@sema-agent/server 7.78.2 → 7.79.0

package/dist/auto-mode-face.d.ts

@@ -1,17 +1,29 @@
-import { type Model, type ModelRoles, type RuntimeCaps } from "@sema-agent/core";
+import { type RunnerDeps, type RuntimeCaps } from "@sema-agent/core";
 import type { SettingsPermissionMode } from "./task-settings.js";
 /**
- * 分类器**配置**的模型路由 —— 直接复用 core 的 `resolveTaskModel({ modelRole: "classifier" })`(prepare-task 武装时
- * 走的同一函数:role 回落链 `classifier → summarize → default`,且 `{select}` 形 RoleSpec 按目录选型)。
- * codex r4 [medium] 验真后改:首版按名字级自算,遇 center 下发的 `{select:{tier}}` 形会错落到 summarize/default,
- * 对 `sema doctor permissions` 报另一个模型。答的是「配置了什么」;运行期 `derivedRouteFallsBack` 的回落不在射程
- * (那是 core 状态座的事)。什么都解不出 ⇒ `{id:undefined, fault}`(core 的拒句当数据交出,读面不写 model 键):
- * 本面是纯披露、不是执法——读面 500 掉整张能力表比少一个 model 键更伤。
+ * 分类器席的模型 —— **调 core 的单一解析器** `classifierSeatModel({deps, main})`(core 7.20.0 / [ref],
+ * 本仓 [ref] 的跨仓诉求兑现;契约句 `classifier.seat.one_resolver` 逐字:引擎的武装点与**显示这个席**
+ * 的宿主读面调同一只导出函数,而不是各自从目录/角色/档位表再推一遍 —— 第二份推导就是第二个答案)。
+ *
+ * 🔴 **S-350:本仓的自算分支已删**。修前这里调的是 `resolveTaskModel({modelRole:"classifier"})`,那只
+ * 回答的是「classifier **角色**解到谁」;引擎真正挑席时在角色没点名模型的情况下还要走 **tierBelowMain**
+ * (主模型档位**严格之下**、路由不同的最近一档)。两者在「档位表在场 + 没有 classifier 角色」这一形上
+ * 给出**不同的模型**(车FL U-3 坐实),读面于是对着 `sema doctor permissions` 报另一只模型。规则变少的
+ * 修法只有一条:把这个问题整个交回给上游的那一只解析器。
+ *
+ * 递进去的 `deps` 就是**交给 `Runner` 的那一只**(main.ts 递 `runnerDeps`):`models`/`roles`/`tiers` 三席
+ * 与引擎看到的是同一批**活引用**(center 原地热更新 ⇒ 读面按请求现算)。解析器对**原始**与**已展开**
+ * 两形 deps 同答(它自己 `normalizeSeatDeps` 一次 `expandTiers`),且**永不抛**。
+ *
+ * 唯一还会抛的是 `main` —— **这条 run 的主模型**,也就是本仓给一条没选模型的 task 铸的那个 ref
+ * ({@link DEFAULT_MODEL_REF};`boot/resolve-spec.ts` 每条 spec 都盖 `spec.model`,所以引擎眼里的 main
+ * 恒是它解出来的那一只,**不是** core 的 `default` **角色**链)。席是相对主模型定义的(tierBelowMain =
+ * 「主模型档位之下」),主模型解不出就没有席可言 ⇒ `{id:undefined, fault}`(core 的拒句当数据交出,读面
+ * 不写 model 键):本面是纯披露、不是执法——读面 500 掉整张能力表比少一个 model 键更伤。`main` 这一步
+ * 喂**展开**目录,与引擎构造期 `expandTiers(models, tiers)` 之后再解逐字同源(邻居惯例:
+ * `routes/capabilities.ts` 的 `workflowModels` / `/v1/models` 两处同法)。
  */
-export declare function classifierRouteFor(deps: {
-    models?: Record<string, Model>;
-    roles?: ModelRoles;
-}): ClassifierRoute;
+export declare function classifierRouteFor(deps: Pick<RunnerDeps, "models" | "roles" | "tiers">): ClassifierRoute;
 /** `classifierRouteFor` 的答:解出 ⇒ `{id}`;解不出 ⇒ `{id:undefined, fault}`(core 的拒句原文,不吞)。 */
 export type ClassifierRoute = {
     readonly id: string;

package/dist/auto-mode-face.js

@@ -2,10 +2,13 @@ import { createRequire } from "node:module";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { z } from "zod";
-import { resolveTaskModel } from "@sema-agent/core";
+import { classifierSeatModel, expandTiers, resolveTaskModel } from "@sema-agent/core";
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 export function classifierRouteFor(deps) {
     try {
-        return { id: resolveTaskModel({ modelRole: "classifier" }, deps).model.id };
+        const expanded = expandTiers(deps.models, deps.tiers ?? {}) ?? deps.models;
+        const main = resolveTaskModel({ model: DEFAULT_MODEL_REF }, { ...deps, ...(expanded !== undefined ? { models: expanded } : {}) }).model;
+        return { id: classifierSeatModel({ deps, main }).model.id };
     }
     catch (err) {
         return { id: undefined, fault: err instanceof Error ? err.message : String(err) };

