@sema-agent/server 7.43.0 → 7.44.0

package/dist/leader/diffup.js

@@ -1,32 +1,8 @@
-/**
- * design/68 §8 F2(a) — worker SELF-UPLOAD diff-out (the factory-env counterpart of diffout.ts's pullDiff).
- *
- * With a factory env the runner owns the container lifecycle (create at task start, destroy at finish — and
- * durable suspend only produces a complete ownedEnv on this path), so the leader can no longer pull the diff
- * from a still-alive env after the task. Instead (the gate#2-proven MinIO presigned pattern):
- *   1. the env factory STAGES each fresh container (seed repo + write an upload script holding a presigned
- *      PUT URL) — adapter-side, so the URL/bulk never enters the model's CONTEXT by construction (it does sit
- *      on the sandbox filesystem, readable if the agent goes looking — the objective forbids inspecting it;
- *      the URL is single-object, PUT-only, short-TTL, so that residual face is small);
- *   2. the worker's objective ends with a MANDATORY final step: run the upload script (`git format-patch` →
- *      `curl -T <file>` — a real file, so Content-Length is set; MinIO 411-rejects chunked presigned PUTs);
- *   3. after fan-out the leader fetches the object over a presigned GET on the CONTROL PLANE (fetchUploadedDiff).
- * A worker that skips the upload surfaces as `{ok:false}` → merge quarantines it (honest failure, no hang).
- * pullDiff stays as the compat path for static (leader-owned) envs — M2 降兼容.
- */
-// 字节帽与 `safeRev` 同源取自 pull 腿(理由见 diffout.ts 的 DEFAULT_MAX_DIFF_BYTES 顶注:同值双抄一旦
-// 单边改值,上行/pull 两腿对同一个 diff 的过/拒判定就分家,且两边都「按自己的常量」静默正确)。
 import { safeRev, DEFAULT_MAX_DIFF_BYTES } from "./diffout.js";
 import { OBJECT_STORE_IO_TIMEOUT_MS } from "../plugins/blob-backend.js";
-/** The staged upload script. `repoDir`/`workDir` are deployment config; `baseSha` is interpolated into a
- *  shell line, so it is re-validated HERE (fail-closed) — callers should already have applied diffout's
- *  safeRev rules, but this function is the last line before the shell. The patch is written OUTSIDE the repo
- *  dir so it never shows up as untracked noise in the worker's `git status`. */
 export function buildUploadScript(p) {
     if (!safeRev(p.baseSha))
         throw new Error(`buildUploadScript: unsafe baseSha ${JSON.stringify(p.baseSha)}`);
-    // presignS3Url percent-encodes all specials today, so a "'" can't occur — escape anyway (belt-and-suspenders;
-    // the URL sits inside single quotes in the script below).
     const putUrl = p.putUrl.replaceAll("'", "'\\''");
     return [
         "#!/bin/sh",
@@ -34,35 +10,25 @@ export function buildUploadScript(p) {
         "set -e",
         `cd ${p.repoDir}`,
         `git format-patch --stdout ${p.baseSha}..HEAD > ${p.workDir}/.leader-out.patch`,
-        // -T <file> (not stdin): sets Content-Length — MinIO returns 411 on chunked presigned PUTs (gate#3 council#3).
         `curl -fsS -X PUT -T ${p.workDir}/.leader-out.patch '${putUrl}'`,
         `echo leader-diff-uploaded`,
         "",
     ].join("\n");
 }
-/** The objective suffix that makes the upload the worker's last task step (no URL through the model). */
 export function uploadStepSuffix(workDir) {
     return `\n\nMANDATORY FINAL STEP: after your final commit, run exactly: sh ${workDir}/.leader-upload.sh — it exports your branch diff for integration. Do not modify, inspect, or skip it; if it fails, fix your git state (commit your work) and run it again.`;
 }
-/**
- * Fetch the worker-uploaded patch over a presigned GET (control plane; creds stay adapter-held). Returns the
- * same result shape as pullDiff so merge consumes either path. 🔴 The presigned URL is a short-lived bearer
- * credential — it must never appear in returned errors (gate#3 council#5 redaction rule).
