@sema-agent/server 7.150.0 → 7.151.0

package/dist/approval-gate-currency.d.ts

@@ -3,7 +3,7 @@
  *
  * ## 病灶(为什么要有这一只)
  * 问账行 `PARKED` 是终态(`approval-ask-machine.ts`:`PARKED: []`):赎回腿的单赢者是 **checkpoint 的 CAS**,取消腿动的也是 checkpoint(先 `expire` 门、再驱 run 终局),
- * 两条腿都不写 ask 行。于是「这张卡的门还在不在」这件事只有 checkpoint 店知道;读口若只看行,就会在卡被答过 / run 被取消之后继续说 `parked` 并指路去决定,
+ * 两条腿都不改 ask 行的态(赎回受理之后只把决定记在行上,行仍 `PARKED`;门被引擎重开了行也不知道)。于是「这张卡的门还在不在」这件事只有 checkpoint 店知道;读口若只看行,就会在卡被答过 / run 被取消之后继续说 `parked` 并指路去决定,
  * 而应答口对同一张卡早已答 `409 approval_stale`。同一件事两个读法 —— 本模块把它收成一个:读的是同一个问题、同一个来源。
  *
  * ## 判官

package/dist/auth-bridge.d.ts

@@ -1,5 +1,6 @@
 import { VerifiedIdentity, type AuthBridgeErrorCode } from "@sema-agent/settings-schema/api/auth-bridge";
 import { type TokenScopeRefusal } from "@sema-agent/settings-schema/api/scopes";
+import type { ServiceConfig } from "./config-types.js";
 import type { Logger } from "./observability/logger.js";
 import type { Metrics } from "./observability/metrics.js";
 export interface WebAdminJwtVerifierOptions {
@@ -58,6 +59,25 @@ type ReportedOutcome = {
  * (调用方按验证失败处置:不设身份 ⇒ 门答 generic 401)。验证失败的结局验证器自己已记过账,这里只答「不装」。
  */
 export declare function admitBridgeIdentity(outcome: ReportedOutcome, sinks: BridgeSinks): BridgeIdentity | undefined;
+/**
+ * [ref] —— 「本 worker 把登录令牌绑在哪个 scope」的**唯一读口**(判官 {@link ssoForeignScope} 与起服行 `auth_bridge_enabled` 同读)。
+ *  · fleet 成员(`FLEET_GENERATION` 在场 —— 「是不是 fleet 形」在本仓的那一个读数,配置目录行「缺席 ⇔ 非 fleet 成员」)⇒ `config.fleetScope`:
+ *    env `FLEET_SCOPE` 的唯一读数(缺席 = 契约缺省 scope),排空口的身份比对读的就是这一个值 —— 一个事实一个读数,不另读 env。
+ *    编排器给每台受管引擎同拍渲成员代际与 `FLEET_SCOPE`;成员却缺 `FLEET_SCOPE` ⇒ 绑在缺省 scope(偏多拒,与排空口同读,不读成「不绑」)。
+ *  · 非成员(手接 / 壳起的个人引擎)⇒ `undefined` = 不绑:令牌的 scope 就是它的用户自己的空间,准入不比对(本仓不为这一形猜一个空间)。
+ */
+export declare function ssoBoundScopeOf(config: Pick<ServiceConfig, "fleetGeneration" | "fleetScope">): string | undefined;
+/**
+ * [ref] —— **sso 准入的 scope 相等判**(唯一判官;唯一调用点 = `http/dispatch.ts` 的入口预认证)。入参是**已装**的桥身份({@link admitBridgeIdentity} 交出的,
+ * scope 已由 `readTokenScope` 读定、恒在)。本 worker 绑了 scope 而令牌的 scope 不是它 ⇒ 拒,交回两只 scope(只进运维日志;HTTP 体不带本 worker 的 scope ——
+ * 那是另一个空间的名字);不绑或相等 ⇒ `undefined`(装)。逐字比较,不规范化(两边都是 scope id 形;不同就是不同)。
+ */
+export declare function ssoForeignScope(identity: {
+    readonly scope: string;
+}, config: Pick<ServiceConfig, "fleetGeneration" | "fleetScope">): {
+    readonly tokenScope: string;
+    readonly boundScope: string;
+} | undefined;
 /**
  * The live object `createWebAdminJwtVerifier` produces — a single `verify` entry point over the process-level JWKS cache, and the issuer it verifies for.
  * This is also the type of the injected seat (`ServiceDeps.webAdminJwtVerifier`): an embedder's verifier states which issuer it verifies, so `createHttpServer`

package/dist/auth-bridge.js

@@ -23,6 +23,15 @@ export function admitBridgeIdentity(outcome, sinks) {
     }
     return { ...rest, scope: scoped.scope, ...(inc.data !== undefined ? { principalInc: inc.data } : {}) };
 }
+export function ssoBoundScopeOf(config) {
+    return config.fleetGeneration === undefined ? undefined : config.fleetScope;
+}
+export function ssoForeignScope(identity, config) {
+    const boundScope = ssoBoundScopeOf(config);
+    if (boundScope === undefined || identity.scope === boundScope)
+        return undefined;
+    return { tokenScope: identity.scope, boundScope };
+}
 export const DEFAULT_JWKS_TTL_SEC = 15 * 60;
 export const JWKS_FETCH_TIMEOUT_MS = 10_000;
 const MAX_JWKS_BYTES = 256 * 1024;

