@sema-agent/server 7.145.0 → 7.147.0

package/dist/boot/execution-lane.js

@@ -1,16 +1,62 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { buildReadDenyFloorUnkeptNote, executionLaneOf, laneIsolated } from "../execution-lane-caps.js";
+import { entryDeclarableRemoteExec } from "../config.js";
+import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 import { seatText } from "../trace/exit-seat.js";
-export const FILE_SOURCED_LANES = ["host", "local-docker"];
-export async function composeExecutionLane(config, ctx) {
+export const FILE_SOURCED_LANES = ["host", "local-docker", "none"];
+export const EXECUTION_LANE_UNDECLARED_REFUSAL = (() => {
+    const sandboxLanes = ALL_EXECUTION_LANES.filter((lane) => laneIsolated(lane));
+    const otherHandLanes = ALL_EXECUTION_LANES.filter((lane) => lane !== "host" && laneWiresExecutionEnv(lane) && !laneIsolated(lane));
+    return ("No execution lane is declared — every deployment names its execution lane: set REMOTE_EXEC (with CONFIG_PROVIDER=local, config.d/remote-exec.json also declares it). " +
+        "To keep what this deployment did before 7.147.0: REMOTE_EXEC=none when CONFIG_PROVIDER is not \"local\" (no execution environment — the agent's tool hands never mount), " +
+        "REMOTE_EXEC=host when CONFIG_PROVIDER=local (tools run directly on this machine with no OS sandbox). " +
+        `Or name a sandbox lane (${sandboxLanes.join(" | ")}) or ${otherHandLanes.join(" | ")} with that lane's required env. ` +
+        "CONFIG_PROVIDER only selects where configuration is read from; it does not select an execution lane.");
+})();
+export const HTTP_SERVICE_LANE_ENTRY = { name: "the HTTP service", runs: ALL_EXECUTION_LANES };
+function entryCannotRunLaneRefusal(entry, lane, source) {
+    return (`${source} declares the execution lane "${lane}", but ${entry.name} runs only ${entry.runs.join(" / ")} — it has no executor for "${lane}". ` +
+        `Refusing before any task starts rather than run on another lane: declare a lane ${entry.name} runs, or serve "${lane}" from an entry that runs it (the HTTP service runs every lane).`);
+}
+function fileLaneUnresolvableRefusal(entry, lane, envReading, root) {
+    return (`config.d/remote-exec.json under ${root} declares the execution lane "${lane}", but ${entry.name} reads "${lane}"'s coordinates only from REMOTE_EXEC env ` +
+        `(file-source name→value resolution is not wired yet), and ${envReading}. The file's declaration ends the lane selection: no other declaration may stand in for it. ` +
+        `Refusing before any task starts: set REMOTE_EXEC=${lane} with that lane's required env, or change the file to the lane you mean.`);
+}
+export async function composeExecutionLane(loaded, ctx) {
     if (ctx.configSource === "local")
-        await applyRemoteExecFile(config, ctx);
-    settleReadFaceForFinalLane(config, ctx.logger);
+        await applyRemoteExecFile(loaded, ctx);
+    return composeDeclaredExecutionLane(loaded, ctx.logger, ctx.entry);
+}
+export function composeDeclaredExecutionLane(loaded, logger, entry) {
+    if (entry !== undefined)
+        settleEntryLane(loaded, entry);
+    const config = requireDeclaredExecutionLane(loaded);
+    settleReadFaceForFinalLane(config, logger);
     assertExecutionLaneInvariants(config);
+    logger.info("exec_lane_selected", { lane: config.remoteExec.provider });
+    return config;
+}
+function requireDeclaredExecutionLane(loaded) {
+    if (!isComposed(loaded))
+        throw new Error(EXECUTION_LANE_UNDECLARED_REFUSAL);
+    return loaded;
+}
+function settleEntryLane(loaded, entry) {
+    const declaredByEntry = !isComposed(loaded) ? entry.declares : undefined;
+    if (declaredByEntry !== undefined)
+        loaded.remoteExec = entryDeclarableRemoteExec(declaredByEntry);
+    if (!isComposed(loaded))
+        return;
+    const lane = loaded.remoteExec.provider;
+    if (!entry.runs.includes(lane))
+        throw new Error(entryCannotRunLaneRefusal(entry, lane, declaredByEntry !== undefined ? `${entry.name} itself` : `REMOTE_EXEC=${lane}`));
+}
+function isComposed(config) {
+    return config.remoteExec !== undefined;
 }
 function settleReadFaceForFinalLane(config, logger) {
     if (!settleDerivedReadFace(config, config.requirePrincipal !== true))
@@ -20,14 +66,14 @@ function settleReadFaceForFinalLane(config, logger) {
         logger.info(notice.event, notice.fields);
 }
 export async function settleHostLaneShell(config, logger) {
