@sema-agent/server 7.146.0 → 7.148.0

package/dist/bake-runner/main.js

@@ -1,12 +1,14 @@
 import { spawn } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { createLogger } from "../observability/logger.js";
+import { createEgressFetch } from "../egress-redirect.js";
 import { logConfigDiagnostics, parseEnvNameAllowlist, parseNumOrFailNonNegative } from "../config.js";
 import { installSecretEnvScrubRecorder } from "../observability/secret-env-scrub.js";
 import { declareServerWithheldEnv, hostSubprocessEnv } from "../server-secret-env.js";
 import { shellQuote as shellSafe } from "../plugins/remote-shell.js";
 import { echoCallerText } from "../caller-text-echo.js";
 import { BakeRunner, } from "./runner.js";
+import { readUpstreamJson } from "../upstream-body.js";
 const BAKE_CLAIM_INGEST_FETCH_TIMEOUT_MS = 30_000;
 const BAKE_HEARTBEAT_FETCH_TIMEOUT_MS = 10_000;
 const BAKE_HOST_PROBE_TIMEOUT_MS = 10_000;
@@ -37,9 +39,10 @@ function loadEnv() {
 }
 function makeApiClient(env, log) {
     const auth = { authorization: `Bearer ${env.token}`, "content-type": "application/json" };
+    const egressFetch = createEgressFetch("declare the final image-api address as IMAGE_API_BASE");
     return {
         async claimNext() {
-            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/claim`, {
+            const res = await egressFetch(`${env.imageApiBase}/v1/images/bakes/claim`, {
                 method: "POST",
                 headers: auth,
                 body: JSON.stringify({ runnerId: env.runnerId }),
@@ -51,7 +54,7 @@ function makeApiClient(env, log) {
                 log.warn("bake_claim_rejected", { status: res.status });
                 return null;
             }
-            const c = (await res.json());
+            const c = (await readUpstreamJson(res));
             if (!c.bakeId || !Array.isArray(c.argv) || !c.ingestSecret) {
                 log.warn("bake_claim_malformed", { status: res.status, bakeId: typeof c.bakeId === "string" ? c.bakeId : undefined });
                 return null;
@@ -68,7 +71,7 @@ function makeApiClient(env, log) {
             };
         },
         async ingest(bakeId, ingestSecret, frame) {
-            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
+            const res = await egressFetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
                 method: "POST",
                 headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
                 body: JSON.stringify(frame),
@@ -77,13 +80,13 @@ function makeApiClient(env, log) {
             await res.arrayBuffer().catch(() => undefined);
         },
         async heartbeat(bakeId, ingestSecret) {
-            const res = await fetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
+            const res = await egressFetch(`${env.imageApiBase}/v1/images/bakes/${encodeURIComponent(bakeId)}/ingest`, {
                 method: "POST",
                 headers: { ...auth, "x-bake-ingest-secret": ingestSecret },
                 body: JSON.stringify({ event: "heartbeat" }),
                 signal: AbortSignal.timeout(BAKE_HEARTBEAT_FETCH_TIMEOUT_MS),
             });
-            const body = res.ok ? (await res.json().catch(() => ({}))) : {};
+            const body = res.ok ? (await readUpstreamJson(res).catch(() => ({}))) : {};
             return {
                 accepted: res.ok,
                 cancelRequested: body.cancelRequested === true,
@@ -304,7 +307,7 @@ async function main() {
 const invokedDirectly = process.argv[1] !== undefined && /bake-runner[/\\]main\.(ts|js)$/.test(process.argv[1]);
 if (invokedDirectly) {
     main().catch((err) => {
-        console.error(JSON.stringify({ ts: new Date().toISOString(), level: "error", msg: "bake_runner_fatal", err: String(err) }));
+        createLogger().error("bake_runner_fatal", { err: String(err) });
         process.exit(1);
     });
 }

