@sema-agent/server 7.147.0 → 7.149.0

package/dist/boot/execution-env.d.ts

@@ -12,9 +12,10 @@ import { type RemoteContainerEnvDeps } from "../plugins/remote-env-e2b.js";
 import { type WorkspaceFillOf } from "../plugins/workspace-fill.js";
 import { k8sExecutionEnvFactory, type K8sEnvConfig, type K8sEnvDeps, type SandboxSecretSeat } from "../plugins/remote-env-k8s.js";
 import { type SandboxGitPlaneSeat, type SandboxGitRunRows } from "../sandbox-git-plane.js";
-import { type SandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
+import type { SandboxReaper } from "../plugins/sandbox-reaper.js";
 import { type SpaceCommitRows } from "../workspace-space-commit.js";
 import { type LocalDockerEnvDeps } from "../plugins/remote-env-local-docker.js";
+import { type LocalDockerCapacity } from "../plugins/local-docker-capacity.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { TaskInheritEnv } from "../request-value-closure.js";
@@ -60,10 +61,15 @@ export interface SessionScopedRegistries {
      *  (core 的访问元组要带 scope,没有进程总数的读口),读的就是这一张 —— 每次提交写一笔、`dropSession` 清一笔、LRU 有界,不另立第二张会话名册。 */
     readonly sessionOwners: ReadonlyMap<string, string | null>;
     /** 记录/对拍本会话的主人。与上次不同 ⇒ **先清两张表**再记新主(换主即清)。`null` = 匿名会话,
-     *  它同样是一个**稳定**的身份值(不是「未知」),所以匿名重入不会被判成换主。 */
-    fenceSessionOwner(sid: string, owner: string | null): void;
+     *  它同样是一个**稳定**的身份值(不是「未知」),所以匿名重入不会被判成换主。
+     *  `incarnation` = 这次提交的授权口读到的那一位住客(会话行上的化身;读不出 ⇒ 缺):与上次记下的那一位不同 ⇒ 同样先清(同一个 id 上换了住客 ——
+     *  删了重建、被拒提交铸下的会话撤回之后重登记 —— 同属主也不接上一位住客的东西);缺 ⇒ 记成「不知道是哪一位」,不因它清。 */
+    fenceSessionOwner(sid: string, owner: string | null, incarnation?: string): void;
     /** 会话删除:两张表 + 身份记录一起清(留着身份记录会让同 id 的下一位与一个幽灵身份比对成「同主」)。 */
     dropSession(sid: string): void;
+    /** 只清**这一位住客**的条目:记下的住客恰是 `incarnation` ⇒ 同 {@link dropSession}、答 `true`;否则(换了住客 / 不知道是哪一位 / 没有条目)一笔不动、答 `false`。
+     *  撤回出口在撤回事务落定之后调 —— 那一刻同 id 的下一位可能已经登记、围栏、写下了它自己的条目。 */
+    dropSessionOf(sid: string, incarnation: string): boolean;
 }
 export declare function createSessionScopedRegistries(maxEntries?: number): SessionScopedRegistries;
 /**
@@ -159,11 +165,13 @@ export interface ExecutionEnvCtx {
     /** run 店的按 id 读(成员凭据代理座读 run 行上受理时记下的身份元组 `RunRecord.identity`)。取值闭包:run 店第 7 段才绑(`late-binds.ts`),
      *  平面开着时每个 run 的 pod 建起前求值一次。不传 / 答 `undefined`(没有存储后端)⇒ 读不到身份 ⇒ 不挂代理。 */
     runRows?: () => SandboxGitRunRows | undefined;
-    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。 */
+    /** 隔离车道三只适配器自己的测试缝(假 e2b SDK / 假集群 / 假 docker CLI),原样交给各自的工厂 —— 与 `K8sEnvDeps` 同一条律:生产装配不传。
+     *  `localDockerReapNow` = local-docker 无主容器回收器的钟缝(保持窗从 run 行转终态那一拍起算;测试把「现在」拨过窗)。 */
     laneDeps?: {
         readonly e2b?: RemoteContainerEnvDeps;
         readonly k8s?: K8sEnvDeps;
         readonly localDocker?: LocalDockerEnvDeps;
+        readonly localDockerReapNow?: () => number;
     };
 }
 export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
@@ -173,16 +181,18 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     setSessionCwd: (sid: string, cwd: string) => void;
     setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
     setSessionInheritEnv: (sid: string, policy: TaskInheritEnv | undefined) => void;
-    fenceSessionOwner: (sid: string, owner: string | null) => void;
+    fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
     dropSessionScoped: (sid: string) => void;
+    dropSessionScopedOf: (sid: string, incarnation: string) => boolean;
     sessionResidentBackground: () => SessionResidentCounts;
     executionEnvFactory: import("@sema-agent/core").ExecutionEnvFactory | undefined;
     worktreeReap: (() => Promise<void>) | undefined;
     sendUserFileTaskEnvs: TaskEnvRegistry | undefined;
-    lspManager: import("@sema-agent/core").NodeLspManager | import("../lsp/manager.js").E2bLspManager | undefined;
+    lspManager: import("@sema-agent/core").NodeLspManager | undefined;
     spaceReclaimer: SpaceReclaimer | undefined;
     sandboxSecretSeatGate: (() => Promise<void>) | undefined;
-    sandboxPodReaper: SandboxPodReaper | undefined;
+    sandboxReaper: SandboxReaper | undefined;
     sandboxGitPlane: SandboxGitPlaneSeat;
+    sandboxCapacity: LocalDockerCapacity | undefined;
 };
 //# sourceMappingURL=execution-env.d.ts.map