- */
 export async function fetchUploadedDiff(getUrl, opts = {}) {
     const maxBytes = opts.maxBytes ?? DEFAULT_MAX_DIFF_BYTES;
     const f = opts.fetchImpl ?? fetch;
     let res;
     try {
-        // C6(2026-08-03):abort 上界(半开 MinIO 此前把 leader merge 阶段挂满 undici ~300s,钉死整个
-        // fanout)。maxBytes 检查仍在 text() 缓冲之后=已知残留(流式读上界另案),本修只收超时轴。
         res = await f(getUrl, { signal: AbortSignal.timeout(OBJECT_STORE_IO_TIMEOUT_MS) });
     }
     catch (e) {
         return { ok: false, error: `diff fetch failed: ${e instanceof Error ? e.message.replaceAll(getUrl, "<presigned-url>") : "network error"}` };
     }
     if (res.status === 404 || res.status === 403) {
-        // MinIO answers 403 (signature scope) for a missing key on some configs — both mean "no upload landed".
         return { ok: false, error: `no uploaded diff (worker skipped the mandatory upload step, or upload failed) [${res.status}]` };
     }
     if (!res.ok)
@@ -74,14 +40,7 @@ export async function fetchUploadedDiff(getUrl, opts = {}) {
         return { ok: false, error: "uploaded diff is empty (worker committed nothing past base)" };
     return { ok: true, patch, bytes: patch.length };
 }
-/** The minimal surface staging must run before (the agent reaches the workspace through these). */
 const STAGED_METHODS = new Set(["exec", "execStream", "writeFile", "readFile"]);
-/**
- * Wrap an ExecutionEnv so a one-shot `stage(env)` (seed repo + write the upload script) runs before the FIRST
- * workspace-touching call — the adapters are lazy-connect, so there is no explicit connect() hook to ride; this
- * guarantees seed-before-agent on whichever call comes first. A failed staging rejects that call (task fails
- * honestly) and RESETS, so a retried call re-attempts staging instead of replaying a cached rejection.
- */
 export function withStaging(env, stage, finalize) {
     let staged;
     const ensure = () => {
@@ -98,11 +57,6 @@ export function withStaging(env, stage, finalize) {
                 return v;
             const fn = v.bind(t);
             if (prop === "destroy" && finalize) {
-                // Belt for the MANDATORY upload step (found live: task02b run4 collapse-solo): a worker that did the
-                // porting but FORGOT `sh .leader-upload.sh` loses its work when the runner destroys the env — diff-out
-                // 404s and merge quarantines a worker that actually finished. Run `finalize` best-effort before the
-                // teardown, only if the env was ever staged (never spawn a pod just to upload nothing). Idempotent:
-                // re-running the upload script after a model-run upload overwrites the same object with the same diff.
                 return async (...args) => {
                     if (staged)
                         await Promise.resolve(staged).then(() => finalize(env)).catch(() => { });
@@ -112,7 +66,6 @@ export function withStaging(env, stage, finalize) {
             if (!STAGED_METHODS.has(prop))
                 return fn;
             if (prop === "execStream") {
-                // async-iterable return — staging must complete before the underlying stream starts.
                 return (...args) => (async function* () {
                     await ensure();
                     yield* fn(...args);

package/dist/leader/endpoint.js

@@ -1,31 +1,5 @@
-/**
- * v2 MVP M4 — leader HTTP endpoint (V2-MVP-PLAN.md). Exposes `runLeaderTask` over HTTP:
- *   POST /v1/leader        → 202 { leaderRunId, status:"running" }, runs in the background
- *   GET  /v1/leader/:id     → { id, status, result?, error? }
- * A leader run is long (minutes: provision N E2B workers → real model coding → merge → push), so it is async
- * (background + poll), mirroring /v1/runs. `runLeader` is injected (the real wiring lives in wire.ts /
- * main.ts) so this handler is pure + mock-tested.