package/dist/bench/s1/arms.js

@@ -1,3 +1,4 @@
+import { writeLogText } from "../../observability/logger.js";
 import { pausedCauseOf, outwardPlane } from "../../terminal.js";
 import { leafBudgetFields, s1DebugGit } from "./runner-ctx.js";
 import {} from "./tasks.js";
@@ -61,7 +62,7 @@ export async function driveSupSuspendResume(initial, deps, implSpec, trap, advan
         foldCost(vr.stats);
         const legPlane = outwardPlane(vr.terminal);
         if (process.env.S1_DEBUG_SUPCOST)
-            console.error(`[SUPCOST leg=${leg}] status=${legPlane.status} reason=${vr.verification?.unverifiedReason} c1µ=${vr.stats?.costBreakdown?.llmRootMicroUsd} accC1µ=${c1Acc.llmRootMicroUsd} hrGates=${vr.stats?.humanReview?.gates?.length}`);
+            writeLogText("stderr", `[SUPCOST leg=${leg}] status=${legPlane.status} reason=${vr.verification?.unverifiedReason} c1µ=${vr.stats?.costBreakdown?.llmRootMicroUsd} accC1µ=${c1Acc.llmRootMicroUsd} hrGates=${vr.stats?.humanReview?.gates?.length}`);
         const paused = pausedCauseOf(vr.terminal);
         const gateKind = paused?.gate.kind;
         const parkWord = paused === undefined ? undefined : outwardPlane(paused).status;
@@ -148,7 +149,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         catch (e) {
             if (s1DebugGit())
-                console.error("[S1 SOLO infra throw]", e instanceof Error ? (e.stack ?? e.message) : String(e));
+                writeLogText("stderr", "[S1 SOLO infra throw]", e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
                 stats: captureStats(undefined),
@@ -161,7 +162,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         const soloPlane = outwardPlane(vr.terminal);
         if (s1DebugGit())
-            console.error("[S1 SOLO vr.status]", soloPlane.status, "| stats:", JSON.stringify(vr.stats)?.slice(0, 200));
+            writeLogText("stderr", "[S1 SOLO vr.status]", soloPlane.status, "| stats:", JSON.stringify(vr.stats)?.slice(0, 200));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         return assembleRow({
             arm,
@@ -195,7 +196,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         catch (e) {
             if (s1DebugGit())
-                console.error(`[S1 SUP infra throw driver=${trap.supDriver}]`, e instanceof Error ? (e.stack ?? e.message) : String(e));
+                writeLogText("stderr", `[S1 SUP infra throw driver=${trap.supDriver}]`, e instanceof Error ? (e.stack ?? e.message) : String(e));
             return assembleRow({
                 arm, trap, seed, ctx,
                 stats: captureStats(undefined),
@@ -208,7 +209,7 @@ export async function runArm(arm, trap, seed, ctx, deps, supStore) {
         }
         const supPlane = outwardPlane(vr.terminal);
         if (s1DebugGit())
-            console.error(`[S1 SUP vr.status driver=${trap.supDriver}]`, supPlane.status, "| repairTerminal:", repairTerminal, "| verdict:", vr.verification?.verdict, "| unverifiedReason:", vr.verification?.unverifiedReason, "| checkpointGate:", JSON.stringify(pausedCauseOf(vr.terminal)?.gate), "| error:", vr.error, "| stats:", JSON.stringify(vr.stats)?.slice(0, 180));
+            writeLogText("stderr", `[S1 SUP vr.status driver=${trap.supDriver}]`, supPlane.status, "| repairTerminal:", repairTerminal, "| verdict:", vr.verification?.verdict, "| unverifiedReason:", vr.verification?.unverifiedReason, "| checkpointGate:", JSON.stringify(pausedCauseOf(vr.terminal)?.gate), "| error:", vr.error, "| stats:", JSON.stringify(vr.stats)?.slice(0, 180));
         const oracle = pickOracleVerdicts(await deps.runOracle());
         const runStatus = classifyRunStatus({ status: supPlane.status, repairTerminal });
         const lastGate = vr.stats?.humanReview?.gates?.at(-1);

