds it; the resume walks the park lane and never reads the space's `latest` (which a fresh connect with the space on
-     * would restore); a snapshot that came back is `restored` and never seeded.
+     * Resume a parked run's workspace onto a FRESH pod (resume = executionEnvFactory rebuild + resumeVM). Where the leg's workspace comes from is
+     * read off the park's snapshot id — it says what the park packed ({@link snapshotIdHolds}), never guessed from what the store answers:
+     *  - an archive ⇒ provision a pod, then download + untar it into the workspace ({@link restoreSnapshot}, lane `park`): it came back ⇒ `restored`
+     *    (never seeded); it is not there ⇒ a dangling restore point, the same rule on both lanes ({@link dropDangling}: one line, an empty workspace);
+     *  - nothing (the env held no pod when it parked — the run parked before anything touched its hand) ⇒ there is no workspace of the park to
+     *    restore, so the leg's restore point is the one a new connect has ({@link establish}): space open ⇒ the previous commit waited out and
+     *    `latest` restored (none ⇒ a fresh workspace), space off ⇒ a fresh workspace — never a fresh workspace beside a `latest` that the leg's
+     *    run-end commit would then overwrite. No archive is asked for under such an id.
      *
      * [ref]①(priorHandle 根保真)——k8s 走**诚实臂**而非绑定臂:pod 的 workspace volume 挂在**当前**
      * 配置根(cfg.mountPath),往 priorHandle.mountPath 绑=往容器 rootfs untar 大工作区,ephemeral-storage
@@ -666,15 +674,14 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     resumeVM(snapshotId: SnapshotId, options?: VmLifecycleOptions): Promise<ConnectResult>;
     /** The one walk of a resume ({@link resumeVM} runs it under the connect gate). */
     private resumeWalk;
-    /**
-     * The ONE tar download (both lanes): provision a FRESH pod, download + untar the lane's archive into the workspace.
-     * A missing archive (404) starts from the clean workspace on both lanes, and on both it is the same fact — no restorable tree ⇒ origin
-     * `minted` (the restore point seeds it, exactly as on a fresh connect). What differs is only what it means:
-     *  - park: a plan-only suspend has no object (the park came before anything touched the hand) — nothing to say;
-     *  - space: `latest` dangles (its pointer is only written after a successful upload, so the archive was removed later —
-     *    by the bucket's lifecycle rule or a hand): the data is gone by an operator rule ⇒ loud and continuable —
-     *    {@link dropDanglingLatest} (one `workspace_latest_dangling` line, the pointer deleted); the run's own run-end
-     *    snapshot then becomes the new `latest`.
+    /** The resumed leg's restore point, chosen by what the park's id names ({@link resumeVM}) — a closed set, one arm each. */
+    private restorePointOf;
+    /**
+     * The ONE tar download (both lanes): provision a FRESH pod, download + untar the lane's archive into the workspace. Only an id that names an
+     * archive reaches it ({@link snapshotIdHolds}: a park that packed nothing resumes through {@link establish}; `latest` names only an object
+     * that was written). So a missing archive (404) is one fact on both lanes — the restore point names data that is gone (removed later, by the
+     * bucket's lifecycle rule or a hand) ⇒ loud and continuable, ONE rule: {@link dropDangling} (one `workspace_latest_dangling` line), and the
+     * run continues on the clean workspace, origin `minted` (no restorable tree ⇒ the restore point seeds it, exactly as on a fresh connect).
      * An attempt that does not complete releases the pod it provisioned: no tool and no run-end snapshot may ever see a torn
      * workspace. A transient class ({@link restoreFailureIsTransient}) is tried again on a fresh pod after the `retry.backoffMs`
      * pause, up to the lane's {@link RESTORE_MAX_ATTEMPTS}; a non-transient one ends the restore at once. The lane then says what
@@ -691,12 +698,18 @@ export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, Backgr
     /** The pause before a restore's next attempt (`retry.backoffMs`, the adapter's one retry pause). `false` ⇒ aborted (now or during it). */
     private restorePause;
     /**
-     * `latest` names an archive that is not there ([ref]): one `workspace_latest_dangling{space, key, deleted}` line and the
-     * pointer is deleted (the next run must not trip on it again); the run continues on the empty workspace. A pointer
-     * delete that fails rides on the same line (`deleted: false` + the error) — the next run then says it once more.
-     * This env is the space's only writer here (the commit fence admits one per space), so the delete is a plain one.
-     */
-    private dropDanglingLatest;
+     * A restore point names an archive that is not there — the data is gone by an operator rule (a bucket lifecycle rule, a hand): loud and
+     * continuable, ONE rule on both lanes — one `workspace_latest_dangling{lane, key, …}` line, and the run continues on the empty workspace
+     * {@link restoreSnapshot} hands over. `key` = the object the id names, spelled by {@link snapshotBase} (the one spelling of both partitions).
+     * What each lane adds is only what it holds:
+     *  - space: its `latest` pointer is deleted (the next run must not trip on it again); the line carries `space` and `deleted` — a delete that
+     *    fails rides on the same line (`deleted: false` + the error) and the next run says it once more. This env is the space's only writer here
+     *    (the commit fence admits one per space), so the delete is a plain one. The run's own run-end snapshot then becomes the new `latest`;
+     *  - park: there is no pointer to drop (the id lives in the engine's checkpoint); the line carries the session id. With the space open, the
+     *    resumed leg's run-end snapshot then becomes the space's new `latest`.
+     * Both lines pass the one redaction seat ({@link snapshotLine}).
+     */
+    private dropDangling;
     /**
      * Honest post-resume consistency ([ref] §5 council #8): the workspace FILES are restored byte-for-byte
      * from the snapshot, so read-before-edit hashing already lines up — there's nothing to re-fetch. In-VM

