fix: engine and gateway hardening

- Parse Bash heredocs when scanning commands so quoted heredoc bodies no
  longer trigger extra approval prompts; raise the parse budget to 500ms.
- Let the Bash tool run with a cwd outside the workspace roots; the
  terminal service keeps its guard.
- Keep the gateway process alive on uncaughtException (log instead of exit).
- Report the journaled event watermark as last_seq on session details so
  clients resume without replaying history.
- Drop null fields when flattening telemetry events; track the session
  index mirror give-up event once per failure streak.
- Allow injecting a pino destination stream for tests.

Author: elkaix

.changeset/bash-cwd-outside-workspace.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Allow the Bash tool to run with a working directory outside the workspace roots.

.changeset/bash-heredoc-approval.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Handle heredocs when scanning Bash commands so quoted heredoc content no longer forces extra approval prompts.

.changeset/server-survives-uncaught-errors.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Keep the gateway server running after an unexpected error instead of exiting the process.

.changeset/session-event-watermark.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Fetch the current event position with session details so clients resume without replaying past events.

packages/agent-core-v2/src/agent/agentsMdReminder/agentsMdReminderService.ts

@@ -41,7 +41,7 @@ import { extractBashTargetDirs } from './bashTargets';
 
 const AGENTS_MD_BASENAMES: ReadonlySet<string> = new Set<string>(AGENTS_MD_PLAIN_NAMES);
 
-const BASH_PARSE_OPTIONS = { timeoutMs: 20, maxNodes: 10_000 } as const;
+const BASH_PARSE_OPTIONS = { timeoutMs: 500, maxNodes: 10_000 } as const;
 
 export const agentsMdReminderKnownKey = defineState<Set<string>>(
   'agentsMdReminder.known',

packages/agent-core-v2/src/agent/permissionPolicy/policies/dangerous-command-ask.ts

@@ -12,7 +12,7 @@ import type {
   PermissionPolicyResult,
 } from '#/agent/permissionPolicy/types';
 
-const PARSE_OPTIONS = { timeoutMs: 20, maxNodes: 10_000 } as const;
+const PARSE_OPTIONS = { timeoutMs: 500, maxNodes: 10_000 } as const;
 
 const MAX_NESTED_SHELL_DEPTH = 4;
 

packages/agent-core-v2/src/app/sessionIndex/sessionIndexMirrorService.ts

@@ -37,6 +37,7 @@ export class SessionIndexMirror extends Disposable implements ISessionIndexMirro
   private readonly timer = this._register(new IntervalTimer({ unref: true }));
   private flushing: Promise<void> | undefined;
   private consecutiveFailures = 0;
+  private giveUpTracked = false;
   private disposed = false;
   private overflowLogged = false;
 
@@ -169,6 +170,7 @@ export class SessionIndexMirror extends Disposable implements ISessionIndexMirro
         if (this.pendingMap.get(id) === summary) this.pendingMap.delete(id);
       }
       this.consecutiveFailures = 0;
+      this.giveUpTracked = false;
     } catch (error) {
       this.consecutiveFailures += 1;
       this.log.warn('failed to flush session index mirror chunk', {
@@ -180,10 +182,13 @@ export class SessionIndexMirror extends Disposable implements ISessionIndexMirro
         this.log.warn('session index mirror giving up until the next record; reconciliation will heal', {
           pending: this.pendingMap.size,
         });
-        this.telemetry.track2('session_index_mirror_give_up', {
-          pending_count: this.pendingMap.size,
-          consecutive_failures: this.consecutiveFailures,
-        });
+        if (!this.giveUpTracked) {
+          this.giveUpTracked = true;
+          this.telemetry.track2('session_index_mirror_give_up', {
+            pending_count: this.pendingMap.size,
+            consecutive_failures: this.consecutiveFailures,
+          });
+        }
       }
     }
   }

packages/agent-core-v2/src/app/telemetry/cloudTransport.ts

@@ -263,7 +263,9 @@ export function flattenEvent(event: EnrichedCloudEvent): Record<string, CloudPri
       flattenNested(out, 'context', value);
     } else {
       assertPrimitive(key, value);
-      out[key] = value;
+      if (value !== null) {
+        out[key] = value;
+      }
     }
   }
   return out;
@@ -285,7 +287,9 @@ function flattenNested(target: Record<string, CloudPrimitive>, prefix: string, v
   if (value === null || typeof value !== 'object' || Array.isArray(value)) return;
   for (const [key, nestedValue] of Object.entries(value)) {
     assertPrimitive(`${prefix}.${key}`, nestedValue);
-    target[`${prefix}_${key}`] = nestedValue;
+    if (nestedValue !== null) {
+      target[`${prefix}_${key}`] = nestedValue;
+    }
   }
 }
 

packages/agent-core-v2/src/runtime/runtimeWorkspaceView.ts

@@ -30,16 +30,14 @@ export class RuntimeWorkspaceView {
   resolve(path: string, cwd = this.workDir): string {
     const env = this.runtime.environment;
     const bridged = env.pathClass === 'win32' ? getShellPathBridge(env).fromShellPath(path) : path;
-    const resolved = this.runtime.path.isAbsolute(bridged)
+    return this.runtime.path.isAbsolute(bridged)
       ? this.runtime.path.resolve(bridged)
       : this.runtime.path.resolve(cwd, bridged);
-    this.assertAllowed(resolved);
-    return resolved;
   }
 
-  assertAllowed(path: string): void {
+  assertAllowed(path: string): string {
     const resolved = this.runtime.path.resolve(path);
-    if (this.roots.some((root) => contains(this.runtime, root, resolved))) return;
+    if (this.roots.some((root) => contains(this.runtime, root, resolved))) return resolved;
     throw new Error2(
       ErrorCodes.FS_PATH_ESCAPES,
       `path ${path} is outside runtime workspace ${this.binding.runtimeId}`,

packages/agent-core-v2/src/session/terminal/terminalService.ts

@@ -79,7 +79,7 @@ export class SessionTerminalService extends Disposable implements ISessionTermin
       ['terminal'],
     );
     const view = new RuntimeWorkspaceView(lease.runtime, this.workspace);
-    const cwd = input.cwd === undefined ? view.workDir : view.resolve(input.cwd);
+    const cwd = input.cwd === undefined ? view.workDir : view.assertAllowed(view.resolve(input.cwd));
     const shell = input.shell ?? lease.runtime.environment.shellPath;
     let process: TerminalProcess;
     try {