-    if (config.remoteExec?.provider !== "host")
+    if (config.remoteExec.provider !== "host")
         return;
     await settleHostShellAtBoot(logger);
 }
 export function warnReadDenyFloorUnkept(config, logger) {
     const note = buildReadDenyFloorUnkeptNote(config);
     if (note !== undefined)
-        logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec?.provider, note });
+        logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec.provider, note });
 }
 export function assertExecutionLaneInvariants(config) {
     const judge = (id) => crossInvariant(id).check({ live: config, next: config });
@@ -61,11 +107,12 @@ async function applyRemoteExecFile(config, ctx) {
     }
     if (!fileRx)
         return;
-    const preemptedLane = executionLaneOf(config.remoteExec?.provider);
-    const disclosePreemption = (winner) => {
+    const envDeclared = config.remoteExec?.provider;
+    const disclosePreemption = envDeclared === undefined ? (_winner) => { } : (winner) => {
+        const preemptedLane = envDeclared;
         if (winner === preemptedLane)
             return;
-        const downgrade = laneIsolated(preemptedLane) && !laneIsolated(winner);
+        const downgrade = laneIsolated(preemptedLane) && laneWiresExecutionEnv(winner) && !laneIsolated(winner);
         logger.warn("remote_exec_lane_preempted_by_file", {
             preemptedLane,
             effectiveLane: winner,
@@ -76,7 +123,7 @@ async function applyRemoteExecFile(config, ctx) {
                 (downgrade ? `. This is an ISOLATION DOWNGRADE: tasks run on a non-isolated target. Delete/fix the file, or unset the lane env if the file is the intended source.` : `. Delete/fix the file, or unset the lane env if the file is the intended source.`),
         });
     };
-    const drives = (lane) => ctx.drivesFromFile.includes(lane);
+    const drives = (lane) => ctx.entry.runs.includes(lane);
     if (fileRx.provider === "host" && drives("host")) {
         config.remoteExec = {
             provider: "host",
@@ -100,18 +147,25 @@ async function applyRemoteExecFile(config, ctx) {
         logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
         return;
     }
+    if (fileRx.provider === "none" && drives("none")) {
+        config.remoteExec = { provider: "none" };
+        disclosePreemption("none");
+        logger.info("remote_exec_from_file", { provider: "none", root: localRoot });
+        return;
+    }
     const fileLane = fileRx.provider;
-    const sourceable = FILE_SOURCED_LANES.some((lane) => lane === fileLane);
+    if (!ctx.entry.runs.includes(fileLane))
+        throw new Error(entryCannotRunLaneRefusal(ctx.entry, fileLane, `config.d/remote-exec.json under ${localRoot}`));
+    if (envDeclared !== fileLane) {
+        const envReading = envDeclared === undefined ? "REMOTE_EXEC is not set" : `REMOTE_EXEC declares "${envDeclared}"`;
+        throw new Error(fileLaneUnresolvableRefusal(ctx.entry, fileLane, envReading, localRoot));
+    }
     logger.warn("remote_exec_file_isolated_lane_unwired", {
         provider: fileLane,
-        effectiveLane: preemptedLane,
-        reason: sourceable ? "entry-has-no-executor" : "needs-name-resolution",
-        note: sourceable
-            ? `config.d/remote-exec.json names "${fileLane}", but this entry has no executor for it (it drives ${ctx.drivesFromFile.join(" / ")} ` +
-                `from the file; the HTTP service drives ${FILE_SOURCED_LANES.join(" / ")}) — the env-derived lane above stays in force`
-            : `this entry drives ${ctx.drivesFromFile.join(" / ")} from config.d/remote-exec.json; "${fileLane}" (like the other isolated lanes ` +
-                `e2b / k8s / ssh / adb) is sourced from REMOTE_EXEC env until file-source NAME→value resolution lands (center field map) — the ` +
-                `env-derived lane above stays in force`,
+        reason: "needs-name-resolution",
+        note: `config.d/remote-exec.json and REMOTE_EXEC both declare "${fileLane}": this entry takes ${FILE_SOURCED_LANES.filter((lane) => ctx.entry.runs.includes(lane)).join(" / ")} ` +
+            `from the file; "${fileLane}" (like the other isolated lanes e2b / k8s / ssh / adb) takes its coordinates from REMOTE_EXEC env until file-source NAME→value ` +
+            `resolution lands (center field map) — the coordinates written in the file for it are not read`,
     });
 }
 //# sourceMappingURL=execution-lane.js.map