package/dist/boot/execution-env.js

@@ -1,11 +1,10 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { createHostLspManager } from "../host-lsp-manager.js";
+import { createLspManager } from "../host-lsp-manager.js";
 import { TaskEnvRegistry } from "../capabilities/sandbox-file-send.js";
 import { DEPLOYMENT_SHAPE_PREDICATES } from "../deployment-shape.js";
 import { SessionEnvironmentSelection } from "../capabilities/select-environment-tool.js";
 import { sandboxEnvNamesInForce } from "../config.js";
-import { createE2bLspManager } from "../lsp/e2b-manager.js";
 import { evictLspOnDestroy } from "../lsp-evict.js";
 import { PerTaskImageRegistry } from "../per-task-image.js";
 import { adbExecutionEnvFactory } from "../plugins/remote-env-adb.js";
@@ -17,10 +16,12 @@ import { boundedStoreCall, checkSandboxEgressPolicy, createSandboxPodApi, create
 import { podSpecPatchBrokerRefusal, SANDBOX_SECRET_SEAT_VERBS } from "../plugins/k8s-exec-protocol.js";
 import { createSandboxBrokerSeatOf, createSandboxGitPlaneSeat, sandboxGitPlanePremisesOf } from "../sandbox-git-plane.js";
 import { createSandboxPodReaper } from "../plugins/k8s-pod-reaper.js";
+import { createLocalDockerReaper } from "../plugins/local-docker-reaper.js";
 import { recordFailOpen } from "../observability/fail-open.js";
 import { createRunWorkspaceSnapshotSeat } from "../fleet/workspace-snapshot-residual.js";
 import { createSpaceCommitFence } from "../workspace-space-commit.js";
 import { localDockerExecutionEnvFactory } from "../plugins/remote-env-local-docker.js";
+import { createLocalDockerCapacity, localDockerWorkerLabelOf } from "../plugins/local-docker-capacity.js";
 import { sshExecutionEnvFactory } from "../plugins/remote-env-ssh.js";
 import { withRemoteScratchpad } from "../plugins/remote-scratchpad.js";
 import { FileSchedulerBackend, defaultSchedulerStorePath } from "../plugins/scheduler-support.js";
@@ -38,8 +39,8 @@ import { workspaceSnapshotTimeoutOf } from "../workspace-space.js";
 import { sayEgressPolicyReading } from "../sandbox-egress-policy.js";
 import { sandboxPathEnvSlots, withSandboxPathEnvSlot } from "./deferred-sandbox-path-env.js";
 import { createLaneHomeAbsenceReporter } from "../lane-home-probe.js";
-import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, executionLaneOf, laneBindsReads, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
-import { warnReadDenyFloorUnkept } from "./execution-lane.js";
+import { buildLaneHomeBootNote, buildLaneHomeClaim, capabilitiesFor, laneIsolated, laneSandboxReadFloorState } from "../execution-lane-caps.js";
+import { settleReadDenyFloor } from "./execution-lane.js";
 import { seatText } from "../trace/exit-seat.js";
 import { countSessionResidentBackground } from "../session-resident-background.js";
 function boundedSessionSetter(map, maxEntries) {
@@ -65,11 +66,13 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionShellEnv = new Map();
     const perSessionInheritEnv = new Map();
     const owners = new Map();
+    const occupants = new Map();
     const dropSession = (sid) => {
         perSessionCwd.delete(sid);
         perSessionShellEnv.delete(sid);
         perSessionInheritEnv.delete(sid);
         owners.delete(sid);
+        occupants.delete(sid);
     };
     const touch = (sid, owner) => {
         const next = owner === undefined ? (owners.has(sid) ? owners.get(sid) : null) : owner;
@@ -99,8 +102,14 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
             perSessionInheritEnv.set(sid, policy);
             touch(sid, undefined);
         },
-        fenceSessionOwner: (sid, owner) => {
-            if (owners.has(sid) && owners.get(sid) !== owner) {
+        fenceSessionOwner: (sid, owner, incarnation) => {
+            const ownerChanged = owners.has(sid) && owners.get(sid) !== owner;
+            const occupantChanged = incarnation !== undefined && occupants.has(sid) && occupants.get(sid) !== incarnation;
+            if (incarnation === undefined)
+                occupants.delete(sid);
+            else
+                occupants.set(sid, incarnation);
+            if (ownerChanged || occupantChanged) {
                 perSessionCwd.delete(sid);
                 perSessionShellEnv.delete(sid);
                 perSessionInheritEnv.delete(sid);
@@ -108,6 +117,12 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
             touch(sid, owner);
         },
         dropSession,
+        dropSessionOf: (sid, incarnation) => {
+            if (occupants.get(sid) !== incarnation)
+                return false;
+            dropSession(sid);
+            return true;
+        },
     };