package/dist/background-session-reap.d.ts

@@ -42,7 +42,7 @@ export interface SessionHardReap {
  *     `no_pgid`(未确认)、linux ⇒ `killed`;已收割 ⇒ `already_gone`。受据按观察答([ref] 车PA 删了「已硬收过」闩:组信号任一成员收到即
  *     成功,闩在部分送达时把活着读成没了),本函数也不为「让硬面先打」挪任何一拍。
  *
- * `scope` = 会话行属主 `owner ?? "default"`(与 core 注册铸值 `spec.principal ?? "default"` 同源 —— 缺席 scope 在 core 的
+ * `scope` = 会话的引擎租户分区 `sessionTenantScope`(唯一换算 `engineScopeOfOwner`,与 core 注册铸值同源 —— 缺席 scope 在 core 的
  * `canAccess` 上 fail-closed、一行都收不到,[ref] 钉过这一病)。
  *
  * 两处调用(见文件头 ①),都 `await`:E21 删除级联 `includeRetained:false`(显式活服务照留);停止口照传请求体。应答在硬面之后发,

package/dist/bake-runner/main.d.ts

@@ -16,7 +16,8 @@ interface RunnerEnv {
 }
 /**
  * bake-runner 的 **env 契约**(本进程只读这些;成文另见 USAGE.md §9.7):
- *  · 必填:`IMAGE_API_BASE`(image-api 根,尾斜杠去掉)、`BAKE_RUNNER_TOKEN`(claim / heartbeat 的运维主体 bearer;不进日志、不进子进程)。
+ *  · 必填:`IMAGE_API_BASE`(image-api 根,尾斜杠去掉)、`BAKE_RUNNER_TOKEN`(claim / heartbeat 的运维主体 bearer;不进日志、不进子进程 —— 它是本包的自有凭据,
+ *    登记在 `config-catalog.ts` `BAKE_RUNNER_CREDENTIAL_ENV`,起服第一步按名与按值向引擎声明:任何子进程组都拿不到它与它的同值副本,`BAKE_ENV_ALLOW` 点到它 ⇒ 拒启)。
  *  · `BAKE_RUNNER_ID`(缺省 `bake-runner-<HOSTNAME>`)、`RECIPE_REF`(缺省 `HEAD` = 用现成 checkout)、`RECIPE_DIR`(缺省 `/opt/recipes`)、
  *    `BUILD_SH_PATH`(缺省 `e2b-template/dev-sandbox/build.sh`)、`BAKE_DATA_DIR`(缺省 `/data`)、`LOG_LEVEL`(缺省 info)。
  *  · 数值四键(`parseNumOrFailNonNegative`,非数 / 负数拒启):`BAKE_HEARTBEAT_MS`(30000)、`BAKE_IDLE_POLL_MS`(5000)、
@@ -24,7 +25,8 @@ interface RunnerEnv {
  *  · `BAKE_ENV_ALLOW=NAME,NAME`(7.103.0,[ref] 残余):本进程 spawn 的每一只子进程组(build.sh 与 git fetch / docker push /
  *    docker image inspect / df)的 env 缺省 = 本进程 env 剥密(runner 自己的 `BAKE_RUNNER_TOKEN` 在内);名单点到的键从本进程 env **原样**
  *    放回(部署方显式承担 —— 例如配方脚本真要一枚 `*_PASSWORD` 做 registry 登录)。与服务侧 `LSP_ENV_ALLOW` **同一只**解析器
- *    (`config.ts` `parseEnvNameAllowlist`)与同一只放行谓词:形错(空段 / 尾逗号 / 非变量名形 / 点名任一只名单型旋钮)⇒ **拒启**,拒句点名
+ *    (`config.ts` `parseEnvNameAllowlist`)与同一只放行谓词:形错(空段 / 尾逗号 / 非变量名形 / 点名任一只名单型旋钮 / 点名本包自有凭据 —— 名是,
+ *    或值是,runner 自己的 `BAKE_RUNNER_TOKEN` 在内)⇒ **拒启**,拒句点名
  *    旋钮与段号、不回显值;本进程环境里没有的名 ⇒ 起服 `config_env_entry_rejected` 只报序号、不放行;旋钮原文本身按凭据类,不进子进程。
  *    没有多租户姿态(构建宿主守护进程没有主体 / 租户);生效名单见起服行 `bake_runner_start.envAllow`(只键名)。
  *    ⚠️ 这不是服务配置目录里的键(目录 `BAKE_*` 行是服务侧 bake API 的旋钮),服务进程不读它。

package/dist/bind-host.d.ts

@@ -7,9 +7,8 @@ export interface BindHostConfig {
     authToken?: string;
     authTokens?: Record<string, string>;
 }
-/** 这台部署配了任何一把 service 凭据吗(`SERVICE_AUTH_TOKEN` / `SERVICE_AUTH_TOKENS`)。 */
-export declare function anyServiceCredential(config: Pick<BindHostConfig, "authToken" | "authTokens">): boolean;
-/** 无鉴权写面(`ALLOW_UNAUTHED_WRITES`)+ 零凭据 ⇒ 起服把监听地址收窄到 loopback(见 {@link resolveBindHost})。 */
+/** 无鉴权写面(`ALLOW_UNAUTHED_WRITES`)+ 全局凭据门不武装(没配 service 凭据,`hasServiceAuth`)⇒ 起服把监听地址收窄到 loopback(见 {@link resolveBindHost})。
+ *  逃生口开着时写门不拒,而门不武装 ⇒ 能连上这个口的都能写 —— 鉴权桥在不在不改这一句(验不过 / 不带令牌的调用方照样过)。 */
 export declare function bindMustNarrow(config: Pick<BindHostConfig, "allowUnauthedWrites" | "authToken" | "authTokens">): boolean;
 /**
  * 这台进程的监听地址(绑址旋钮 + 无鉴权自收窄)。`undefined` = Node 缺省全接口。

