@fitlab-ai/agent-infra 0.10.0 → 0.11.0

package/README.md

@@ -95,13 +95,9 @@ Every command above works the same way in Claude Code, Codex, Antigravity CLI, a
 
 ### Sandbox control boundary
 
-Task-bound sandboxes use a host-only control service for lifecycle and workflow writes. On Linux its fixed endpoint is `/run/user/<uid>/agent-infra/host-control.sock`; on macOS it is `/Users/<login>/Library/Application Support/agent-infra/run/host-control.sock`, resolved from the account identity rather than `HOME` or `TMPDIR`. The service directory is private (`0700`) and the socket is private (`0600`). If the endpoint or sandbox identity is unavailable, task-control commands fail closed.
+Direct-host lifecycle and workflow commands execute in the current CLI process. Task-bound sandboxes route requests to their broker; the broker verifies the request, manifest, generation, owner, lease, and controller before starting a one-request executor. There is no host socket, worker token, or user-level task-control service.
 
-The shell installer creates and starts the user-scoped service through systemd user units on Linux or launchd user agents on macOS. After a manual npm install, run `agent-infra-internal host-control install`, then enable the generated user service; `agent-infra-internal host-control status` reports endpoint health. No root or setuid service is required.
-
-On macOS, the installer retries service registration during reload. If registration or startup still fails, it exits with an error and a recovery command.
-
-The task directory exposed inside a task-bound sandbox is a writable projection. Artifact commands accept only typed workflow operations and canonical artifact basenames. The host opens candidates with `O_NOFOLLOW`, reads and hashes them through one file descriptor, checks observable metadata changes, and atomically lands validated bytes into the authoritative task directory. Changes to the projection's protected topology fail closed and never turn the projection into task state.
+The task directory exposed inside a task-bound sandbox is writable only for its bound task. Artifact commands accept typed workflow operations and canonical artifact basenames. The executor opens candidates with `O_NOFOLLOW`, reads and hashes them through one file descriptor, checks observable metadata changes, and atomically lands validated bytes into the authoritative task directory.
 
 ## Quick Start
 

package/README.zh-CN.md

@@ -94,13 +94,9 @@ agent-infra 的目标就是把这层共享基础设施标准化。它为所有
 
 ### 沙箱控制边界
 
-任务沙箱的生命周期和工作流写操作由宿主专用控制服务执行。Linux 固定端点为 `/run/user/<uid>/agent-infra/host-control.sock`；macOS 固定端点为 `/Users/<login>/Library/Application Support/agent-infra/run/host-control.sock`，路径根据账户身份解析，不读取 `HOME` 或 `TMPDIR`。服务目录权限为 `0700`，socket 权限为 `0600`。端点或沙箱身份不可用时，task-control 命令会失败关闭。
+direct-host 生命周期和工作流命令在当前 CLI 进程中执行。任务沙箱把请求发送给所属 broker；broker 会先校验请求、manifest、generation、owner、lease 和 controller，再启动一次性 executor。系统不再使用宿主 socket、worker token 或用户级 task-control 服务。
 
-Shell 安装脚本会在 Linux 通过 systemd 用户单元、在 macOS 通过 launchd 用户代理创建并启动该服务。手动 npm 安装后，可运行 `agent-infra-internal host-control install` 创建服务配置，再启用对应的用户服务；`agent-infra-internal host-control status` 可检查端点健康状态。整个服务不需要 root 或 setuid。
-
-macOS 重载期间，安装脚本会重试服务注册；若最终仍无法注册或启动，则以错误退出并提供恢复命令。
-
-任务沙箱内的 task 目录是可写投影。产物命令只接受类型化 workflow 操作和规范的产物 basename。宿主使用 `O_NOFOLLOW` 打开候选文件，通过同一个文件描述符读取并计算摘要，检查可观察的元数据变化，再把已校验字节原子落入权威 task 目录。投影的受保护拓扑发生变化时会失败关闭，投影修改不会变成任务状态。
+任务沙箱内的 task 目录只允许其绑定任务读写。产物命令只接受类型化 workflow 操作和规范的产物 basename。executor 使用 `O_NOFOLLOW` 打开候选文件，通过同一个文件描述符读取并计算摘要，检查可观察的元数据变化，再把已校验字节原子落入权威 task 目录。
 
