@fitlab-ai/agent-infra 0.11.1 → 0.11.3

package/templates/.agents/skills/run-manual-validation/SKILL.zh-CN.md

@@ -26,7 +26,7 @@ description: >
 - `complete-manual-validation` 仍是维护者确认覆盖充分后的最终登记入口。
 - 禁止直接操作临时 worktree、lease 或 container；只调用 `agent-infra-internal task-validate`。
 - 产物不得记录 token、环境变量、完整 argv、绝对用户路径或原始 transcript；每个验证目标必须由核心写入同一 current-only evidence envelope。
-- 生成会同步到 Issue 的验证 artifact Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；Issue 同步保持透明，不解析或改写正文。
+- 生成会由 task 评论引用的验证 artifact Markdown 前，先读取 `.agents/rules/sync-content-generation.md` 并遵循其中的生成端约束；验证 artifact 保留在本地，不发布为 Issue artifact 评论。
 - branch-only 降级路径走 `.agents/workspace/validations/{branch-slug}/`，标记 `recoverable: false`：不写 task.md、不发 lifecycle 事件、不同步 Issue、不跑 `task-verify`；产物须带回宿主机，由维护者登记。
 
 ## 第 0 步：状态核对（执行前硬约束）
@@ -46,7 +46,7 @@ branch-only 无 `{task-id}`，跳过本步，并在产物 `## 状态核对` 记
 3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
 4. 为每个验证目标分配 `{evidence-file}`，分别调用 `agent-infra-internal task-validate {task-ref} --scope snapshot --format json --evidence-file {evidence-file} -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用并写入对应 evidence 文件。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
 5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；记录输入模式、发现清单、逐项结果、CLI JSON allowlist 与去敏摘要。
-6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
+6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`。存在 Issue 时仅运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}`；验证 artifact 不发布为 Issue 评论。
 7. 运行 `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`；未通过则修复后重跑。
 8. 告知用户证据路径、覆盖缺口和验证结果；明确仍需维护者判断是否执行 `complete-manual-validation`。读取 `.agents/rules/next-step-output.md`，最后一行输出 `Completed at`。
 

package/templates/.agents/skills/run-task/SKILL.en.md

@@ -1,7 +1,7 @@
 ---
 name: run-task
 description: >
-  Orchestrate lifecycle stages from the task's current state with fresh executors/reviewers and one-use provenance receipts.
+  Orchestrate lifecycle stages from the task's current state with fresh executors/reviewers and recorded execution results.
   Use when one entry should advance an existing task until a safe commit or stable pause.
 ---
 
@@ -14,14 +14,15 @@ The entry point may omit the task ref; explicit task scope accepts only `--task
 The orchestrator delegates only and never executes a stage skill itself. First read `.agents/rules/no-mid-flow-questions.md`, `.agents/rules/lifecycle-orchestration.md`, and `reference/host-validation.md`.
 