package/dist/plugins/remote-env-k8s.js

@@ -8,7 +8,7 @@ import { appendFileStaged, buildCwdEnvCommand, createCwdGuardedCall, shellQuote,
 import { presignS3Url, presignS3ListUrl } from "./s3-presign.js";
 import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
 import { SNAPSHOT_BUCKET_MISSING, isNoSuchBucketAnswer } from "./s3-answer.js";
-import { K8S_WORKSPACE_MOUNT_DEFAULT, SNAPSHOT_KEY_SEGMENT, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, mintSnapshotId, snapshotKeyPrefixProblem, snapshotNameOwnedBy } from "../workspace-space.js";
+import { K8S_WORKSPACE_MOUNT_DEFAULT, SNAPSHOT_KEY_SEGMENT, WORKSPACE_SNAPSHOT_PREFIX_DEFAULT, WORKSPACE_SNAPSHOT_TIMEOUT_MS_DEFAULT, mintSnapshotId, snapshotIdHolds, snapshotKeyPrefixProblem, snapshotNameOwnedBy } from "../workspace-space.js";
 import { spaceCommitAlive } from "../workspace-space-commit.js";
 import { incarnationLogPrefix, redactIncarnations } from "../session-incarnation.js";
 import { WORKSPACE_CACHE_SPACE_LABEL, workspaceCacheClaimOf, workspaceCacheEnv } from "../workspace-cache.js";
@@ -509,8 +509,10 @@ export class RemoteK8sExecutionEnv {
         return spaceReadFailed("occupant", ` (${code}) — refusing to start this run on a workspace that could be neither restored nor saved; retry the run once the session store answers, or set ${ways}`);
     }
     spaceLine(event, space, fields) {
-        const safe = Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, typeof v === "string" ? redactIncarnations(v) : v]));
-        this.logger?.warn(event, { space: incarnationLogPrefix(space.incarnation), ...safe });
+        this.snapshotLine(event, { space: incarnationLogPrefix(space.incarnation), ...fields });
+    }
+    snapshotLine(event, fields) {
+        this.logger?.warn(event, Object.fromEntries(Object.entries(fields).map(([k, v]) => [k, typeof v === "string" ? redactIncarnations(v) : v])));
     }
     provision(signal) {
         const space = this.spaceLane;
@@ -1224,12 +1226,12 @@ export class RemoteK8sExecutionEnv {
     async uploadSnapshot(target, boundMs = this.cfg.dataTimeoutMs) {
         if (target.lane === "park" && this.inFlight.size > 0)
             return { ok: false, error: new RemoteExecutionError("command_in_flight", "cannot suspend while a command is in flight (would snapshot a torn workspace)") };
-        const snapshotId = mintSnapshotId(this.occupantIncarnation);
         if (!this.podName) {
             return target.lane === "space"
                 ? { ok: false, error: new RemoteExecutionError("connect_failed", "the sandbox pod was gone when the run-end snapshot reached the upload — nothing was saved (the workspace could not be read), and `latest` keeps naming the previous snapshot") }
-                : ok(snapshotId);
+                : ok(mintSnapshotId(this.occupantIncarnation, "nothing"));
         }
+        const snapshotId = mintSnapshotId(this.occupantIncarnation, "archive");
         const presigned = this.presignSnapshot({ ...target, method: "PUT", snapshotId });
         if (!presigned.ok)
             return presigned;
@@ -1273,13 +1275,26 @@ export class RemoteK8sExecutionEnv {
             this.logger?.warn("sandbox_pod_released_before_restore", { pod: this.podName, ...(this.cfg.sessionId ? { sessionId: this.cfg.sessionId } : {}), effect: "this env held a pod minted before the park snapshot's restore — it is deleted; the restore provisions the leg's one pod" });
             await this.releasePod();
         }
-        const r = await this.settle(await this.restoreSnapshot({ lane: "park" }, snapshotId, options?.abortSignal));
+        const r = await this.restorePointOf(snapshotId, options?.abortSignal);
         if (!r.ok)
             return r;
         this.handleSnapshotId = snapshotId;
         this.armSpace();