package/dist/bind-host.js

@@ -1,10 +1,8 @@
 import { isIP } from "node:net";
 import { canonicalAddress } from "./net-address.js";
-export function anyServiceCredential(config) {
-    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
-}
+import { hasServiceAuth } from "./identity-source.js";
 export function bindMustNarrow(config) {
-    return Boolean(config.allowUnauthedWrites) && !anyServiceCredential(config);
+    return Boolean(config.allowUnauthedWrites) && !hasServiceAuth(config);
 }
 export function resolveBindHost(config) {
     const mustNarrow = bindMustNarrow(config);

package/dist/boot/budget-tracing.js

@@ -34,7 +34,7 @@ export function createBudgetAndTracing(ctx) {
     const tracer = createTracer(metrics, costQuota, modelUsageTracker, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1, promptManifestTracker);
     const sideQueryAccounting = createSideQueryAccountant(metrics, costQuota, fleetUsage, fleetLease, (m) => config.modelQuotaWeights[m] ?? 1);
     const toolResultStore = backend?.toolResult ? backend.toolResult() : undefined;
-    const sessionPolicyStore = backend ? backend.sessionPolicy(logger) : undefined;
+    const sessionPolicyStore = backend ? backend.sessionPolicy() : undefined;
     const { store: fileHistoryStore, erasure: fileHistoryErasure } = assembleFileHistory(backend);
     return {
         brain, degradeRouteWatch, pricing, counterDegradeHook, costQuota, modelUsageTracker, promptManifestTracker,

package/dist/boot/engine-lease.d.ts

@@ -245,6 +245,9 @@ export interface EngineLeaseExitReport {
  *  · `tickMs` = 自退检查的采样拍。自退发生在**生效窗**满之后、至多再晚一拍(顶注 8);生效窗恒 ≥ `lingerMs`(`lingerMs` 是各窗里最短的一个),所以触点比 `lingerMs` 密 ⇒ 在任何状态下都先于自退。
  *    读数**不预言**自退时刻:父还活着时生效的是 owned 窗,自退只会更晚。
  *  · `lane`([ref])= 此刻的车道(与自退判据同一只派生函数,每次现读)。
+ *  · `attached`([ref])= 本副本此刻**打开着的 SSE 流**条数 —— 与自退判据第一合取(`attachedStreams() === 0`)读**同一只**读口(`deps.attachedStreams()`),每次现读,不是采样拍的缓存。
+ *    哪些算、哪些不算写在契约 `/health` 节计法表的「附着」一列(与 `inflightBreakdown` 的「总数 / 阻断」两列同一张表):订阅流与流式提交腿算,后台腿、无流的同步腿、leader 腿不算。
+ *    它是**附着流条数,不是活跃调用方**:纯轮询壳(零 SSE)与毫秒级请求的下采样读到 0 合法 —— 判「这台引擎此刻有没有人在用」要连 `inflight` 与最近触点一起读(顶注 3),不能拿 `attached === 0` 当「没人」。
  *
  * ## 一源
  * 与租约腿自己的行为同一处铸出:`engine_lease_armed` 日志、自退判据用的窗、拍频推导(`tickMs = min(15s, 最短窗)`)和本读数读的是同一组数 ——
@@ -255,6 +258,8 @@ export interface EngineLeaseFacts {
     readonly tickMs: number;
     /** [ref]:此刻的车道。 */
     readonly lane: EngineLane;
+    /** [ref]:此刻打开着的 SSE 附着流条数(整数,≥ 0;语义与读口见上「报的是什么」一条 —— 附着流条数,不是活跃调用方)。 */
+    readonly attached: number;
     /** [ref] 首窗格({@link EngineLeaseFirstAttachFacts}):候首触窗有限(owned 窗有限)才在场 —— 永不到期的窗不上 wire(同上一段那条律)。 */
     readonly firstAttach?: EngineLeaseFirstAttachFacts;
     /** [ref] 交接格({@link EngineHandoverFacts}):只在 handover 车道在场。 */

package/dist/boot/engine-lease.js

@@ -184,6 +184,7 @@ export function createEngineLeaseTracker(deps) {
                 lingerMs: shortestLingerMs,
                 tickMs,
                 lane: laneNow().lane,
+                attached: deps.attachedStreams(),
                 ...(firstAttach !== undefined ? { firstAttach } : {}),
                 ...(handover !== undefined ? { handover } : {}),
             });