package/dist/bench/s1/live-deps.js

@@ -1,6 +1,10 @@
+import { writeLogText } from "../../observability/logger.js";
 import { outwardPlane } from "../../terminal.js";
 import { Runner, runWithVerification, resumeWithVerification, runRepairLoop, combinePolicies, createDurableQuestionPolicy, QUESTION_AWAITS_RESUME, } from "@sema-agent/core";
 import { loadConfig } from "../../config.js";
+import { declareServerWithheldEnv } from "../../server-secret-env.js";
+import { composeDeclaredExecutionLane } from "../../boot/execution-lane.js";
+import { ALL_EXECUTION_LANES } from "../../execution-lane-caps.js";
 import { assertServedModelRoute } from "../../model-route-endpoint.js";
 import { withUnattendedLeg } from "../../unattended-permission-mode.js";
 import { createBrain } from "../../brain.js";
@@ -51,7 +55,8 @@ function buildBrainIngredients(rt) {
         process.env.MODEL_COST_CACHE_READ = String(rt.costCacheRead);
     if (rt.costCacheWrite != null)
         process.env.MODEL_COST_CACHE_WRITE = String(rt.costCacheWrite);
-    const config = loadConfig();
+    declareServerWithheldEnv();
+    const config = composeDeclaredExecutionLane(loadConfig(), { info: () => { } }, { name: "the s1 bench", runs: ALL_EXECUTION_LANES, declares: "none" });
     assertServedModelRoute(config, { envTableIsPlaceholder: false });
     const brain = createBrain(config, {});
     const pricing = buildPricing(config.models);
@@ -119,7 +124,7 @@ async function transferWorkerTreeToGrader(worker, grader) {
     if (ext.code !== 0 || !ext.out.includes("EXTRACTED="))
         throw new Error(`s1 grader tar extract failed: ${ext.out.slice(-400)}`);
     if (s1DebugGit())
-        console.error(`[S1_DEBUG_TAR] head=${head.slice(0, 8)} base=${base.slice(0, 8)} tarBytes=${buf.length} ${ext.out.slice(-60)}`);
+        writeLogText("stderr", `[S1_DEBUG_TAR] head=${head.slice(0, 8)} base=${base.slice(0, 8)} tarBytes=${buf.length} ${ext.out.slice(-60)}`);
     return { head, base };
 }
 function oracleTaskFromTrap(trap) {
@@ -169,7 +174,7 @@ export function buildLiveDeps(rt, trap, seed, cellId) {
         const task = { ...oracleTaskFromTrap(trap), ...(state.shas ? { deliveredShas: state.shas } : {}) };
         const v = await runStandaloneOracle(grader, graderTransport(grader), worker, task);
         if (s1DebugGit())
-            console.error(`[S1_DEBUG_ORACLE ${trap.id}] delivered=${v.delivered} tests=${v.hiddenTestsGreen} build=${v.buildPassed} inv=${v.invariantsOk} | raw=`, JSON.stringify(v.raw)?.slice(0, 700));
+            writeLogText("stderr", `[S1_DEBUG_ORACLE ${trap.id}] delivered=${v.delivered} tests=${v.hiddenTestsGreen} build=${v.buildPassed} inv=${v.invariantsOk} | raw=`, JSON.stringify(v.raw)?.slice(0, 700));
         return v;
     };
     const deps = {

package/dist/bench/s1/run-firm.js

@@ -1,3 +1,4 @@
+import { writeLogText } from "../../observability/logger.js";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 import { AppendLog, Runner, InMemoryCheckpointStore } from "@sema-agent/core";
@@ -213,7 +214,7 @@ export function positiveIntArg(raw, def, flag) {
         return def;
     const n = Number(raw);
     if (!Number.isInteger(n) || n < 1) {
-        console.error(`[s1 run-firm] ${flag} must be a positive integer, got: ${raw}`);
+        writeLogText("stderr", `[s1 run-firm] ${flag} must be a positive integer, got: ${raw}`);
         process.exit(2);
     }
     return n;
@@ -251,13 +252,13 @@ export async function main(argv = process.argv.slice(2)) {
     setS1DebugGit(args.debugGit);
     const liveRuntime = liveRuntimeConfigFromEnv();
     if (!args.dryRun && !liveRuntime) {
-        console.error("[s1 run-firm] LIVE path refused: E2B_API_KEY + DEEPSEEK_API_KEY are required (the brain gateway). " +
+        writeLogText("stderr", "[s1 run-firm] LIVE path refused: E2B_API_KEY + DEEPSEEK_API_KEY are required (the brain gateway). " +
             "Run with --dry-run for the deterministic loop, or export the keys for the owner's gated live run.");
         process.exit(2);
         return;
     }
     const modelId = liveRuntime?.modelId ?? "deepseek-v4-flash";
-    const log = (msg, meta) => console.error(`[s1 run-firm] ${msg}`, meta ? JSON.stringify(meta) : "");
+    const log = (msg, meta) => writeLogText("stderr", `[s1 run-firm] ${msg}`, meta ? JSON.stringify(meta) : "");
     const result = await runFirm({
         seeds: args.seeds,
         cellTimeoutMs: args.cellTimeoutMs,
@@ -271,7 +272,7 @@ export async function main(argv = process.argv.slice(2)) {
         ...(args.dryRun ? { mockDepsFactory: dryRunMockFactory() } : { liveRuntime: liveRuntime }),
         log,
     });
-    console.log(JSON.stringify({
+    writeLogText("stdout", JSON.stringify({
         runId: args.runId,
         mode: args.dryRun ? "dry-run" : "live",
         ranThisPass: result.ranThisPass,
@@ -297,7 +298,7 @@ const isMain = (() => {
 })();
 if (isMain) {
     void main().catch((e) => {
-        console.error("[s1 run-firm] fatal:", e instanceof Error ? e.stack : String(e));
+        writeLogText("stderr", "[s1 run-firm] fatal:", e instanceof Error ? e.stack : String(e));
         process.exit(1);
     });
 }