package/dist/boot/exit-boundary.d.ts

@@ -1,4 +1,49 @@
+/**
+ * [ref] —— **进程退出边界**的装配器:全进程**一只**,两条车道(HTTP 服务 / `run-local` 一次性 CLI)同走。
+ *
+ * 不变量 = **本进程拥有的东西不得活过本进程**(自起的前台子进程组 + 自铸的 ephemeral host 工作区)。
+ * 它是**进程**的性质,不属于某一条退出路径,也不属于某一个入口 —— 所以收割挂 `process.once("exit")`,
+ * 而这只钩的**装配**从 `boot/shutdown.ts`(只有 HTTP 车道装得起:它的 ctx 绑着 server / backend / runner…)
+ * 抽到这里,变成一条只要一只 {@link Logger} 的函数。
+ *
+ * ── [ref] 的病(test 7.93.3 复验实测)────────────────────────────────────────────────────────────────
+ * [ref] 之后 HTTP 车道零孤儿,而 `src/run-local.ts` **一只 `process.on/once` 都没有** —— 它却经
+ * `hostExecutionEnvFactory` 走同一条 host exec 腿、同一本前台簿(`trackHostForegroundChild`)。Ctrl-C ⇒
+ * 进程在 12ms 内被信号**默认终止**,簿上的组留 `ppid=1` 跑满。用户面:一次 `sema run` 被 Ctrl-C 之后,
+ * 机器上留着它起的 `npm run build` / `sleep`,没有任何人会再去 kill。
+ *
+ * ── 为什么不是「run-local 也补一份」──────────────────────────────────────────────────────────────────
+ * 同一句不变量在两个入口各写一份 = 两个写者、两份会各自腐烂的注(CLAUDE.md 以点改面:修一个类,不是
+ * 修一个出口)。所以是**抽出**而不是复制:钩体、两条腿、哨兵读数、`dispose` 全在本文件,两条车道各自
+ * 只剩一行调用。HTTP 车道的行为**逐字不变**(函数体整段搬运,缩进外无一字改动)。
+ *
+ * 🔴 **光有本装配器治不了 run-local**:`exit` 事件在进程被信号**默认终止**时**不触发**。前台 CLI 的
+ * Ctrl-C 是常态 ⇒ run-local 必须同时装 SIGINT / SIGTERM 处理器,让信号落到一条显式 `process.exit` 上
+ * (见 `run-local.ts` 的 {@link installRunLocalExitBoundary} 注:退出码取 128+signo 的理由写在那里)。
+ * HTTP 车道的三只信号处理器留在 `boot/shutdown.ts`(它们承载的是 drain / SIGHUP 空闲窗这些**车道语义**,
+ * 不是退出边界)。
+ */
+import { type TaskRegistry } from "@sema-agent/core";
 import type { Logger } from "../observability/logger.js";
+/**
+ * 退出边界的硬收面**此刻**会收掉的后台 shell 行数(`background_bash` + `monitor`,在跑,整张进程级注册表,retain 行按