package/dist/boot/execution-env.d.ts

@@ -19,6 +19,7 @@ import { type LocalDockerCapacity } from "../plugins/local-docker-capacity.js";
 import * as facts from "../capability-facts.js";
 import { type TaskAttachmentStore } from "../plugins/task-attachment-store.js";
 import type { TaskInheritEnv } from "../request-value-closure.js";
+import { type SessionBindings, type SessionBindingSeat } from "../session-bindings.js";
 import { type HeadRead } from "../session-incarnation.js";
 import type { SpaceReclaimer } from "../workspace-space.js";
 import { type SessionResidentCounts } from "../session-resident-background.js";
@@ -43,20 +44,11 @@ import { type SessionResidentCounts } from "../session-resident-background.js";
  * 那一个副本上发生。跨副本的陈值靠「读面必经本副本的一次提交 ⇒ 必过本副本的围栏」兜住 —— 这条推理成立
  * 是因为 run 在受理它的那个副本上执行(ARCHITECTURE 副本模型)。device lane 的部署形本身也是单副本(§4.6)。
  */
-export interface SessionScopedRegistries {
+export interface SessionScopedRegistries extends SessionBindingSeat {
     readonly perSessionCwd: Map<string, string>;
     readonly perSessionShellEnv: Map<string, Record<string, string>>;
-    /** [ref]:host shell 的继承策略(`inheritEnv` 请求键)。只读面给 host 工厂包装;写只经 {@link setSessionInheritEnv}。 */
+    /** [ref]:host shell 的继承策略(`inheritEnv` 请求键)。只读面给 host 工厂包装。 */
     readonly perSessionInheritEnv: ReadonlyMap<string, TaskInheritEnv>;
-    setSessionCwd(sid: string, cwd: string): void;
-    setSessionShellEnv(sid: string, env: Record<string, string>): void;
-    /**
-     * [ref] —— 第三只 per-session 绑定(与 cwd / shellEnv 同一只 LRU 权威、同一条围栏、同一条删除)。
-     * `undefined` = **清掉**这一格(不是「不动」):`inheritEnv` 是「本条请求要什么」,缺席的请求要的是缺省清洗 ——
-     * 与 cwd / shellEnv 的「缺席 = 留着上一条的值」刻意不同(那两位由壳每条请求重发,粘住无害;这一位粘住 = 替一个没说话的
-     * 请求放宽凭据面)。
-     */
-    setSessionInheritEnv(sid: string, policy: TaskInheritEnv | undefined): void;
     /** 本进程见过的会话 → 属主(围栏表本身,只读视图;`null` = 匿名)。**会话驻留后台行的枚举源**:`session-resident-background.ts` 逐会话问注册表
      *  (core 的访问元组要带 scope,没有进程总数的读口),读的就是这一张 —— 每次提交写一笔、`dropSession` 清一笔、LRU 有界,不另立第二张会话名册。 */
     readonly sessionOwners: ReadonlyMap<string, string | null>;
@@ -178,9 +170,11 @@ export declare function createExecutionEnv(ctx: ExecutionEnvCtx): {
     perTaskImage: PerTaskImageRegistry;
     sessionEnvSelection: SessionEnvironmentSelection;
     perSessionCwd: Map<string, string>;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
-    setSessionInheritEnv: (sid: string, policy: TaskInheritEnv | undefined) => void;
+    sessionBindings: {
+        commitSessionBindings: (sessionId: string, bindings: SessionBindings) => import("../session-bindings.js").SessionBindingReceipt;
+        withdrawSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+        settleSessionBindings: (receipt: import("../session-bindings.js").SessionBindingReceipt) => boolean;
+    };
     fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;
     dropSessionScoped: (sid: string) => void;
     dropSessionScopedOf: (sid: string, incarnation: string) => boolean;

package/dist/boot/execution-env.js

@@ -32,6 +32,7 @@ import { reapOrphanWorktrees, withWorktreeIsolation } from "../plugins/worktree-
 import { derivePkgSourceEnv } from "../sandbox-pkg-source.js";
 import { effectiveHostWorkspace } from "../task-cwd.js";
 import { taskInheritEnvRefusal } from "../hosted-posture.js";
+import { bindingsOf } from "../session-bindings.js";
 import { sessionFaceOfHead } from "../session-incarnation.js";
 import { isCodeToken } from "../terminal.js";
 import { createCacheMissMemory } from "../workspace-cache.js";
@@ -61,16 +62,40 @@ function sandboxLaneEnvMerged(lane) {
     return Object.keys(merged).length > 0 ? merged : undefined;
 }
 const MAX_CWD_SESSIONS = 4096;
+function withWrites(cells, writes) {
+    return bindingsOf(writes.cwd ?? cells.cwd, writes.shellEnv !== undefined ? { ...writes.shellEnv } : cells.shellEnv, writes.inheritEnv);
+}
+function restoreCell(map, sid, value) {
+    if (value === undefined)
+        map.delete(sid);
+    else
+        map.set(sid, value);
+}
 export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
     const perSessionCwd = new Map();
     const perSessionShellEnv = new Map();
     const perSessionInheritEnv = new Map();
     const owners = new Map();
     const occupants = new Map();
+    const logs = new Map();
+    const cellsOf = (sid) => bindingsOf(perSessionCwd.get(sid), perSessionShellEnv.get(sid), perSessionInheritEnv.get(sid));
+    const materialize = (sid, log) => {
+        const cells = log.entries.reduce((acc, e) => withWrites(acc, e.writes), log.base);
+        restoreCell(perSessionCwd, sid, cells.cwd);
+        restoreCell(perSessionShellEnv, sid, cells.shellEnv);
+        restoreCell(perSessionInheritEnv, sid, cells.inheritEnv);
+    };
+    const compact = (sid, log) => {
+        while (log.entries[0]?.settled === true)
+            log.base = withWrites(log.base, log.entries.shift().writes);
+        if (log.entries.length === 0)
+            logs.delete(sid);
+    };
     const dropSession = (sid) => {
         perSessionCwd.delete(sid);
         perSessionShellEnv.delete(sid);
         perSessionInheritEnv.delete(sid);
+        logs.delete(sid);
         owners.delete(sid);
         occupants.delete(sid);
     };
@@ -85,22 +110,34 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
         perSessionCwd,
         perSessionShellEnv,
         sessionOwners: owners,
-        setSessionCwd: (sid, cwd) => {
-            perSessionCwd.set(sid, cwd);
+        perSessionInheritEnv,
+        commitSessionBindings: (sid, bindings) => {
+            const log = logs.get(sid) ?? { base: cellsOf(sid), entries: [] };
+            logs.set(sid, log);
+            const token = Symbol(sid);
+            log.entries.push({ token, writes: { ...bindings, ...(bindings.shellEnv !== undefined ? { shellEnv: { ...bindings.shellEnv } } : {}) }, settled: false });
+            materialize(sid, log);
             touch(sid, undefined);
+            return { sessionId: sid, token };
         },
-        setSessionShellEnv: (sid, env) => {
-            perSessionShellEnv.set(sid, env);
-            touch(sid, undefined);
+        withdrawSessionBindings: (receipt) => {
+            const log = logs.get(receipt.sessionId);
+            const at = log?.entries.findIndex((e) => e.token === receipt.token) ?? -1;
+            if (log === undefined || at < 0)
+                return false;
+            log.entries.splice(at, 1);
+            materialize(receipt.sessionId, log);
+            compact(receipt.sessionId, log);
+            return true;
         },
-        perSessionInheritEnv,
-        setSessionInheritEnv: (sid, policy) => {
-            if (policy === undefined) {
-                perSessionInheritEnv.delete(sid);
-                return;
-            }
-            perSessionInheritEnv.set(sid, policy);
-            touch(sid, undefined);
+        settleSessionBindings: (receipt) => {
+            const log = logs.get(receipt.sessionId);
+            const entry = log?.entries.find((e) => e.token === receipt.token);
+            if (log === undefined || entry === undefined)
+                return false;
+            entry.settled = true;
+            compact(receipt.sessionId, log);
+            return true;
         },
         fenceSessionOwner: (sid, owner, incarnation) => {
             const ownerChanged = owners.has(sid) && owners.get(sid) !== owner;
@@ -113,6 +150,7 @@ export function createSessionScopedRegistries(maxEntries = MAX_CWD_SESSIONS) {
                 perSessionCwd.delete(sid);
                 perSessionShellEnv.delete(sid);
                 perSessionInheritEnv.delete(sid);
+                logs.delete(sid);
             }
             touch(sid, owner);
         },
@@ -250,9 +288,7 @@ export function createExecutionEnv(ctx) {
     const perTaskImage = new PerTaskImageRegistry();
     const sessionEnvSelection = new SessionEnvironmentSelection();
     const sessionScoped = createSessionScopedRegistries();
-    const { perSessionCwd, setSessionCwd } = sessionScoped;
-    const { perSessionShellEnv, setSessionShellEnv } = sessionScoped;
-    const { perSessionInheritEnv, setSessionInheritEnv } = sessionScoped;
+    const { perSessionCwd, perSessionShellEnv, perSessionInheritEnv } = sessionScoped;
     const lspManager = createLspManager(config, (event, fields) => logger.info(event, fields));
     if (lspManager)
         logger.info("lsp_enabled", { provider: config.remoteExec.provider });
@@ -533,7 +569,8 @@ export function createExecutionEnv(ctx) {
         },
     });
     return {
-        perTaskImage, sessionEnvSelection, perSessionCwd, setSessionCwd, setSessionShellEnv, setSessionInheritEnv,
+        perTaskImage, sessionEnvSelection, perSessionCwd,
+        sessionBindings: { commitSessionBindings: sessionScoped.commitSessionBindings, withdrawSessionBindings: sessionScoped.withdrawSessionBindings, settleSessionBindings: sessionScoped.settleSessionBindings },
         fenceSessionOwner: sessionScoped.fenceSessionOwner,
         dropSessionScoped: sessionScoped.dropSession,
         dropSessionScopedOf: sessionScoped.dropSessionOf,