package/dist/boot/deferred-sandbox-path-env.d.ts

@@ -1,3 +1,50 @@
+/**
+ * [ref] —— 沙箱 lane(e2b/k8s/ssh/adb/local-docker)写门的**真 env 裁决**接法。
+ *
+ * ## 缺口与它的形状
+ *
+ * core 的 `createFsWriteGatePolicy` / `createSensitivePathPolicy` 把每一个写目标交给
+ * `canonicalizeTarget(env, …)` 去问 fs 要真身(`absolutePath` → `exists` → `canonicalPath` →
+ * `fileInfo`/`readLink` 逐跳,dist 亲读)。host lane 上那个 env 就是 hand 工具真正写的那块盘。
+ * 沙箱 lane 不是:per-task 的沙箱 env 由 core 的 `executionEnvFactory` 在 spec **之后**才铸,
+ * 而写门 wiring 必须在 spec 期就交出去。
+ *
+ * 出路不是把裁决搬去 hook 层(那要在本仓复刻 `canonicalizeTarget` 的逐级 exists / symlink 解析 /
+ * 段匹配 / 折叠序——复制 core 的裁决逻辑=同源谎),而是利用一个部署事实:**那个 per-task 沙箱 env
+ * 本来就是本仓铸的**。于是本模块给写门一个 ExecutionEnv **代理**:它在**调用时刻**(runToolGate 裁决,
+ * 必在 prepare 之后)去 slot 里取该 task 的真 env 并转发 fs 读原语。call-time 转发消除了时序问题,
+ * 与「从调用上下文读 env」是同一性质。
+ *
+ * ## 三条不可动的裁定
+ *
+ *  1. **`absolutePath` 一面不转发**,沿用词法规则(POSIX 绝对形归一 / NUL 拒 / 非绝对形 err)。
+ *     真 env 的 `absolutePath` 会按 **env 自己的 cwd** 解析相对路径,而工具真写处按 engine 跟踪的
+ *     cwd 解析——两个基准不同,转发它等于拿错基准铸 canonical key,而**错误的 allow 比没有门更糟**。
+ *     相对形 / `~` / 盘符形因此照旧 err ⇒ `canonicalizeTarget` 失败 ⇒ 写门 `ask`(fail-closed)。
+ *     「不猜沙箱工作目录」这条公理不随真 env 到场而松。
+ *  2. **slot 空 = fail-closed 且响亮**:转发面返回错误 ⇒ core 把 `exists` 报错读成
+ *     `unresolvedSymlink` ⇒ `createSensitivePathPolicy` 判 deny、写门判 ask,折叠后 deny 恒赢。
+ *     保护型缺席的失败方向必须与能力语义同向。留痕走结构化 `warn`(每实例一次)而**不**走
+ *     `observability/fail-open.ts`:那个词表按其模块头是 `F`(体验/缓存回退)与 `P-DEBT`(明知方向
+ *     不对的保护型欠账)两类的准入面,本臂方向是**对的**(fail-closed),登记进去会把「已收口的
+ *     保护臂」混进「待还的债」计数里。
+ *  3. **slot 只认「当前活腿」**:同一 session 同时只有一条活腿(HTTP `conflict.session_active_run` +
+ *     core session acquire 双重串行化;委派子代另用一个 sessionId),所以同键改铸即顶替旧登记——
+ *     那些旧登记来自 park-only 之类「不 destroy 也不 suspend」的终局,留着只会让 resume 腿失去真身裁决。
+ *
+ * ## slot 的键 = sessionId
+ *
+ * 工厂 ctx 只有 `{sessionId, taskId?, isolation?, parentCwd?}`(core `ExecutionEnvFactoryContext`),
+ * 而 `/v1/runs` 会在 resolveSpec **之后**铸自己的持久 taskId 覆盖 `spec.taskId`,所以 taskId 在主路径
+ * 上对不上——sessionId 是两侧都稳的那一个(per-task 镜像登记簿是同一个先例)。
+ * 委派子任务(Agent / workflow 子代)拿的是**另一个** sessionId,所以父的 slot 不会被子代覆盖(「不许
+ * 最后写赢」由此成立)。**残余面**:子代的写仍按**父**的 env 裁决——子代的 policy 就是父的那一个实例
+ * (core `inheritedGateForChildren` 把它当 parentConstraint 继承),而 policy 收到的只有
+ * `{toolName, args, toolCallId}`,读侧根本没有腿身份可键控。方向上它逼近真相而非远离(过渡形是「谁的盘
+ * 都不看」),但有一条**新的松面**:父盘上一个名叫守卫段、真身良性的软链,会让子代在自己盘上指向真守卫段
+ * 的同名路径拿到父盘的宽松答案。收口需要一条「按当前工具调用的 env 裁决」的引擎缝,属设计件;
+ * 该面由 test/task-settings.test.ts 的「真身胜过名字」特征化钉机器可见。
+ */
 import { FileError, StubExecutionEnv, type ExecutionEnv, type ExecutionEnvFactory, type FileInfo, type Result } from "@sema-agent/core";
 /** 哪些 lane 用本模块的代理裁决写门 —— `REMOTE_EXEC` 未设(进程内 host)与显式 `host` 之外的全部。
  *  与 resolve-spec 的 `hostSemanticsLane` 是同一判别式的两面,取值处**只此一个**(两处各写一份正是漂移的成因)。 */