+ * {@link PROCESS_EXIT_INCLUDES_RETAINED} 跳过)—— 「引擎现在退,会不会把一条在跑的后台 shell 一起收掉」这一问的**唯一**读法。
+ *
+ * 一问一源:数与收读同一只 `includeRetained` 常量,core 的 `countRunningBackgroundShells` 与 `killAllBackgroundShellsNow` 又按同一只访问函数选行
+ * (core 注:the count and the walk cannot drift)⇒ 这只数就是硬收面会交出的 `killed` 收据数。
+ * **不是** `/health.inflightBreakdown.sessionResident`(`session-resident-background.ts`):那一项回答「引擎托管着多少会话驻留的 shell / monitor」,是总数里的一个分项 ——
+ * 只数围栏表里会话的、会话驻留的行(挂在 run 腿上的行算在 http 项里,数它是第二次;围栏外的会话它看不见);本函数整表数、不分会话,
+ * 腿上的行、围栏外会话的行都在内。两问的关系 = 读得出时本数 ≥ 驻留项(驻留项的每一行都是本数的一行)。
+ *
+ * 读不出(core:某行 env 的 retain 声明读抛 ⇒ 计数抛)⇒ 按 **1** 计并经 `onUnreadable` 报出 —— 读不出 ⇒ 非空闲,与驻留项同一条律;
+ * 本函数在租约拍(定时器回调)、`/health` 与交接口里被调,**不许抛**(定时器里一抛就是 uncaught,一台交接出去的引擎会因此崩掉并收掉它本该留着的 shell)——
+ * 报口自己再抛(抛出物转不成文本之类)也一样:落 `console.error`(不回同一只报口),读数照返 1。
+ * `registry` 只供测试换桩(只用到 `countRunningBackgroundShells`)。
+ */
+export declare function countShellsExitWouldKill(opts: {
+    readonly registry?: Pick<TaskRegistry, "countRunningBackgroundShells">;
+    readonly onUnreadable: (err: unknown) => void;
+}): number;
 /** {@link installProcessExitBoundary} 的把手。 */
 export interface ProcessExitBoundary {
     /**
@@ -8,6 +53,11 @@ export interface ProcessExitBoundary {
      * 返回本次软停的后台行数(core `reapAllSessionBackground` 的返回;腿抛错 ⇒ 0,warn 已记)—— 调用方据此决定欠不欠宽限。
      */
     reapChildProcessesEarly(): number;
+    /**
+     * 硬收面此刻会收掉的后台 shell 行数({@link countShellsExitWouldKill},进程级注册表)。读不出 ⇒ 按 1 计,运维行
+     * `engine_handover_shell_count_unreadable` 本装配**只响一次**(这只读口在租约拍里被调,逐次响会刷屏)。附着租约交接车道那一格工作谓词读它。
+     */
+    shellsExitWouldKill(): number;
     /** 摘掉本次装配的 `exit` 钩。幂等(同进程内反复装配的调用方=测试必须用它收尾)。 */
     dispose(): void;
 }