package/dist/boot/execution-lane.js

@@ -1,7 +1,7 @@
 import { loadRemoteExec } from "@sema-agent/settings-schema/node";
 import { assertLocalConfigDirTrusted } from "../config-dir-trust.js";
 import { crossInvariant } from "../config-invariants.js";
-import { entryDeclarableRemoteExec } from "../config.js";
+import { entryDeclarableRemoteExec, FILE_LANE_CELL_ENV, logConfigDiagnostics, parseHostLaneEnv, parseLocalDockerLaneEnv, } from "../config.js";
 import { ALL_EXECUTION_LANES, buildReadDenyFloorUnkeptNote, laneIsolated, laneWiresExecutionEnv } from "../execution-lane-caps.js";
 import { installReadDenyFloorDeployment } from "../read-deny-floor-notice.js";
 import { buildReadFacePostureNotice, settleDerivedReadFace } from "../read-face-posture.js";
@@ -27,6 +27,29 @@ function fileLaneUnresolvableRefusal(entry, lane, envReading, root) {
         `(file-source name→value resolution is not wired yet), and ${envReading}. The file's declaration ends the lane selection: no other declaration may stand in for it. ` +
         `Refusing before any task starts: set REMOTE_EXEC=${lane} with that lane's required env, or change the file to the lane you mean.`);
 }
+function envReadingOfFileLane(minted, read, logger) {
+    if (minted !== undefined)
+        return minted;
+    const reading = read();
+    logConfigDiagnostics(logger);
+    return reading;
+}
+function discloseFileCellOverrides(lane, envReading, fileCells, logger, root) {
+    const cellEnvKeys = FILE_LANE_CELL_ENV[lane];
+    const keys = Object.entries(cellEnvKeys)
+        .filter(([cell]) => envReading[cell] !== undefined && fileCells[cell] !== undefined && envReading[cell] !== fileCells[cell])
+        .map(([, envKey]) => envKey);
+    if (keys.length === 0)
+        return;
+    logger.warn("remote_exec_file_overrides", {
+        provider: lane,
+        root,
+        keys,
+        note: `config.d/remote-exec.json (CONFIG_PROVIDER=local, file-wins) gives a different value than env for ${keys.join(", ")} on the "${lane}" lane — the file's value is in effect and ` +
+            `the env value for ${keys.length === 1 ? "that key is" : "those keys are"} INERT. The lane's other env parameters are read as usual. ` +
+            `Make the two agree: unset the env key if the file's value is the intended one, or change the file's cell (an optional cell can be removed from the file; "image" is mandatory there).`,
+    });
+}
 export async function composeExecutionLane(loaded, ctx) {
     if (ctx.configSource === "local")
         await applyRemoteExecFile(loaded, ctx);
@@ -127,25 +150,29 @@ async function applyRemoteExecFile(config, ctx) {
     };
     const drives = (lane) => ctx.entry.runs.includes(lane);
     if (fileRx.provider === "host" && drives("host")) {
-        config.remoteExec = {
-            provider: "host",
+        const envReading = envReadingOfFileLane(config.remoteExec?.provider === "host" ? config.remoteExec : undefined, parseHostLaneEnv, logger);
+        const fileCells = {
             ...(fileRx.workdir ? { workspaceBase: fileRx.workdir } : {}),
             ...(fileRx.commandTimeoutMs != null ? { commandTimeoutMs: fileRx.commandTimeoutMs } : {}),
         };
+        config.remoteExec = { provider: "host", ...envReading, ...fileCells };
         disclosePreemption("host");
+        discloseFileCellOverrides("host", envReading, fileCells, logger, localRoot);
         logger.info("remote_exec_from_file", { provider: "host", root: localRoot });
         return;
     }
     if (fileRx.provider === "local-docker" && drives("local-docker")) {
-        config.remoteExec = {
-            provider: "local-docker",
+        const envReading = envReadingOfFileLane(config.remoteExec?.provider === "local-docker" ? config.remoteExec : undefined, () => parseLocalDockerLaneEnv(config.requirePrincipal !== true), logger);
+        const fileCells = {
             image: fileRx.image,
             ...(fileRx.mountPath ? { mountPath: fileRx.mountPath } : fileRx.workdir ? { mountPath: fileRx.workdir } : {}),
             ...(fileRx.memory ? { memory: fileRx.memory } : {}),
             ...(fileRx.cpus != null ? { cpus: fileRx.cpus } : {}),
             ...(fileRx.network ? { network: fileRx.network } : {}),
         };
+        config.remoteExec = { provider: "local-docker", ...envReading, ...fileCells };
         disclosePreemption("local-docker");
+        discloseFileCellOverrides("local-docker", envReading, fileCells, logger, localRoot);
         logger.info("remote_exec_from_file", { provider: "local-docker", root: localRoot, image: fileRx.image });
         return;
     }