package/dist/boot/deferred-sandbox-path-env.js

@@ -1,12 +1,8 @@
-import { posix } from "node:path";
 import { FileError, StubExecutionEnv, err, ok } from "@sema-agent/core";
+import { normalizeAbsolutePathLexically } from "../task-cwd.js";
 export function isSandboxPathAdjudicationLane(provider) {
     return provider !== undefined && provider !== "host";
 }
-function normalizeAbsolutePathLexically(path) {
-    const collapsed = posix.normalize(path.replace(/^\/+/, "/"));
-    return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
-}
 const MAX_BOUND_SESSIONS = 4096;
 export class SandboxPathEnvSlots {
     bySession = new Map();

package/dist/boot/resolve-spec.js

@@ -1,6 +1,6 @@
 import { realpathSync } from "node:fs";
 import { join } from "node:path";
-import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, deriveAskEffective, expandTiers, resolveAskSeamForm, tightenTaskSpec } from "@sema-agent/core";
+import { NodeExecutionEnv, QUESTION_AWAITS_RESUME, WRITE_EXEMPT_DIR_COVERS_ROOT_CODE, deriveAskEffective, expandTiers, resolveAskSeamForm, tightenTaskSpec } from "@sema-agent/core";
 import { cappedCeiling } from "../budget.js";
 import { centerPromptProvider, centerIdentityAssembled } from "../capabilities/center-prompts.js";
 import { SessionEnvironmentSelection, selectEnvironmentTool } from "../capabilities/select-environment-tool.js";
@@ -10,7 +10,7 @@ import { stampHandsLane, toolPolicyForHands } from "../capabilities/hands-lane.j
 import { shouldDiscloseNoPersistentMemory, withNoPersistentMemoryNotice } from "../capabilities/memory-notice.js";
 import { applyLongtailDefer } from "../capabilities/tool-defer.js";
 import { assertGuardPatternsUsable, buildOnlySensitiveBaselineWarning, createApprovalBaselinePolicy, createDeploymentGovernanceInputs } from "../deployment-governance.js";
-import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane } from "../env-facts.js";
+import { acceptShellScratchpadDir, buildEnvFacts, egressForRemoteExec, ensureScratchpadDir, resumeFactsForLane, scratchpadCoveringTaskRoot } from "../env-facts.js";
 import { FleetEventBus } from "../fleet/fleet-bus.js";
 import { composeHooks, createTaskHooks } from "../hooks/hook-runner.js";
 import { headerStr } from "../http/principal-gate.js";
@@ -46,6 +46,19 @@ export function createResolveSpec(ctx) {
         assertRequestMcpUnlocked(body.mcpServers, lockedKeys);
         if (opts?.leg === "fresh")
             assertRequestMcpContentOrigin(body.mcpServers);
+        if (opts?.leg === "fresh") {
+            const conflict = scratchpadCoveringTaskRoot({
+                cwd: body.cwd,
+                shellScratchpadDir: body.scratchpadDir,
+                localDataRoot: config.localDataRoot ?? localRoot,
+                sessionId: auth?.sessionId,
+                requirePrincipal: config.requirePrincipal,
+                cwdHonored: cwdHonored(config),
+            });
+            if (conflict) {
+                throw new HttpError(400, `cwd "${conflict.cwd.asSpelled}" is inside this session's scratchpad "${conflict.scratchpadDir.asSpelled}" — the scratchpad is the fs-write gate's EXEMPT directory, so a task rooted there would auto-approve every write under its own root and the engine refuses to build the gate at all (config.write_exempt_dir_covers_root). Point cwd at the project directory instead (or send no cwd and let the session keep the one it has): this session registers the cwd you send, so a task that happens not to mount the write gate would still leave every LATER task on this session rooted in the exemption. A workflow that really is meant to write without prompts says so with a knob that means it (a permission mode, an open write face) and still keeps its root outside the scratchpad — those knobs do not lift this refusal, because the conflict is between two fields of this request, not a permission level.`, { code: "request.field_conflict", extra: { cwd: conflict.cwd, scratchpadDir: conflict.scratchpadDir } });
+            }
+        }
         const rawMemoryCapture = body.memoryCapture;
         if (rawMemoryCapture !== undefined && rawMemoryCapture !== "off") {
             throw new HttpError(400, "memoryCapture must be the string 'off' when present (the session-level memory-capture opt-out declaration; absent = capture as usual — there is no 'on' spelling)", { code: "request.field_invalid" });
@@ -507,6 +520,12 @@ export function createResolveSpec(ctx) {
                 governed = applyTaskSettings(governedBase, effectiveSettings, fsWriteGate, workflowGate);
             }
             catch (e) {
+                if (e.code === WRITE_EXEMPT_DIR_COVERS_ROOT_CODE) {
+                    throw new HttpError(400, e.message, {
+                        code: "request.field_conflict",
+                        ...(e.detail !== undefined ? { extra: { writeExemptDirCoversRoot: e.detail } } : {}),
+                    });
+                }
                 throw new HttpError(422, `settings are tighten-only and cannot loosen the deployment policy: ${e.message}`);
             }
         }