package/dist/bind-host.d.ts

@@ -0,0 +1,25 @@
+/** 读监听地址要的那几格(取自配置的同名键)。 */
+export interface BindHostConfig {
+    bindHost?: string;
+    /** 缝合审 M5:`bindHost` 的**来源**决定它算不算 operator 明示,见 {@link resolveBindHost}。 */
+    bindHostSource?: "BIND_HOST" | "HOST";
+    allowUnauthedWrites?: boolean;
+    authToken?: string;
+    authTokens?: Record<string, string>;
+}
+/** 这台部署配了任何一把 service 凭据吗(`SERVICE_AUTH_TOKEN` / `SERVICE_AUTH_TOKENS`)。 */
+export declare function anyServiceCredential(config: Pick<BindHostConfig, "authToken" | "authTokens">): boolean;
+/** 无鉴权写面(`ALLOW_UNAUTHED_WRITES`)+ 零凭据 ⇒ 起服把监听地址收窄到 loopback(见 {@link resolveBindHost})。 */
+export declare function bindMustNarrow(config: Pick<BindHostConfig, "allowUnauthedWrites" | "authToken" | "authTokens">): boolean;
+/**
+ * 这台进程的监听地址(绑址旋钮 + 无鉴权自收窄)。`undefined` = Node 缺省全接口。
+ * `BIND_HOST`(兼容 `HOST`)显式值恒生效;缺省:**无鉴权写面(`allowUnauthedWrites` 且零凭据)自动收窄到 127.0.0.1**,其余维持全接口。
+ */
+export declare function resolveBindHost(config: BindHostConfig): string | undefined;
+/**
+ * 监听地址是不是**只在本机回环上**(别的主机连不上这个口)。`undefined`(Node 缺省全接口)、`0.0.0.0` / `::`(全接口)、任何别的地址或主机名 ⇒ 否。
+ * 认:IPv4 `127.0.0.0/8`、IPv6 `::1`、它们的 IPv4 映射拼法(经 {@link canonicalAddress} 折回点分 IPv4)、字面 `localhost`(大小写不敏感;
+ * 刻意不认 `*.localhost` 与别的主机名 —— 落不落在本机取决于系统解析器,不是这个值本身的事实)。
+ */
+export declare function listensLoopbackOnly(bindHost: string | undefined): boolean;
+//# sourceMappingURL=bind-host.d.ts.map

package/dist/bind-host.js

@@ -0,0 +1,25 @@
+import { isIP } from "node:net";
+import { canonicalAddress } from "./net-address.js";
+export function anyServiceCredential(config) {
+    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+}
+export function bindMustNarrow(config) {
+    return Boolean(config.allowUnauthedWrites) && !anyServiceCredential(config);
+}
+export function resolveBindHost(config) {
+    const mustNarrow = bindMustNarrow(config);
+    if (config.bindHost && !(mustNarrow && config.bindHostSource === "HOST"))
+        return config.bindHost;
+    return mustNarrow ? "127.0.0.1" : undefined;
+}
+export function listensLoopbackOnly(bindHost) {
+    if (bindHost === undefined)
+        return false;
+    if (bindHost.toLowerCase() === "localhost")
+        return true;
+    const address = canonicalAddress(bindHost);
+    if (address === undefined)
+        return false;
+    return isIP(address) === 4 ? address.startsWith("127.") : address === "::1";
+}
+//# sourceMappingURL=bind-host.js.map

package/dist/boot/adoption.d.ts

@@ -1,6 +1,9 @@
+import type { AdoptionWiring } from "../adoption/plan.js";
 import type { StoreBackend } from "../plugins/store-backend.js";
 export interface AdoptionBootCtx {
     backend: StoreBackend | undefined;
+    /** 可选存储面的接线事实(必填、无默认值;与 `POST /v1/adoption` 路由读的是同一对 boot 事实,见 {@link AdoptionWiring})。 */
+    wiring: AdoptionWiring;
     logger: {
         info?(msg: string, meta?: unknown): void;
         warn?(msg: string, meta?: unknown): void;