 ## 快速开始
 

package/bin/internal-cli.sh

@@ -26,19 +26,6 @@ else
   internal_cli="$script_dir/../dist/bin/internal-cli.js"
 fi
 
-command=${1-}
-task_control_command=false
-case "$command" in
-  task-lifecycle|task-orchestration|task-finalization) task_control_command=true ;;
-esac
-
-status_mount_present=false
-if [ -d /run/agent-infra/control-status ]; then status_mount_present=true; fi
-launch_config=${AGENT_INFRA_TASK_ID-}${AGENT_INFRA_CONTROL_TOKEN-}${AGENT_INFRA_CONTROL_GENERATION-}${AGENT_INFRA_CONTROL_DIR-}${AGENT_INFRA_CONTROL_STATUS_DIR-}${AGENT_INFRA_RUNTIME_DIR-}${AGENT_INFRA_EXECUTOR_MANIFEST-}
-if [ "$task_control_command" = true ] && [ "$status_mount_present" = true ] && [ -z "$launch_config" ] && [ -z "${AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT-}" ]; then
-  printf '%s\n' '{"status":"failed","changed":false,"error":{"code":"SANDBOX_CONTROL_IDENTITY_MISSING","message":"sandbox control identity is present but its launch configuration is missing"}}'
-  exit 1
-fi
 # The outer launcher owns the Node startup boundary. A task-bound process must
 # not pass preload, import, or loader injection into the control router.
 unset NODE_OPTIONS NODE_PATH