package/dist/capabilities/code-review-council.js

@@ -1,4 +1,5 @@
 import { Type } from "typebox";
+import { DEFAULT_MODEL_REF } from "../model-select.js";
 import { runTeamDiscussion } from "@sema-agent/core";
 import { REVIEW_LENSES, GROUNDING, LENS_SYSTEM_TPL, DEBATE_MEMBER_TPL, DEBATE_TOPIC_TPL, ARBITER_SYSTEM, ARBITER_FALLBACK_HEADER } from "./prompts/code-review.js";
 const LENSES = REVIEW_LENSES;
@@ -79,7 +80,7 @@ async function runConvergence(subRunner, repoTools, objective, findings, opts, s
     if (opts.debate) {
         const team = await (opts.teamFn ?? runTeamDiscussion)({
             runner: subRunner,
-            model: "default",
+            model: DEFAULT_MODEL_REF,
             members: lenses.map((l) => ({ role: l.name, systemPrompt: debateMemberSystem(l) })),
             topic: debateTopic(objective, findings),
             rounds: opts.rounds ?? 1,

package/dist/config.js

@@ -1,4 +1,5 @@
 import { readFileSync } from "node:fs";
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -872,14 +873,14 @@ function parseModelDomain() {
     const models = { default: model, [model.id]: model };
     if (cheapModel)
         models[cheapModel.id] = cheapModel;
-    const cheapRef = cheapModel ? cheapModel.id : "default";
+    const cheapRef = cheapModel ? cheapModel.id : DEFAULT_MODEL_REF;
     const verifierEnv = process.env.MODEL_VERIFIER;
-    const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : "default";
+    const verifierRef = verifierEnv && models[verifierEnv] ? verifierEnv : DEFAULT_MODEL_REF;
     const roles = {
         verifier: verifierRef,
     };
     for (const r of ROSTER_PRIMARY_ROLES)
-        roles[r] = "default";
+        roles[r] = DEFAULT_MODEL_REF;
     for (const r of ROSTER_CHEAP_ROLES)
         roles[r] = cheapRef;
     for (const r of csv("MODEL_CODE_ROLES")) {

