@sema-agent/server 7.78.2 → 7.79.1

package/dist/main.js

@@ -1,7 +1,8 @@
 import { readFileSync } from "node:fs";
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { Runner, terminalProjection, createPermissionRuleStoreProvider, InMemoryToolResultStore, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, probeSearchBackend, describeStaticWiring, expandTiers, DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
+import { Runner, terminalProjection, createPermissionRuleStoreProvider, InMemoryToolResultStore, TtlSessionStore, uuidv7, defaultTaskRegistry, createAllowDenyPolicy, workflowsCapability, probeSearchBackend, describeStaticWiring, DEFAULT_SUBAGENT_TOOL_NAME } from "@sema-agent/core";
 import { createSessionTitler } from "./session-titler.js";
 import { posIntEnv } from "./session-watch.js";
 import { selectEnvironmentTool } from "./capabilities/select-environment-tool.js";
@@ -27,6 +28,7 @@ import { createToolTracer, createPermissionDeniedMeter } from "./observability/t
 import { createRegistryJwtVerifier } from "./auth-bridge.js";
 import { createMetrics } from "./observability/metrics.js";
 import { installFailOpenRecorder } from "./observability/fail-open.js";
+import { installFileHistoryFailureRecorder } from "./file-history-disclosure.js";
 import { installSecretEnvScrubRecorder } from "./observability/secret-env-scrub.js";
 import { setRunTerminalObserver } from "./observability/run-terminal-log.js";
 import { setRedactionObserver, redactSecrets } from "./trace/redact.js";
@@ -95,6 +97,7 @@ async function main() {
     const metrics = createMetrics();
     installFailOpenRecorder({ logger, metrics });
     installSecretEnvScrubRecorder({ logger, metrics });
+    installFileHistoryFailureRecorder({ logger, metrics });
     logConfigDiagnostics(logger);
     for (const w of drainNumEnvWarnings())
         logger.warn("config_env_invalid_using_default", { env: w.env, raw: w.raw });
@@ -469,7 +472,7 @@ async function main() {
     const ensureChildSessionDurable = checkpointStore && config.sessionBackend === "tidb" ? (sessionId) => ensureChildSessionDurableWithPromotion(sessionStore, subRunnerSessions, sessionId) : undefined;
     const webFetchSummarize = createWebFetchSummarizeLane({ brain, config, getKeyResolver: () => configCenter.getKeyResolver(), logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: "default", skills, repoClient, requirePrincipal: config.requirePrincipal,
+        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, requirePrincipal: config.requirePrincipal,
         webSearch: webSearch ? webSearch : undefined, metrics, logger, webFetchSummarize,
         backgroundAgentStore: backgroundAgentStore ? backgroundAgentStore : undefined,
         checkpointStore: checkpointStore ? checkpointStore : undefined,
@@ -692,7 +695,7 @@ async function main() {
             engineArmsOnIntent: coreArmsAutoOnIntent(),
             resolveCaps: runtimeCapsPeekResolver,
             classifierModel: () => {
-                const route = classifierRouteFor({ models: expandTiers(config.models, config.tiers ?? {}) ?? config.models, roles: config.roles });
+                const route = classifierRouteFor(runnerDeps);
                 if (route.fault !== undefined)
                     logger.debug("auto_mode_classifier_route_unresolved", { fault: route.fault });
                 return route.id;

package/dist/model-select.d.ts

@@ -23,6 +23,10 @@
  * 🔴 Was a real defect: resolveSpec previously read ONLY the inline @mention, so `body.model` (the picker + the
  * `--model` flag) was SILENTLY DROPPED — the picker UX was a no-op server-side. This restores it.
  */
+/** 调用方**什么都没选**时这条 task 落到的目录 ref —— 即 `config.models.default` 那一格(引擎侧
+ *  `resolveModel("default", catalog)` 解它)。**单点**:读面要说「这台部署的主模型是谁」时读同一个词
+ *  (`auto-mode-face.ts` 的席解析器入参),两处各写一个 `"default"` 字面串正是漂移的成因。 */
+export declare const DEFAULT_MODEL_REF = "default";
 export declare function resolveTaskModel(bodyModel: unknown, objective: string, catalog: Record<string, unknown>, allowlist?: readonly string[]): {
     model: string;
     cleanedObjective: string;