 }
 export function ownsItsWorkspace(ctx) {
@@ -238,10 +253,14 @@ export function createExecutionEnv(ctx) {
     const { perSessionCwd, setSessionCwd } = sessionScoped;
     const { perSessionShellEnv, setSessionShellEnv } = sessionScoped;
     const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
+    const lspManager = createLspManager(config, (event, fields) => logger.info(event, fields));
+    if (lspManager)
+        logger.info("lsp_enabled", { provider: config.remoteExec.provider });
     let executionEnvFactory;
     let spaceReclaimer;
     let sandboxSecretSeatGate;
-    let sandboxPodReaper;
+    let sandboxReaper;
+    let sandboxCapacity;
     let sandboxGitPlane = createSandboxGitPlaneSeat((r) => sandboxGitPlanePremisesOf(config, r), {});
     let worktreeReap;
     const workspaceFillOf = taskAttachmentStore === undefined ? undefined : (fctx) => createWorkspaceFill({ store: taskAttachmentStore, sessionId: fctx.sessionId, seeds: ownsItsWorkspace(fctx), logger });
@@ -299,7 +318,7 @@ export function createExecutionEnv(ctx) {
         if (k8sCfg.cache !== undefined || k8sCfg.s3Snapshot !== undefined)
             spaceReclaimer = createSpaceReclaimer(k8sCfg);
         sandboxSecretSeatGate = () => ensureSandboxSecretSeat(k8sCfg, logger, undefined, () => readSandboxSecretSeat(k8sCfg, "env"));
-        sandboxPodReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
+        sandboxReaper = createSandboxPodReaper({ api: createSandboxPodApi(k8sCfg), logger, metrics });
         void checkSandboxEgressPolicy(k8sCfg)
             .then((gaps) => sayEgressPolicyReading(gaps, logger, k8sCfg.namespace))
             .catch((e) => logger.error("sandbox_egress_policy_check_crashed", { error: seatText("operator-log-text", e instanceof Error ? e.message : String(e)), effect: "the sandbox egress self-check did not complete this boot — the lane runs; the egress policy was not read" }));
@@ -347,6 +366,7 @@ export function createExecutionEnv(ctx) {
                 ? new FileSchedulerBackend({
                     storePath: schedulerStorePath,
                     log: logger,
+                    trust: { declaredOwnerUid: config.configLocalOwnerUid },
                     ...(config.schedulerSessionWakeup === false || config.schedulerSessionLifetime === false
                         ? {
                             caps: {
@@ -364,27 +384,29 @@ export function createExecutionEnv(ctx) {
                 ...(config.remoteExec.workspaceBase ? { workspaceBase: config.remoteExec.workspaceBase } : {}),
                 ...(config.remoteExec.commandTimeoutMs != null ? { commandTimeoutMs: config.remoteExec.commandTimeoutMs } : {}),
                 ...(hostScheduler ? { scheduler: hostScheduler } : {}),
-                backgroundShell: config.requirePrincipal !== true,
+                backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config),
             };
-            executionEnvFactory = (ctx) => {
+            executionEnvFactory = hostExecutionEnvFactory(hostCfg, (ctx) => {
                 if (ctx.isolation === "worktree")
                     throw hostWorktreeUnwrappedRefusal();
                 const cwd = effectiveHostWorkspace(perSessionCwd.get(ctx.sessionId), ctx);
                 const shellEnv = perSessionShellEnv.get(ctx.sessionId);
                 const inheritEnv = perSessionInheritEnv.get(ctx.sessionId);
-                const env = hostExecutionEnvFactory({
-                    ...hostCfg,
+                return {
                     ...(cwd ? { workspaceDir: cwd } : {}),
                     ...(shellEnv ? { env: shellEnv } : {}),
                     ...(inheritEnv !== undefined ? { inheritEnv } : {}),
-                })(ctx);
-                return lspManager && !cwd ? evictLspOnDestroy(env, lspManager) : env;
-            };
+                    ...(lspManager && !cwd ? { minted: (env) => void evictLspOnDestroy(env, lspManager) } : {}),
+                };
+            });
         }
     }
     else if (config.remoteExec.provider === "local-docker") {
-        executionEnvFactory = localDockerExecutionEnvFactory({
+        const workerLabel = localDockerWorkerLabelOf(config.localDataRoot);
+        sandboxCapacity = config.remoteExec.capacity !== undefined ? createLocalDockerCapacity(config.remoteExec.capacity, { label: workerLabel, logger }) : undefined;
+        const localDockerFactory = localDockerExecutionEnvFactory({
             image: config.remoteExec.image,
+            workerLabel,
             ...(config.remoteExec.mountPath ? { mountPath: config.remoteExec.mountPath } : {}),
             ...homeDirSeat, ...homeAbsentNotice,