package/dist/env-facts.d.ts

@@ -96,6 +96,67 @@ export declare function acceptShellScratchpadDir(raw: unknown, opts: {
     hostSemanticsLane: boolean;
     warn: (msg: string, meta?: object) => void;
 }): Promise<string | undefined>;
+/**
+ * {@link acceptShellScratchpadDir} 的**词法半场**(S-351 拆出):零 I/O、可在请求的任何一点问。
+ *
+ * 为什么拆:S-351 的前判要在**任何副作用之前**回答「这条请求会把哪个目录当写门豁免域」,而验收门的
+ * 后半场是 `mkdir`(副作用 + I/O)。把判据抄一份到前判处 = 两份验收规则,而两份规则漂移的那天,前判
+ * 会替一条**根本不会被接受**的壳供路径拒掉请求(或反过来放过一条会被接受的)。所以规则只有这一份,
+ * 两个调用点各取所需:验收门 = 本函数 + mkdir;前判 = 本函数。
+ *
+ * 返回的是**词法归一后**(`resolve`)的拼法 —— 与验收门交给写门的那一个逐字相同。
+ */
+export declare function screenShellScratchpadDir(raw: unknown, opts: {
+    requirePrincipal: boolean;
+    hostSemanticsLane: boolean;
+    warn: (msg: string, meta?: object) => void;
+}): string | undefined;
+/**
+ * S-351(core 7.20.0 / [ref])—— **这条请求会不会把任务根放进写门的豁免域里**。
+ *
+ * ## 病形(引擎侧的硬拒,不是判决期的宽严)
+ * 写门的豁免域就是 scratchpad(`exemptDirs: [scratchpadDir]`,`task-settings.ts` 的
+ * `createFsWriteGatePolicy` 那一句),而门的根是这条 task 的 cwd。core 7.20.0 起,**豁免域等于根或是
+ * 根的祖先 ⇒ 构造期抛**(亲读安装树 `dist/core/fs-write-gate-policy.js:11-28`,
+ * `code = "config.write_exempt_dir_covers_root"`)——理由逐字:一条盖住根的豁免把根下**每一次写**都自动
+ * 批准,那就是整个工作区,门宁可拒绝被建出来,也不肯带着一扇静默关掉的写治理去跑。
+ *
+ * 本仓真正够得着这一形的只有**一条边**:调用方自设 `body.cwd` 进 scratchpad 树(server 自己**从不**
+ * 把 cwd 缺省到 scratchpad —— scratchpad 与 task root 是两棵子树)。它今天的下场是 spec 折叠期抛出一条
+ * 没人分诊过的错,而调用方看到的是一条与病因无关的 422。所以前判把它提前成一条**读得懂的请求拒绝**。
+ *
+ * ## 判据只有词法(不承诺 canonical)
+ * 引擎那一侧的构造期**没有 I/O**(同上坐标:`lexicalViewOf` 纯字符串),所以这里也只做词法 —— 承诺
+ * canonical 就是承诺一件此刻做不到的事(软链形的真身要到裁决时刻才问 fs,那是写门自己的第二道)。
+ *
+ * ## 射程(每一条都是「不这样写就会误拒」)
+ *  · **只在 cwd 真会被尊重时判**:`cwdHonored` 为假的部署(多租户 / 非 host 车道)把 cwd 直接忽略,
+ *    它永远不会变成门的根 —— 在那里拒等于凭空多一条 400;
+ *  · **豁免域取这条会话可能挂上的每一只**(不是「这一次挂哪只」):server 自算那条恒是候选(有 session
+ *    就算得出),壳供 `body.scratchpadDir` **过了词法验收**才追加为候选(过不了的那条永远挂不上,拿它拒
+ *    就是凭空多一条 400)。只判其一会留一条**跨请求**的洞:一条请求供一只合法壳 scratchpad 把判据引开、
+ *    同时把 cwd 指进自算那只,放行后 cwd 坐进会话表,下一条不带路径字段的请求回落自算形、死在引擎构造期,
+ *    而它根本没送过 cwd(codex r2 [medium] 实证);
+ *  · **`in-process` 车道(provider 未设)不在射程**:那条腿的门根是**进程自己的 cwd**,与请求字段无关 ——
+ *    对着一个请求字段拒一件不是它造成的事,是把诊断指向错的地方(如实登记,不假装覆盖)。
+ */
+export declare function scratchpadCoveringTaskRoot(args: {
+    cwd: unknown;
+    shellScratchpadDir: unknown;
+    localDataRoot: string;
+    sessionId: string | undefined;
+    requirePrincipal: boolean;
+    cwdHonored: boolean;
+}): {
+    cwd: {
+        asSpelled: string;
+        lexical: string;
+    };
+    scratchpadDir: {
+        asSpelled: string;
+        lexical: string;
+    };
+} | undefined;
 /** 删除一个 session 的 scratchpad 目录(rm -rf,幂等:目录不存在=no-op)。失败吞 warn 不抛——
  *  清理绝不 fault 调用它的 session-delete 路径;下一轮 {@link sweepStaleScratchpads} 仍会兜到它。 */
 export declare function purgeScratchpadDir(localDataRoot: string, sessionId: string): Promise<void>;

package/dist/env-facts.js

@@ -1,6 +1,7 @@
 import { isAbsolute, join, resolve, sep } from "node:path";
 import { mkdir, readdir, rm, stat } from "node:fs/promises";
 import { createHash } from "node:crypto";
+import { dirCoversPath, isValidCwd, normalizeAbsolutePathLexically } from "./task-cwd.js";
 const MAX_STR = 64;
 const MAX_CAPS = 16;
 const MAX_PATH = 160;
@@ -61,6 +62,19 @@ export async function ensureScratchpadDir(localDataRoot, sessionId) {
     }
 }
 export async function acceptShellScratchpadDir(raw, opts) {
+    const screened = screenShellScratchpadDir(raw, opts);
+    if (screened === undefined)
+        return undefined;
+    try {
+        await mkdir(screened, { recursive: true });
+        return screened;
+    }
+    catch (err) {
+        opts.warn("shell_scratchpad_ignored", { reason: "mkdir_failed", error: err instanceof Error ? err.message : String(err) });
+        return undefined;
+    }
+}
+export function screenShellScratchpadDir(raw, opts) {
     if (typeof raw !== "string" || raw.length === 0)
         return undefined;
     if (opts.requirePrincipal) {
@@ -85,14 +99,26 @@ export async function acceptShellScratchpadDir(raw, opts) {
         opts.warn("shell_scratchpad_ignored", { reason: "too_shallow", canonical });
         return undefined;
     }
-    try {
-        await mkdir(canonical, { recursive: true });
-        return canonical;
-    }
-    catch (err) {
-        opts.warn("shell_scratchpad_ignored", { reason: "mkdir_failed", error: err instanceof Error ? err.message : String(err) });
+    return canonical;
+}
+export function scratchpadCoveringTaskRoot(args) {
+    if (!args.cwdHonored || !isValidCwd(args.cwd))
         return undefined;
+    const candidates = [];
+    const shell = screenShellScratchpadDir(args.shellScratchpadDir, { requirePrincipal: args.requirePrincipal, hostSemanticsLane: true, warn: () => { } });
+    if (shell !== undefined)
+        candidates.push({ asSpelled: typeof args.shellScratchpadDir === "string" ? args.shellScratchpadDir : shell, dir: shell });
+    if (args.sessionId !== undefined) {
+        const own = scratchpadDirFor(args.localDataRoot, args.sessionId);
+        candidates.push({ asSpelled: own, dir: own });
     }
+    const hit = candidates.find((c) => dirCoversPath(c.dir, args.cwd));
+    if (hit === undefined)
+        return undefined;
+    return {
+        cwd: { asSpelled: args.cwd, lexical: normalizeAbsolutePathLexically(args.cwd) },
+        scratchpadDir: { asSpelled: hit.asSpelled, lexical: normalizeAbsolutePathLexically(hit.dir) },
+    };
 }
 export async function purgeScratchpadDir(localDataRoot, sessionId) {
     const dir = scratchpadDirFor(localDataRoot, sessionId);