package/dist/model-select.js

@@ -1,11 +1,12 @@
 import { parseModelMention } from "@sema-agent/core";
+export const DEFAULT_MODEL_REF = "default";
 export function resolveTaskModel(bodyModel, objective, catalog, allowlist) {
     const mention = parseModelMention(objective, Object.keys(catalog));
     const explicit = typeof bodyModel === "string" ? matchCatalogModel(bodyModel, catalog) : undefined;
     const present = bodyModel !== undefined && bodyModel !== null;
     const unknown = present && explicit === undefined;
     const repr = typeof bodyModel !== "string" ? `<non-string:${typeof bodyModel}>` : bodyModel === "" ? "<empty-string>" : bodyModel;
-    const model = explicit ?? mention.model ?? "default";
+    const model = explicit ?? mention.model ?? DEFAULT_MODEL_REF;
     const picked = explicit !== undefined ? { ref: explicit, source: "explicit", requested: repr } : mention.model !== undefined ? { ref: mention.model, source: "mention", requested: mention.model } : undefined;
     const notAllowed = picked !== undefined && !isModelAllowlisted(picked.ref, catalog, allowlist)
         ? { requested: picked.requested, resolved: terminalCatalogName(picked.ref, catalog) ?? picked.ref, source: picked.source }

package/dist/observability/metrics.js

@@ -221,7 +221,7 @@ export function createMetrics() {
     m.counter("degraded_total", "Tasks degraded to a cheaper model (1.40), by reason (budget/rate_limit/breaker_open)");
     m.counter("task_model_not_allowlisted_resume_total", "Resumed legs whose model/compactionModel is outside the @-mention allowlist (allowed to keep running by design — the allowlist gates fresh picks only)");
     m.counter("prompt_constitution_total", "Prompt assembly constitution mode per task (core 1.243 提示词主权): steady state = core; provider-assembled/replaced/legacy warrant eyes");
-    m.counter("rewind_snapshot_failed_total", "Per-turn rewind file snapshots that failed, by code (too_large = big working tree, expected/benign; other codes warrant eyes)");
+    m.counter("rewind_snapshot_failed_total", "Per-turn rewind file snapshots that failed, by the engine's FileHistoryResult.error.code (snapshot_failed/aborted/…; `unknown` = the disclosure text carried no readable code). COARSE on purpose — whether a failure is permanent (the same file will fail every turn until the deployment changes) is counted by file_history_permanent_failure_total instead, from the typed error object rather than from prose");
     m.counter("verifications_total", "Tasks run through the verification gate (1.44), by final verdict");
     m.counter("cascade_total", "Tasks run through the model cascade (1.45), by outcome (passed/exhausted)");
     m.counter("degenerate_total", "Degenerate-output failures (1.59), by salvage class (a/b/unknown)");