         return ok(this.workspaceHandle());
     }
+    async restorePointOf(snapshotId, abortSignal) {
+        const holds = snapshotIdHolds(snapshotId);
+        switch (holds) {
+            case "archive":
+                return this.settle(await this.restoreSnapshot({ lane: "park" }, snapshotId, abortSignal));
+            case "nothing":
+                return this.establish(abortSignal ? { abortSignal } : undefined);
+            default: {
+                const unreachable = holds;
+                throw new Error(`unhandled snapshot id family: ${String(unreachable)}`);
+            }
+        }
+    }
     async restoreSnapshot(target, snapshotId, abortSignal) {
         const presigned = this.presignSnapshot({ ...target, method: "GET", snapshotId });
         if (!presigned.ok)
@@ -1303,8 +1318,7 @@ export class RemoteK8sExecutionEnv {
                     : undefined;
             if (!failure) {
                 if (r.ok && r.value.stdout.includes("EMPTY_SNAPSHOT")) {
-                    if (target.lane === "space")
-                        await this.dropDanglingLatest(target.space, snapshotId);
+                    await this.dropDangling(target, snapshotId);
                     return { ok: true, value: this.workspaceHandle(), origin: "minted" };
                 }
                 return { ok: true, value: this.workspaceHandle(), origin: "restored" };
@@ -1347,15 +1361,34 @@ export class RemoteK8sExecutionEnv {
             signal?.addEventListener("abort", onAbort, { once: true });
         });
     }
-    async dropDanglingLatest(space, snapshotId) {
-        const prefix = this.snapshotKeyPrefix();
-        const dropped = await this.writePointer(space, "latest", null);
-        this.spaceLine("workspace_latest_dangling", space, {
-            key: `${prefix}/${space.incarnation}/space/${snapshotId}.tar.gz`,
-            deleted: dropped.ok,
-            ...(dropped.ok ? {} : { error: dropped.error.message }),
-            effect: "the space's latest snapshot is gone (removed by a bucket lifecycle rule or by hand) — this run starts from an empty /workspace; its run-end snapshot becomes the new latest",
-        });
+    async dropDangling(target, snapshotId) {
+        const key = `${this.snapshotBase(target)}${snapshotId}.tar.gz`;
+        switch (target.lane) {
+            case "space": {
+                const dropped = await this.writePointer(target.space, "latest", null);
+                this.spaceLine("workspace_latest_dangling", target.space, {
+                    lane: "space",
+                    key,
+                    deleted: dropped.ok,
+                    ...(dropped.ok ? {} : { error: dropped.error.message }),
+                    effect: "the space's latest snapshot is gone (removed by a bucket lifecycle rule or by hand) — this run starts from an empty /workspace; its run-end snapshot becomes the new latest",
+                });
+                return;
+            }
+            case "park":
+                this.snapshotLine("workspace_latest_dangling", {
+                    lane: "park",
+                    key,
+                    ...(this.cfg.sessionId ? { sessionId: this.cfg.sessionId } : {}),
+                    effect: "the parked run's snapshot is gone (removed by a bucket lifecycle rule or by hand) — the resumed leg starts from an empty /workspace" +
+                        (this.spaceLane.state === "open" ? "; its run-end snapshot becomes the space's new latest" : ""),
+                });
+                return;
+            default: {
+                const unreachable = target;
+                throw new Error(`unhandled snapshot lane: ${String(unreachable.lane)}`);
+            }
+        }
     }
     async postResumeInit() {
         if (!this.cfg.s3Snapshot)