package/dist/boot/late-binds.d.ts

@@ -1,5 +1,5 @@
 /**
- * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 五只 cell,读点在前段、写点在后段。
+ * 晚绑席([ref] 十段切分的**唯一**跨段可变面)—— 六只 cell,读点在前段、写点在后段。
  *
  * 为什么是模块级 live binding 而不是 ctx 字段:读点的原文是**裸标识符**(`() => runStore`、
  * `() => parkedAskRedeem`),而 ctx 字段是**快照** —— 把读点改成 `ctx.runStore` 就是正文改写,
@@ -9,9 +9,10 @@
  *  · `parkedAskRedeem` / `runDenySweep` —— 它们的**声明行本身**就是 `let`(逐字搬进本文件,含缩进),
  *    赋值点(server 造出来之后那两处)也随之搬进 `bindServerLateSeats` —— 跨模块给 import 赋值是非法的,
  *    所以 cell 与它的写点必须同居一个模块;
- *  · `sessionNotifyDoor` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`)。
+ *  · `sessionNotifyDoor` / `runEndedHandoff` —— 同上一形(server 的产物,写点在 `bindServerLateSeats`);
+ *  · `sessionAgeOut` —— 会话老化腿(`boot/session-age-out.ts`):读点在第 8 段的维护拍,它要的删除协调器在第 9 段铸 ⇒ 写点 `bindSessionAgeOut` 在第 9 段协调器之后。
  *
- * 时序与修前逐字相同:五只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
+ * 时序与修前逐字相同:六只 cell 的读点全是 `() => x` 取值闭包(boot 期不求值,最早的求值发生在
  * listen 之后的请求/tick 上),写点仍在各自原来的那一拍。未绑窗内取值得到 `undefined` —— 这正是
  * 各消费座既有的 fail-closed 臂(device 限速座:`gate()` 取不到就抛,见 boot/device-lane.ts:68)。
  */
@@ -27,7 +28,10 @@ declare let rateLimiter: RateGate | undefined;
 declare let parkedAskRedeem: ParkedAskRedeem | undefined;
 declare let runDenySweep: ((now: number) => Promise<void>) | undefined;
 declare let sessionNotifyDoor: SessionNotifyDoor | undefined;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
+declare let runEndedHandoff: ((runId: string) => Promise<void>) | undefined;
+declare let sessionAgeOut: (() => Promise<unknown>) | undefined;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor, runEndedHandoff, sessionAgeOut };
+export declare function bindSessionAgeOut(v: (() => Promise<unknown>) | undefined): void;
 export declare function bindRunStore(v: ReturnType<StoreBackend["run"]> | undefined): void;
 export declare function bindRateLimiter(v: RateGate): void;
 export declare function bindServerLateSeats(ctx: {

package/dist/boot/late-binds.js

@@ -3,7 +3,12 @@ let rateLimiter;
 let parkedAskRedeem;
 let runDenySweep;
 let sessionNotifyDoor;
-export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor };
+let runEndedHandoff;
+let sessionAgeOut;
+export { runStore, rateLimiter, parkedAskRedeem, runDenySweep, sessionNotifyDoor, runEndedHandoff, sessionAgeOut };
+export function bindSessionAgeOut(v) {
+    sessionAgeOut = v;
+}
 export function bindRunStore(v) {
     runStore = v;
 }
@@ -14,6 +19,7 @@ export function bindServerLateSeats(ctx) {
     const { config, logger, server } = ctx;
     runDenySweep = server.denyExpiredApprovals;
     sessionNotifyDoor = server.sessionNotifyDoor;
+    runEndedHandoff = server.handOverRunEndedDecisions;
     if (!config.directDoorActive)
         parkedAskRedeem = server.redeemParkedAsk;
     else