             ...(config.remoteExec.dockerPath ? { dockerPath: config.remoteExec.dockerPath } : {}),
@@ -398,8 +420,11 @@ export function createExecutionEnv(ctx) {
             ...(config.remoteExec.env ? { env: config.remoteExec.env } : {}),
             sandboxReadFloor: config.sandboxReadFloor,
             ...(workspaceFillOf !== undefined ? { workspaceFillOf } : {}),
+            ...(sandboxCapacity !== undefined ? { capacity: sandboxCapacity } : {}),
             logger,
         }, ctx.laneDeps?.localDocker);
+        executionEnvFactory = localDockerFactory;
+        sandboxReaper = createLocalDockerReaper({ port: localDockerFactory.reapPort, logger, metrics, ...(ctx.laneDeps?.localDockerReapNow !== undefined ? { now: ctx.laneDeps.localDockerReapNow } : {}) });
     }
     if (executionEnvFactory && DEPLOYMENT_SHAPE_PREDICATES.remoteScratchpad.holds(config)) {
         executionEnvFactory = withRemoteScratchpad(executionEnvFactory, logger);
@@ -415,14 +440,14 @@ export function createExecutionEnv(ctx) {
             });
         }
         else if (config.remoteExec.provider === "host") {
-            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: config.requirePrincipal !== true, gitBase: true });
+            const gitBaseEnv = new RemoteHostExecutionEnv({ workspaceDir: config.worktreeIsolation.repoRoot, inheritEnv: "all", backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config), gitBase: true });
             executionEnvFactory = withWorktreeIsolation(executionEnvFactory, {
                 repoRoot: config.worktreeIsolation.repoRoot,
                 ...(config.worktreeIsolation.allowedRoots ? { allowedRoots: config.worktreeIsolation.allowedRoots } : {}),
                 ...(config.worktreeIsolation.commit ? { commit: config.worktreeIsolation.commit } : {}),
                 baseEnvForGit: gitBaseEnv,
                 rootEnvAt: (dir) => {
-                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: config.requirePrincipal !== true });
+                    const env = new RemoteHostExecutionEnv({ ...homeDirSeat, workspaceDir: dir, backgroundShell: DEPLOYMENT_SHAPE_PREDICATES.backgroundShell.holds(config) });
                     return lspManager ? evictLspOnDestroy(env, lspManager) : env;
                 },
                 logger,
@@ -475,29 +500,7 @@ export function createExecutionEnv(ctx) {
         if (config.remoteExec.provider === "host")
             logger.info("task_inherit_env_honored", { honored: taskInheritEnvRefusal(config) === undefined });
     }
-    warnReadDenyFloorUnkept(config, logger);
-    const lspProvider = config.remoteExec.provider;
-    const lspLane = executionLaneOf(lspProvider);
-    const lspLaneBindsReads = lspLane !== undefined && laneBindsReads(lspLane);
-    if ((lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && !lspLaneBindsReads) {
-        logger.warn("lsp_not_mounted", {
-            provider: lspProvider,
-            reason: "LSP_ENABLED is set, but this lane's execution environment cannot bind a read to the file that was checked (openBound), so every language-server file sync would be refused; the LSP tool is not mounted on this lane in this version",
-        });
-    }
-    const lspManager = (lspProvider === "e2b" || lspProvider === "k8s") && config.lspEnabled && lspLaneBindsReads
-        ? createE2bLspManager({
-            log: (event, fields) => logger.info(event, fields),
-            scheme: lspProvider === "k8s" ? "ws" : "wss",
-            provider: lspProvider,
-            metrics,
-        })
-        :
-            lspProvider === "host" && config.lspHostEnabled && config.requirePrincipal !== true && lspLaneBindsReads
-                ? createHostLspManager(config, (event, fields) => logger.info(event, fields))
-                : undefined;
-    if (lspManager)
-        logger.info("lsp_enabled", { provider: lspProvider });
+    settleReadDenyFloor(config, logger);
     const unreadableReported = new Set();
     let stallReapFailureReported = false;
     const stallMs = config.backgroundAgentStallMs;
@@ -533,8 +536,10 @@ export function createExecutionEnv(ctx) {
         perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
+        dropSessionScopedOf: sessionScoped.dropSessionOf,
         sessionResidentBackground,
-        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxPodReaper, sandboxGitPlane,
+        executionEnvFactory, worktreeReap, sendUserFileTaskEnvs, lspManager, spaceReclaimer, sandboxSecretSeatGate, sandboxReaper, sandboxGitPlane,
+        sandboxCapacity,
     };
 }
 //# sourceMappingURL=execution-env.js.map