package/dist/plugins/file-history-store-sql.js

@@ -4,6 +4,7 @@ import { SqlBlobBackend } from "./blob-backend.js";
 import { mysqlDriver, pgDriver } from "./sql-driver.js";
 import { isMissingColumnError } from "./sql-errors.js";
 import { recordFailOpen } from "../observability/fail-open.js";
+import { discloseCaughtFailure } from "../file-history-disclosure.js";
 export const FILE_HISTORY_BLOB_TABLE = "file_history_blob";
 export const FILE_HISTORY_BLOB_KEY_PREFIX = "file-history/";
 const sha256hex = (s) => createHash("sha256").update(s).digest("hex");
@@ -116,7 +117,7 @@ export class SqlFileHistoryStore {
             return { ok: false, error: { code: "track_failed", message: `first-touch record for ${absPath} kept racing a concurrent retraction — retry` } };
         }
         catch (err) {
-            return { ok: false, error: { code: "track_failed", message: `first-touch record for ${absPath} could not be persisted: ${err.message}` } };
+            return { ok: false, error: { code: "track_failed", message: `first-touch record for ${absPath} could not be persisted: ${discloseCaughtFailure(err)}` } };
         }
     }
     async annulIneligibleReason(scope, keyHash, absPath) {
@@ -189,7 +190,7 @@ export class SqlFileHistoryStore {
             return { ok: false, error: { code: "conflict", message: `first-touch record for ${absPath} was replaced while this retraction was being proven` } };
         }
         catch (err) {
-            return { ok: false, error: { code: "track_failed", message: `annulling the first-touch record for ${absPath} failed: ${err.message}` } };
+            return { ok: false, error: { code: "track_failed", message: `annulling the first-touch record for ${absPath} failed: ${discloseCaughtFailure(err)}` } };
         }
     }
     async loadTracked(exec, scope, forUpdate = false) {
@@ -296,7 +297,7 @@ export class SqlFileHistoryStore {
             }
         }
         catch (err) {
-            return { ok: false, error: { code: "snapshot_failed", message: err.message } };
+            return { ok: false, error: { code: "snapshot_failed", message: discloseCaughtFailure(err) } };
         }
         this.activeAttempts.add(lease);
         try {
@@ -398,7 +399,7 @@ export class SqlFileHistoryStore {
             catch (err) {
                 await conn.rollback().catch(() => undefined);
                 this.spentAttempts.add(lease);
-                return { ok: false, error: { code: "snapshot_failed", message: `boundary for entry "${entryId}" could not be committed: ${err.message}` } };
+                return { ok: false, error: { code: "snapshot_failed", message: `boundary for entry "${entryId}" could not be committed: ${discloseCaughtFailure(err)}` } };
             }
             finally {
                 conn.release();
@@ -408,7 +409,7 @@ export class SqlFileHistoryStore {
         }
         catch (err) {
             this.spentAttempts.add(lease);
-            return { ok: false, error: { code: "snapshot_failed", message: err.message } };
+            return { ok: false, error: { code: "snapshot_failed", message: discloseCaughtFailure(err) } };
         }
         finally {
             this.activeAttempts.delete(lease);
@@ -475,7 +476,7 @@ export class SqlFileHistoryStore {
                     });
                 }
                 catch (err) {
-                    applied = { outcome: "failed", reason: err.message };
+                    applied = { outcome: "failed", reason: discloseCaughtFailure(err) };
                 }
                 if (applied.outcome === "applied")
                     ledger.filesChanged.push(t.trackKey);
@@ -492,7 +493,7 @@ export class SqlFileHistoryStore {
         }
         catch (err) {
             const touched = empty.filesChanged.length > 0 || empty.identicalSkipped.length > 0 || empty.refused.length > 0 || empty.failed.length > 0;
-            return { outcome: touched ? "partial" : "failed", ...empty, error: { code: "restore_failed", message: err.message } };
+            return { outcome: touched ? "partial" : "failed", ...empty, error: { code: "restore_failed", message: discloseCaughtFailure(err) } };
         }
     }
     async restorePlan(scope, entryId) {
@@ -593,7 +594,7 @@ export class SqlFileHistoryStore {
             return { ok: true };
         }
         catch (err) {
-            return { ok: false, error: { code: "snapshot_failed", message: `putBlob ${hash} write/upload failed: ${err.message}` } };
+            return { ok: false, error: { code: "snapshot_failed", message: `putBlob ${hash} write/upload failed: ${discloseCaughtFailure(err)}` } };
         }
     }
     async getBlob(hash) {
@@ -636,7 +637,7 @@ export class SqlFileHistoryStore {
             }
         }
         catch (err) {
-            return { ok: false, error: { code: "conflict", message: `adoptScope failed: ${err.message}` } };
+            return { ok: false, error: { code: "conflict", message: `adoptScope failed: ${discloseCaughtFailure(err)}` } };
         }
     }
     async scopeEmpty(exec, scope, forUpdate = false) {
@@ -735,7 +736,7 @@ export class SqlFileHistoryStore {
                     bytes = await srcGetBlob(hash);
                 }
                 catch (err) {
-                    return { ok: false, error: { code: "unsupported_format", message: `source blob ${hash} fetch failed: ${err.message}` } };
+                    return { ok: false, error: { code: "unsupported_format", message: `source blob ${hash} fetch failed: ${discloseCaughtFailure(err)}` } };
                 }
                 if (bytes === undefined)
                     return { ok: false, error: { code: "not_found", message: `source blob ${hash} is missing — the envelope's graph cannot be completed, so nothing is published` } };
@@ -786,7 +787,7 @@ export class SqlFileHistoryStore {
             }
         }
         catch (err) {
-            return { ok: false, error: { code: "unsupported_format", message: `importHistory failed: ${err.message}` } };
+            return { ok: false, error: { code: "unsupported_format", message: `importHistory failed: ${discloseCaughtFailure(err)}` } };
         }
     }
 }