package/dist/bin/internal-cli.js

@@ -1,8 +1,6 @@
 #!/usr/bin/env node
 import { formatTaskViewDiagnostic, guardTaskOperation, resolveSandboxControlTransport, TaskViewOperationError } from '../lib/internal/task-operation-registry.js';
 import { INTERNAL_HANDLER_ROUTE_SELECTORS } from '../lib/internal/cli-route-inventory.js';
-import { hostControlRequestForCommand, requestHostControl, HostControlClientError, HOST_CONTROL_TEST_ENVIRONMENT_KEYS } from '../lib/host-control/client.js';
-import { resolveHostControlEndpoint, readHostControlWorkerToken } from '../lib/host-control/path.js';
 const [major = 0, minor = 0] = process.versions.node.split('.').map((part) => parseInt(part, 10));
 if (major < 22 || (major === 22 && minor < 9)) {
     process.stderr.write(`agent-infra-internal requires Node.js >= 22.9.0 (current: ${process.version})\n`);
@@ -18,9 +16,13 @@ const taskWorkflowCommand = command === 'task-artifact'
     || command === 'task-invalidation'
     || command === 'task-warning';
 const manualValidationWorkflowCommand = command === 'manual-validation';
-const localTaskControlHelp = taskControlCommand
-    && (process.argv[3] === '--help' || process.argv[3] === '-h')
-    && !process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT;
+const taskControlMarkers = [
+    'AGENT_INFRA_TASK_ID', 'AGENT_INFRA_CONTROL_TOKEN', 'AGENT_INFRA_CONTROL_GENERATION',
+    'AGENT_INFRA_CONTROL_DIR', 'AGENT_INFRA_CONTROL_STATUS_DIR', 'AGENT_INFRA_RUNTIME_DIR',
+    'AGENT_INFRA_CONTROL_CONTROLLER_BINDING', 'AGENT_INFRA_EXECUTOR_MANIFEST'
+];
+const markerlessHelp = ['--help', '-h'].includes(process.argv[3] ?? '')
+    && taskControlMarkers.every((key) => !process.env[key]);
 let taskViewGuardFailed = false;
 try {
     const guard = guardTaskOperation('internal', command, process.argv.slice(3));
@@ -45,44 +47,8 @@ function taskControlTransportFailure(message, code = 'TASK_CONTROL_TRANSPORT_INV
     })}\n`);
     process.exit(1);
 }
-async function runHostControlCommand(commandName, args) {
-    let response;
-    try {
-        const testEndpoint = process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT;
-        const forwardedEnvironment = testEndpoint
-            ? Object.fromEntries(HOST_CONTROL_TEST_ENVIRONMENT_KEYS.flatMap((key) => process.env[key] === undefined ? [] : [[key, process.env[key]]]))
-            : {};
-        response = await requestHostControl({
-            request: hostControlRequestForCommand(commandName, args, process.cwd(), forwardedEnvironment),
-            endpoint: process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT ?? resolveHostControlEndpoint()
-        });
-    }
-    catch (error) {
-        if (error instanceof HostControlClientError) {
-            taskControlTransportFailure(error.message, error.changed === false
-                ? 'SANDBOX_CONTROL_HOST_AUTHORITY_UNAVAILABLE' : error.code, error.changed);
-        }
-        throw error;
-    }
-    process.stdout.write(response.stdout);
-    process.stderr.write(response.stderr);
-    process.exitCode = response.exitCode;
-}
-const hostWorkerRequested = process.env.AGENT_INFRA_HOST_CONTROL_WORKER === '1';
-const hostWorker = hostWorkerRequested && (() => {
-    try {
-        const endpoint = process.env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT ?? resolveHostControlEndpoint();
-        return process.env.AGENT_INFRA_HOST_CONTROL_WORKER_TOKEN === readHostControlWorkerToken(endpoint);
-    }
-    catch {
-        return false;
-    }
-})();
-if (hostWorkerRequested && !hostWorker && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand)) {
-    taskControlTransportFailure('host-control worker authorization is invalid', 'SANDBOX_CONTROL_HOST_AUTHORITY_UNAVAILABLE');
-}
 let controlRouted = false;
-if (!taskViewGuardFailed && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand) && !hostWorker && !localTaskControlHelp) {
+if (!taskViewGuardFailed && !markerlessHelp && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand)) {
     const transport = resolveSandboxControlTransport(process.env);
     switch (transport.kind) {
         case 'fail-closed': {
@@ -91,7 +57,8 @@ if (!taskViewGuardFailed && (taskControlCommand || taskWorkflowCommand || manual
             break;
         }
         case 'direct-host':
-            await runHostControlCommand(command, process.argv.slice(3));
+            // The host CLI is the direct-host authority. Domain handlers retain their
+            // task locks, atomic writes, and operation-specific recovery facts.
             break;
         case 'broker-client': {
             const { sandboxControl } = await import('../lib/internal/sandbox-control.js');
@@ -99,7 +66,7 @@ if (!taskViewGuardFailed && (taskControlCommand || taskWorkflowCommand || manual
             break;
         }
     }
-    controlRouted = true;
+    controlRouted = transport.kind === 'broker-client';
 }
 if (!controlRouted && !taskViewGuardFailed && internalRouteRegistered)
     switch (command) {
@@ -128,11 +95,6 @@ if (!controlRouted && !taskViewGuardFailed && internalRouteRegistered)
             await sandboxControl(process.argv.slice(3));
             break;
         }
-        case 'host-control': {
-            const { hostControl } = await import('../lib/internal/host-control.js');
-            await hostControl(process.argv.slice(3));
-            break;
-        }
         case 'agent-client': {
             const { agentClient } = await import('../lib/internal/agent-client.js');
             agentClient(process.argv.slice(3));

package/dist/lib/internal/cli-route-inventory.js

@@ -33,7 +33,6 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'task-create': ['input'],
     'task-qualification': ['proposal', 'confirm', 'supersede', 'revoke'],
     'sandbox-control': ['serve', 'execute', 'recover', 'client'],
-    'host-control': ['serve', 'status', 'install', 'uninstall'],
     'agent-client': ['next-steps', 'model-selection'],
     'codex-lifecycle': ['preflight', 'capability-arm', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
     'codex-sandbox-controller': ['verify-context', 'run'],
@@ -44,7 +43,7 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'platform-security': ['read', 'dismiss'],
     'platform-metadata': ['init-labels', 'init-milestones'],
     'platform-context': ['resolve'],
-    'platform-comment': ['list', 'owner', 'backfill', 'sync'],
+    'platform-comment': ['list', 'recover', 'owner', 'backfill', 'sync'],
     'platform-issue': ['inspect', 'create', 'bind', 'sync'],
     'platform-pr': ['inspect', 'summary-context', 'resolve-external', 'create', 'bind', 'skip', 'sync', 'change-report', 'summary-sync', 'sync-in-labels'],
     'platform-pr-review': ['inspect', 'list', 'publish-pr', 'publish-task'],
@@ -54,9 +53,9 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'task-ledger': ['decision-next-id', 'stage-status', 'finding-upsert', 'finding-respond', 'finding-review', 'decision-upsert', 'rework-intent-upsert'],
     'task-warning': ['list', 'add', 'set-status'],
     'task-activity': ['pr-review-inspect', 'pr-review-start', 'pr-review-complete', 'pr-review-terminate'],
-    'task-artifact': ['inspect', 'init', 'finalize-local'],
+    'task-artifact': ['inspect', 'init', 'preflight', 'finalize-local'],
     'task-orchestration': ['status', 'progress'],
-    'task-review': ['finalize-summary'],
+    'task-review': ['preflight', 'finalize-summary'],
     'task-event': ['event'],
     'task-invalidation': ['reconcile'],
     'task-override': ['diagnose', 'issue', 'consume'],