package/dist/boot/adoption.js

@@ -8,6 +8,7 @@ export async function runAdoptionBootScan(ctx) {
         store,
         dialect: ctx.backend?.kind === "pg" ? "pg" : "mysql",
         now: ctx.now ?? Date.now,
+        wiring: ctx.wiring,
         logger: ctx.logger,
     });
     try {

package/dist/boot/crash-last.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { z } from "zod";
 import { redactSecrets } from "../trace/redact.js";
+import { OWNER_ONLY_FILE_MODE } from "../plugins/owner-only-file-mode.js";
 const CrashLastSchema = z.object({
     at: z.string(),
     version: z.string(),
@@ -25,7 +26,7 @@ export function writeCrashLast(dataRoot, info) {
             ...(info.inflight !== undefined ? { inflight: info.inflight } : {}),
             err: redactSecrets(firstLine),
         };
-        writeFileSync(crashLastPath(dataRoot), JSON.stringify(body) + "\n");
+        writeFileSync(crashLastPath(dataRoot), JSON.stringify(body) + "\n", { mode: OWNER_ONLY_FILE_MODE });
     }
     catch {
     }

package/dist/boot/deployment-mods.d.ts

@@ -44,7 +44,7 @@ export interface LoadedModPackage {
 export interface DeploymentModsAssembly {
     readonly registrations: readonly ModRegistration<EngineDollar>[];
     readonly loaded: readonly LoadedModPackage[];
-    /** 部署座在**任务座之下**挂了链成员(不是观察者)的站点式样 —— 引擎这一次准入的记录读出({@link belowTaskChainPatternsOf})。读者:请求 `settings.hooks` 托管车道的只许收紧判据(`hooks/hook-runner.ts` 的 `managedTightenOnlyOn`)。 */
+    /** 部署座在**任务座之下**挂了链成员(不是观察者)的站点式样 —— 引擎这一次准入的记录读出({@link belowTaskChainPatternsOf})。读者:请求 `settings.hooks` 两条车道的只许收紧判据(`hooks/hook-runner.ts` 的 `chainsBelowTaskOn` 一处)。 */
     readonly belowTaskChainPatterns: readonly string[];
 }
 /**

package/dist/boot/device-lane.js

@@ -10,7 +10,7 @@ export function createDeviceLane(ctx) {
         throw new Error("device lane: the device store is wired but the session store carries no execution placement seat — the session↔device binding lives on the " +
             "root session row and is read only through that seat; refusing to start a device lane that could neither bind nor read a binding (assembly bug)");
     }
-    const knobs = config.remoteExec?.provider === "device" ? config.remoteExec : undefined;
+    const knobs = config.remoteExec.provider === "device" ? config.remoteExec : undefined;
     const enrollment = createDeviceEnrollment({
         store,
         seat,
@@ -48,14 +48,14 @@ export function assertDeviceLaneWired(isDeviceLane, lane, hasFactory) {
     if (!lane) {
         throw new Error("REMOTE_EXEC=device but the device lane could not be wired at boot [device-lane-unwired]: the SQL backend is " +
             "configured yet this replica did not get one, so the device registry / session↔device binding / audit tables are absent. " +
-            "Refusing to serve a lane that would silently fall back to the in-process stub env — a worker claiming to " +
+            "Refusing to serve a lane that would silently fall back to the engine's stub env with no hands mounted — a worker claiming to " +
             "execute on the employee's device while actually running inside its own process (#157). Fix the database " +
-            "(or unset REMOTE_EXEC) and restart (device-executor-lane-v2 §4.7)");
+            "(or declare another lane, e.g. REMOTE_EXEC=none) and restart (device-executor-lane-v2 §4.7)");
     }
     if (!hasFactory) {
         throw new Error("REMOTE_EXEC=device but no DeviceExecutionEnv factory was built [device-lane-unwired]: the lane's stores are up " +
-            "yet `boot/execution-env.ts` produced no factory, so core would fall back to the in-process stub env. This is " +
-            "an assembly bug, not a configuration one — refusing to start rather than silently execute in-process (#157)");
+            "yet `boot/execution-env.ts` produced no factory, so core would fall back to its stub env with no hands mounted. This is " +
+            "an assembly bug, not a configuration one — refusing to start rather than silently run with no execution environment (#157)");
     }
 }
 export async function noteDeviceRelayBindings(relay, store, logger) {