- *
- * ── 登记表的两条腿(#193 车4 件1,台账 P1-9)────────────────────────────────────────────────────────
- * **默认腿 = durable SQL 店**(`opts.store`,`plugins/leader-run-store-sql.ts` 的双方言孪生)。它一次解掉
- * 三条同源缺口:跨副本 GET(行在库里)、POST 提交幂等(`idem_key` UNIQUE 的原子赢或观察)、以及
- * 「重复 spawn」这件事本身(准入处只放一条进去,worker 层就不需要那道由构造即无效的并发去重面 ——
- * 它的删除理由见 `fanout.ts` 头注)。
- *
- * **降级腿 = 进程内 `Map`**(`opts.store` 缺席时)。它是**显式的单副本限定**形,不是「以后再补」:
- *   · 跨副本 GET 404、进程重启即失忆、幂等作用域只到本进程;
- *   · 生产部署不会落到这条腿上 —— config 层已把「`LEADER_ENABLED=true` 且无外部 SQL 店」整个组合拒启
- *     (#193 车4 件2 门②),所以这条腿的真实用户只有单元测试与手工试跑。
- * 两腿的**可观察行为**除上述三条外逐位一致(同一套 4xx 码、同一套属主门、同一份 202/200 体)。
- */
 import { uuidv7 } from "@sema-agent/core";
 import { leaderIdemKey } from "../plugins/leader-run-store-sql.js";
-/**
- * LEADER-REPAIRLOOP-INTEGRATION §5/§10.6 — map a finished `LeaderResult` to the run status. The repair terminal
- * (set only when LEADER_REPAIR_LOOP/LEADER_MEASURE_GATES drove a single-agent path or the merge push chokepoint
- * held) refines the legacy `ok ? completed : failed` into a THIRD `needs_human` for an ABSTAIN (a held candidate
- * awaiting a human), keeping `oracle.unprotected`/`gave_up` as `failed` (carry the terminal as the WHY —
- * no-silent-failures). Undefined `repairTerminal` ⇒ the exact legacy mapping (byte-identical default path). */
 function statusForLeaderResult(result) {
     switch (result.repairTerminal) {
         case "candidate_only":
@@ -36,20 +10,13 @@ function statusForLeaderResult(result) {
         case "gave_up":
             return "failed";
         default:
-            // `fixed` (not reachable SAFE-tier) or undefined → the legacy ok-based mapping.
             return result.ok ? "completed" : "failed";
     }
 }
 const LEADER_ID_RE = /^\/v1\/leader\/([^/]+)$/;
-/** How long a FINISHED leader run stays pollable before it's evicted from the in-memory registry.
- *  Bounds PROCESS MEMORY on the degraded arm — it is not a retention policy (the durable table keeps its rows;
- *  see the store's header for why it has no reaper leg). */
 const RUN_RETENTION_MS = 60 * 60_000;
-/** 终局写库的有界重试(codex R1-high③):一次瞬断不该永久丢掉一条真 run 的终局。 */
 const TERMINAL_WRITE_ATTEMPTS = 3;
 const TERMINAL_WRITE_RETRY_MS = 200;
-/** `Idempotency-Key` 的形:1–255 且无首尾空白(与 `/v1/runs` 的 zod `.max(255)` + 店门口
- *  `assertIdempotencyKeyShape` 同规)。坏形 ⇒ 400,不静默忽略 —— 忽略一个去重键 = 悄悄放行第二次真 push。 */
 function idemShapeError(raw) {
     if (raw.length === 0 || raw.length > 255 || raw.trim() !== raw) {
         return `invalid Idempotency-Key: must be 1-255 chars with no leading/trailing whitespace (got length ${raw.length})`;
@@ -58,10 +25,7 @@ function idemShapeError(raw) {
 }
 export function createLeaderEndpoint(runLeader, opts = {}) {
     const runs = new Map();
-    /** 降级臂的进程内幂等索引(scope 过的键 → run id)。store 在场时不使用(库上的 UNIQUE 才是执法者)。 */
     const memIdem = new Map();
-    // Bound the in-memory registry: a finished leader run stays pollable for RUN_RETENTION_MS, then is evicted.