package/dist/plugins/remote-shell.js

@@ -157,7 +157,7 @@ export async function runSymlinkChain(absPath, run) {
 const STAGED_FILE = "data";
 const STAGE_DIR_REFUSED_EXIT = 3;
 const STAGE_DIR_UNSEALED_EXIT = 4;
-const STAGE_DIR_UNSEALED_MESSAGE = "sema: the private staging directory could not be made private (chmod 700 failed or did not take effect, or the mode or owner read back differently — the filesystem ignores permission bits or the parent directory carries a default ACL); nothing was staged";
+const STAGE_DIR_UNSEALED_MESSAGE = "sema: the private staging directory could not be made private (chmod 700 failed or did not take effect, the mode or owner read back differently, or an inherited ACL entry could not be removed or read on this platform — the filesystem ignores permission bits or the parent directory carries a default or inheritable ACL); nothing was staged";
 export const STAGE_DIR_LEFT_MARK = "sema: staging directory left behind:";
 export function buildStagingPaths(abs, nonce = randomBytes(6).toString("hex")) {
     const cut = abs.lastIndexOf("/");
@@ -174,7 +174,17 @@ function privateMkdir(dir) {
 }
 function hardenPrivate(dir) {
     const statOf = (gnu, bsd) => `$(stat -c ${gnu} -- ${dir} 2>/dev/null || stat -f ${bsd} -- ${dir} 2>/dev/null)`;
-    return `( chmod -- 700 ${dir} 2>/dev/null && m=${statOf("%a", "%Lp")} && u=${statOf("%u", "%u")} && case "$m" in 700|[1-7]700) [ "$u" = "$(id -u)" ];; *) false;; esac )`;
+    return `( chmod -- 700 ${dir} 2>/dev/null && m=${statOf("%a", "%Lp")} && u=${statOf("%u", "%u")} && case "$m" in 700|[1-7]700) [ "$u" = "$(id -u)" ];; *) false;; esac && ${aclCleared(dir)} )`;
+}
+function aclCleared(dir) {
+    const marker = `ls_out=$(cd ${dir} && ls -ld . 2>&1) && [ -z "$(printf '%s\\n' "$ls_out" | sed -n 2p)" ] && mode_word=\${ls_out%% *} && ` +
+        `case "$mode_word" in d?????????*+*) echo +;; d?????????*) ;; *) false;; esac`;
+    return (`plat=$(uname -s 2>/dev/null) && case "$plat" in ` +
+        `Linux) acl_read() { :; }; acl_strip() { false; };; ` +
+        `Darwin) acl_read() { ls_out=$(cd ${dir} && ls -led . 2>&1) && case "$ls_out" in d?????????*) ;; *) false;; esac && printf '%s\\n' "$ls_out" | sed 1d; }; acl_strip() { chmod -N ${dir}; };; ` +
+        `FreeBSD) acl_read() { ${marker}; }; acl_strip() { setfacl -b ${dir}; };; ` +
+        `SunOS) acl_read() { ${marker}; }; acl_strip() { chmod A- ${dir}; };; ` +
+        `*) false;; esac && acl=$(acl_read 2>/dev/null) && { [ -z "$acl" ] || { acl_strip 2>/dev/null && acl=$(acl_read 2>/dev/null) && [ -z "$acl" ]; }; }`);
 }
 function emptyPrivate(dir) {
     return `[ ! -e ${dir}/${STAGED_FILE} ] && [ ! -L ${dir}/${STAGED_FILE} ]`;