package/dist/boot/exit-boundary.js

@@ -4,6 +4,21 @@ import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plu
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
 import { seatText } from "../trace/exit-seat.js";
 const PROCESS_EXIT_INCLUDES_RETAINED = false;
+export function countShellsExitWouldKill(opts) {
+    const registry = opts.registry ?? defaultTaskRegistry;
+    try {
+        return registry.countRunningBackgroundShells({ includeRetained: PROCESS_EXIT_INCLUDES_RETAINED });
+    }
+    catch (err) {
+        try {
+            opts.onUnreadable(err);
+        }
+        catch (reportErr) {
+            console.error("engine_handover_shell_count_report_threw", reportErr);
+        }
+        return 1;
+    }
+}
 export function installProcessExitBoundary({ logger }) {
     const reapOwnChildProcesses = () => {
         let backgroundSoftStopped = 0;
@@ -81,8 +96,25 @@ export function installProcessExitBoundary({ logger }) {
     };
     process.once("exit", onProcessExit);
     let disposed = false;
+    let shellCountUnreadableReported = false;
+    const shellsExitWouldKill = () => countShellsExitWouldKill({
+        onUnreadable: (err) => {
+            if (shellCountUnreadableReported)
+                return;
+            shellCountUnreadableReported = true;
+            let text;
+            try {
+                text = String(err);
+            }
+            catch {
+                text = Object.prototype.toString.call(err);
+            }
+            logger.warn("engine_handover_shell_count_unreadable", { counted: 1, err: seatText("operator-log-text", text) });
+        },
+    });
     return {
         reapChildProcessesEarly: reapOwnChildProcesses,
+        shellsExitWouldKill,
         dispose: () => {
             if (disposed)
                 return;

package/dist/boot/exit-last.d.ts

@@ -1,10 +1,18 @@
 import { z } from "zod";
+/** 本构建写的格式号([ref] 抬到 2;[ref] 抬到 3:必填 `lane`,退 `orphan` / `firstAttachWindowExpired`)。格式 1 = 无 `format` 键的旧形。 */
+export declare const EXIT_LAST_FORMAT = 3;
 /** 读回 schema(宪法 [ref] §2:边界读一律 safeParse,不裸铸)。写侧同形。 */
 declare const ExitLastSchema: z.ZodObject<{
+    format: z.ZodLiteral<3>;
     at: z.ZodString;
     version: z.ZodString;
     pid: z.ZodNumber;
-    orphan: z.ZodBoolean;
+    lane: z.ZodEnum<{
+        orphan: "orphan";
+        handover: "handover";
+        awaitingFirstAttach: "awaitingFirstAttach";
+        owned: "owned";
+    }>;
     reason: z.ZodString;
     idleForMs: z.ZodNumber;
     attached: z.ZodNumber;
@@ -15,9 +23,17 @@ declare const ExitLastSchema: z.ZodObject<{
 export type ExitLastInfo = z.infer<typeof ExitLastSchema>;
 export declare function exitLastPath(dataRoot: string): string;
 /** 自退那一刻写留痕(同步;自身绝不抛 —— 留痕写失败不得阻塞停机)。 */
-export declare function writeExitLast(dataRoot: string, info: Omit<ExitLastInfo, "at" | "pid">): void;
-/** boot 读回:在场读回、缺席/坏字节/坏形回 `undefined`(绝不抛 —— 留痕坏了不能挡启动)。 */
-export declare function readExitLast(dataRoot: string): ExitLastInfo | undefined;
+export declare function writeExitLast(dataRoot: string, info: Omit<ExitLastInfo, "format" | "at" | "pid">): void;
+/** {@link readExitLast} 的读数:本构建格式读成了 ⇒ `found`;文件格式号不是 {@link EXIT_LAST_FORMAT} ⇒ `formatMismatch`(契约 6)。 */
+export type ExitLastReading = {
+    readonly kind: "found";
+    readonly info: ExitLastInfo;
+} | {
+    readonly kind: "formatMismatch";
+    readonly fileFormat: number;
+};
+/** boot 读回:本构建格式读回 `found`、别的格式号回 `formatMismatch`;缺席/坏字节/本格式坏形回 `undefined`(绝不抛 —— 留痕坏了不能挡启动)。 */
+export declare function readExitLast(dataRoot: string): ExitLastReading | undefined;
 /** 读回并报过之后即清(幂等,缺席零抛):在场 ⇔ **上一次**退出是自退。 */
 export declare function clearExitLast(dataRoot: string): void;
 export {};