-    // Swept on each POST (amortized, no timer) so the map can't grow without limit over a long-lived process.
     function reap() {
         const cutoff = Date.now() - RUN_RETENTION_MS;
         for (const [id, run] of runs) {
@@ -73,13 +37,12 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
             }
         }
     }
-    /** 后台驱动一条已准入的 run。两腿共用:终局既写本地 Map(drain 门 + 降级臂的读面),又写库(若在场)。 */
     function drive(id, body) {
         void (async () => {
             let terminal;
             try {
                 const result = await runLeader(body);
-                const status = statusForLeaderResult(result); // §10.6: ok→completed/failed PLUS needs_human for a held candidate
+                const status = statusForLeaderResult(result);
                 terminal = { status: status, result };
                 opts.logger?.info?.("leader_run_done", { id, ok: result.ok, status, ...(result.repairTerminal ? { repairTerminal: result.repairTerminal } : {}), merged: result.merge && result.merge.ok ? result.merge.merged : undefined });
             }
@@ -87,13 +50,7 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
                 terminal = { status: "failed", error: e instanceof Error ? e.message : String(e) };
                 opts.logger?.error?.("leader_run_error", { id, err: terminal.error });
             }
-            // 🔴 codex R1-high③(验真后修):**先落库,后改本地记录**。`inflight()` 数的是本地 `running`,
-            // 而 drain 门读的正是它 —— 反过来写(先改本地再 await 落库)会让 SIGTERM 在终局 SQL 还在飞时看到 0,
-            // hardShutdown 关掉连接池 ⇒ 终局写丢 ⇒ 别的副本永远读到 `running`,而代码可能已经真 push 过了。
-            // 顺序反过来之后,这条 run 直到库写**尘埃落定**(成功或彻底失败)才退出 inflight 集。
             if (opts.store) {
-                // 有界重试:一次瞬断(连接被回收/主从切换)不该让一条真 run 的终局永久丢失。重试是**有界**的
-                // ——停机窗里无限重试只会把 drain 拖死,而那时该做的是响亮记一笔让运维手工对账。
                 for (let attempt = 1;; attempt += 1) {
                     try {
                         const moved = await opts.store.finishRun(id, terminal);
@@ -121,7 +78,6 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
             }
         })();
     }
-    /** GET 的公共出口形(两腿同一份体)。 */
     function getBody(run) {
         return {
             status: 200,
@@ -152,19 +108,12 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
                 const bad = idemShapeError(idempotencyKey);
                 if (bad)
                     return { status: 400, body: { error: bad, errorCode: "request.body_shape" } };
-                // 🔴 按提交者 scope:两个 principal 用了同一个字面键,不该撞进同一条 run —— 那既是一次别人的
-                // run id 泄漏(存在性预言机),也会让 B 的提交被 A 的 run 静默吞掉。
                 scopedIdem = leaderIdemKey(idempotencyKey, owner);
             }
             reap();
             if (opts.store) {
                 const { created, run } = await opts.store.createRun({ objective: b.objective, owner, idemKey: scopedIdem });
-                // 幂等重投:回既有行,**不**起第二条后台腿(第二次 = 第二次真 git push)。
                 if (!created) {
-                    // 🔴 codex R1-high④(验真后修):重放**必须校属主**。`idem_key` 编码的是提交时的 owner,而
-                    // `owner` 列会被身份收编(design/183)重绑 —— 于是旧身份拿旧键重投,可以命中一条**现属他人**的行。
-                    // 直接回显 = 把别人的 leaderRunId 与状态泄漏出去。姿势照 `/v1/runs` 的 clientTaskId 重放先例:
-                    // 属主不符 ⇒ 409 冲突,不回显任何标识(不给跨租户预言机)。
                     if (run.owner != null && run.owner !== owner) {
                         return { status: 409, body: { error: "idempotency key already used by another principal", errorCode: "conflict.leader_run_exists" } };
                     }
@@ -174,7 +123,6 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
                 drive(run.id, b);
                 return { status: 202, body: { leaderRunId: run.id, status: "running" } };
             }
-            // 降级臂(无 store):作用域=本进程的同一套语义。
             if (scopedIdem) {
                 const prior = memIdem.get(scopedIdem);
                 const priorRun = prior ? runs.get(prior) : undefined;
@@ -182,7 +130,7 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
                     return { status: 202, body: { leaderRunId: priorRun.id, status: priorRun.status } };
             }
             const id = uuidv7();
-            runs.set(id, { id, status: "running", startedAt: Date.now(), owner }); // BL-4: record owner
+            runs.set(id, { id, status: "running", startedAt: Date.now(), owner });
             if (scopedIdem)
                 memIdem.set(scopedIdem, id);
             drive(id, b);
@@ -191,9 +139,6 @@ export function createLeaderEndpoint(runLeader, opts = {}) {
         const m = method === "GET" ? LEADER_ID_RE.exec(url) : null;
         if (m) {
             const id = m[1];
-            // BL-4 owner check: an owned run is visible ONLY to its owner — 404 (not 403) to anyone else, so a
-            // non-owner can't even confirm the id exists. owner null/undefined = anonymous/single-tenant run,
-            // visible to any authenticated caller (back-compat; mirrors GET /v1/runs/:id's runOwnerOk).