package/dist/execution-lane-caps.d.ts

@@ -52,6 +52,18 @@ export interface ExecutionLaneCaps {
     /** core 的 `isRemoteExecutionEnv` 对本车道的判决(鸭子类型;判别位 = `config.remoteExec` 在不在场,
      *  **含 host**)。5.26.0 起它决定 `# Memory` 写指令撤不撤。 */
     readonly coreRemoteExecutionEnv: LaneCapability;
+    /**
+     * S-354 / core 7.20.0([ref]):这条车道的适配器**声明**了 `capabilities.canonicalPathAuthoritative`
+     * 没有 —— 即「我的 `canonicalPath` 是路径落点的权威,整链答不出来是解析器出了事,不是一个我看不见的
+     * 命名空间」。声明 ⇒ 读边界的执行期复核在解析器沉默时**拒**;缺席 ⇒ 今天每个适配器的读法(词法判决
+     * 成立、命令照跑)—— **缺席不是「声明为 false」**,所以这一位的 `unsupported` 读作「本车道没表态」。
+     *
+     * 判别式:各 adapter 的 `capabilities` 字面量(`plugins/remote-env-{host,ssh,adb,k8s,device,e2b,local-docker}.ts`),
+     * 由 core 的严格读器 `canonicalPathIsAuthoritative(env)` 读;对账测试逐 lane 拿**真 adapter 实例**问它。
+     * 本位存在的理由 = 让「新车道/新适配器不表态」变成**编译红**(穷举 switch 少一行即 tsc 红),而不是
+     * 静默继承一个没人表过态的缺席。
+     */
+    readonly canonicalPathAuthority: LaneCapability;
 }
 /**
  * per-lane 能力表。**穷举 switch,禁 default 臂**(hands-lane.ts:39-46 先例)。

package/dist/execution-lane-caps.js

@@ -19,6 +19,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: YES,
                 coreRemoteExecutionEnv: NO,
+                canonicalPathAuthority: NO,
             };
         case "host":
             return {
@@ -35,6 +36,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: YES,
                 hostFilePlane: YES,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: YES,
             };
         case "e2b":
             return {
@@ -51,6 +53,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: NO,
             };
         case "k8s":
             return {
@@ -67,6 +70,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: YES,
             };
         case "ssh":
             return {
@@ -83,6 +87,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: YES,
             };
         case "adb":
             return {
@@ -99,6 +104,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: YES,
             };
         case "local-docker":
             return {
@@ -115,6 +121,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: NO,
             };
         case "device":
             return {
@@ -131,6 +138,7 @@ export function executionLaneCaps(lane) {
                 memoryPersistenceCapable: NO,
                 hostFilePlane: NO,
                 coreRemoteExecutionEnv: YES,
+                canonicalPathAuthority: YES,
             };
     }
 }

package/dist/main.js

@@ -1,7 +1,8 @@
 import { readFileSync } from "node:fs";
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Runner, terminalProjection, createPermissionRuleStoreProvider, InMemoryToolResultStore, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, probeSearchBackend, describeStaticWiring, expandTiers, DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
+import { Runner, terminalProjection, createPermissionRuleStoreProvider, InMemoryToolResultStore, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, probeSearchBackend, describeStaticWiring, DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
 import { createSessionTitler } from "./session-titler.js";
 import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
@@ -469,7 +470,7 @@ async function main() {
     const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => configCenter.getKeyResolver(), logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: "default", skills, repoClient, requirePrincipal: config.requirePrincipal,
+        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
         webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,
@@ -692,7 +693,7 @@ async function main() {
             engineArmsOnIntent: coreArmsAutoOnIntent(),
             resolveCaps: runtimeCapsPeekResolver,
             classifierModel: () => {
-                const route = classifierRouteFor({ models: expandTiers(config.models, config.tiers ?? {}) ?? config.models, roles: config.roles });
+                const route = classifierRouteFor(runnerDeps);
                 if (route.fault !== undefined)
                     logger.debug("auto_mode_classifier_route_unresolved", { fault: route.fault });
                 return route.id;