 1. Resolve the canonical task ID, current Agent Client, and optional atomic policy flags, then run `task-snapshot`. If one explicit role field is present, all four are required.
-2. Before `begin-or-resume`, Codex selects a host. Without `AGENT_INFRA_CONTROL_TOKEN`, use direct-host. With task-bound control authority but no `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT`, only run `codex-sandbox-controller run` with the complete policy and wait; the outer loop must not create a run, baseline, or receipt. With a context, run `verify-context` first. Stop on protocol, task/controller/process, lease, or source/profile discovery failures. Package/build/contract or hook/profile content drift is delivered as a structured warning and tells the user to rebuild the sandbox.
-3. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
-4. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
-5. Codex runs `codex-lifecycle capability-arm --task-id {task-id}` once. The current loop's real PostToolUse must attest that ordinary tool response. Pass its `capabilityRef` marker, the exact routed model, and the exact routed reasoning effort to `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort} --capability-ref {capabilityRef}`. Core accepts only the phase attestation issued by the current controller issuer: `orchestration.prepare` reserves the capability, then `artifact.finalize-local` and `task-event.completed` validate and consume their own phases; the underlying capability is terminally consumed only after the completed commit is confirmed. Without current controller proof, direct-host returns `LOCAL_EXECUTION_AUTHORITY_UNAVAILABLE` and creates no recovery intent, baseline, receipt, or child. Activation then verifies that spawn belongs to the same session and turn and uses a distinct tool-use. Other clients use the same prepare without authority. Failure creates no baseline, receipt, or child.
-6. After prepare, run `task-orchestration <task-ref> dispatch` immediately before calling the fresh native child, then use route's exact model/effort and only the short task ref, skill, `--orchestrated`, and stage identity. The trusted hook-spawn first-observation time must fall between dispatch and the deadline. Its first provenance-sensitive command must be `await-activation --stage ... --round ... --artifact ... --role ...`; before `running`, it must not snapshot, emit stage-started, or write business files. The code stage may create a local checkpoint only through code-task's durable intent core; it must not delegate a separate commit stage or push. Only explicit `recover-prepared` may clear an expired orphan when the task fingerprint is exact and no matching unconsumed active lifecycle evidence remains.
-7. Codex uses SubagentStart/Stop and App Server actual evidence to activate, consume, and seal one receipt; trusted parent fallback must produce the same complete provenance. Timed-out waits do nothing. Advance only a sealed receipt and repeat step 4 only while running.
-8. Create a fresh child each round and never follow up with an old reviewer. Each requested/actual mismatch needs its own host fallback reason. Protocol, capability, receipt hook/evidence binding, source, controller, identity, ledger, or fingerprint failure pauses and fails closed; cross-root package/build/contract or hook/profile content drift is delivered as a warning instead of blocking natural evolution.
-9. On pause or completion, run the matching typed verification and report the structured endpoint.
+2. Use the current host's native child spawn, wait, and result interfaces. Task-bound sandboxes execute ordinary task orchestration locally in the current worktree; Codex controller `open`, `verify`, and `close` remain restricted broker operations. Retain task binding and checks for real external process operations.
+3. Before each loop, run `agent-infra-internal task-lifecycle {task-id} recover-started --agent {client} --auto`. The client adapter owns recovery capability and stop-evidence validation; an unsupported adapter or a run that needs no recovery returns `no-op`. Continue only after `no-op` or `applied`. Stop on every other result; a later operator invocation retries from persisted state without routing or dispatching a child.
+4. Run `task-orchestration {task-id} begin-or-resume --client {client}` with the complete explicit policy. With no explicit policy, core reads that client's configured policy; existing runs use persisted policy. Disk state outside the complete current structure fails closed without rewriting; finish or clear active runs before upgrading. Stop on paused/completed results.
+5. Run `route`. On `completed`, run `agent-infra-internal task-verify {task-id} run-task.completed --format text` and stop. Only a `running` result with non-null `next` supplies action, role, round, artifact, requested model, and requested effort.
+6. Call `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}` with route's exact policy. The client adapter runs host preflight. Report actual task, policy, or host failures.
+7. After prepare, run `task-orchestration <task-ref> dispatch` before spawning a fresh native child with route's model/effort. Pass the short task ref, skill, `--orchestrated`, and stage identity. The child calls `await-activation --stage ... --round ... --artifact ... --role ...` to associate its actual identity before executing. Code-task creates the local checkpoint; do not delegate a separate commit stage or push. Retain existing write locks without introducing a new lock protocol around native spawn.
+8. Record actual start and terminal results through the current host's native lifecycle events and result interfaces. A timed-out wait does not imply success. Pause on actual identity, transport, or terminal failures. After the stage and child finish, call `advance`; repeat step 3 only while running.
+9. Create a fresh child each round and never reuse a reviewer. Record actual model/effort and host fallback reasons. Validate current identity, artifacts, ledger, and execution results. User rulings override derived historical plan requirements. Do not introduce child discovery, orphan recovery, or a dedicated recovery protocol.
+10. On pause or completion, run the matching typed verification and report the structured endpoint.
 