package/dist/lib/internal/platform-comment.js

@@ -2,9 +2,11 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { checkPlatformCommentOwner, listPlatformComments, syncPlatformComment } from '../platform/issue-comments.js';
+import { recoverTaskFromComments } from '../platform/task-recovery.js';
 import { backfillCompletionComments } from '../platform/completion-backfill.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal platform-comment list --issue <token> [--cwd <path>]
+       agent-infra-internal platform-comment recover --issue <token> --task-id <TASK-id> --output <staging-task.md> [--cwd <path>]
        agent-infra-internal platform-comment owner <task-ref> [--cwd <path>]
        agent-infra-internal platform-comment backfill <task-ref> --agent <agent> [--cwd <path>]
        agent-infra-internal platform-comment sync <task-ref> --kind <kind> --agent <agent> [--artifact <file>] [--body-file <path|->] [--status-label <label>] [--backfill] [--cwd <path>]
@@ -26,7 +28,7 @@ function parseFlags(args, start) {
     const seen = new Set();
     for (let index = start; index < args.length; index += 1) {
         const flag = args[index];
-        if (!['--issue', '--cwd', '--kind', '--agent', '--artifact', '--body-file', '--status-label', '--backfill'].includes(flag)) {
+        if (!['--issue', '--task-id', '--output', '--cwd', '--kind', '--agent', '--artifact', '--body-file', '--status-label', '--backfill'].includes(flag)) {
             return { values, error: `unknown option '${flag}'` };
         }
         if (seen.has(flag))
@@ -58,6 +60,7 @@ async function platformComment(args = []) {
     const operation = args[0];
     if (!operation || ![
         internalHandlerRoute('platform-comment', 'list', operation),
+        internalHandlerRoute('platform-comment', 'recover', operation),
         internalHandlerRoute('platform-comment', 'owner', operation),
         internalHandlerRoute('platform-comment', 'backfill', operation),
         internalHandlerRoute('platform-comment', 'sync', operation)
@@ -65,7 +68,7 @@ async function platformComment(args = []) {
         fail('a valid operation is required');
         return;
     }
-    const hasTaskRef = operation !== 'list';
+    const hasTaskRef = operation !== 'list' && operation !== 'recover';
     const taskRef = hasTaskRef ? args[1] : undefined;
     if (hasTaskRef && (!taskRef || taskRef.startsWith('--'))) {
         fail(`${operation} requires a task ref`);
@@ -91,6 +94,61 @@ async function platformComment(args = []) {
         finish(await listPlatformComments(issue, cwd));
         return;
     }
+    if (internalHandlerRoute('platform-comment', 'recover', operation)) {
+        const issue = parsed.values.issue;
+        const taskId = parsed.values.taskId;
+        const output = parsed.values.output;
+        if (typeof issue !== 'string' || !issue || typeof taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/.test(taskId)
+            || typeof output !== 'string' || !output) {
+            fail('recover requires --issue <token> --task-id <TASK-id> --output <staging-task.md>');
+            return;
+        }
+        const unexpected = Object.keys(parsed.values).find((key) => !['issue', 'taskId', 'output', 'cwd'].includes(key));
+        if (unexpected) {
+            fail(`recover does not accept '--${unexpected}'`);
+            return;
+        }
+        const outputPath = path.resolve(cwd, output);
+        const workspaceDir = path.resolve(cwd, '.agents', 'workspace');
+        const stagingDir = path.dirname(outputPath);
+        const stagingParent = fs.existsSync(stagingDir) ? path.dirname(fs.realpathSync(stagingDir)) : '';
+        const realWorkspace = fs.existsSync(workspaceDir) ? fs.realpathSync(workspaceDir) : '';
+        if (path.basename(outputPath) !== 'task.md' || stagingParent !== realWorkspace
+            || !path.basename(stagingDir).startsWith('.restore-staging-') || !fs.existsSync(stagingDir)
+            || !fs.lstatSync(stagingDir).isDirectory() || fs.existsSync(outputPath)) {
+            fail('recover output must be a new task.md inside an existing .agents/workspace/.restore-staging-* directory');
+            return;
+        }
+        const listed = await listPlatformComments(issue, cwd);
+        if (listed.status === 'failed' || listed.status === 'blocked' || !listed.comments) {
+            finish(listed);
+            return;
+        }
+        try {
+            const taskContent = recoverTaskFromComments({ taskId, comments: listed.comments });
+            fs.writeFileSync(outputPath, taskContent, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+            finish({
+                ...listed,
+                status: 'applied',
+                changed: true,
+                operations: [{ name: `recovery:task:${taskId}`, status: 'applied', reasonCode: null }],
+                error: null
+            });
+        }
+        catch (error) {
+            finish({
+                ...listed,
+                status: 'failed',
+                changed: false,
+                error: {
+                    code: 'RECOVERY_EVIDENCE_MISSING',
+                    message: error instanceof Error ? error.message : String(error),
+                    retryable: false
+                }
+            });
+        }
+        return;
+    }
     if (internalHandlerRoute('platform-comment', 'owner', operation)) {
         const unexpected = Object.keys(parsed.values).find((key) => key !== 'cwd');
         if (unexpected) {