package/dist/boot/execution-lane.d.ts

@@ -58,12 +58,14 @@ export declare function composeDeclaredExecutionLane(loaded: LoadedConfig, logge
  */
 export declare function settleHostLaneShell(config: Pick<ServiceConfig, "remoteExec">, logger: Pick<Logger, "info" | "warn">): Promise<void>;
 /**
- * **读地板的起服一行**:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
- * 起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`)。
+ * **读拒字节地板在本部署上怎么说** —— 两件事,一个入口:
+ *  ① 把部署的执行车道装给说法的属主(`read-deny-floor-notice.ts` 的 `installReadDenyFloorDeployment`):每条 run 的通告 / 结果格 / 拒句由它点名 `REMOTE_EXEC=<车道>`;
+ *  ② 起服一行:部署要求读拒表的字节地板(`READ_DENY_FLOOR_REQUIRED=true`)而最终车道的执行环境块不守 ⇒ 每条读拒表有行的 run 都在准备期拒 ——
+ *     起服先说清后果与出路(`warn read_deny_floor_required_unkept { provider, note }`;判据与句子的唯一属主 `buildReadDenyFloorUnkeptNote`,句子 = 每条 run 的拒句)。
  * 两个入口调同一只(与 {@link settleHostLaneShell} 同形):HTTP 服务在执行环境装配里(`boot/execution-env.ts`,有没有执行环境工厂都调),`run-local` 在宿主车道定下之后 ——
- * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先说。不要求 / 车道守地板 ⇒ 零动作。
+ * 旋钮两个入口都递给引擎(`RunnerDeps.readDenyFloorRequired`),所以两个入口都要先装、先说。不要求 / 车道守地板 ⇒ 不出那一行(装照装:车道名是每条 run 的说法要的)。
  */
-export declare function warnReadDenyFloorUnkept(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
+export declare function settleReadDenyFloor(config: Parameters<typeof buildReadDenyFloorUnkeptNote>[0], logger: Pick<Logger, "warn">): void;
 /**
  * 车道合成之后的跨域不变量 —— 表(`config-invariants.ts`)里读 `remoteExec.provider` 的那几条,boot 期 `live === next`。
  * 同步、纯判据:只读 config,不碰文件(测试可以对 `loadConfig()` 的产物直接调它)。