package/dist/plugins/retention-store-sql.d.ts

@@ -387,7 +387,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      * 它的域完全靠「属主 sessionId 的墓碑」推。而会话 id 是**调用方可自选**的 ⇒ 两个租户先后用过同一个 id
      * 完全合法;两边都删过之后,同一个 row_key 上会有**两个域**的墓碑,这时任何一边的 sweep 拿自己的墓碑
      * 去认领这些字节都只是猜。判据因此是:**存在第二个域的同名墓碑 ⇒ 这批行不可归属 ⇒ 一根不删**,
-     * 实体清理退回既有的 TTL 腿(`reapOlderThan`)。少删一次是可接受的;删掉另一个租户的字节、还跳过它的
+     * 实体清理退回既有的 TTL 腿(core `ToolResultStore.reap`)。少删一次是可接受的;删掉另一个租户的字节、还跳过它的
      * legal hold 与审计域,不可接受。
      */
     protected orphanToolResultCandidates(exec: {
@@ -475,7 +475,7 @@ export declare class SqlRetentionStore implements ManagedRetentionCapability {
      *    也只计 `skipped` 不删。会话本体的清理归 {@link SqlRetentionStore.deleteExpiredSessions}(它会连着
      *    这行一起删),两条腿因此不重叠也不互相抢行。
      *  · **一根不碰的那一支**:`owner_session_id IS NULL` 的**无出处**行。没有出处就没有域,按任何域去删它
-     *    都是猜;实体清理归既有的 TTL 腿(`reapOlderThan`,`boot/reapers.ts` 驱动)。这与 core 的
+     *    都是猜;实体清理归既有的 TTL 腿(core `ToolResultStore.reap`,`boot/reapers.ts` 驱动)。这与 core 的
      *    「an UNOWNED entry is never deleted」是同一条纪律的两处执行点。
      *
      * 事务形与另外两只方法逐字同款(hold 哨兵行锁读 → 删除+墓碑 → 审计行,同 commit 同 rollback)。

package/dist/plugins/sandbox-read-floor.d.ts

@@ -5,11 +5,9 @@ export declare const READ_FLOOR_UNAVAILABLE_REASONS: readonly ["arch", "user_not
 export type ReadFloorUnavailableReason = (typeof READ_FLOOR_UNAVAILABLE_REASONS)[number];
 /** F2:附着不过的环境上,带地板起动的拒句(纯字符串 ⇒ `build*`)。首句点名原因词;点名表的首行与旋钮。 */
 export declare function buildReadFloorUnavailableMessage(reason: ReadFloorUnavailableReason, detail: string | undefined, floor: ReadFloor | undefined): string;
-/** F6:守地板的环境上,不带地板的引擎起动的拒句。 */
-export declare function buildReadFloorMissingMessage(lane: SandboxFloorLane): string;
 /**
  * 一次起动是什么(闭集,调用方必须表态 —— 没有缺省臂):
- *  · `engine` —— 经执行环境公共起动口要起的命令(引擎的,或替引擎干活的服务端调用方的);带不带地板是它交来的事实。`hold` = 适配器之后还会以
+ *  · `engine` —— 经执行环境公共起动口要起的命令(引擎的,或替引擎干活的服务端调用方的);它带的地板就是它的表,缺席 = 表无行。`hold` = 适配器之后还会以
  *    同一起动号再起 `run`(k8s 后台作业的轮询 / 停 / 收尾读的是这次起动的产物,按这次起动的地板跑),登记留到 {@link SandboxReadFloor.release};
  *  · `under` —— 以一次已登记(`hold`)起动的号再起一只 `run`(上面那类轮询);
  *  · `adapter` —— 适配器自己的固定命令(文件面助手、探针、数据搬运、全杀);附着成功之后经监督者的 `plain` 起;
@@ -29,7 +27,7 @@ export type FloorStart = {
 };
 export declare const ADAPTER_START: FloorStart;
 export declare const BOOTSTRAP_START: FloorStart;
-/** 引擎起动:`readFloor` 原样交(`undefined` = 这次起动不带地板)。 */
+/** 引擎起动:`readFloor` 原样交(`undefined` = 这次起动的表一行都没有)。 */
 export declare function engineStart(readFloor: ReadFloor | undefined, hold?: boolean): FloorStart;
 /** 起动身份:`root` = 车道以 root 起(e2b `user:"root"`、local-docker `-u 0`);`exec-user` = 车道自己的执行身份(改前的形)。 */
 export type FloorLaunchIdentity = "root" | "exec-user";
@@ -125,8 +123,8 @@ export interface RelayAnswer {
 export declare const UNJUDGED_VERDICT = "read floor: no verdict for this start";
 /** 判官:适配器进程里唯一回答「这条路径拒不拒」的东西。live object ⇒ `create*`。 */
 export interface FloorJudge {
-    /** 登记一次带地板的起动,回它的起动号(随机、不可猜)。`held` ⇒ 之后还会以这个号再起 `run`(`under`),直到 {@link release};否则这一次就是它唯一的起动。 */
-    register(floor: ReadFloor, held: boolean): string;
+    /** 登记一次引擎起动(带它的表;`undefined` = 表无行),回它的起动号(随机、不可猜)。`held` ⇒ 之后还会以这个号再起 `run`(`under`),直到 {@link release};否则这一次就是它唯一的起动。 */
+    register(floor: ReadFloor | undefined, held: boolean): string;
     /** 以这个号再起一次 `run`(`under`)之前问:在册且适配器没说过「不再起」⇒ `true`(记下又有一只监督者将连上);否则 `false`(起动拒)。 */
     launch(startId: string): boolean;
     /** 适配器不会再以这个号起 `run` 了。登记要两件都到才撤(协议 §5.5):这一句 ∧ 此后的 `gone` —— `gone` 已在 ⇒ 当即撤;否则等它(还连着的监督者照旧有判官答)。 */
@@ -202,7 +200,7 @@ export interface SandboxReadFloor {
     readonly state: SandboxReadFloorState;
     /** 这只模块钉住的监督者二进制(守地板 ⇒ 在;裸模块 ⇒ 缺席)。k8s 的 pod 座({@link buildFloorPodSeat})只读它 —— 放进 pod 的与自检核的是同一份钉。 */
     readonly binaries: FloorBinaries | undefined;
-    /** 唯一接缝:一次起动 → 答案,或 `spawn_error`(F2 / F6 / 时机不对的引导起动 / 已撤的号)。 */
+    /** 唯一接缝:一次起动 → 答案,或 `spawn_error`(F2 / 时机不对的引导起动 / 已撤的号)。 */
     wrap(start: FloorStart): Result<FloorLaunch, ExecutionError>;
     /** 适配器不会再以这个号起 `run`(`hold` 起动的收尾)。登记在其后的 `gone` 到时撤(还连着的监督者照旧有判官答)。 */
     release(startId: string | undefined): void;