package/dist/boot/memory-consolidation.d.ts

@@ -326,8 +326,9 @@ export declare function judgeConsolidationValve(input: ConsolidationValveInput):
 export declare function buildConsolidationValveAudit(input: {
     /** 阀门判决({@link resolveConsolidationValve} 的 `enabled` + `source`)。 */
     valve: Pick<ConsolidationValve, "enabled" | "source">;
-    /** 这台部署配了任何一把 service 凭证吗(`config.authToken` 或 `config.authTokens` 非空)。 */
-    hasServiceAuth: boolean;
+    /** 这台部署接没接任何一类过凭据门的来源(service 凭据 / 鉴权桥;部署形表行 `credentialGateSource`,写门律 5 在部署上的投影)。
+     *  没接 ⇒ 没有一次请求过得了写门(逃生口之外)。 */
+    credentialGateSource: boolean;
     /** 本地开发的显式逃生口(`ALLOW_UNAUTHED_WRITES=true`)。 */
     allowUnauthedWrites: boolean;
 }): {

package/dist/boot/memory-consolidation.js

@@ -282,17 +282,17 @@ export function buildConsolidationValveAudit(input) {
     if (!input.valve.enabled || input.valve.source !== "explicit")
         return { warnings: [] };
     const warnings = [];
-    if (!input.hasServiceAuth && !input.allowUnauthedWrites) {
+    if (!input.credentialGateSource && !input.allowUnauthedWrites) {
         warnings.push({
             tag: "memory_consolidation_run_credential_gated",
-            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve, but this worker has NO service credential " +
-                "(SERVICE_AUTH_TOKEN / per-system tokens are unset) and ALLOW_UNAUTHED_WRITES is not on. POST " +
+            detail: "MEMORY_CONSOLIDATION_DRIVER=on armed the consolidation valve, but this worker accepts NO credential on its write face " +
+                "(SERVICE_AUTH_TOKEN / per-system tokens are unset and no SSO bridge verifies registry sign-in tokens) and ALLOW_UNAUTHED_WRITES is not on. POST " +
                 "/v1/admin/memory/consolidation/run runs the model, so it rides the billable-submit gate and is refused " +
-                "with 503 auth.service_token_required BEFORE it reaches the route — while capabilities." +
+                "with 503 auth.service_token_required BEFORE it reaches the route for every caller — while capabilities." +
                 "memoryConsolidationDriver still reports true (a family-wide gap this worker shares with adoption / memory " +
                 "bundle / memory compliance; it is documented, not silently accepted). GET /v1/admin/memory/consolidation " +
-                "is unaffected (it runs no model). Set SERVICE_AUTH_TOKEN, or set ALLOW_UNAUTHED_WRITES=true for local " +
-                "development only.",
+                "is unaffected (it runs no model). Set SERVICE_AUTH_TOKEN (or configure the SSO bridge, AUTH_BRIDGE_ISSUER, so verified " +
+                "sign-in tokens pass), or set ALLOW_UNAUTHED_WRITES=true for local development only.",
         });
     }
     return { warnings };

package/dist/boot/reapers.d.ts

@@ -28,6 +28,7 @@ import type { ToolApprovalCoordinator } from "../tool-approval.js";
 import type { ParkCommitWatch } from "../plugins/park-commit-watch.js";
 import { type SandboxReaper } from "../plugins/sandbox-reaper.js";
 import { type AuditRotationPort } from "../approval-ask-retention.js";
+import type { HolderPullTally } from "../orchestration/workflow-park-holder.js";
 /** [ref] / [ref]§五(sema-comms `audits/failopen-governance-176.md` §7 "Z 类 1 条"):default consecutive-failure
  *  count before a reaper leg's swallowed error gets a `warn` line. The ~15 `.catch(() => undefined)` sites
  *  below are correct in DIRECTION (a hiccuping periodic sweep must never crash the whole tick loop — one bad
@@ -103,6 +104,8 @@ export interface ReapersCtx {
      *  `TOOL_APPROVAL_ENABLED=false` 的部署恒 undefined ⇒ 收敛器照常收敛,只是不发通知帧(壳侧靠
      *  重连 preamble 对账,见 approval-card.ts 的 `ApprovalRevokeFrame` 顶注)。 */
     toolApproval: ToolApprovalCoordinator | undefined;
+    /** workflow 停驻卡持有进程的拉取腿(`orchestration/workflow-park-holder.ts`;第 8 段按决定店 / 执行器视图在场装配)。缺席 = 没有 workflow 停驻车道 ⇒ 本腿零调用。 */
+    workflowParkHolderPull?: () => Promise<HolderPullTally>;
     /** [ref]:规则店的**保留期口**。`PERMISSION_RULES_ENABLED=false` 或后端没实装 ⇒ undefined
      *  ⇒ 本腿根本不注册(零扫描),与它的同族旋钮腿同姿势。
      *
@@ -122,6 +125,8 @@ export interface ReapersCtx {
     approvalAskAudit: AuditRotationPort | undefined;
     /** 晚绑(server 造出来才有)——见文件头「位置即契约」①。 */
     getRunDenySweep: () => ((now: number) => Promise<void>) | undefined;
+    /** 会话老化腿(晚绑:它要的删除协调器在第 9 段铸,`late-binds.ts` 的 `sessionAgeOut`)。缺席 = 这台部署记不了会话种类 / 还没绑 ⇒ 本腿零调用。 */
+    getSessionAgeOut?: () => (() => Promise<unknown>) | undefined;
     /** 本车道的沙箱回收座(`plugins/sandbox-reaper.ts`;第 5 段与 run 工厂同一份车道配置铸):k8s 车道 = 沙箱 Pod reaper(`plugins/k8s-pod-reaper.ts`),local-docker 车道 = 无主容器 reaper
      *  (`plugins/local-docker-reaper.ts`)。缺席 = 别的车道 ⇒ 本腿零调用。一次部署一条执行车道 ⇒ 一只座、一个节拍。 */
     sandboxReaper?: SandboxReaper;