 ## Stop
 

package/templates/.agents/skills/run-task/SKILL.zh-CN.md

@@ -1,7 +1,7 @@
 ---
 name: run-task
 description: >
-  从任务当前状态持续编排生命周期阶段，并用 fresh executor/reviewer 与一次性 receipt 验证隔离来源。
+  从任务当前状态持续编排生命周期阶段，使用 fresh executor/reviewer 并记录实际执行结果。
   当用户希望通过单一入口推进已有任务直到安全提交或稳定暂停时使用。
 ---
 
@@ -14,14 +14,15 @@ description: >
 总控只编排，不直接执行任何阶段技能。执行前先读取 `.agents/rules/no-mid-flow-questions.md`、`.agents/rules/lifecycle-orchestration.md` 与 `reference/host-validation.md`。
 
 1. 解析规范任务 ID、当前 Agent Client，以及可选的原子策略 `--executor-model`、`--executor-reasoning-effort`、`--reviewer-model`、`--reviewer-reasoning-effort`，并执行 `agent-infra-internal task-snapshot {task-id} --format text`。任一显式策略字段出现时四个 role 字段必须完整，不得与配置拼接；两个角色可以使用同一模型。
-2. Codex 在 `begin-or-resume` 前选择宿主：没有 `AGENT_INFRA_CONTROL_TOKEN` 时使用 direct-host；有 task-bound control authority 但没有 `AGENT_INFRA_CODEX_CONTROLLER_CONTEXT` 时，只调用 `agent-infra-internal codex-sandbox-controller run`（转发完整显式策略）并等待其终态，外层不得创建 run、baseline 或 receipt；已有 context 时先调用 `verify-context`。protocol、task/controller/process、lease 或 source/profile discovery 校验失败即停止；package/build/contract 或 hook/profile 内容漂移只输出结构化 warning，并提示用户重建 sandbox。
-3. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；existing run 使用持久化策略。磁盘状态不符合当前完整结构时核心失败关闭且不改写；升级前必须完成或清空 active run。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
-4. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
-5. Codex 先调用一次 `agent-infra-internal codex-lifecycle capability-arm --task-id {task-id}`。该普通工具调用必须由当前 loop 的真实 PostToolUse 回写 attestation；把 route 返回的精确 model、effort 和 marker 中的 `capabilityRef` 一并传给 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort} --capability-ref {capabilityRef}`。核心只接受当前 controller issuer 根据 typed lifecycle authority request 签发的 phase attestation：`orchestration.prepare` 只 reserve capability，随后由 `artifact.finalize-local` 和 `task-event.completed` 各自独立校验并消费 phase；底层 capability 仅在 completed commit 已确认后 terminal consume。没有 current controller proof 时 direct-host 返回 `LOCAL_EXECUTION_AUTHORITY_UNAVAILABLE`，不得创建 recovery intent、baseline、receipt 或 child。activation 再校验 spawn 与该来源属于同一 session/turn，且 spawn 使用独立的 tool-use。其他客户端直接调用同一 prepare（无 authority）。任一失败不得创建 baseline、receipt 或 child。
-6. prepare 成功后，在调用 fresh 原生子 Agent 的紧邻前一步执行 `task-orchestration <task-ref> dispatch`，再显式覆盖 route 返回的 model/effort；只传短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。可信 hook-spawn 首次观察时间必须位于 dispatch 与 deadline 之间。child 的第一条 provenance-sensitive 命令必须是 `await-activation --stage ... --round ... --artifact ... --role ...`；返回 running 前禁止 snapshot、阶段 started 或业务写入；代码阶段的本地 checkpoint 只能通过 code-task 的持久化 intent 核心完成，禁止单独委派 commit 阶段或推送。超时由核心暂停；崩溃遗留 prepared receipt 只能在 exact workspace fingerprint、无匹配的未消费 active lifecycle evidence 且 deadline 已过时显式 `recover-prepared`。