package/dist/boot/exit-last.js

@@ -1,11 +1,15 @@
 import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
+import { ENGINE_LANES } from "./engine-lease.js";
+import { OWNER_ONLY_FILE_MODE } from "../plugins/owner-only-file-mode.js";
+export const EXIT_LAST_FORMAT = 3;
 const ExitLastSchema = z.object({
+    format: z.literal(EXIT_LAST_FORMAT),
     at: z.string(),
     version: z.string(),
     pid: z.number(),
-    orphan: z.boolean(),
+    lane: z.enum(ENGINE_LANES),
     reason: z.string(),
     idleForMs: z.number(),
     attached: z.number(),
@@ -18,19 +22,33 @@ export function exitLastPath(dataRoot) {
 }
 export function writeExitLast(dataRoot, info) {
     try {
-        const body = { at: new Date().toISOString(), pid: process.pid, ...info };
-        writeFileSync(exitLastPath(dataRoot), JSON.stringify(body) + "\n");
+        const body = { format: EXIT_LAST_FORMAT, at: new Date().toISOString(), pid: process.pid, ...info };
+        writeFileSync(exitLastPath(dataRoot), JSON.stringify(body) + "\n", { mode: OWNER_ONLY_FILE_MODE });
     }
     catch {
     }
 }
+function fileFormatOf(raw) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+        return undefined;
+    if (!Object.hasOwn(raw, "format"))
+        return 1;
+    const f = raw.format;
+    return typeof f === "number" && Number.isSafeInteger(f) ? f : undefined;
+}
 export function readExitLast(dataRoot) {
     try {
         const p = exitLastPath(dataRoot);
         if (!existsSync(p))
             return undefined;
-        const parsed = ExitLastSchema.safeParse(JSON.parse(readFileSync(p, "utf8")));
-        return parsed.success ? parsed.data : undefined;
+        const raw = JSON.parse(readFileSync(p, "utf8"));
+        const fileFormat = fileFormatOf(raw);
+        if (fileFormat === undefined)
+            return undefined;
+        if (fileFormat !== EXIT_LAST_FORMAT)
+            return { kind: "formatMismatch", fileFormat };
+        const parsed = ExitLastSchema.safeParse(raw);
+        return parsed.success ? { kind: "found", info: parsed.data } : undefined;
     }
     catch {
         return undefined;

package/dist/boot/governance-seams.d.ts

@@ -48,7 +48,7 @@
  *
  * ## 件D 的边界(成文,别读成「数据会被删」)
  *
- * 三只被托管的 SQL 店(session / checkpoint / tool-result)的 `retention` 声明读一个事实 —— 留存扫车道开不开(`plugins/retention-store-sql.ts` 的
+ * 三只被托管的 SQL 店(session / checkpoint / tool-result)的 `retention` 声明读一个事实 —— 留存扫车道开不开(`plugins/retention-declaration.ts` 的
  * `retentionSweepRuns`):开 ⇒ `managed`,关(缺省)⇒ `none`;local 形的店恒声明 `none`。删除的执行面是扫车道(`boot/retention-lane.ts`)与 SQL 店上的
  * 执行器,不在本装配点。所以本装配点对件D 只做两件事:①把策略与执行器递给 core 的启动期校验
  * (`assertRetentionCapability` —— 配对由引擎一个判官判:店声明 `managed` 而部署不跑执行器、执行器不是执行器,锁不锁都拒;锁着 + 店不能删 ⇒ 拒启,
@@ -83,7 +83,7 @@ export interface GovernanceSeamsCtx {
     /**
      * 交给引擎启动检查的留存执行器 —— 本部署跑扫车道 ⇒ 那只执行器(`backend.retention`),不跑 ⇒ `null`(必填:漏递即编译红,
      * 引擎对 `undefined` 也拒启)。「店说 managed」与「有执行器」的配对由引擎一个判官判(引擎 7.58.0:锁不锁都判);
-     * 店的词与这一格读同一个事实(`retention-store-sql.ts` 的 `retentionSweepRuns`),本仓不再另判一遍。
+     * 店的词与这一格读同一个事实(`retention-declaration.ts` 的 `retentionSweepRuns`),本仓不再另判一遍。
      */
     retentionExecutor: ManagedRetentionCapability | null;
 }