package/dist/model-select.d.ts

@@ -23,6 +23,10 @@
  * 🔴 Was a real defect: resolveSpec previously read ONLY the inline @mention, so `body.model` (the picker + the
  * `--model` flag) was SILENTLY DROPPED — the picker UX was a no-op server-side. This restores it.
  */
+/** 调用方**什么都没选**时这条 task 落到的目录 ref —— 即 `config.models.default` 那一格(引擎侧
+ *  `resolveModel("default", catalog)` 解它)。**单点**:读面要说「这台部署的主模型是谁」时读同一个词
+ *  (`auto-mode-face.ts` 的席解析器入参),两处各写一个 `"default"` 字面串正是漂移的成因。 */
+export declare const DEFAULT_MODEL_REF = "default";
 export declare function resolveTaskModel(bodyModel: unknown, objective: string, catalog: Record<string, unknown>, allowlist?: readonly string[]): {
     model: string;
     cleanedObjective: string;

package/dist/model-select.js

@@ -1,11 +1,12 @@
 import { parseModelMention } from "@sema-agent/core";
+export const DEFAULT_MODEL_REF = "default";
 export function resolveTaskModel(bodyModel, objective, catalog, allowlist) {
     const mention = parseModelMention(objective, Object.keys(catalog));
     const explicit = typeof bodyModel === "string" ? matchCatalogModel(bodyModel, catalog) : undefined;
     const present = bodyModel !== undefined && bodyModel !== null;
     const unknown = present && explicit === undefined;
     const repr = typeof bodyModel !== "string" ? `<non-string:${typeof bodyModel}>` : bodyModel === "" ? "<empty-string>" : bodyModel;
-    const model = explicit ?? mention.model ?? "default";
+    const model = explicit ?? mention.model ?? DEFAULT_MODEL_REF;
     const picked = explicit !== undefined ? { ref: explicit, source: "explicit", requested: repr } : mention.model !== undefined ? { ref: mention.model, source: "mention", requested: mention.model } : undefined;
     const notAllowed = picked !== undefined && !isModelAllowlisted(picked.ref, catalog, allowlist)
         ? { requested: picked.requested, resolved: terminalCatalogName(picked.ref, catalog) ?? picked.ref, source: picked.source }

package/dist/plugins/remote-env-adb.d.ts

@@ -44,9 +44,20 @@ export interface AdbEnvDeps {
  *  typed retryable (reconnect + retry per idempotency), never a fake command result. Exported for tests. */
 export declare function isAdbTransportLost(stderr: string): boolean;
 export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,在设备 shell 里解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     cwd: string;
     private connected;

package/dist/plugins/remote-env-adb.js

@@ -18,7 +18,7 @@ export function isAdbTransportLost(stderr) {
     return /device offline|device '.*' not found|no devices\/emulators found|connection reset|protocol fault|device disconnected/i.test(stderr);
 }
 export class RemoteAdbExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     cwd;
     connected = false;
     destroyed = false;

package/dist/plugins/remote-env-device.d.ts

@@ -94,9 +94,20 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
      * 谁要把 executor 的工作区改成临时目录,先来改这一行:那一刻这个 `false` 就变成谎话,park 赎回会
      * 落到一个空工作区上而链路上没有任何一层会报错。
      */
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(设备 WS 协议的**必答** `canonicalPath` op)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     readonly externalContentTarget = true;
     /** [ref]:设备路径不在 worker 宿主文件系统上 —— host-path 回执消费方据此拒绝把它当宿主路径呈现。 */

package/dist/plugins/remote-env-device.js

@@ -110,7 +110,7 @@ function assertPosixDevicePlatform(os, deviceId) {
 export class RemoteDeviceExecutionEnv {
     cfg;
     homeDir;
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     externalContentTarget = true;
     hostLocalPaths = false;
     cwd;

package/dist/plugins/remote-env-host.d.ts

@@ -58,9 +58,20 @@ export interface HostEnvConfig {
 }
 export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, SchedulerCapability, BackgroundShellCapability {
     /** [ref] §9 / DUAL-MODE-DESIGN §5: a `host` env is the operator's real machine — no isolation, no snapshot. */
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(worker 本机的 `fs.realpath`)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     /** R7 自唤醒: structural delegation to the injected scheduler backend. `hasScheduler(env)` checks BOTH the method
      *  presence (always, since we implement the interface) AND `schedulerCapabilities.supported===true` — which is only

package/dist/plugins/remote-env-host.js

@@ -34,7 +34,7 @@ const UNSUPPORTED_SCHEDULER_CAPS = {
     maxScheduledHorizonSec: 0,
 };
 export class RemoteHostExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     get schedulerCapabilities() {
         return this.cfg.scheduler?.schedulerCapabilities ?? UNSUPPORTED_SCHEDULER_CAPS;
     }