package/dist/boot/reapers.js

@@ -86,7 +86,7 @@ export function createPlacementAwareReapSessions(deps) {
     };
 }
 export function startReapers(ctx) {
-    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, userInputLedger, approvalAskAudit, sandboxReaper, } = ctx;
+    const { config, logger, metrics, localRoot, backend, subRunner, runStore, checkpointStore, parkCommits, rateLimiter, costQuota, storeSweep, fileHistoryErasure, taskAttachmentStore, imageBakes, worktreeReap, workflowNotifyGate, workflowRecoverOpts, sqlWorkflowRunStore, workflowNotifyJournal, backgroundAgentStore, mailboxStore, toolApproval, permissionRuleStores, approvalNonceStore, getRunDenySweep, getSessionAgeOut, userInputLedger, approvalAskAudit, sandboxReaper, workflowParkHolderPull, } = ctx;
     const leg = (p) => {
         if (p !== undefined)
             trackMaintenanceLeg(p);
@@ -119,6 +119,7 @@ export function startReapers(ctx) {
     const approvalNonceReapExpiredGuard = createThrottledReaperCatch("approval_nonce_reap_expired", logger);
     const runsFailSuspendedExpiredCheckpointGuard = createThrottledReaperCatch("runs_fail_suspended_expired_checkpoint", logger);
     const runDenySweepGuard = createThrottledReaperCatch("run_deny_sweep", logger);
+    const sessionAgeOutGuard = createThrottledReaperCatch("session_age_out", logger);
     const runsReapSuspendedGuard = createThrottledReaperCatch("runs_reap_suspended", logger);
     const checkpointReapCtxGuard = createThrottledReaperCatch("checkpoint_reap_ctx", logger);
     const storeSweepGuards = {
@@ -158,6 +159,8 @@ export function startReapers(ctx) {
     const approvalReconcileGuard = createThrottledReaperCatch("approval_reconcile", logger);
     const approvalSuspendedPollGuard = createThrottledReaperCatch("approval_suspended_poll", logger);
     let approvalSuspendedPollInFlight = false;
+    const workflowParkHolderPullGuard = createThrottledReaperCatch("workflow_park_holder_pull", logger);
+    let workflowParkHolderPullInFlight = false;
     const permissionRuleReapGuard = createThrottledReaperCatch("permission_rule_reap_expired", logger);
     let permissionRuleReapInFlight = false;
     let approvalReconcileInFlight = false;
@@ -265,6 +268,8 @@ export function startReapers(ctx) {
             leg(getRunDenySweep()?.(Date.now())
                 .then(() => runDenySweepGuard.onSuccess(), runDenySweepGuard.onError));
         }
+        leg(getSessionAgeOut?.()?.()
+            .then(() => sessionAgeOutGuard.onSuccess(), sessionAgeOutGuard.onError));
         leg(approvalNonceStore
             ?.reapExpired()
             .then(reapCount("approval_nonces_reaped_total", {}))
@@ -360,6 +365,12 @@ export function startReapers(ctx) {
                 .then(() => approvalSuspendedPollGuard.onSuccess(), approvalSuspendedPollGuard.onError)
                 .finally(() => (approvalSuspendedPollInFlight = false)));
         }
+        if (workflowParkHolderPull && !workflowParkHolderPullInFlight) {
+            workflowParkHolderPullInFlight = true;
+            leg(workflowParkHolderPull()
+                .then(() => workflowParkHolderPullGuard.onSuccess(), workflowParkHolderPullGuard.onError)
+                .finally(() => (workflowParkHolderPullInFlight = false)));
+        }
         if (!permissionRuleReapInFlight) {
             permissionRuleReapInFlight = true;
             leg(permissionRuleStores

package/dist/boot/resolve-spec.d.ts

@@ -33,9 +33,9 @@ export interface ResolveSpecCtx {
     /** 活引用(registry 热应用换引用)—— 见文件头「位置即契约」。 */
     getKeyResolver: () => ReturnType<typeof createKeyResolver>;
     taskAttachmentStore: TaskAttachmentStore | undefined;
-    perSessionCwd: Map<string, string>;
-    setSessionCwd: (sid: string, cwd: string) => void;
-    setSessionShellEnv: (sid: string, env: Record<string, string>) => void;
+    /** 会话登记簿的工作目录那一格(**只读**:这条腿没带工作目录时它是会话上已登记的那一枚)。会话绑定(cwd / shellEnv / inheritEnv)本装配器只判、只算
+     *  (`LegFacts.sessionBindings`),写在路由层 run 认领之后的唯一提交点(`session-bindings.ts` 的 `commitLegBindings`)—— 律见那只文件头注。 */
+    perSessionCwd: ReadonlyMap<string, string>;
     /** 两张 per-session 登记簿的**租户围栏**(codex R1-F1):每次提交对拍本会话的主人,换主即清。
      *  论证(为什么 device lane 把这条从「不需要」变成「必需」)逐字见 `createSessionScopedRegistries` 头注。 */
     fenceSessionOwner: (sid: string, owner: string | null, incarnation?: string) => void;