package/dist/boot/governance-seams.js

@@ -54,6 +54,7 @@ const DENY_CONFLICTS = {
     },
     workflows: null,
     org_memory_mount: null,
+    memory_consolidation: null,
 };
 function resolveGovernanceDeclarations(config) {
     return {

package/dist/boot/leader.js

@@ -34,7 +34,7 @@ export function createLeaderFace(ctx) {
             },
         }
         : {};
-    const leaderProvider = config.remoteExec?.provider;
+    const leaderProvider = config.remoteExec.provider;
     const leaderRunStore = ctx.backend?.leaderRun?.();
     assertLeaderDurableStore(config.leaderEnabled, leaderRunStore !== undefined);
     const minioGap = leaderK8sMinioGap(config.leaderEnabled, leaderProvider, "s3" in leaderMinio);

package/dist/boot/memory-boundary.d.ts

@@ -14,9 +14,9 @@
  * 这条链**结构上**走不通」——那句必须说出来。围栏根算不出来时**不说话**(判不了就闭嘴,别把猜测当告警)。
  *
  * 🔴 **已登记的判据限度(不在本批射程,别把它读成「判据已闭合」)**:② 号 warn 今天唯一算得出围栏根的
- * 腿是 `REMOTE_EXEC` 未设的 in-process 形(`boot/stores.ts` 的 `containmentRoots`),而**恰恰是这条腿
+ * 腿是无手的 `none` 形(`boot/stores.ts` 的 `containmentRoots`),而**恰恰是这条腿
  * 没有文件工具** —— 亲读装的这台 core:`prepare-execution-env.js` 的
- * `handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined`,本仓不设 `REMOTE_EXEC` 时
+ * `handsEnabled = ownedEnv !== undefined || deps.executionEnv !== undefined`,`REMOTE_EXEC=none` 时
  * `executionEnvFactory` 恒 `undefined` ⇒ `handsEnabled=false` ⇒ `prepareHandsMount` 整个不跑。所以这条
  * warn 描述的失败形(「模型照提示词去 Write,拿回 `path_not_in_root`」)在该腿上并不成立:真相是**一只
  * 文件工具都没有**,而按它给的第一条恢复路径(把根挪进 workspace)会让 warn 闭嘴却仍然写不成。
@@ -54,7 +54,7 @@
  * `TaskSpec.memoryPersistenceCapable` 一条路进去(`boot/resolve-spec.ts` 直通),我方显式**不铸**受限会话、
  * 也**不投**这个读面(硬造一个消费点 = 造给自己看的 wire 键)。哪天真要在诊断面露它,先有消费方需求。
  */
-import { type ExecutionLane, type RemoteExecProvider } from "../execution-lane-caps.js";
+import { type ExecutionLane } from "../execution-lane-caps.js";
 import type { MemoryEngineBackend } from "@sema-agent/settings-schema/execution-lanes";
 /** boot 期可知的全部事实。每一位都必须由调用点从真配置/真装配结果取,禁在本模块内重算(重算=第二真源)。 */
 export interface MemoryWriteBoundaryFacts {
@@ -66,9 +66,9 @@ export interface MemoryWriteBoundaryFacts {
      *  core 7.16.0([ref])之后写家还要再深一层(`<平面>/<label>`),但 label 归引擎注册簿,boot 期说不出口;
      *  平面是**包含关系上等价**的那一只(家恒为平面的直接子目录),所以判据停在平面,不猜 label。 */
     memoryRoot: string | undefined;
-    /** 执行车道名,只进文案(归一读口 `executionLaneOf` 的答案;[ref] 起不在调用点手写 `?? "in-process"`)。 */
+    /** 执行车道名,只进文案(已合成配置上的车道词,直读)。 */
     lane: ExecutionLane;
-    /** 该车道的路径是不是本机的文件(执行环境块 `hostLocalPaths`:in-process 的桩块 / `REMOTE_EXEC=host` 为真)。false = 沙箱 / 远端 / 设备盘,