package/dist/plugins/remote-env-adb.d.ts

@@ -44,9 +44,20 @@ export interface AdbEnvDeps {
  *  typed retryable (reconnect + retry per idempotency), never a fake command result. Exported for tests. */
 export declare function isAdbTransportLost(stderr: string): boolean;
 export declare class RemoteAdbExecutionEnv implements RemoteExecutionEnv {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,在设备 shell 里解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     cwd: string;
     private connected;

package/dist/plugins/remote-env-adb.js

@@ -18,7 +18,7 @@ export function isAdbTransportLost(stderr) {
     return /device offline|device '.*' not found|no devices\/emulators found|connection reset|protocol fault|device disconnected/i.test(stderr);
 }
 export class RemoteAdbExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     cwd;
     connected = false;
     destroyed = false;

package/dist/plugins/remote-env-device.d.ts

@@ -94,9 +94,20 @@ export declare class RemoteDeviceExecutionEnv implements RemoteExecutionEnv {
      * 谁要把 executor 的工作区改成临时目录,先来改这一行:那一刻这个 `false` 就变成谎话,park 赎回会
      * 落到一个空工作区上而链路上没有任何一层会报错。
      */
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(设备 WS 协议的**必答** `canonicalPath` op)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     readonly externalContentTarget = true;
     /** [ref]:设备路径不在 worker 宿主文件系统上 —— host-path 回执消费方据此拒绝把它当宿主路径呈现。 */

package/dist/plugins/remote-env-device.js

@@ -110,7 +110,7 @@ function assertPosixDevicePlatform(os, deviceId) {
 export class RemoteDeviceExecutionEnv {
     cfg;
     homeDir;
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     externalContentTarget = true;
     hostLocalPaths = false;
     cwd;

package/dist/plugins/remote-env-host.d.ts

@@ -58,9 +58,20 @@ export interface HostEnvConfig {
 }
 export declare class RemoteHostExecutionEnv implements RemoteExecutionEnv, SchedulerCapability, BackgroundShellCapability {
     /** [ref] §9 / DUAL-MODE-DESIGN §5: a `host` env is the operator's real machine — no isolation, no snapshot. */
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(worker 本机的 `fs.realpath`)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     /** R7 自唤醒: structural delegation to the injected scheduler backend. `hasScheduler(env)` checks BOTH the method
      *  presence (always, since we implement the interface) AND `schedulerCapabilities.supported===true` — which is only

package/dist/plugins/remote-env-host.js

@@ -34,7 +34,7 @@ const UNSUPPORTED_SCHEDULER_CAPS = {
     maxScheduledHorizonSec: 0,
 };
 export class RemoteHostExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     get schedulerCapabilities() {
         return this.cfg.scheduler?.schedulerCapabilities ?? UNSUPPORTED_SCHEDULER_CAPS;
     }

package/dist/plugins/remote-env-k8s.d.ts

@@ -119,9 +119,20 @@ export { execSocketTlsOptions } from "./k8s-exec-protocol.js";
 export declare function errorMessageOf(e: unknown): string;
 export { exitCodeFromStatus } from "./k8s-exec-protocol.js";
 export declare class RemoteK8sExecutionEnv implements RemoteExecutionEnv, BackgroundShellCapability {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,经 pod exec 解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: true;
     };
     cwd: string;
     private podName?;