package/dist/boot/engine-lease.d.ts

@@ -28,8 +28,8 @@
  *     `ENGINE_AUTO_EXIT` / `SEMA_PARENT_PID` 的表态上。
  *  2. **自退判据 = 三合取,且必须持续满 `linger`**(`linger` = 孤儿态 `orphan.lingerMs`,否则 `lingerMs`):
  *       · 附着租约集空(`attachedStreams() === 0`);
- *       · 无必须等完的活(`inflight() === 0` —— 读 `drainState.blockingInflight` = **阻断集** `http + leader`,与排空等的、SIGHUP 空闲窗**同一只**,不另立第二判据;
- *         `/health.inflight` 是它再加会话驻留的后台 shell / monitor 的**总数**:同一份分项 `/health.inflightBreakdown` 派生的两个事实,不是两套计数,见下「已知收窄」);
+ *       · 无必须等完的活(`inflight() === 0` —— 读 `drainState.blockingInflight` = **阻断集** `http + leader + backgroundAgents`,与排空等的、SIGHUP 空闲窗**同一只**,不另立第二判据;
+ *         `/health.inflight` 是它再加会话驻留的后台 shell / monitor 的**总数**:同一只分项函数 `/health.inflightBreakdown` 派生的两个事实,不是两套计数,见下「已知收窄」);
  *       · HTTP 触点静默(`now() - lastActivityAt() >= lingerMs`),**且**最后一条附着流的**离场**
  *         也已满窗(`now() - lastAttachEndedAt() >= lingerMs` —— codex R1-F1,见该 dep 的注)。
  *     任何一条不满足即把计时清零(连续性判据,不是累计)。
@@ -67,17 +67,18 @@
  *    每 15s 无限期跑下去的定时器 —— 为它引入周期性 SQL 轮询,代价压过收益。**bg run 在跑不退**那一臂
  *    已由 `inflight()` 结构性守住;parked 行是 durable 的,引擎退掉不丢:下次起来仍可赎回(spawn 形里
  *    「下次」就是壳的下一次 spawn)。伤害面 = 一条 parked run 的赎回被推迟到下次启动,不是丢失。
- *    这是**允许的收窄,不是静默**:有了廉价 parked 计数口(或本腿改成事件驱动)之后应当补上。
- *  · **会话驻留的后台 shell / monitor 与活过父 run 的后台子代理都不入判据**(两件事实不同,同一条判据)。
- *    阻断集 `http + leader` 是「还有没有**必须等完**的活」:HTTP 腿(在飞 run 集 · 同步计费腿 · admission 期请求)与 leader 腿。
+ *    这是**允许的收窄,不是静默**:有了廉价 parked 计数口(或本腿改成事件驱动)之后应当补上。停驻的后台子代理(任务表 `parked`)同一条律、同样不计。
+ *  · **会话驻留的后台 shell / monitor 不入判据**。阻断集 `http + leader + backgroundAgents` 是「还有没有**必须等完**的活」:HTTP 腿(在飞 run 集 · 同步计费腿 ·
+ *    admission 期请求)、leader 腿,以及活过起它的那条 HTTP 腿、仍在跑的后台子代理(core `backgroundScope:"session"`;它是一条在干活的模型腿,干完自己收尾,不等它 = 受控退把它中断)。
  *    会话驻留的后台 shell / monitor(`session-resident-background.ts` 读;running ∧ 会话驻留 ∧ 非 retain)**报**在 `/health.inflight`(总数)与
  *    `inflightBreakdown.sessionResident` 里 —— 外部判官据此判「这台引擎此刻托管着多少活」—— 但**不阻断**自退:它不是一条腿,等它没有意义,而一只不退出的 shell
  *    (`while true`)若阻断,崩溃孤儿引擎就永生(孤儿窗 / SIGHUP 空闲窗同读阻断集,排空也每次等满窗)。窗到 / 排空完成,退出边界的后台收割
  *    (`reapAllSessionBackground` + 硬面,`boot/exit-boundary.ts`)收掉它们;retain 行按 retain 既有语义活过受控退。伤害面 = 壳没了且没人附着时,引擎照退、
- *    驻留的进程随受控退被收掉(与 7.145.x 逐字同,**本件不改这一行为**,只把它报出来)。