             const ownerOk = (owner) => owner == null || owner === (requester ?? null);
             if (opts.store) {
                 const run = await opts.store.getRun(id);

package/dist/leader/fanout.js

@@ -1,4 +1,3 @@
-/** A tiny counting semaphore (FIFO-ish) bounding concurrent worker execution. */
 class Semaphore {
     max;
     active = 0;
@@ -19,23 +18,6 @@ class Semaphore {
         }
     }
 }
-/**
- * 「这条 worker 的 TaskResult 停在门上(durable park)了吗」——`TaskStatus` 的穷举判据。
- *
- * 🔴 park 是**两个词**(扫描P2,status/kind 同名词混淆病族):`suspended`(工具审批 / human /
- * resource_limit 门)与 `needs_review`(`plan_review` 与 dry-run 拦截门)。真源 = core
- * `agents/suspend-guard.js` 的 `isDurablePause`(逐字 `status === "suspended" || status === "needs_review"`),
- * `mapNestedSuspend` / `verify.js` 的 `unverifiedReason` 两处都按这张表分词。
- *
- * 只认 `suspended` 的后果不是「少一个标签」:一条 plan_review 停下的 worker 会被报成 `failed` ⇒
- * fanOut 的 C4 抢占({@link FanOutOptions.cancelOnSuspend})不触发(其余 worker 继续烧钱)、leader 的
- * replan「suspended 波」看不见它、`suspendedSessions` 的豁免名单漏掉它 ⇒ 它那张还能被决议的 checkpoint
- * 与暂停中的环境会被当失败清掉。带验证器的那条腿早已改用「还带着 checkpointToken 就是 park」的判据
- * (leader.ts round-3 review BLOCKER),这里是它当时漏掉的另外半场。
- *
- * `never` 收敛 = core `TaskStatus` 增删成员的**编译期**执行点(同 `store-contracts.ts` 两条判据的姿势);
- * 运行时未知词保守判**非 park**(与既有 `else → failed` 同行为,不静默扩大 park 面)。
- */
 export function isDurablePauseStatus(s) {
     switch (s) {
         case "suspended":
@@ -55,30 +37,17 @@ export function isDurablePauseStatus(s) {
 function mapStatus(s) {
     return s === "completed" ? "completed" : isDurablePauseStatus(s) ? "suspended" : "failed";
 }
-/**
- * Fan out `subtasks` in parallel. Never throws — every worker resolves to a WorkerReport (failures captured).
- * The caller (Coordinator) merges only `status==="completed"` reports.
- */
 export async function fanOut(subtasks, opts) {
     const sharedAC = new AbortController();
     const streams = new Map();
     let cancelled = false;
     const cancelAll = async () => {
         cancelled = true;
-        // Abort FIRST (council round-2): one signal both aborts RUNNING workers (their shared spec.signal) AND
-        // stops NOT-YET-STARTED ones — runOne's `sharedAC.signal.aborted` guard returns before provisioning a VM.