-7. Codex 用 SubagentStart/Stop 与 App Server actual evidence 激活、消费并封存唯一 receipt；受信 parent fallback 仍必须形成相同的完整 provenance。timed-out wait 无动作；只有 empty turns 或协议 `inProgress` 可等待，malformed、身份/传输错误或异常 terminal 均暂停。子 Agent 返回后只对 sealed receipt 调用 `advance`；只有 `running` 才重复步骤 4。
-8. 每轮创建新 child；禁止 follow-up 复用 reviewer。actual model/effort 与 requested 不同时必须有各自的宿主降级理由。protocol、capability、receipt 内 hook/evidence binding、source、controller、身份、账本或 fingerprint 异常都调用 `pause` 并失败关闭；跨根 package/build/contract 或 hook/profile 内容漂移按 warning 交付，不把自然演进差异当成硬失败。
-9. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
+2. 使用当前宿主的原生子 Agent 启动、等待与结果接口。task-bound sandbox 在当前 worktree 本地执行普通任务编排；Codex controller 的 `open`、`verify`、`close` 继续通过受限 broker 执行。保留任务绑定与真实外部进程操作检查。
+3. 每次进入循环时先调用 `agent-infra-internal task-lifecycle {task-id} recover-started --agent {client} --auto`。客户端适配器负责恢复能力和停止证据校验；没有该能力或无需恢复时返回 `no-op`。仅在结构化结果为 `no-op` 或 `applied` 时继续，其他结果安全停止；下一次人为调用按持久化状态幂等重试，不 route、不派发 child。
+4. 调用 `agent-infra-internal task-orchestration {task-id} begin-or-resume --client {client}` 并转发完整显式策略。完全没有显式策略时由核心读取当前 client 的 `agentClients[].orchestration`；existing run 使用持久化策略。磁盘状态不符合当前完整结构时核心失败关闭且不改写；升级前必须完成或清空 active run。仅当核心返回 `ORCHESTRATION_MODEL_POLICY_REQUIRED` 时，先用 `agent-client model-selection` 展示 complete/partial/interactive-only 来源，再一次收集完整策略；未回答则不创建 run。若为 paused/completed，按结构化结果停止。
+5. 调用 `route` 并读取结构化结果。若返回 `completed`，立即运行 `agent-infra-internal task-verify {task-id} run-task.completed --format text` 并停止；仅当返回 `running` 且 `next` 非空时读取唯一 action、role、round、artifact、`requestedModel` 和 `requestedReasoningEffort`，不得自行推断。
+6. 调用 `prepare --client {client} --requested-model {requestedModel} --requested-reasoning-effort {requestedReasoningEffort}`，使用 route 返回的精确策略。客户端适配器执行宿主 preflight；任务身份、策略或宿主检查失败时记录实际诊断。
+7. prepare 成功后，在调用 fresh 原生子 Agent 前执行 `task-orchestration <task-ref> dispatch`，显式指定 route 返回的 model/effort；传递短任务引用、skill 名、`--orchestrated` 与 stage/round/artifact/role。child 调用 `await-activation --stage ... --round ... --artifact ... --role ...`，确认当前阶段与实际 child 关联后执行。代码阶段通过 code-task 创建本地 checkpoint；禁止单独委派 commit 阶段或推送。保留已有写锁，不把实际 spawn 纳入新建锁协议。
+8. 通过当前宿主的原生生命周期事件和结果接口记录实际启动及终态。timed-out wait 不推断成功；身份、传输或异常终态失败如实暂停。阶段结果和 child 完成后调用 `advance`；只有 `running` 才重复步骤 3。
+9. 每轮创建新 child；禁止 follow-up 复用 reviewer。如实记录 actual model/effort 及宿主降级理由。检查当前身份、产物、账本与实际执行结果；用户裁决优先于历史方案派生要求。不得新增 child discovery、孤立 child 恢复或专用恢复协议。
+10. 完成或暂停后运行对应 typed verification，并把结构化 run 摘要、暂停原因、commit 终点或 clean completion evidence 告知用户。
 