package/dist/lib/internal/task-artifact.js

@@ -1,6 +1,6 @@
 import { parseArtifactCommand, executeArtifactCommand } from '../task/artifact-command.js';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family>\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> finalize-local --family <analysis|plan|code> --artifact <artifact> [--recovery-id <id>]\n\nInspect, initialize, or finalize a workflow artifact without changing task state.\n`;
+const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family>\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> preflight|finalize-local --family <analysis|plan|code> --artifact <artifact> [--recovery-id <id>]\n\nInspect, initialize, preflight, or finalize a workflow artifact without changing task state.\n`;
 function taskArtifact(args = []) {
     if (!ensureInternalHandlerRoute('task-artifact', args))
         return;

package/dist/lib/internal/task-finalization.js

@@ -20,12 +20,12 @@ function parseFailure(error) {
     return message.replace(/^TASK_CONTROL_OPERATION_INVALID: /u, '');
 }
 async function taskFinalization(args = []) {
-    if (!ensureInternalHandlerRoute('task-finalization', args))
-        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
+    if (!ensureInternalHandlerRoute('task-finalization', args))
+        return;
     let operation;
     try {
         operation = parseTaskControlOperation('task-finalization', args);

package/dist/lib/internal/task-lifecycle.js

@@ -13,12 +13,12 @@ function parseFailure(error) {
     return message.replace(/^TASK_CONTROL_OPERATION_INVALID: /u, '');
 }
 async function taskLifecycle(args = []) {
-    if (!ensureInternalHandlerRoute('task-lifecycle', args))
-        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
+    if (!ensureInternalHandlerRoute('task-lifecycle', args))
+        return;
     let operation;
     try {
         operation = parseTaskControlOperation('task-lifecycle', args);