package/dist/plugins/remote-env-k8s.js

@@ -78,7 +78,7 @@ export class RemoteK8sExecutionEnv {
         this.cwd = this.cfg.mountPath;
         this.homeDir = config.homeDir;
         this.deps = deps ?? {};
-        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot };
+        this.capabilities = { isolation: true, suspendable: !!this.cfg.s3Snapshot, canonicalPathAuthoritative: true };
         const bgMax = Math.max(1, Math.min(K8S_BG_MAX_TIMEOUT_SEC, Math.floor(this.cfg.timeoutMs / 1000)));
         this.backgroundCapabilities = {
             supported: true,

package/dist/plugins/remote-env-ssh.d.ts

@@ -61,9 +61,20 @@ export interface SshEnvDeps {
     connectOnce?: (signal?: AbortSignal) => Promise<ConnectResult>;
 }
 export declare class RemoteSshExecutionEnv implements RemoteExecutionEnv {
+    /**
+     * 🔴 **S-354 / core 7.20.0([ref])`canonicalPathAuthoritative: true`** —— 本适配器的 `canonicalPath`
+     * 就是**命令真正跑的那块文件系统**的权威答案(`posix-shell-fs` 的 `canonicalPath` 原语,在真机上解到落点)。声明它 = 告诉引擎:整链答不出来是**解析器出了事**
+     * (RPC 断、传输掉),不是「一个它看不见的命名空间」⇒ 读边界的执行期复核**拒**,而不是让词法判决站着。
+     * 缺席是今天每个适配器的读法(整链沉默 ⇒ 词法判决成立、命令照跑),所以这一声明是**收紧**方向。
+     * 严格读法 `=== true`(core `canonicalPathIsAuthoritative`);`isSuspendable` 一族同样严格,对本仓的
+     * 布尔字面量零影响(三键都写死字面 `true`/`false`,不存在「非布尔值被读成缺席」那一形 —— 那一形由
+     * core 的 `config.execution_env_capability_invalid` 普查响亮播报,本仓的受众表已登记)。
+     * 谁该声明由闭集门看着(`test/execution-lane-caps.test.ts` 的逐 lane 对账:新 lane 不表态 = 编译红)。
+     */
     readonly capabilities: {
         isolation: boolean;
         suspendable: boolean;
+        canonicalPathAuthoritative: boolean;
     };
     /** Working directory; relative paths resolve against it (ExecutionEnv contract). Starts at mountPath. */
     cwd: string;

package/dist/plugins/remote-env-ssh.js

@@ -16,7 +16,7 @@ function exitCodeForSignalKill(signal) {
     return 128 + (signalNumber(`SIG${signal}`) ?? 9);
 }
 export class RemoteSshExecutionEnv {
-    capabilities = { isolation: false, suspendable: false };
+    capabilities = { isolation: false, suspendable: false, canonicalPathAuthoritative: true };
     cwd;
     conn;
     sftpPromise;

package/dist/run-local.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { DEFAULT_MODEL_REF } from "./model-select.js";
 import { terminalProjection } from "@sema-agent/core";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -429,7 +430,7 @@ export async function runLocal(argv, deps = {}) {
     const webSearch = webSearchCfg ? createWebSearchBackend(webSearchCfg) : undefined;
     const taskListLane = createTaskListLane({ logger });
     const scenarioDeps = {
-        runner, subRunner, handslessSubRunner, model: "default", skills, repoClient, metrics, logger,
+        runner, subRunner, handslessSubRunner, model: DEFAULT_MODEL_REF, skills, repoClient, metrics, logger,
         ...(webSearch ? { webSearch } : {}),
         backgroundAgentStore: fileBackend.backgroundAgentStore,
         taskListStoreFor: taskListLane.storeFor,