package/dist/boot/execution-lane.js

@@ -3,6 +3,7 @@ import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
 import { entryDeclarableRemoteExec } from "../config.js";
 import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
+import { installReadDenyFloorDeployment } from "../read-deny-floor-notice.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
 import { settleHostShellAtBoot } from "../plugins/host-platform.js";
 import { seatText } from "../trace/exit-seat.js";
@@ -70,7 +71,8 @@ export async function settleHostLaneShell(config, logger) {
         return;
     await settleHostShellAtBoot(logger);
 }
-export function warnReadDenyFloorUnkept(config, logger) {
+export function settleReadDenyFloor(config, logger) {
+    installReadDenyFloorDeployment(config);
     const note = buildReadDenyFloorUnkeptNote(config);
     if (note !== undefined)
         logger.warn("read_deny_floor_required_unkept", { provider: config.remoteExec.provider, note });

package/dist/boot/exit-boundary.d.ts

@@ -24,7 +24,7 @@
  * 不是退出边界)。
  */
 import { type TaskRegistry } from "@sema-agent/core";
-import type { Logger } from "../observability/logger.js";
+import { type Logger } from "../observability/logger.js";
 /**
  * 退出边界的硬收面**此刻**会收掉的后台 shell 行数(`background_bash` + `monitor`,在跑,整张进程级注册表,retain 行按
  * {@link PROCESS_EXIT_INCLUDES_RETAINED} 跳过)—— 「引擎现在退,会不会把一条在跑的后台 shell 一起收掉」这一问的**唯一**读法。
@@ -37,7 +37,7 @@ import type { Logger } from "../observability/logger.js";
  *
  * 读不出(core:某行 env 的 retain 声明读抛 ⇒ 计数抛)⇒ 按 **1** 计并经 `onUnreadable` 报出 —— 读不出 ⇒ 非空闲,与驻留项同一条律;
  * 本函数在租约拍(定时器回调)、`/health` 与交接口里被调,**不许抛**(定时器里一抛就是 uncaught,一台交接出去的引擎会因此崩掉并收掉它本该留着的 shell)——
- * 报口自己再抛(抛出物转不成文本之类)也一样:落 `console.error`(不回同一只报口),读数照返 1。
+ * 报口自己再抛(抛出物转不成文本之类)也一样:落日志出口接缝的文本出口 `writeLogText`(不回同一只报口),读数照返 1。
  * `registry` 只供测试换桩(只用到 `countRunningBackgroundShells`)。
  */
 export declare function countShellsExitWouldKill(opts: {

package/dist/boot/exit-boundary.js

@@ -1,5 +1,6 @@
 import { defaultTaskRegistry } from "@sema-agent/core";
 import { reportHardKillReceipts } from "../background-session-reap.js";
+import { writeLogText } from "../observability/logger.js";
 import { liveHostForegroundChildCount, reapHostForegroundChildren } from "../plugins/host-platform.js";
 import { liveEphemeralHostWorkspaceCount, reapEphemeralHostWorkspaces } from "../plugins/host-workspace-registry.js";
 import { seatText } from "../trace/exit-seat.js";
@@ -14,7 +15,7 @@ export function countShellsExitWouldKill(opts) {
             opts.onUnreadable(err);
         }
         catch (reportErr) {
-            console.error("engine_handover_shell_count_report_threw", reportErr);
+            writeLogText("stderr", "engine_handover_shell_count_report_threw", reportErr);
         }
         return 1;
     }
@@ -70,19 +71,19 @@ export function installProcessExitBoundary({ logger }) {
             reapOwnChildProcesses();
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_child_reap_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_child_reap_threw", err);
         }
         try {
             reapBackgroundHard();
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_background_hard_kill_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_background_hard_kill_threw", err);
         }
         try {
             reapOwnHostWorkspaces();
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_workspace_reap_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_workspace_reap_threw", err);
         }
         const left = { foregroundChildren: liveHostForegroundChildCount(), hostWorkspaces: liveEphemeralHostWorkspaceCount() };
         try {
@@ -91,7 +92,7 @@ export function installProcessExitBoundary({ logger }) {
                 logger.warn("shutdown_exit_boundary_incomplete", left);
         }
         catch (err) {
-            console.error("shutdown_exit_boundary_log_threw", err);
+            writeLogText("stderr", "shutdown_exit_boundary_log_threw", err);
         }
     };
     process.once("exit", onProcessExit);