 ## 停止
 

package/templates/.agents/skills/run-task/reference/host-validation.en.md

@@ -10,7 +10,7 @@ Before publishing support for a client, prove the lifecycle evidence chain with
 - Explicit requested model/effort reaches each executor/reviewer. A fallback of either field reports the corresponding actual value and its own non-empty reason.
   > claude-code exception: requested reasoning effort does not yet support per-role dispatch to executor/reviewer — `.claude/agents/{executor,reviewer}.md` is a repository-level shared singleton, and writing it per role would race across concurrent tasks. This client only needs to honestly record the actual model/actual reasoning effort observed in native Start/Stop host events (`delegationEvidence.actualReasoningEffort` is declared `spawn-ack`); when not observed it is recorded as missing, which is not treated as a fallback requiring its own reason and does not fail closed. This exception does not apply to any other client.
 - Candidate-checkout and packed-install behavior match, with model policy, receipts, and verification results auditable in `orchestration.json`.
-- Direct-host and sandbox controller hooks/profiles must come from trusted sources. Cross-root build/contract/profile content drift emits an actionable warning, while controller/task/process/lease and the receipt's hook/evidence binding remain identical through prepare/start/stop/consume.
+- Use the hooks/profiles actually loaded by the current host and verify observed parent/child identity and terminal results. Prepare does not depend on historical capability or controller attestation.
 
 ## Validation Sequence
 
@@ -21,4 +21,4 @@ Before publishing support for a client, prove the lifecycle evidence chain with
 5. Commit only redacted summaries and non-sensitive fixtures. Remove or replace tokens, user-specific absolute paths, transcript content, and credentials.
 6. For sandbox, run at least ten cold executor starts and ten cold reviewer starts. Record monotonic prepared, spawn-dispatch, SubagentStart, and activation-completed timestamps plus p50/p95/max. Enable only when max plus 20% fits the deadline and symlink/config/plugin/lease/context/build failure injection and terminal cleanup audits pass.
 
-If any required field cannot be observed reliably from the real host, keep that client's orchestration capability `unsupported` and record the gap as manual validation. Codex may advertise `experimental`, but every `prepare` must still pass static preflight and either native start/stop or the parent spawn/completed-wait fallback must produce verifiable consumed host evidence. The fallback may wait only for empty turns or protocol `inProgress`; malformed, identity/transport errors, or abnormal terminals pause deterministically. The claude-code exception above is already scoped in the second bullet and does not change this rule's fail-closed requirement for any other field or client.
+If any required field cannot be observed reliably from the real host, keep that client's orchestration capability `unsupported` and record the gap as manual validation. Codex may advertise `experimental`, but every `prepare` must still pass static preflight and either native start/stop or the parent spawn/completed-wait fallback must record verifiable execution results. The fallback may wait only for empty turns or protocol `inProgress`; malformed, identity/transport errors, or abnormal terminals pause deterministically. The claude-code exception above is already scoped in the second bullet and does not change this rule's fail-closed requirement for any other field or client.

package/templates/.agents/skills/run-task/reference/host-validation.zh-CN.md

@@ -10,7 +10,7 @@
 - 显式 requested model/effort 能传给 executor/reviewer；宿主对任一字段回退时，事件能给出对应 actual 值与独立的非空 fallback reason。
   > claude-code 例外：requested reasoning effort 暂不支持按角色下发给 executor/reviewer——`.claude/agents/{executor,reviewer}.md` 是仓库级共享单例，动态写入存在跨任务竞态，解决该竞态超出本任务范围。该客户端只要求如实记录宿主原生 Start/Stop 事件中能观察到的 actual model/actual reasoning effort（`delegationEvidence.actualReasoningEffort` 声明为 `spawn-ack`）；观察不到时记录为缺失，不视为需要独立 fallback reason 的回退场景，也不构成 fail-closed 阻断。此例外不适用于其他客户端。
 - candidate checkout 与打包安装后的行为一致，且模型策略、receipt 与验证结果可从 `orchestration.json` 复核。
-- direct-host 与 sandbox controller 使用的 hook/profile 必须来自受信来源；build/contract/profile 内容在跨根比较中允许漂移并输出可操作 warning，但 controller/task/process/lease 与 receipt 内 hook/evidence binding 仍须在 prepare/start/stop/consume 全链路一致。
+- 使用当前宿主实际加载的 hook/profile，并核对实际 parent/child 身份与终态；prepare 不依赖历史 capability 或 controller attestation。
 