- *    后台**子代理**(agent 行)同样不入(codex R1 [high] 验真后如实登记,不是本件引入:[ref] 之前父死走的是**当场** drain,而 `drainThenShutdown` 读的是同一只 `inflight()` ⇒ 同一个缺口):
- *    core 侧 `backgroundScope:"session"` 的子代理可以**活过**生它的那条 HTTP 腿,那之后它在本腿眼里是 0;伤害面 = 一条还在跑的后台子代理会随引擎的受控退被中断(它的账本行照常落终态,不是静默丢)。
- *    这条收窄**成文在此**,不许再被读成「bg 全被守住」。
+ *    驻留的进程随受控退被收掉(与 7.145.x 逐字同,只把它报出来)。
+ *  · **活过起它的腿的 workflow 不入判据**:任务表对它只投 `running`,一条腿停在审批门上等人时也是 `running`,读法分不出「在干活」与「在等人」;
+ *    等人的活若阻断,一张没人答的审批就让崩溃孤儿引擎永生(同上一条的病)。伤害面 = 壳没了且没人附着时,一条还在干活的 workflow 随受控退被收掉
+ *    (与 7.146.x 同)。停驻位由 core 任务表投出后按停驻律分(见 `session-resident-background.ts` 头注)。
+ *    (修前后台子代理也在这一条里:它们活过生它的 HTTP 腿之后在本腿眼里是 0,受控退把还在跑的子代理中断 —— 7.147.0 起收进阻断集,这条收窄只剩上面两类。)
  *  · **`/health` 探针不算触点**:`lastActivityAt` 的属主(`http/server.ts` 的 `noteActivity`)按既有契约
  *    把 `/health` 与 `/metrics*` 排除在活性时钟之外(常态采样噪音不得把空闲窗永远撑开)。⇒ 一只**只**
  *    轮询 `/health` 的壳不构成租约。这与 SIGHUP 空闲窗的判据同源,刻意保持一致而非在本腿另开一份。
@@ -278,7 +279,7 @@ export interface EngineLeaseFirstAttachFacts {
  * [ref] —— 交接格(`GET /health` 的 `engineLease.handover`;交接口 200 体 = 其中 `since` / `lingerMs` / `backgroundShells` 三键加 `lane`)。
  *  · `since` = 进入交接车道的时刻(epoch ms,与首窗格同一只单调钟投影);幂等的再次交接回同一个值。
  *  · `lingerMs` = 交接窗;`backgroundShells` = 退出边界此刻会硬收的后台 shell 行数(现读)。窗只在它为 0、阻断集在飞为 0、且无附着与触点时起算。
- *  · 不带在飞数:阻断集在同一份 `/health` 里已由 `inflightBreakdown.http + leader` 读出(一个事实一处读);交接口 200 体若带它,读到的恒含这次请求自己。
+ *  · 不带在飞数:阻断集在同一份 `/health` 里已由 `inflightBreakdown.http + leader + backgroundAgents` 读出(一个事实一处读);交接口 200 体若带它,读到的恒含这次请求自己。
  */
 export interface EngineHandoverFacts {
     readonly since: number;
@@ -321,7 +322,7 @@ export interface EngineLeaseHandle {
 export interface EngineLeaseDeps {
     /** 活附着数 = 本副本当前**打开着的 SSE 流**条数(`drainState.attachedStreams`,由 `createHttpServer` 自赋)。 */
     attachedStreams: () => number;
-    /** 必须等完的活的数 —— **阻断集** `drainState.blockingInflight`(`http + leader`;与排空等的、SIGHUP 空闲窗同一只 getter。会话驻留的后台 shell / monitor 在
+    /** 必须等完的活的数 —— **阻断集** `drainState.blockingInflight`(`http + leader + backgroundAgents`;与排空等的、SIGHUP 空闲窗同一只 getter。会话驻留的后台 shell / monitor 在
      *  `/health.inflight` 的总数里、不在这里,见顶注「已知收窄」)。不自建第二套计数:两套计数迟早分叉,而分叉的那一侧恰好是「以为没 run 了」就把引擎关掉。 */
     inflight: () => number;
     /** 最后一次**非探针** HTTP 触点的单调时刻(`drainState.lastActivityAt`)。