-        // Closes the race where a worker registering AFTER the snapshot would miss it. Then destroy() each registered
-        // stream (core 1.71): abort + await settle + CAS-expire the checkpoint (fences any concurrent resume) + reap
-        // a SUSPENDED worker's paused container — so a cancel that hits a suspended worker leaks neither a paused
-        // container nor an orphan checkpoint. The leader (leader.ts) still destroys each worker's static env in its
-        // own finally; destroy() here reaps the (durable) checkpoint — the two are disjoint (core [R47]).
         sharedAC.abort();
         await Promise.allSettled([...streams.values()].map((s) => s.destroy()));
     };
     const sem = new Semaphore(opts.maxConcurrency);
     let pendingCancel;
-    // C4: a SUSPENDED settle preempts the remaining fan-out (the settled worker is already out of `streams`,
-    // so cancelAll's destroy sweep is exempt of it by construction — its checkpoint/paused env survive).
     const maybeCancelOnSuspend = (r) => {
         if (opts.cancelOnSuspend && r.status === "suspended" && !cancelled) {
             opts.logger?.info?.("fanout_suspend_cancel", { suspendedWorker: r.workerId });
@@ -91,8 +60,6 @@ export async function fanOut(subtasks, opts) {
         return sem.run(async () => {
             if (sharedAC.signal.aborted)
                 return { ...base, status: "timeout", error: "cancelled before start" };
-            // Per-worker run override (verify path): reuse the semaphore + shared abort signal; map throws like the
-            // default path so runOne still never rejects (Promise.all stays safe).
             if (opts.runWorker) {
                 try {
                     return maybeCancelOnSuspend(await opts.runWorker(st, sharedAC.signal));
@@ -115,32 +82,24 @@ export async function fanOut(subtasks, opts) {
                 report = { ...base, status: mapStatus(result.status), stats: result.stats, ...(result.errorMessage ? { error: result.errorMessage } : {}) };
             }
             catch (e) {
-                // interrupted/aborted workers may reject here — report, don't propagate.
                 report = { ...base, status: cancelled ? "timeout" : "failed", error: e instanceof Error ? e.message : String(e) };
             }
             finally {
                 streams.delete(st.workerId);
             }
-            // AFTER deregistration — so a suspend-triggered cancelAll can never destroy THIS worker's own stream
-            // (destroying a suspended stream = CAS-expiring its checkpoint, the exact thing C4 forbids).
             return maybeCancelOnSuspend(report);
         });
     };
-    // Record each worker's report as it settles so the overall deadline can HARD-bound the wait: if a worker's
-    // stream.result() ignores the abort, `Promise.all(work)` would never resolve and `await work` below would hang
-    // PAST the deadline (the overall timeout would be only "soft"). On the grace expiry we return whatever settled
-    // + a synthesized `timeout` for the rest, so fanOut always returns within timeoutMs + the cancel grace.
     const results = new Map();
     const work = Promise.all(subtasks.map((st) => runOne(st).then((r) => { results.set(st.workerId, r); return r; })));
     const timer = new Promise((resolve) => {
         const id = setTimeout(() => resolve("timeout"), opts.timeoutMs);
-        void work.then(() => clearTimeout(id)); // don't leak the timer when work finishes first
+        void work.then(() => clearTimeout(id));
     });
     const raced = await Promise.race([work.then(() => "done"), timer]);
     if (raced === "timeout") {
         opts.logger?.warn?.("fanout_timeout", { timeoutMs: opts.timeoutMs, workers: subtasks.length });
         await cancelAll();
-        // Hard bound: give cancelAll a grace window to settle the running workers, then stop waiting regardless.
         const graceMs = opts.cancelGraceMs ?? CANCEL_GRACE_MS;
         const grace = new Promise((resolve) => {
             const id = setTimeout(() => resolve("grace"), graceMs);
@@ -154,11 +113,10 @@ export async function fanOut(subtasks, opts) {
             };
         }
     }
-    const reports = await work; // all settled (normal path, or cancelled workers settled within grace)
+    const reports = await work;
     if (pendingCancel)
-        await pendingCancel.catch(() => { }); // suspend-triggered sweep fully settled before return
+        await pendingCancel.catch(() => { });
     return { reports, cancelled };
 }
-/** Grace window after `cancelAll` before fanOut returns regardless — bounds a worker that ignores the abort. */
 const CANCEL_GRACE_MS = 30_000;
 //# sourceMappingURL=fanout.js.map

package/dist/leader/grader-env-factory.js

@@ -1,48 +1,9 @@
-/**
- * The OUT-OF-PROCESS grader plumbing for the leader × `runRepairLoop` integration
- * (`sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.2 + the authoritative §10 layer). Two distinct consumers:
- *
- *  - **R1 (single-agent oracle, §10.1)** — the `RepairOracle` closure (`repair-oracle.ts`) reuses the EXISTING
- *    integration sandbox as its grader at ZERO extra sandbox cost. It needs only a `GraderHandle` (a writeFile +
- *    exec bound to that sandbox via the wire's `asIntegrationEnv`/`sh` pattern) and the worker-diff source — it
- *    grades through `runExecGate(graderEnv, steps)` itself, so it does NOT use `applyAndGrade` (the closure owns
- *    its hermetic reset+apply inline; `repair-oracle.ts:89`). This file gives the merge path the SAME apply-and-
- *    grade primitive so the two stay byte-consistent.