package/dist/lib/internal/task-operation-registry.js

@@ -16,10 +16,6 @@ function internalTaskRoutes() {
         descriptor('internal', 'sandbox-control', 'execute', 'non-task', 'progress', 'none'),
         descriptor('internal', 'sandbox-control', 'recover', 'conditional', 'recovery', 'delegated'),
         descriptor('internal', 'sandbox-control', 'client', 'conditional', 'progress', 'delegated'),
-        descriptor('internal', 'host-control', 'serve', 'non-task', 'progress', 'none'),
-        descriptor('internal', 'host-control', 'status', 'non-task', 'diagnostic', 'none'),
-        descriptor('internal', 'host-control', 'install', 'non-task', 'progress', 'none'),
-        descriptor('internal', 'host-control', 'uninstall', 'non-task', 'progress', 'none'),
         descriptor('internal', 'agent-client', 'next-steps', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'agent-client', 'model-selection', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'codex-lifecycle', 'preflight', 'non-task', 'diagnostic', 'none'),
@@ -51,6 +47,7 @@ function internalTaskRoutes() {
         descriptor('internal', 'platform-metadata', 'init-milestones', 'non-task', 'remote-write', 'none'),
         descriptor('internal', 'platform-context', 'resolve', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'platform-comment', 'list', 'non-task', 'diagnostic', 'none'),
+        descriptor('internal', 'platform-comment', 'recover', 'non-task', 'recovery', 'none'),
         descriptor('internal', 'platform-comment', 'owner', 'task-bound', 'diagnostic'),
         descriptor('internal', 'platform-comment', 'backfill', 'task-bound', 'remote-write'),
         descriptor('internal', 'platform-comment', 'sync', 'task-bound', 'remote-write'),
@@ -96,9 +93,11 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-activity', 'pr-review-terminate', 'task-bound', 'progress'),
         descriptor('internal', 'task-artifact', 'inspect', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-artifact', 'init', 'task-bound', 'artifact-write'),
+        descriptor('internal', 'task-artifact', 'preflight', 'task-bound', 'artifact-write'),
         descriptor('internal', 'task-artifact', 'finalize-local', 'task-bound', 'artifact-write'),
         descriptor('internal', 'task-orchestration', 'status', 'task-bound', 'diagnostic'),
         descriptor('internal', 'task-orchestration', 'progress', 'task-bound', 'progress'),
+        descriptor('internal', 'task-review', 'preflight', 'task-bound', 'artifact-write'),
         descriptor('internal', 'task-review', 'finalize-summary', 'task-bound', 'progress'),
         descriptor('internal', 'task-event', 'event', 'task-bound', 'progress'),
         descriptor('internal', 'task-invalidation', 'reconcile', 'task-bound', 'progress'),
@@ -175,7 +174,7 @@ export const TASK_OPERATION_DESCRIPTORS = Object.freeze([
     ...PUBLIC_OPERATION_DESCRIPTORS
 ]);
 export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
-    'task-create', 'task-qualification', 'sandbox-control', 'host-control', 'agent-client', 'codex-lifecycle', 'codex-sandbox-controller',
+    'task-create', 'task-qualification', 'sandbox-control', 'agent-client', 'codex-lifecycle', 'codex-sandbox-controller',
     'git-workflow', 'task-delivery', 'release-workflow', 'platform-release-notes', 'platform-security', 'platform-metadata', 'platform-context',
     'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
     'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
@@ -287,28 +286,39 @@ function taskMarkerState(env) {
     return 'incomplete';
 }
 export function resolveSandboxControlTransport(env = process.env, options = {}) {
-    const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
-    const fixedStatusDir = options.statusMountPath
-        ?? SANDBOX_CONTROL_STATUS_MOUNT;
     const hasAnyMarker = TASK_MARKER_KEYS.some((key) => Boolean(env[key]))
         || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING)
         || Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
-    const fixedStatusProbe = !env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT && path.isAbsolute(fixedStatusDir)
+    const fixedStatusDir = options.statusMountPath
+        ?? SANDBOX_CONTROL_STATUS_MOUNT;
+    const fixedStatusProbe = path.isAbsolute(fixedStatusDir)
         ? nativeDirectoryProbe(fixedStatusDir) : 'absent';
     if (fixedStatusProbe === 'unknown') {
         return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_UNAVAILABLE' };
     }
     const fixedStatusMounted = fixedStatusProbe === 'present';
+    // A fixed status mount is installed only in a task-bound sandbox. Its
+    // presence is not mutable by the sandbox process, so marker removal must
+    // never make that process look like a direct host invocation.
+    if (!hasAnyMarker) {
+        return fixedStatusMounted
+            ? { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' }
+            : { kind: 'direct-host', reasonCode: null };
+    }
+    const hasCompleteConfig = TASK_CONTROL_CONFIG_KEYS.every((key) => Boolean(env[key]));
+    if (!hasCompleteConfig) {
+        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
+    }
+    const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
     const configuredStatusProbe = configuredStatusDir && path.isAbsolute(configuredStatusDir)
         ? nativeDirectoryProbe(configuredStatusDir) : 'absent';
     if (configuredStatusProbe === 'unknown') {
         return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_UNAVAILABLE' };
     }
-    const statusDir = configuredStatusDir && path.isAbsolute(configuredStatusDir) && configuredStatusProbe === 'present'
-        ? configuredStatusDir
+    const statusDir = configuredStatusDir && path.isAbsolute(configuredStatusDir)
+        ? configuredStatusProbe === 'present' ? configuredStatusDir : null
         : fixedStatusMounted ? fixedStatusDir : null;
     const statusMounted = statusDir !== null;
-    const hasCompleteConfig = TASK_CONTROL_CONFIG_KEYS.every((key) => Boolean(env[key]));
     if (env.AGENT_INFRA_EXECUTOR_MANIFEST || env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING) {
         return { kind: 'fail-closed', reasonCode: 'TASK_CONTROL_TRANSPORT_INVALID' };
     }