package/dist/boot/execution-env.d.ts

@@ -12,14 +12,16 @@ import { type RemoteContainerEnvDeps } from "../plugins/remote-env-e2b.js";
 import { type WorkspaceFillOf } from "../plugins/workspace-fill.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
 import { type SandboxGitPlaneSeat, type SandboxGitRunRows } from "../sandbox-git-plane.js";
-import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
+import type { SandboxReaper } from "../plugins/sandbox-reaper.js";
 import { type SpaceCommitRows } from "../workspace-space-commit.js";
 import { type LocalDockerEnvDeps } from "../plugins/remote-env-local-docker.js";
+import { type LocalDockerCapacity } from "../plugins/local-docker-capacity.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { TaskInheritEnv } from "../request-value-closure.js";
 import { type HeadRead } from "../session-incarnation.js";
 import type { SpaceReclaimer } from "../workspace-space.js";
+import { type SessionResidentCounts } from "../session-resident-background.js";
 /**
  * per-session 的 **cwd / shellEnv 登记簿**(TOC cwd seam + R-survey shellEnv seam)+ 它们的**租户围栏**。
  *
@@ -59,10 +61,15 @@ export interface SessionScopedRegistries {
      *  (core 的访问元组要带 scope,没有进程总数的读口),读的就是这一张 —— 每次提交写一笔、`dropSession` 清一笔、LRU 有界,不另立第二张会话名册。 */
     readonly sessionOwners: ReadonlyMap<string, string | null>;
     /** 记录/对拍本会话的主人。与上次不同 ⇒ **先清两张表**再记新主(换主即清)。`null` = 匿名会话,
-     *  它同样是一个**稳定**的身份值(不是「未知」),所以匿名重入不会被判成换主。 */
-    fenceSessionOwner(sid: string, owner: string | null): void;
+     *  它同样是一个**稳定**的身份值(不是「未知」),所以匿名重入不会被判成换主。
+     *  `incarnation` = 这次提交的授权口读到的那一位住客(会话行上的化身;读不出 ⇒ 缺):与上次记下的那一位不同 ⇒ 同样先清(同一个 id 上换了住客 ——
+     *  删了重建、被拒提交铸下的会话撤回之后重登记 —— 同属主也不接上一位住客的东西);缺 ⇒ 记成「不知道是哪一位」,不因它清。 */
+    fenceSessionOwner(sid: string, owner: string | null, incarnation?: string): void;
     /** 会话删除:两张表 + 身份记录一起清(留着身份记录会让同 id 的下一位与一个幽灵身份比对成「同主」)。 */
     dropSession(sid: string): void;
+    /** 只清**这一位住客**的条目:记下的住客恰是 `incarnation` ⇒ 同 {@link dropSession}、答 `true`;否则(换了住客 / 不知道是哪一位 / 没有条目)一笔不动、答 `false`。
+     *  撤回出口在撤回事务落定之后调 —— 那一刻同 id 的下一位可能已经登记、围栏、写下了它自己的条目。 */
+    dropSessionOf(sid: string, incarnation: string): boolean;
 }
 export declare function createSessionScopedRegistries(maxEntries?: number): SessionScopedRegistries;
 /**
@@ -158,11 +165,13 @@ export interface ExecutionEnvCtx {
     /** run 店的按 id 读(成员凭据代理座读 run 行上受理时记下的身份元组 `RunRecord.identity`)。取值闭包:run 店第 7 段才绑(`late-binds.ts`),
      *  平面开着时每个 run 的 pod 建起前求值一次。不传 / 答 `undefined`(没有存储后端)⇒ 读不到身份 ⇒ 不挂代理。 */
     runRows?: () => SandboxGitRunRows | undefined;
-    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。 */
+    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。
+     *  `localDockerReapNow` = local-docker 无主容器回收器的钟缝(保持窗从 run 行转终态那一拍起算;测试把「现在」拨过窗)。 */
     laneDeps?: {
         readonly e2b?: RemoteContainerEnvDeps;
         readonly k8s?: K8sEnvDeps;
         readonly localDocker?: LocalDockerEnvDeps;
+        readonly localDockerReapNow?: () => number;
     };
 }
 export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
@@ -172,16 +181,18 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     setSessionInheritEnv: (sid: string, policy: TaskInheritEnv | undefined) => void;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
     dropSessionScoped: (sid: string) => void;
-    sessionResidentBackground: () => number;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
+    sessionResidentBackground: () => SessionResidentCounts;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     worktreeReap: (() => Promise<void>) | undefined;
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: SpaceReclaimer | undefined;
     sandboxSecretSeatGate: (() => Promise<void>) | undefined;
-    sandboxPodReaper: SandboxPodReaper | undefined;
+    sandboxReaper: SandboxReaper | undefined;
     sandboxGitPlane: SandboxGitPlaneSeat;
+    sandboxCapacity: LocalDockerCapacity | undefined;
 };
 //# sourceMappingURL=execution-env.d.ts.map