 ## 验证顺序
 
@@ -21,4 +21,4 @@
 5. 仅把去敏摘要与非敏感 fixture 纳入版本库；token、绝对用户路径、transcript 内容和凭证必须删除或替换。
 6. sandbox backend 另做至少 10 次 executor 与 10 次 reviewer 冷启动，记录 prepared、spawn dispatch、SubagentStart、activation completed 的单调时钟及 p50/p95/max；仅当 max 加 20% 余量不超过 deadline，并通过 symlink/config/plugin/lease/context/build 失败注入和终态清理审计时启用。
 
-任一字段无法从真实宿主稳定观察时，该客户端的 orchestration capability 保持 `unsupported`，并把缺口记录为人工验证项。Codex 可声明为 `experimental`，但每次 `prepare` 仍必须通过静态 preflight，且原生 start/stop 或 parent spawn/completed-wait fallback 必须形成可验证的 consumed host evidence。fallback 只允许 empty turns/协议 `inProgress` 等待；malformed、身份/传输错误或异常 terminal 都稳定暂停。上述关于 claude-code 的例外已在第 2 条单独说明，不改变本条对其余字段/客户端的 fail-closed 要求。
+任一字段无法从真实宿主稳定观察时，该客户端的 orchestration capability 保持 `unsupported`，并把缺口记录为人工验证项。Codex 可声明为 `experimental`，但每次 `prepare` 仍必须通过静态 preflight，且原生 start/stop 或 parent spawn/completed-wait fallback 必须记录可核对的实际执行结果。fallback 只允许 empty turns/协议 `inProgress` 等待；malformed、身份/传输错误或异常 terminal 都稳定暂停。上述关于 claude-code 的例外已在第 2 条单独说明，不改变本条对其余字段/客户端的 fail-closed 要求。

package/dist/lib/sandbox/control/task-workflow.js

@@ -1,74 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { readStableFile, SecureFileError, writeAtomicFile } from '../../task/secure-fs.js';
-import { TASK_WORKFLOW_COMMANDS, TASK_WORKFLOW_OPERATIONS } from '../../task/workflow-command.js';
-export function validateTaskWorkflowRequest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    const request = value;
-    if (Object.keys(request).sort().join(',') !== 'args,generation,id,operation,taskId,version'
-        || request.version !== 1 || typeof request.id !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(request.id)
-        || typeof request.taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/u.test(request.taskId)
-        || typeof request.generation !== 'string' || !request.generation
-        || !Object.hasOwn(TASK_WORKFLOW_COMMANDS, request.operation)
-        || !Array.isArray(request.args) || request.args.length < 2 || request.args.length > 128
-        || !request.args.every((arg) => typeof arg === 'string' && !/[\r\n]/u.test(arg))
-        || request.args[0] !== request.taskId)
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    const [, selector] = TASK_WORKFLOW_COMMANDS[request.operation];
-    if (selector !== null && request.args[1] !== selector)
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    return request;
-}
-/** Preserve argv verbatim; the domain command owns option parsing and validation. */
-export function createTaskWorkflowRequest(command, args, taskId, generation) {
-    const operation = TASK_WORKFLOW_OPERATIONS.find((key) => {
-        const [name, selector] = TASK_WORKFLOW_COMMANDS[key];
-        return name === command && (selector === null || selector === args[1]);
-    });
-    if (!operation)
-        throw new Error('TASK_WORKFLOW_OPERATION_UNSUPPORTED');
-    return validateTaskWorkflowRequest({ version: 1, id: randomUUID(), taskId, generation, operation, args: [...args] });
-}
-export function canonicalArtifactName(value) {
-    return /^(?:analysis|plan|code|review-analysis|review-plan|review-code)(?:-r[1-9]\d*)?\.md$/u.test(value)
-        && path.basename(value) === value;
-}
-function assertTaskArtifactDirectory(directory) {
-    const resolved = path.resolve(directory);
-    let stat;
-    try {
-        stat = fs.lstatSync(resolved);
-    }
-    catch {
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory is unavailable');
-    }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory must be a real directory');
-    }
-    return resolved;
-}
-export async function readTaskArtifact(taskDir, input) {
-    if (!canonicalArtifactName(input.artifact))
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
-    const root = assertTaskArtifactDirectory(taskDir);
-    const candidate = path.join(root, input.artifact);
-    if (path.dirname(candidate) !== root)
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
-    const stable = await readStableFile(candidate, {
-        maxBytes: 1024 * 1024,
-        ...(input.expectedSha256 ? { expectedSha256: input.expectedSha256 } : {})
-    });
-    return { artifact: input.artifact, bytes: stable.bytes, sha256: stable.sha256 };
-}
-export async function writeTaskArtifact(taskDir, artifact) {
-    if (!canonicalArtifactName(artifact.artifact))
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
-    const root = assertTaskArtifactDirectory(taskDir);
-    const target = path.join(root, artifact.artifact);
-    if (path.dirname(target) !== root)
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
-    await writeAtomicFile(target, artifact.bytes, 0o600, artifact.expectedSha256);
-}
-//# sourceMappingURL=task-workflow.js.map