package/dist/lib/internal/task-orchestration.js

@@ -16,12 +16,12 @@ function parseFailure(error) {
     return message.replace(/^TASK_CONTROL_OPERATION_INVALID: /u, '');
 }
 async function taskOrchestration(args = []) {
-    if (!ensureInternalHandlerRoute('task-orchestration', args))
-        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
+    if (!ensureInternalHandlerRoute('task-orchestration', args))
+        return;
     const route = internalHandlerRoute('task-orchestration', 'status', args[1] ?? '')
         ? 'status'
         : internalHandlerRoute('task-orchestration', 'progress', args[1] ? 'progress' : '')

package/dist/lib/internal/task-review.js

@@ -1,15 +1,15 @@
 import { parseReviewCommand } from '../task/review-command.js';
-import { finalizeReviewSummary } from '../task/review-finalization.js';
+import { finalizeReviewSummary, preflightReviewSummary } from '../task/review-finalization.js';
 import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal task-review <task-ref> finalize-summary --stage <analysis|plan|code> --artifact <review-*.md> [--recovery-id <id>] [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
+const USAGE = 'Usage: agent-infra-internal task-review <task-ref> <preflight|finalize-summary> --stage <analysis|plan|code> --artifact <review-*.md> [--recovery-id <id>] [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
 function failUsage(message) {
     process.stdout.write(`${JSON.stringify({
         status: 'failed',
         changed: false,
-        intent: 'finalize-summary',
+        intent: 'review-operation',
         error: { code: 'REVIEW_PAYLOAD_INVALID', message }
     })}\n`);
     process.stderr.write(USAGE);
@@ -31,6 +31,7 @@ async function taskReview(args = []) {
         return;
     }
     const { stage, artifact, recoveryId, dryRun, orchestrated, overrideTicket, overrideTarget, overrideScope } = request;
+    const operation = args[1];
     const dryRunConflict = overrideDryRunConflict({ dryRun, overrideTicket, overrideTarget, overrideScope });
     if (dryRunConflict) {
         failUsage(dryRunConflict.message);
@@ -44,8 +45,12 @@ async function taskReview(args = []) {
     let result;
     let humanOverride = null;
     try {
-        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-review.finalize-summary', async () => {
-            let current = finalizeReviewSummary({ taskRef: args[0], stage, artifact, recoveryId, orchestrated, dryRun }, { lockAlreadyHeld: true });
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-review.${operation}`, async () => {
+            let current = operation === 'preflight'
+                ? preflightReviewSummary({ taskRef: args[0], stage, artifact, recoveryId, orchestrated, dryRun }, { lockAlreadyHeld: true })
+                : finalizeReviewSummary({ taskRef: args[0], stage, artifact, recoveryId, orchestrated, dryRun }, { lockAlreadyHeld: true });
+            if (operation === 'preflight')
+                return current;
             if (current.status !== 'failed' || !overrideTicket)
                 return current;
             if (!overrideTarget || !overrideScope) {