package/dist/plugins/sandbox-read-floor.js

@@ -35,11 +35,6 @@ export function buildReadFloorUnavailableMessage(reason, detail, floor) {
         `This command carries a read-deny table${first !== undefined ? ` (first row "${first}")` : ""} this sandbox cannot keep, so it is refused rather than run with fewer rows. ` +
         `To run this lane without the byte floor, set ${SANDBOX_READ_FLOOR_ENV}=off (the lane then declares keepsReadFloor=false: each run with read-deny rows is announced, or refused when READ_DENY_FLOOR_REQUIRED=true).`);
 }
-export function buildReadFloorMissingMessage(lane) {
-    return (`read floor: this ${lane} sandbox keeps the read-deny byte floor, and this command start carries no floor — it is refused rather than run a process the floor does not judge ` +
-        `(every start on a lane that keeps the floor must carry the run's read-deny table). ` +
-        `To run this lane without the byte floor, set ${SANDBOX_READ_FLOOR_ENV}=off.`);
-}
 export const ADAPTER_START = Object.freeze({ kind: "adapter" });
 export const BOOTSTRAP_START = Object.freeze({ kind: "bootstrap" });
 export function engineStart(readFloor, hold = false) {
@@ -121,6 +116,8 @@ export function parseRelayFrame(line) {
 }
 export const UNJUDGED_VERDICT = "read floor: no verdict for this start";
 function judgeOne(floor, path) {
+    if (floor === undefined)
+        return null;
     let v;
     try {
         v = floor.denies(path);
@@ -433,8 +430,6 @@ export function createKeptSandboxReadFloor(opts) {
                 }
                 case "engine": {
                     const floor = start.readFloor;
-                    if (floor === undefined)
-                        return spawnError(buildReadFloorMissingMessage(lane));
                     if (phase.kind === "unavailable")
                         return spawnError(buildReadFloorUnavailableMessage(phase.reason, phase.detail, floor));
                     if (phase.kind !== "ready" || bin === undefined)