package/dist/task-cwd.d.ts

@@ -18,6 +18,30 @@ export declare const MAX_CWD_CHARS = 4096;
  *     先改这里**:把判据换成 core 的 `isAbsoluteForFamily`,并把家族从这条 cwd 自己的拼法取。
  *  钉见 `test/task-cwd.test.ts` 的「[ref] 路径家族接缝」格(实测读数,不是推断)。 */
 export declare function isValidCwd(cwd: unknown): cwd is string;
+/**
+ * 词法归一:纯字符串运算,折 `.` / `..` / 重复分隔符,**不碰 fs**。
+ * `posix.normalize` 把 `..` 在根部截断(`/../x` → `/x`),与「根之上没有东西」的语义一致;尾部分隔符
+ * 统一剥掉(根 `/` 除外),让同一目标只有一个 key —— 前缀判域(见 {@link dirCoversPath})靠的就是
+ * key 的唯一性。
+ *
+ * 🔴 **单点**(S-351 起):此前它的一份私有副本住在 `boot/deferred-sandbox-path-env.ts`(沙箱代理的
+ * `absolutePath` 词法臂),而写门豁免域与任务根的判域现在读的是同一条律 —— 两份各自归一就是两个 key
+ * 空间,而「豁免域盖没盖住任务根」这种判断在两个 key 空间里可以同时答是和否。
+ * (core 内部有同形的 `normalizeAbsPathLexically`,但未从包根导出;此处是 Node 标准库的等价运算,
+ *  不是它的抄本——若日后 core 导出,这里应改为直接复用。)
+ */
+export declare function normalizeAbsolutePathLexically(p: string): string;
+/**
+ * **词法**判域:`dir` 是不是 `target` 本身或它的祖先(= `target` ⊆ `dir`,「等于 ∪ 后代」)。
+ *
+ * 这是 core `assertExemptDirsDoNotCoverRoot` 那条律的本仓同形(亲读安装树
+ * `dist/core/fs-write-gate-policy.js:11-28` → `swallowedFenceRoot` → `isWithin(root, p)`:
+ * 先各自词法归一,再判 `p === root` 或 `p` 以 `root + "/"` 起头)。**两端都只做词法**,不 realpath ——
+ * 写门的构造期本来就没有 I/O(core 同理),承诺 canonical 是承诺一件此刻做不到的事。
+ *
+ * 段感知由「归一后 + 分隔符前缀」保证:`/a/bc` **不在** `/a/b` 域内。
+ */
+export declare function dirCoversPath(dir: string, target: string): boolean;
 /**
  * The deployment-level gate: does THIS deployment honor a caller-supplied `cwd`? TRUE only for the single-user
  * `host` lane (see module header). All cloud/container lanes + any multi-tenant deployment → FALSE (cwd ignored).

package/dist/task-cwd.js

@@ -8,6 +8,15 @@ export function isValidCwd(cwd) {
         path.isAbsolute(cwd) &&
         !cwd.split(/[/\\]/).includes(".."));
 }
+export function normalizeAbsolutePathLexically(p) {
+    const collapsed = path.posix.normalize(p.replace(/^\/+/, "/"));
+    return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
+}
+export function dirCoversPath(dir, target) {
+    const root = normalizeAbsolutePathLexically(dir);
+    const p = normalizeAbsolutePathLexically(target);
+    return p === root || p.startsWith(root.endsWith("/") ? root : `${root}/`);
+}
 export function cwdHonored(config) {
     return config.remoteExec?.provider === "host" && config.requirePrincipal !== true;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sema-agent/server",
-  "version": "7.78.2",
+  "version": "7.79.1",
   "description": "Sema Server — the server/API implementation layer for Sema, wiring core, registry, model providers, and cloud agent execution. Built on @sema-agent/core.",
   "type": "module",
   "license": "BUSL-1.1",
@@ -54,7 +54,7 @@
     "build:binary:run-local:darwin-arm64": "bun build --compile --target=bun-darwin-arm64 src/run-local.ts --outfile dist/run-local-darwin-arm64"
   },
   "dependencies": {
-    "@sema-agent/core": "7.19.0",
+    "@sema-agent/core": "7.20.0",
     "@sema-agent/settings-schema": "2.1.0",
     "e2b": "^2.28.0",
     "libsodium-wrappers": "^0.8.4",