package/dist/plugins/remote-env-k8s.d.ts

@@ -119,9 +119,20 @@ export { execSocketTlsOptions } from "./k8s-exec-protocol.js";
 export declare function errorMessageOf(e: unknown): string;
 export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
 export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, BackgroundShellCapability {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,经 pod exec 解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: true;
     };
     cwd: string;
     private podName?;

package/dist/plugins/remote-env-k8s.js

@@ -78,7 +78,7 @@ export class RemoteK8sExecutionEnv {
         this.cwd = this.cfg.mountPath;
         this.homeDir = config.homeDir;
         this.deps = deps ?? {};
-        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot };
+        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true };
         const bgMax = Math.max(1, Math.min(K8S_BG_MAX_TIMEOUT_SEC, Math.floor(this.cfg.timeoutMs / 1000)));
         this.backgroundCapabilities = {
             supported: true,

package/dist/plugins/remote-env-ssh.d.ts

@@ -61,9 +61,20 @@ export interface SshEnvDeps {
     connectOnce?: (signal?: AbortSignal) => Promise<ConnectResult>;
 }
 export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,在真机上解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     /** Working directory; relative paths resolve against it (ExecutionEnv contract). Starts at mountPath. */
     cwd: string;

package/dist/plugins/remote-env-ssh.js

@@ -16,7 +16,7 @@ function exitCodeForSignalKill(signal) {
     return 128 + (signalNumber(`SIG${signal}`) ?? 9);
 }
 export class RemoteSshExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     cwd;
     conn;
     sftpPromise;

package/dist/run-local.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { terminalProjection } from "@sema-agent/core";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -429,7 +430,7 @@ export async function runLocal(argv, deps = {}) {
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const taskListLane = createTaskListLane({ logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: "default", skills, repoClient, metrics, logger,
+        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, metrics, logger,
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,

package/dist/task-cwd.d.ts

@@ -18,6 +18,30 @@ export declare const MAX_CWD_CHARS = 4096;
  *     先改这里**:把判据换成 core 的 `isAbsoluteForFamily`,并把家族从这条 cwd 自己的拼法取。
  *  钉见 `test/task-cwd.test.ts` 的「[ref] 路径家族接缝」格(实测读数,不是推断)。 */
 export declare function isValidCwd(cwd: unknown): cwd is string;
+/**
+ * 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,**不碰 fs**。
+ * `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「根之上没有东西」的语义一致;尾部分隔符
+ * 统一剥掉(根 `/` 除外),让同一目标只有一个 key —— 前缀判域(见 {@link dirCoversPath})靠的就是
+ * key 的唯一性。
+ *
+ * 🔴 **单点**(S-351 起):此前它的一份私有副本住在 `boot/deferred-sandbox-path-env.ts`(沙箱代理的
+ * `absolutePath` 词法臂),而写门豁免域与任务根的判域现在读的是同一条律 —— 两份各自归一就是两个 key
+ * 空间,而「豁免域盖没盖住任务根」这种判断在两个 key 空间里可以同时答是和否。
+ * (core 内部有同形的 `normalizeAbsPathLexically`,但未从包根导出;此处是 Node 标准库的等价运算,
+ *  不是它的抄本——若日后 core 导出,这里应改为直接复用。)
+ */
+export declare function normalizeAbsolutePathLexically(p: string): string;
+/**
+ * **词法**判域:`dir` 是不是 `target` 本身或它的祖先(= `target` ⊆ `dir`,「等于 ∪ 后代」)。
+ *
+ * 这是 core `assertExemptDirsDoNotCoverRoot` 那条律的本仓同形(亲读安装树
+ * `dist/core/fs-write-gate-policy.js:11-28` → `swallowedFenceRoot` → `isWithin(root, p)`:
+ * 先各自词法归一,再判 `p === root` 或 `p` 以 `root + "/"` 起头)。**两端都只做词法**,不 realpath ——
+ * 写门的构造期本来就没有 I/O(core 同理),承诺 canonical 是承诺一件此刻做不到的事。
+ *
+ * 段感知由「归一后 + 分隔符前缀」保证:`/a/bc` **不在** `/a/b` 域内。
+ */
+export declare function dirCoversPath(dir: string, target: string): boolean;
 /**
  * The deployment-level gate: does THIS deployment honor a caller-supplied `cwd`? TRUE only for the single-user
  * `host` lane (see module header). All cloud/container lanes + any multi-tenant deployment → FALSE (cwd ignored).

package/dist/task-cwd.js

@@ -8,6 +8,15 @@ export function isValidCwd(cwd) {
         path.isAbsolute(cwd) &&
         !cwd.split(/[/\\]/).includes(".."));
 }
+export function normalizeAbsolutePathLexically(p) {
+    const collapsed = path.posix.normalize(p.replace(/^\/+/, "/"));
+    return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
+}
+export function dirCoversPath(dir, target) {
+    const root = normalizeAbsolutePathLexically(dir);
+    const p = normalizeAbsolutePathLexically(target);
+    return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
+}
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.78.2",
+  "version": "7.79.0",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.19.0",
+    "@sema-agent/core": "7.20.0",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",