package/dist/lib/sandbox/control/workflow-executor.js

@@ -1,157 +0,0 @@
-import { TASK_WORKFLOW_COMMANDS } from '../../task/workflow-command.js';
-import { parseArtifactCommand, executeArtifactCommand } from '../../task/artifact-command.js';
-import { parseReviewCommand } from '../../task/review-command.js';
-import { prepareLocalArtifact, preflightLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.js';
-import { prepareReviewSummaryCandidate, commitReviewSummaryProvenance, preflightReviewSummary } from '../../task/review-finalization.js';
-import { readArtifactRecoveryIntent } from '../../task/artifact-repair-intent.js';
-import { withTaskExecutionLock } from '../../task/task-execution-lock.js';
-import { dispatchWorkflowCommand } from '../../task/workflow-dispatch.js';
-import { assertSandboxTaskSource } from '../workspace-view.js';
-import { appendDiagnosticAudit } from './audit.js';
-import { readTaskArtifact } from './task-workflow.js';
-import { applyTaskEvent } from '../../task/events.js';
-import { parseTaskEventRequest } from '../../internal/task-event.js';
-function executionResult(result) {
-    return { exitCode: result.status === 'failed' || result.status === 'refused' ? 1 : 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
-}
-/** The broker already authorized this host executor; domain operations own validation. */
-export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAttestation = null, options = {}) {
-    let publicationCommitted = false;
-    let recoveryObservation = null;
-    const observeRecoveryPublication = () => {
-        if (!recoveryObservation || recoveryObservation.wasPassed)
-            return;
-        const intent = readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, recoveryObservation.family, recoveryObservation.artifact);
-        publicationCommitted ||= intent?.state === 'preflight-ready'
-            || intent?.state === 'preflight-commit-started'
-            || intent?.state === 'preflight-passed'
-            || intent?.state === 'passed'
-            || intent?.state === 'commit-started';
-    };
-    let faultTriggered = false;
-    const fault = (window) => {
-        if (faultTriggered || options.faultWindow !== window)
-            return;
-        faultTriggered = true;
-        throw new Error(`TASK_WORKFLOW_FAULT_INJECTED:${window}`);
-    };
-    const response = (result) => {
-        fault('before-result-return');
-        return executionResult(result);
-    };
-    try {
-        fault('before-call');
-        const taskDir = assertSandboxTaskSource(manifest.repoRoot, request.taskId);
-        const [command] = TASK_WORKFLOW_COMMANDS[request.operation];
-        if (request.operation === 'event') {
-            const eventRequest = parseTaskEventRequest(request.args);
-            const boundEventRequest = lifecycleRecoveryAttestation && eventRequest.requestId === undefined
-                ? { ...eventRequest, requestId: lifecycleRecoveryAttestation.lifecycleRequestId }
-                : eventRequest;
-            fault('before-domain-write');
-            const result = applyTaskEvent(boundEventRequest, {
-                repoRoot: manifest.repoRoot,
-                lifecycleRecoveryAttestation,
-                deferLifecycleRecoveryConsumption: true
-            });
-            publicationCommitted = result.changed;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        if (command !== 'task-artifact' && command !== 'task-review') {
-            // The broker owns this short-lived executor; no global service or worker
-            // credential participates in the command's authority or recovery path.
-            fault('before-domain-write');
-            const result = dispatchWorkflowCommand(manifest.repoRoot, request.operation, request.args);
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        const input = command === 'task-artifact' ? parseArtifactCommand(request.args) : parseReviewCommand(request.args);
-        if (command === 'task-artifact' && 'operation' in input && input.operation === 'inspect') {
-            fault('before-domain-write');
-            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot });
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        if ('operation' in input && input.operation === 'init') {
-            fault('before-domain-write');
-            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot, artifactDir: taskDir });
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        return await withTaskExecutionLock(manifest.repoRoot, request.taskId, `sandbox-control.${request.operation}`, async () => {