+    /** 该车道的路径是不是本机的文件(执行环境块 `hostLocalPaths`:`none` 的桩块 / `REMOTE_EXEC=host` 为真)。false = 沙箱 / 远端 / 设备盘,
      *  与记忆根分平面 —— 引擎在这一形上不教 `# Memory` 写指令(除非部署声明 `memoryPersistenceCapable: true`),判的是同一键。 */
     hostSemanticsLane: boolean;
     /** 部署声明 `MEMORY_PERSISTENCE_CAPABLE`(三态)。两极都让本模块闭嘴,但理由不同 —— 见各臂注释。 */
@@ -84,16 +84,16 @@ export interface MemoryWriteBoundaryFacts {
 }
 /**
  * 审计的**车道三位**由本函数派生(boot/stores.ts 的装配点只调它,不就地手写):
- *  · `lane` ⇐ 归一读口 `executionLaneOf`;
+ *  · `lane` ⇐ 已合成配置上的车道词;
  *  · `hostSemanticsLane` ⇐ 执行环境块 `hostLocalPaths`(唯一作者 `capabilitiesFor`;引擎撤不撤写指令读的是同一键);
- *  · `containmentRoots` ⇐ 只有 in-process 给得出(见下)。
+ *  · `containmentRoots` ⇐ 只有无手车道(`none`)给得出(见下)。
  * `processCwd` 由调用点传(stores 传 `process.cwd()`),本函数保持纯。
  */
 export declare function buildMemoryBoundaryLaneFacts(config: {
-    readonly remoteExec?: {
-        readonly provider: RemoteExecProvider;
+    readonly remoteExec: {
+        readonly provider: ExecutionLane;
         readonly s3Snapshot?: unknown;
-    } | undefined;
+    };
 }, processCwd: string): Pick<MemoryWriteBoundaryFacts, "lane" | "hostSemanticsLane" | "containmentRoots">;
 /** 一条启动告警:`tag` 进日志事件名(可被运维按名过滤/告警),`detail` 是给人读的整句(含恢复路径)。 */
 export interface MemoryWriteBoundaryWarning {
@@ -106,7 +106,7 @@ export interface MemoryWriteBoundaryWarning {
  * ① **路径不是本机的车道**(块 `hostLocalPaths` 为假:沙箱 / 远端 / 设备;记忆引擎在这里只可能因为 `MEMORY_ENGINE_REMOTE_LANE=allow`
  *    或 DB 记忆面才在):引擎不教 `# Memory` 写指令(手带够不着本机的记忆根),官方恢复路径是声明 `memoryPersistenceCapable: true`。
  *    未声明 ⇒ 点名 warn,把恢复旋钮写进句子里。
- * ② **路径是本机的车道**(in-process / host):记忆根不在任何一个已知围栏根内 ⇒ 模型被教着往一个 fs 工具够不到的路径写。
+ * ② **路径是本机的车道**(none / host):记忆根不在任何一个已知围栏根内 ⇒ 模型被教着往一个 fs 工具够不到的路径写。
  *
  * 两极声明都让本模块闭嘴,但理由不同,别合并:
  *  · `true` = operator 自证有推断看不见的持久通道(共享挂载 / 自定义 writer),我们的结构判断本就不该

package/dist/boot/memory-boundary.js

@@ -1,11 +1,11 @@
 import { resolve } from "node:path";
-import { capabilitiesFor, executionLaneOf } from "../execution-lane-caps.js";
+import { capabilitiesFor } from "../execution-lane-caps.js";
 export function buildMemoryBoundaryLaneFacts(config, processCwd) {
-    const lane = executionLaneOf(config.remoteExec?.provider);
+    const lane = config.remoteExec.provider;
     return {
         lane,
         hostSemanticsLane: capabilitiesFor(config).hostLocalPaths,
-        containmentRoots: lane === "in-process" ? [processCwd] : [],
+        containmentRoots: capabilitiesFor(config).io ? [] : [processCwd],
     };
 }
 function isInside(child, root) {