package/dist/boot/fatal-exit.d.ts

@@ -18,12 +18,10 @@ export declare function buildFatalErrorText(err: unknown): string;
  * ── 修 ─────────────────────────────────────────────────────────────────────────────────────────
  * **同一只产物**再原样多行写一份到 stderr。刻意不做的三件:不铸第二份文案(两份措辞必然分叉)、不加
  * pretty 旋钮(一个只有出错时才走的出口不该有配置面)、JSON 行**照旧**(机读面零回退,scraper 不动)。
- * 两个面都在 stderr,次序=先机器行后人读段。**这个次序还承重**:`createLogger()` 的构造会装上 stdio 的
- * EPIPE 无害化监听(见 `observability/logger.ts` 那段注 —— 宿主把 stderr 接管道又先退时,下一次写会发一个
- * 异步 `'error'`,无监听即致命),所以那条裸 `process.stderr.write` **必须**排在它之后;同步抛由下面的
- * `try/finally` 兜住。
+ * 两个面都在 stderr,次序=先机器行后人读段;两个面都经日志出口接缝(`observability/logger.ts`:同一只秘密形筛、同一只
+ * 物理写,EPIPE 无害化监听由接缝在每次写之前装好),同步抛由下面的 `try/finally` 兜住。
  *
- * 全仓两个 fatal 出口(`main.ts` 的 `main().catch` 与 `run-local.ts` 的同名尾巴)都经这里 —— 后者此前
+ * 全仓三个 fatal 出口(`main.ts` 的 `main().catch`、起服前探针 `model-plane-probe.ts` 的同名尾巴与 `run-local.ts` 的那一只)都经这里 —— run-local 此前
  * 连形状律都没过(裸 `String(err)`),两处各写一遍正是「同类不同命」的土壤。
  */
 export declare function fatalExit(err: unknown): never;

package/dist/boot/fatal-exit.js

@@ -1,5 +1,5 @@
 import { redactSecrets } from "../trace/redact.js";
-import { createLogger } from "../observability/logger.js";
+import { createLogger, writeLogText } from "../observability/logger.js";
 export function buildFatalErrorText(err) {
     const code = err instanceof Error ? err.code : undefined;
     return redactSecrets(typeof code === "string" && err instanceof Error ? `${err.name} [${code}]: ${err.message}` : String(err));
@@ -8,7 +8,7 @@ export function fatalExit(err) {
     const text = buildFatalErrorText(err);
     try {
         createLogger().error("fatal", { err: text });
-        process.stderr.write(text + "\n");
+        writeLogText("stderr", text);
     }
     finally {
         process.exit(1);

package/dist/boot/leader.d.ts

@@ -81,5 +81,20 @@ export declare function leaderK8sMinioGap(leaderEnabled: boolean, leaderProvider
  * 而承担的方式是重复的真实推送。
  */
 export declare function assertLeaderDurableStore(leaderEnabled: boolean, hasLeaderRunStore: boolean): void;
+/**
+ * leader 的对象存储座(F2(a) 工厂模式的 diff-out:worker 自传补丁到 `<桶>/leader-diff/…`,leader 用同桶的 presigned GET 取回)。纯数据:三键齐(`MINIO_ENDPOINT` /
+ * `MINIO_ACCESS_KEY` / `MINIO_SECRET_KEY`)⇒ `{ s3 }`,否则 `{}`(静态兼容模式;k8s 车道要它)。
+ * 桶 = `MINIO_BUCKET`,缺席 = 工作区快照桶的**缺省名**(`WORKSPACE_SNAPSHOT_BUCKET_DEFAULT`,同一只常量)。两根旋钮各自独立:改了 `WORKSPACE_SNAPSHOT_BUCKET` 的部署,
+ * leader 的补丁仍落 `MINIO_BUCKET` 那一只 —— 要同桶就两根同设(目录两行写明)。
+ */
+export declare function buildLeaderObjectStore(env?: NodeJS.ProcessEnv): {
+    readonly s3?: {
+        endpoint: string;
+        bucket: string;
+        accessKey: string;
+        secretKey: string;
+        region?: string;
+    };
+};
 export declare function createLeaderFace(ctx: LeaderCtx): ReturnType<typeof createLeaderEndpoint> | undefined;
 //# sourceMappingURL=leader.d.ts.map