- *
- *  - **R2 (measure-drives-repair, §10.4)** — the merge path (`merge.ts`, Stage-2) RE-SEEDS a single minted
- *    grader per measure round (NOT a new microVM): `git reset --hard <integBase> && git clean -fdx`, re-apply the
- *    INTEGRATED patch, then run the trusted `measureCmd` there. The repair agent edits the merged sandbox, so the
- *    measure must NOT run in that (possibly poisoned) sandbox — `applyAndGrade` runs it in a fresh-seeded grader.
- *    Before re-measure, the caller mechanically checks the patch's changed-file list against an allowlist
- *    (`changedFilesWithinAllowlist`, §10.4(ii)) — an out-of-allowlist / build-config touch denies the candidate.
- *
- * A standalone, mint-a-distinct-sandbox grader belongs to the AUTO-ACCEPT slice, which has NOT been designed or
- * built. v1 reuses the integration sandbox (R1) + re-seeds it (R2) instead. **There is no config key that turns
- * such a factory on** — an earlier revision of this header named one and shipped a `throw`-only stub beside it,
- * but no such key ever existed in `config.ts`, so an operator following that text set an env var that did
- * nothing. Both the stub and the promise were removed (#193 车4 件3 / staleness ledger P2-9); the auto-accept
- * slice, when it happens, is a new design件 that lands its factory, its wiring and its knob in one batch.
- *
- * Everything here is additive + OFF by default: nothing in this file runs unless the Stage-2 seams call it behind
- * `LEADER_REPAIR_LOOP` / `LEADER_MEASURE_GATES`.
- */
 import { runExecGate } from "@sema-agent/core";
 import { shellQuote as sq } from "../plugins/remote-shell.js";
-/**
- * §10.1/§10.4 — HERMETIC apply-and-grade. Reset the grader to its clean `integBase` (`git reset --hard` +
- * `git clean -fdx`), apply the FULL `base→latest` `patch` (never cumulative onto an already-applied tree), then
- * run the TRUSTED, spec-derived `steps` (`testCmd` / `measureCmd`) there. `steps` MUST NOT be worker-authored
- * (the `runExecGate` security contract — exec-gate.ts header). Used by the R2 measure grader; the R1 oracle
- * closure performs the equivalent inline (`repair-oracle.ts`) so the single-agent and merge paths grade
- * identically. Never throws — an apply conflict or a step failure is a non-passing `GradeOutcome`.
- */
 export async function applyAndGrade(handle, patch, steps) {
     const repo = handle.repoDir;
     const patchPath = `/tmp/grade-${Date.now()}.patch`;
     await handle.writeFile(patchPath, patch);
-    // Hermetic prep: clean base, then apply the full base→latest diff. `--whitespace=nowarn` matches `merge.ts:144`
-    // and `repair-oracle.ts:93`. An apply failure is a non-flaky, non-applied failure (a candidate that no longer
-    // applies onto the clean base — e.g. it raced the integration head).
     const prep = await runExecGate(handle.env, [
         { command: `git -C ${sq(repo)} reset --hard ${sq(handle.integBase)} && git -C ${sq(repo)} clean -fdx`, label: "grader-reset" },
         { command: `git -C ${sq(repo)} apply --whitespace=nowarn ${sq(patchPath)}`, label: "grader-apply" },
@@ -57,21 +18,6 @@ export async function applyAndGrade(handle, patch, steps) {
     const trace = gate.steps.map((s) => `${s.label}\n${s.stdout}\n${s.stderr}`).join("\n").slice(-4000);
     return { passed: false, applied: true, trace };
 }
-/**
- * §10.4(ii) — the mechanical CHANGED-FILES ALLOWLIST guard. A "fresh sandbox" is necessary-NOT-sufficient: poison
- * can ride INSIDE the integrated patch (a malicious `build.gradle` / git hook / test shim). Before re-measuring,
- * diff the patch's changed-file list against the allowlist = the workers' planned `files` ∪ trusted spec dirs.