package/dist/plugins/schema-consistency.d.ts

@@ -73,7 +73,11 @@ export interface ParsedTable {
 export declare function parseCreateTable(stmt: string): ParsedTable | undefined;
 /** 启动时真会建出来的**全部**表形(录制 → 解析)。同名表二次出现以**先到**为准(`IF NOT EXISTS` 的真语义)。 */
 export declare function expectedTableShapes(dialect: SqlDialect): Promise<Map<string, ParsedTable>>;
-/** 拒启码(机读)。附录 A / 拒启码表的登记名。 */
+/**
+ * 拒启码(机读)。附录 A / 拒启码表的登记名。含义 = 「本构建读不出的持久形,开始服务之前判」,一个码三只臂:本文件的列册对账与退役 schema 两道(SQL),
+ * 以及 local 数据根的严格边档对账(`local-session-store.ts` 的 `LocalDataRootSchemaMismatchError`,`LocalBackend.ensureSchema()` 调;拒句同形:
+ * 码开头的表头 · 逐坐标一段 · 「NEWER than this build」方向句 · 闭集出路)。
+ */
 export declare const SCHEMA_MISMATCH_ERROR_CODE = "config.schema_mismatch";
 /** 一张表的对账结论。 */
 export interface TableMismatch {

package/dist/plugins/session-fork.d.ts

@@ -28,7 +28,7 @@ export interface ForkLogRow {
     readonly ts: unknown;
 }
 /**
- * 两只 SQL 孪生的行怎么交给引擎的 `selectForkRows`(按答案挑行 + 新会话的叶;分叉点不在日志里 ⇒ `invalid_fork_target`、路径中途悬空父 / 父链成环 ⇒ `invalid_session`,
+ * 两只 SQL 孪生的行怎么交给引擎的 `selectForkRows`(按答案挑行 + 新会话的叶;分叉点不在日志里 ⇒ `invalid_fork_target`、路径中途悬空父 / 父链成环 ⇒ `corrupt_session`〔core 7.61.x 及以前 `invalid_session`〕,
  * 引擎的原词原句)。本仓不再自写父链走法 —— 那曾是与引擎 `getPathToRoot` 同义的第二份。
  */
 export declare const FORK_LOG_ROW_SHAPE: ForkRowShape<ForkLogRow>;

package/dist/plugins/session-ownership.d.ts

@@ -22,6 +22,15 @@ export declare function forkOwnerOf(requested: string | null | undefined, source
  * 「首写」由调用方判(已记下属主的会话上的调用照旧静默不改,不经这里)。判官 = {@link isSessionOwnerValue}(core 7.56.0 [ref] `principalNameOf`)。
  */
 export declare function assertFirstOwnerWritable(sessionId: string, owner: unknown): asserts owner is string | null;
+/**
+ * placed 行属主格的唯一读法(core 7.62.0 [ref] 盒义务 7;三只持久会话店的 placing write 同调):记下的属主 = 引擎交来的 `placement.owner` **原样** ——
+ * 委派树的属主由引擎判(没人派生的 run 读自己那一行、按化身绑一次,原样带给每一层子代;`null` = 根匿名),店只记、不判、不推断,也不进元组
+ * (`SessionPlacementRecord` 没有属主)。值不是主体名也不是 `null`(空串、空白、缺席 —— 绕过类型的调用)⇒ 响亮拒(`SessionError("storage")`,一个字节不写):
+ * 一只谁也不指的属主会让行要么谁都读得到、要么谁都读不到。判官 = {@link isSessionOwnerValue},与 `register` 首写同一只。
+ */
+export declare function placedSessionOwnerOf(sessionId: string, placement: {
+    readonly owner?: unknown;
+}): string | null;
 /**
  * 导入者的属主 —— 换装的写腿(公开 `importEntries` / `replaceEntries` 与暂存提交)把调用方给的属主重戳进会话行之前的唯一读法:
  * 主体名或 `null`(匿名)⇒ 原样交回;别的一切(空串、空白串、带控制 / 分隔 / 非连接符格式字符的串、非串)⇒ `TypeError` 响亮拒 ——

package/dist/plugins/session-ownership.js

@@ -22,6 +22,12 @@ export function assertFirstOwnerWritable(sessionId, owner) {
     throw new SessionError("storage", `register(${sessionId}): a first ownership write must carry a principal name or null (anonymous), got ${ownerValueFault(owner)} — ` +
         "a value that names nobody would leave the session claimable by anyone or ownable by no one; refusing, nothing written");
 }
+export function placedSessionOwnerOf(sessionId, placement) {
+    const owner = placement.owner;
+    if (isSessionOwnerValue(owner))
+        return owner;
+    throw new SessionError("storage", `acquire(${sessionId}): a placed session's owner (placement.owner, the delegation tree's owner the engine judged) must be a principal name or null (an anonymous tree), got ${ownerValueFault(owner)} — refusing, nothing written`);
+}
 export function importerOwnerOf(owner) {
     if (isSessionOwnerValue(owner))
         return owner;