-            const artifact = await readTaskArtifact(taskDir, { artifact: input.artifact });
-            const content = artifact.bytes.toString('utf8');
-            fault('before-domain-write');
-            let result;
-            if ('operation' in input) {
-                const { family } = input;
-                if (family !== 'analysis' && family !== 'plan' && family !== 'code')
-                    throw new Error('ARTIFACT_IDENTITY_INVALID');
-                const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot, recoveryId: input.recoveryId, lockAlreadyHeld: true };
-                if (input.operation === 'preflight') {
-                    // Preflight only seals a verified generation. It must not publish the
-                    // formal artifact, set publicationStarted, or append finalizer audit.
-                    const result = preflightLocalArtifact(local);
-                    recoveryObservation = { family, artifact: input.artifact, wasPassed: false };
-                    observeRecoveryPublication();
-                    return response(result);
-                }
-                recoveryObservation = {
-                    family,
-                    artifact: input.artifact,
-                    wasPassed: readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, family, input.artifact)?.state === 'passed'
-                };
-                const prepared = prepareLocalArtifact(local, content, lifecycleRecoveryAttestation ?? undefined);
-                observeRecoveryPublication();
-                const commitOptions = { afterPublish: () => fault('after-atomic-rename') };
-                if (prepared.result.status === 'failed')
-                    return executionResult(commitLocalArtifactProvenance(prepared, commitOptions));
-                result = commitLocalArtifactProvenance(prepared, commitOptions);
-            }
-            else {
-                if (input.overrideTicket)
-                    throw new Error('TASK_WORKFLOW_OVERRIDE_UNSUPPORTED');
-                const family = `review-${input.stage}`;
-                if (request.operation === 'review-preflight') {
-                    const result = preflightReviewSummary(input, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
-                    recoveryObservation = { family, artifact: input.artifact, wasPassed: false };
-                    observeRecoveryPublication();
-                    return response(result);
-                }
-                recoveryObservation = {
-                    family,
-                    artifact: input.artifact,
-                    wasPassed: readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, family, input.artifact)?.state === 'passed'
-                };
-                const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true, startRecovery: true });
-                observeRecoveryPublication();
-                if (input.dryRun || prepared.result.status === 'planned')
-                    return executionResult(prepared.result);
-                const commitOptions = { afterPublish: () => fault('after-atomic-rename') };
-                if (prepared.result.status === 'failed')
-                    return executionResult(commitReviewSummaryProvenance(prepared, manifest.repoRoot, commitOptions));
-                result = commitReviewSummaryProvenance(prepared, manifest.repoRoot, commitOptions);
-            }
-            observeRecoveryPublication();
-            publicationCommitted ||= result.changed === true;
-            if (result.status !== 'failed')
-                appendDiagnosticAudit(manifest, 'task-workflow-artifact-finalized', {
-                    requestId: request.id, sandboxTaskId: request.taskId, workflowOperation: request.operation,
-                    artifact: input.artifact, sha256: result.artifactSha256, semanticDigest: result.semanticDigest
-                });
-            fault('after-atomic-rename');
-            return response(result);
-        });
-    }
-    catch (error) {
-        observeRecoveryPublication();
-        const message = error instanceof Error ? error.message : String(error);
-        const code = error?.code ?? /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_WORKFLOW_REQUEST_INVALID';
-        return executionResult({ status: 'failed', changed: publicationCommitted ? null : false, error: { code, message } });
-    }
-}
-//# sourceMappingURL=workflow-executor.js.map