- * Any out-of-allowlist path, or a build-config touch (gradle / settings / dependency manifests / git hooks), is a
- * DENY — the caller downgrades the candidate to `needs_human_oracle` (the prompt-only "do NOT modify build config"
- * `wire.ts:269` is unreliable; this makes it mechanical). Returns the offending paths (empty ⇒ within allowlist).
- *
- * `changedFiles` is parsed by the caller from the patch (`git apply --numstat` / `git diff --name-only`); this is
- * the PURE policy over that list so it is unit-testable without a sandbox. Matching is path-prefix on normalized
- * POSIX paths: an allowlist entry `"."` or `""` allows everything UNDER it (a worker that legitimately owns the
- * whole tree); a file allow-entry matches exactly; a dir allow-entry (trailing `/` or a real dir) matches its
- * subtree. Build-config patterns are denied even when nominally within the allowlist (a worker must not be able
- * to launder a `build.gradle` edit through an over-broad `files:["."]`).
- */
 const BUILD_CONFIG_DENY = [
     /(^|\/)build\.gradle(\.kts)?$/,
     /(^|\/)settings\.gradle(\.kts)?$/,
@@ -96,12 +42,11 @@ const norm = (p) => p.replace(/^\.\/+/, "").replace(/\/+$/, "");
 function withinAllowEntry(file, entry) {
     const e = norm(entry);
     if (e === "" || e === ".")
-        return true; // owns the whole tree
+        return true;
     if (file === e)
-        return true; // exact file match
-    return file.startsWith(`${e}/`); // subtree match
+        return true;
+    return file.startsWith(`${e}/`);
 }
-/** The §10.4(ii) decision: the subset of `changedFiles` that is OUT of the allowlist or hits a build-config deny. */
 export function changedFilesOutOfAllowlist(changedFiles, allowlist) {
     const files = changedFiles.map(norm).filter((f) => f !== "");
     const offending = [];
@@ -115,21 +60,7 @@ export function changedFilesOutOfAllowlist(changedFiles, allowlist) {
     }
     return offending;
 }
-/** §10.4(ii): true iff EVERY changed file is within the allowlist and none is a denied build-config path. */
 export function changedFilesWithinAllowlist(changedFiles, allowlist) {
     return changedFilesOutOfAllowlist(changedFiles, allowlist).length === 0;
 }
-/*
- * §3.2 的「standalone 铸新沙箱 grader 工厂」曾以 `GraderEnvFactoryCfg` / `MintedGrader` / `createGraderEnvFactory`
- * 三件的形式停在这里:一个固定好的签名 + 一个必抛的 not-implemented 实现,理由写的是「签名先定好,将来
- * 自动接受切片直接接线,不改契约」。#193 车4(台账 P2-9)裁定删除,理由三条:
- *   ① 它零调用零测试,而它承诺的开关(见文件头注)在 `config.ts` 里从来不存在 —— 「签名已定」这句话
- *      本身在骗读者:没有任何消费方按它写过一行码,所谓的契约稳定性没有被任何东西验证过;
- *   ② 一个 `throw` 工厂在 grep 结果里长得像「这条路已经有了」,恰恰是本仓 doc-rot 战役反复清理的那一类
- *      「过期的在哪里比缺失的在哪里更危险」;
- *   ③ 真需求出现时,铸沙箱 + 播种 + oracle 隔离本来就要跟着 `assertOracleIsolation` 一起重新设计
- *      (§10.2 明说 v1 OMITS immutableOraclePaths),旧签名大概率也不会被原样采用。
- * 复原坐标(需要时按此重建):sema-internal `server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.2/§7,
- * 以及本文件的 git 历史(#193 车4 之前的任一版本)。
- */
 //# sourceMappingURL=grader-env-factory.js.map