package/dist/boot/leader.js

@@ -1,8 +1,10 @@
 import { createLeaderEndpoint } from "../leader/endpoint.js";
-import { createLeaderRunVisibility } from "../http/owner-access.js";
-import { createLeaderRunner } from "../leader/wire.js";
-import { buildDeploymentPostureSeats } from "./runner-deps.js";
+import { seesRunAs } from "../http/owner-access.js";
+import { claimCallerOf } from "../security.js";
+import { createLeaderParkExpirer, createLeaderRunner } from "../leader/wire.js";
+import { buildDeploymentPostureSeats, buildHandsBand } from "./runner-deps.js";
 import { hasApprovalListIntent } from "../approval.js";
+import { WORKSPACE_SNAPSHOT_BUCKET_DEFAULT } from "../object-store-buckets.js";
 export function leaderK8sMinioGap(leaderEnabled, leaderProvider, hasS3) {
     if (!(leaderEnabled && leaderProvider === "k8s" && !hasS3))
         return null;
@@ -21,19 +23,17 @@ export function assertLeaderDurableStore(leaderEnabled, hasLeaderRunStore) {
         "without it a retry starts a SECOND real git push. Fix the database (or unset LEADER_ENABLED) and restart " +
         "(#193 车4 件2 capability gate; the DB_BACKEND literal check in config.ts is the intent half of the same rule)");
 }
+export function buildLeaderObjectStore(env = process.env) {
+    const endpoint = env.MINIO_ENDPOINT;
+    const accessKey = env.MINIO_ACCESS_KEY;
+    const secretKey = env.MINIO_SECRET_KEY;
+    if (!endpoint || !accessKey || !secretKey)
+        return {};
+    return { s3: { endpoint, bucket: env.MINIO_BUCKET ?? WORKSPACE_SNAPSHOT_BUCKET_DEFAULT, accessKey, secretKey, ...(env.MINIO_REGION ? { region: env.MINIO_REGION } : {}) } };
+}
 export function createLeaderFace(ctx) {
     const { config, logger, brain, pricing, executionEnvFactory, toolResultStore, sessionStore, checkpointStore, checkpointCtxSealing, governanceSeams } = ctx;
-    const leaderMinio = process.env.MINIO_ENDPOINT && process.env.MINIO_ACCESS_KEY && process.env.MINIO_SECRET_KEY
-        ? {
-            s3: {
-                endpoint: process.env.MINIO_ENDPOINT,
-                bucket: process.env.MINIO_BUCKET ?? "workspaces",
-                accessKey: process.env.MINIO_ACCESS_KEY,
-                secretKey: process.env.MINIO_SECRET_KEY,
-                ...(process.env.MINIO_REGION ? { region: process.env.MINIO_REGION } : {}),
-            },
-        }
-        : {};
+    const leaderMinio = buildLeaderObjectStore();
     const leaderProvider = config.remoteExec.provider;
     const leaderRunStore = ctx.backend?.leaderRun?.();
     assertLeaderDurableStore(config.leaderEnabled, leaderRunStore !== undefined);
@@ -60,6 +60,7 @@ export function createLeaderFace(ctx) {
             ...(ctx.promptSource ? { promptSource: ctx.promptSource } : {}),
             ...(ctx.onError ? { onError: ctx.onError } : {}),
             mods: ctx.deploymentMods,
+            hands: buildHandsBand(config, undefined),
             fanoutEnabled: config.leaderFanoutEnabled,
             ...(process.env.MODEL_ROUTER_ID ? { routerModel: process.env.MODEL_ROUTER_ID } : {}),
             ...(leaderProvider === "e2b" ? { e2bApiKey: config.remoteExec.apiKey } : {}),
@@ -87,7 +88,8 @@ export function createLeaderFace(ctx) {
             logger,
             requiredFields: ["objective", "durableRemote", "testCmd", "seedCmd", "baseSha"],
             ...(leaderRunStore ? { store: leaderRunStore } : {}),
-            ownerVisible: createLeaderRunVisibility(config),
+            ownerVisible: (subject, owner) => seesRunAs("run.leader", claimCallerOf(subject ?? undefined, config), owner ?? null),
+            ...(checkpointStore ? { expireWorkerParks: createLeaderParkExpirer(checkpointStore) } : {}),
         })
         : undefined;
     if (leaderEndpoint)