Merge pull request #58 from ApodexAI/fix/spill-scope-recovery

fix(spill): one store and one scope key for spill storage, mount and reads

Author: zhanghanduo

CHANGELOG.md

@@ -76,6 +76,19 @@ Initial open-source release of FrontierAgent.
   `reboot` are no longer refused, while `bash -c`, shell heredocs, pipes into a
   shell, evaluators (`watch`/`tmux`/…) and `systemctl` shutdown units still are.
   `DROP TABLE` keeps screening the whole text.
+- Spill recovery: oversized and compacted tool results are stored through
+  AgentCore's `SpillStore` (one store, one registry). A single scope key
+  (`task:llm_session`) now decides the store directory, the bwrap `/spill` mount
+  and read authorization: a jail sees only its own store and its sub-agents',
+  siblings and other conversations see nothing, and `_path_auth` no longer
+  authorizes every store the process created. A path is advertised only when
+  the backend actually running commands can open it (`auto` going to E2B, or
+  bwrap unusable, gets none), and the compaction spill callback is withheld
+  then. Compacting a truncated preview points at the original full body
+  instead of storing the preview as "[Full text]". The `recover_result` footer
+  is only shown when a trajectory JSONL exists. Known limitation: `container`
+  mode without the inner bwrap jail shares one tool uid, so model commands can
+  still read other scopes there.
 - Surface finalize-gate bypasses on the final turn: an answer delivered despite
   open task-board items now carries an unfinished-work note and a
   `finalize_gate_bypassed` marker instead of reading as a clean success.

apodex/tests/test_changes.py

@@ -1135,6 +1135,8 @@ def test_clear_discards_only_the_active_sessions_spill(tmp_path, monkeypatch):
     from apodex.session import TerminalSession
     from frontier_agent.core.messages import user_msg
 
+    # This tests store access/cleanup, independently of host bwrap support.
+    monkeypatch.setenv("SANDBOX_BACKEND", "native")
     monkeypatch.setenv("HOME", str(tmp_path))
     monkeypatch.setenv("APODEX_RUNS_ROOT", str(tmp_path / "runs"))
     monkeypatch.delenv("APODEX_INPUT_STAGING_DIR", raising=False)
@@ -1239,6 +1241,8 @@ def test_context_reset_still_cleans_a_session_private_workspace(tmp_path, monkey
     private.mkdir(parents=True)
     link = tmp_path / "current-workspace"
     link.symlink_to(private, target_is_directory=True)
+    # This tests store access/cleanup, independently of host bwrap support.
+    monkeypatch.setenv("SANDBOX_BACKEND", "native")
     monkeypatch.setenv("APODEX_RUNS_ROOT", str(runs_root))
     monkeypatch.setenv("FRONTIER_AGENT_WORKSPACE_DIR", str(link))
     monkeypatch.setenv("APODEX_SPILL_DIR", str(tmp_path / "store"))

apodex/tests/test_tui.py

@@ -3159,7 +3159,8 @@ async def test_user_scroll_can_leave_and_restore_stream_following() -> None:
         await pilot.pause()
         assert transcript.scroll_offset.y == 5
 
-        transcript.scroll_end(animate=False)
+        # Assert the completed scroll, without depending on a deferred refresh.
+        transcript.scroll_end(animate=False, immediate=True)
         await pilot.pause()
         assert transcript._wants_tail is True
         app.sink.content_delta("tail output\n\n" * 20)

frontier_agent/core/runtime/loop/agent_loop.py

@@ -21,6 +21,7 @@
 from frontier_agent.core.execution_context import (
     ExecutionScope,
     chain_fallback_active,
+    get_current_execution_scope,
     reset_current_execution_scope,
     set_current_execution_scope,
 )
@@ -49,13 +50,26 @@ def _enter_scope(
         phase_id=phase_id,
         metadata=metadata,
     )
+    # A loop entered from inside another (an in-process sub-agent) is that
+    # loop's child: the parent may read the child's spill store, siblings not.
+    from plugins.tools._overflow import register_child_scope
+
+    register_child_scope(get_current_execution_scope(), scope)
     return scope, set_current_execution_scope(scope)
 
 
 def _body_has_spill_reference(body: str) -> bool:
+    """Whether the trajectory recovery footer should stay quiet for ``body``.
+
+    True when the body already names a spill file (that file holds the full
+    output), and also when this agent has no trajectory JSONL: the footer names
+    ``recover_result``, which reads exactly that file, so without one it would
+    hand the model a handle that can only answer "unavailable".
+    """
     from plugins.tools._overflow import body_names_a_spill_file
+    from plugins.tools.recover_result import trajectory_recovery_available
 
-    return body_names_a_spill_file(body)
+    return body_names_a_spill_file(body) or not trajectory_recovery_available()
 
 
 def _with_recovery_handle(body: str, result: Any, turn: int, *, enabled: bool) -> str: