@fitlab-ai/agent-infra 0.11.10 → 0.11.12

package/dist/lib/internal/agent-client.js

@@ -3,10 +3,10 @@ import path from 'node:path';
 import { AgentClientConfigError, normalizeAgentClients } from '../agent-clients/config.js';
 import { normalizeCustomToolInvocations } from '../agent-clients/custom-tool-invocations.js';
 import { renderNextStepCommands } from '../agent-clients/next-steps.js';
-import { getAgentClientModelSelection } from '../agent-clients/registry.js';
+import { getAgentClientAdapter, getAgentClientModelSelection } from '../agent-clients/registry.js';
 import { isAgentClientId } from '../agent-clients/types.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal agent-client <next-steps|model-selection> [options]\n';
+const USAGE = 'Usage: agent-infra-internal agent-client <next-steps|model-selection|launch-carrier> [options]\n';
 function failure(code, message) {
     process.stdout.write(`${JSON.stringify({
         status: 'failed',
@@ -72,71 +72,113 @@ function parseArgs(args) {
         format
     };
 }
-function agentClient(args = []) {
-    if (!ensureInternalHandlerRoute('agent-client', args))
-        return;
-    if (internalHandlerRoute('agent-client', 'model-selection', args[0] ?? '')) {
-        const values = {};
-        const seen = new Set();
-        for (let index = 1; index < args.length; index += 1) {
-            const flag = args[index];
-            if (!['--client', '--format'].includes(flag) || seen.has(flag)) {
-                failure('AGENT_CLIENT_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
-                return;
-            }
-            const value = args[++index];
-            if (!value || value.startsWith('--')) {
-                failure('AGENT_CLIENT_PAYLOAD_INVALID', `option '${flag}' requires a value`);
-                return;
-            }
-            seen.add(flag);
-            values[flag] = value;
+function parseLaunchCarrierArgs(args) {
+    const allowed = new Set(['--client', '--adapter-context', '--stage', '--round', '--role', '--format']);
+    const values = {};
+    const seen = new Set();
+    for (let index = 1; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!allowed.has(flag) || seen.has(flag)) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
+            return null;
         }
-        const client = values['--client'];
-        const format = values['--format'] ?? 'text';
-        if (!isAgentClientId(client) || !['text', 'json'].includes(format)) {
-            failure('AGENT_CLIENT_PAYLOAD_INVALID', 'model-selection requires a known --client and text|json format');
-            return;
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `option '${flag}' requires a value`);
+            return null;
         }
-        const context = getAgentClientModelSelection(client);
-        if (format === 'json') {
-            process.stdout.write(`${JSON.stringify({
-                status: 'resolved', changed: false, client, context, error: null
-            })}\n`);
+        seen.add(flag);
+        values[flag] = value;
+    }
+    const round = Number(values['--round']);
+    if (!isAgentClientId(values['--client']) || !values['--adapter-context'] || !values['--stage'] || !values['--role']
+        || !Number.isSafeInteger(round) || round < 1 || (values['--format'] ?? 'json') !== 'json') {
+        failure('AGENT_CLIENT_PAYLOAD_INVALID', 'launch-carrier requires client, adapter context, stage, positive round, role, and json format');
+        return null;
+    }
+    return {
+        client: values['--client'],
+        adapterContext: values['--adapter-context'],
+        stage: values['--stage'],
+        round,
+        role: values['--role']
+    };
+}
+function launchCarrier(args) {
+    const parsed = parseLaunchCarrierArgs(args);
+    if (!parsed)
+        return;
+    const createCarrier = getAgentClientAdapter(parsed.client).orchestrationAdapter?.createLaunchCarrier;
+    if (!createCarrier) {
+        process.stdout.write(`${JSON.stringify({
+            status: 'failed', changed: false, client: parsed.client, carrier: null,
+            error: { code: 'AGENT_CLIENT_LAUNCH_CARRIER_UNSUPPORTED', message: `Agent Client '${parsed.client}' does not support lifecycle launch carriers` }
+        })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const carrier = createCarrier(parsed.adapterContext, { stage: parsed.stage, round: parsed.round, role: parsed.role });
+        process.stdout.write(`${JSON.stringify({ status: 'ready', changed: false, client: parsed.client, carrier, error: null })}\n`);
+    }
+    catch (error) {
+        process.stdout.write(`${JSON.stringify({
+            status: 'failed', changed: false, client: parsed.client, carrier: null,
+            error: { code: error instanceof Error && error.name ? error.name : 'AGENT_CLIENT_LAUNCH_CARRIER_INVALID', message: error instanceof Error ? error.message : String(error) }
+        })}\n`);
+        process.exitCode = 1;
+    }
+}
+function modelSelection(args) {
+    const values = {};
+    const seen = new Set();
+    for (let index = 1; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!['--client', '--format'].includes(flag) || seen.has(flag)) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
             return;
         }
-        if (context.kind === 'interactive-only') {
-            process.stdout.write(`Model selection: interactive-only\nCommand: ${context.command}\n${context.guidance}\n`);
-        }
-        else {
-            process.stdout.write(`Model selection: ${context.completeness} catalog\nSource: ${context.source}\n`);
-            for (const model of context.models) {
-                const efforts = model.reasoningEfforts?.length
-                    ? ` (${model.reasoningEfforts.join(', ')})`
-                    : '';
-                process.stdout.write(`- ${model.id}${efforts}\n`);
-            }
-            if (context.guidance)
-                process.stdout.write(`${context.guidance}\n`);
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `option '${flag}' requires a value`);
+            return;
         }
+        seen.add(flag);
+        values[flag] = value;
+    }
+    const client = values['--client'];
+    const format = values['--format'] ?? 'text';
+    if (!isAgentClientId(client) || !['text', 'json'].includes(format)) {
+        failure('AGENT_CLIENT_PAYLOAD_INVALID', 'model-selection requires a known --client and text|json format');
         return;
     }
-    const parsed = parseArgs(args);
-    if (!parsed || process.exitCode)
+    const context = getAgentClientModelSelection(client);
+    if (format === 'json') {
+        process.stdout.write(`${JSON.stringify({ status: 'resolved', changed: false, client, context, error: null })}\n`);
         return;
-    let config;
-    try {
-        const configPath = path.join(process.cwd(), '.agents', '.airc.json');
-        const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-        if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
-            throw new Error('configuration root must be an object');
-        }
-        config = raw;
     }
-    catch (error) {
-        failure('AGENT_CLIENT_CONFIG_INVALID', String(error));
+    renderModelSelection(context);
+}
+function renderModelSelection(context) {
+    if (context.kind === 'interactive-only') {
+        process.stdout.write(`Model selection: interactive-only\nCommand: ${context.command}\n${context.guidance}\n`);
         return;
     }
+    process.stdout.write(`Model selection: ${context.completeness} catalog\nSource: ${context.source}\n`);
+    for (const model of context.models) {
+        const efforts = model.reasoningEfforts?.length ? ` (${model.reasoningEfforts.join(', ')})` : '';
+        process.stdout.write(`- ${model.id}${efforts}\n`);
+    }
+    if (context.guidance)
+        process.stdout.write(`${context.guidance}\n`);
+}
+function renderNextSteps(args) {
+    const parsed = parseArgs(args);
+    if (!parsed || process.exitCode)
+        return;
+    const config = readAgentClientConfig();
+    if (!config)
+        return;
     try {
         const clients = normalizeAgentClients(config);
         const custom = normalizeCustomToolInvocations(config);
@@ -148,22 +190,7 @@ function agentClient(args = []) {
             ...(parsed.taskRef ? { taskRef: parsed.taskRef } : {}),
             ...(parsed.version ? { version: parsed.version } : {})
         });
-        if (parsed.format === 'json') {
-            process.stdout.write(`${JSON.stringify({
-                status: 'rendered',
-                changed: false,
-                commands,
-                diagnostics: custom.diagnostics,
-                error: null
-            })}\n`);
-            return;
-        }
-        for (const command of commands) {
-            process.stdout.write(`  - ${command.displayName}: ${command.command}\n`);
-        }
-        for (const diagnostic of custom.diagnostics) {
-            process.stderr.write(`${diagnostic.code} at ${diagnostic.path}\n`);
-        }
+        writeNextStepOutput(parsed.format, commands, custom.diagnostics);
     }
     catch (error) {
         if (error instanceof AgentClientConfigError) {
@@ -173,5 +200,38 @@ function agentClient(args = []) {
         failure('AGENT_CLIENT_RENDER_INVALID', error instanceof Error ? error.message : String(error));
     }
 }
+function readAgentClientConfig() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), '.agents', '.airc.json'), 'utf8'));
+        if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+            throw new Error('configuration root must be an object');
+        return raw;
+    }
+    catch (error) {
+        failure('AGENT_CLIENT_CONFIG_INVALID', String(error));
+        return null;
+    }
+}
+function writeNextStepOutput(format, commands, diagnostics) {
+    if (format === 'json') {
+        process.stdout.write(`${JSON.stringify({ status: 'rendered', changed: false, commands, diagnostics, error: null })}\n`);
+        return;
+    }
+    for (const command of commands)
+        process.stdout.write(`  - ${command.displayName}: ${command.command}\n`);
+    for (const diagnostic of diagnostics)
+        process.stderr.write(`${diagnostic.code} at ${diagnostic.path}\n`);
+}
+function agentClient(args = []) {
+    if (!ensureInternalHandlerRoute('agent-client', args))
+        return;
+    if (internalHandlerRoute('agent-client', 'launch-carrier', args[0] ?? '')) {
+        return launchCarrier(args);
+    }
+    if (internalHandlerRoute('agent-client', 'model-selection', args[0] ?? '')) {
+        return modelSelection(args);
+    }
+    renderNextSteps(args);
+}
 export { agentClient };
 //# sourceMappingURL=agent-client.js.map

package/dist/lib/internal/cli-route-inventory.js

@@ -33,8 +33,8 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'task-create': ['input'],
     'task-qualification': ['proposal', 'confirm', 'supersede', 'revoke'],
     'sandbox-control': ['serve', 'execute', 'recover', 'client'],
-    'agent-client': ['next-steps', 'model-selection'],
-    'codex-lifecycle': ['preflight', 'capability-arm', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
+    'agent-client': ['next-steps', 'model-selection', 'launch-carrier'],
+    'codex-lifecycle': ['preflight', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
     'codex-sandbox-controller': ['verify-context', 'run'],
     'git-workflow': ['inspect', 'preview-tree', 'snapshot', 'compare-trees', 'commit', 'push-rebased'],
     'task-delivery': ['deliver'],

package/dist/lib/internal/manual-validation.js

@@ -196,7 +196,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
         if (transaction.phase === 'prepared') {
             const staged = await syncPullRequestSummary(taskRef, {
                 cwd, client: options.client, agent, body: pendingBody, changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult: primaryResult, strict: true,
-                manualValidation: { phase: 'pending' }, lockAlreadyHeld: true
+                manualValidation: { phase: 'pending', transactionId: transaction.transactionId }, lockAlreadyHeld: true
             });
             if (!['applied', 'no-op'].includes(staged.status))
                 transactionFailure(staged.error ?? { code: 'MANUAL_VALIDATION_TRANSACTION_FAILED', message: 'pending summary staging failed' });
@@ -261,7 +261,7 @@ async function executeManualValidationTransactionLocked(taskRef, values, cwd, re
             try {
                 await syncPullRequestSummary(taskRef, {
                     cwd, client: options.client, agent, body: pendingBody, changeReportFile: path.resolve(cwd, values.changeReportFile), primaryResult: primaryResult, strict: true,
-                    manualValidation: { phase: 'pending' }, lockAlreadyHeld: true
+                    manualValidation: { phase: 'pending', transactionId: transaction.transactionId }, lockAlreadyHeld: true
                 });
             }
             catch {

package/dist/lib/internal/platform-pr.js

@@ -10,7 +10,7 @@ const USAGE = `Usage: agent-infra-internal platform-pr inspect <task-ref> [--cwd
        agent-infra-internal platform-pr bind <task-ref> --pr <token> --agent <agent> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr skip <task-ref> --agent <agent> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr sync <task-ref> --agent <agent> [--metadata] [--closing-issue] --result <pr_created|pr_reused|no_op> [--dry-run] [--cwd <path>]
-       agent-infra-internal platform-pr sync-in-labels --pr <N> [--dry-run] [--cwd <path>]
+       agent-infra-internal platform-pr sync-in-labels --pr <token> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr summary-context <task-ref> [--cwd <path>]
        agent-infra-internal platform-pr change-report <task-ref> --agent <agent> --mechanical-file <path> --precheck-file <path> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr summary-sync <task-ref> --agent <agent> --body-file <path|-> --change-report-file <path> --result <pr_created|pr_reused|no_op> [--manual-phase pending|final ...] [--strict] [--dry-run] [--cwd <path>]
@@ -91,13 +91,12 @@ async function platformPr(args = []) {
             fail(`sync-in-labels does not accept --${unexpected}`);
             return;
         }
-        const pr = Number(values.pr);
-        if (!Number.isInteger(pr) || pr <= 0) {
-            fail('sync-in-labels requires a positive --pr');
+        if (typeof values.pr !== 'string' || !values.pr || values.pr.trim() !== values.pr) {
+            fail('sync-in-labels requires a non-empty --pr token');
             return;
         }
         const cwd = path.resolve(typeof values.cwd === 'string' ? values.cwd : process.cwd());
-        finish(await syncPlatformPullRequestInLabels(pr, { cwd, dryRun: values.dryRun === true }));
+        finish(await syncPlatformPullRequestInLabels(values.pr, { cwd, dryRun: values.dryRun === true }));
         return;
     }
     const taskRef = args[1];

package/dist/lib/internal/task-artifact.js

@@ -1,6 +1,6 @@
 import { parseArtifactCommand, executeArtifactCommand } from '../task/artifact-command.js';
 import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family> [--source-finding <id> --source-artifact <name> --source-sha256 <digest>]\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> preflight|finalize-local --family <analysis|plan|code> --artifact <artifact>\n\nInspect, initialize, preflight, or finalize workflow artifact facts.\n`;
+const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family> [--reason-code <reason>] [--source-finding <id> --source-artifact <name> --source-sha256 <digest>]\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> preflight|finalize-local --family <analysis|plan|code> --artifact <artifact>\n\nInspect, initialize, preflight, or finalize workflow artifact facts.\n`;
 function taskArtifact(args = []) {
     if (!ensureInternalHandlerRoute('task-artifact', args))
         return;

package/dist/lib/internal/task-create.js

@@ -54,7 +54,21 @@ async function taskCreate(args) {
             throw new Error('TASK_CREATE_INPUT_INVALID: input must be a regular file');
         if (stat.size > SANDBOX_CONTROL_MAX_BYTES)
             throw new Error('TASK_CREATE_INPUT_TOO_LARGE: input exceeds the control limit');
-        const candidate = validateTaskCreateCandidate(JSON.parse(fs.readFileSync(inputPath, 'utf8')));
+        const inputContent = fs.readFileSync(inputPath, 'utf8');
+        let candidate;
+        try {
+            candidate = validateTaskCreateCandidate(JSON.parse(inputContent));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_INPUT_INVALID';
+            output(failed(code, message, false, {
+                requestId: null,
+                accepted: false,
+                recovery: 'new-request-id'
+            }));
+            return;
+        }
         const environment = resolveSandboxControlTransport();
         if (environment.kind === 'fail-closed') {
             output(failed(environment.reasonCode ?? 'TASK_CONTROL_TRANSPORT_INVALID', 'sandbox client control configuration is invalid'));

package/dist/lib/internal/task-finalization.js

@@ -65,9 +65,7 @@ async function taskFinalization(args = []) {
     const transport = resolveSandboxControlTransport(process.env, { localWorkflow: true });
     if (transport.kind === 'sandbox-local') {
         try {
-            const response = requestSandboxTaskFinalization({
-                agent: boundOperation.request.agent
-            });
+            const response = requestSandboxTaskFinalization({ agent: boundOperation.request.agent });
             process.stdout.write(response.stdout);
             process.stderr.write(response.stderr);
             process.exitCode = response.exitCode ?? 1;

package/dist/lib/internal/task-operation-registry.js

@@ -3,7 +3,8 @@ import path from 'node:path';
 import { accessSandboxTaskView, parseSandboxTaskView, taskViewFromStatus } from '../sandbox/control/task-view.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { PUBLIC_CLI_COMMAND_ALIASES, PUBLIC_CLI_SELECTOR_ALIASES, internalRouteSelector } from './cli-route-inventory.js';
-import { readSandboxControlIdentitySentinel } from '../sandbox/control/identity-sentinel.js';
+import { hasSandboxControlMarker, resolveSandboxControlTransport, sandboxTaskMarkerState } from '../sandbox/environment.js';
+export { resolveSandboxControlTransport } from '../sandbox/environment.js';
 const descriptor = (dispatcher, command, selector, scope, effect, taskRefSource = scope === 'non-task' ? 'none' : 'argv') => ({ dispatcher, command, selector, scope, effect, taskRefSource, guardBeforeImport: true });
 function internalTaskRoutes() {
     return [
@@ -18,8 +19,8 @@ function internalTaskRoutes() {
         descriptor('internal', 'sandbox-control', 'client', 'conditional', 'progress', 'delegated'),
         descriptor('internal', 'agent-client', 'next-steps', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'agent-client', 'model-selection', 'non-task', 'diagnostic', 'none'),
+        descriptor('internal', 'agent-client', 'launch-carrier', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'codex-lifecycle', 'preflight', 'non-task', 'diagnostic', 'none'),
-        descriptor('internal', 'codex-lifecycle', 'capability-arm', 'conditional', 'progress'),
         descriptor('internal', 'codex-lifecycle', 'hook-event', 'conditional', 'progress'),
         descriptor('internal', 'codex-lifecycle', 'resolve-start', 'conditional', 'progress'),
         descriptor('internal', 'codex-lifecycle', 'resolve-stop', 'conditional', 'progress'),
@@ -232,141 +233,6 @@ export function resolveDelegatedTaskOperation(args) {
         return null;
     return resolveTaskOperation('internal', rest[0], rest.slice(1));
 }
-const TASK_MARKER_KEYS = [
-    'AGENT_INFRA_TASK_ID',
-    'AGENT_INFRA_CONTROL_TOKEN',
-    'AGENT_INFRA_CONTROL_GENERATION',
-    'AGENT_INFRA_CONTROL_DIR',
-    'AGENT_INFRA_CONTROL_STATUS_DIR',
-    'AGENT_INFRA_RUNTIME_DIR'
-];
-const TASK_CONTROL_MARKER_KEYS = [
-    'AGENT_INFRA_CONTROL_TOKEN',
-    'AGENT_INFRA_CONTROL_GENERATION',
-    'AGENT_INFRA_CONTROL_DIR',
-    'AGENT_INFRA_CONTROL_STATUS_DIR'
-];
-const TASK_CONTROL_CONFIG_KEYS = [
-    'AGENT_INFRA_CONTROL_TOKEN',
-    'AGENT_INFRA_CONTROL_GENERATION',
-    'AGENT_INFRA_CONTROL_ROOT_ID',
-    'AGENT_INFRA_CONTROL_DIR',
-    'AGENT_INFRA_CONTROL_STATUS_DIR'
-];
-export const SANDBOX_CONTROL_STATUS_MOUNT = '/run/agent-infra/control-status';
-function nativeDirectoryProbe(candidate) {
-    try {
-        // The fixed mount is a trust anchor. Do not use a mutable node:fs export:
-        // a preload must not turn a mounted sandbox into the direct-host path by
-        // replacing the ordinary filesystem probe.
-        const binding = process.binding('fs');
-        if (!Function.prototype.toString.call(binding.internalModuleStat).includes('[native code]'))
-            return 'unknown';
-        const result = binding.internalModuleStat(candidate);
-        if (result === 1)
-            return 'present';
-        if (result === -2)
-            return 'absent';
-        return 'unknown';
-    }
-    catch {
-        return 'unknown';
-    }
-}
-function taskMarkerState(env) {
-    const present = (key) => Boolean(env[key]);
-    const taskId = present('AGENT_INFRA_TASK_ID');
-    const controls = TASK_CONTROL_MARKER_KEYS.every(present);
-    const runtime = present('AGENT_INFRA_RUNTIME_DIR');
-    const any = TASK_MARKER_KEYS.some(present);
-    if (!any)
-        return 'none';
-    if (taskId && controls && runtime)
-        return 'task-bound';
-    if (!taskId && controls && !runtime)
-        return 'branch-only';
-    return 'incomplete';
-}
-export function resolveSandboxControlTransport(env = process.env, options = {}) {
-    const hasAnyMarker = TASK_MARKER_KEYS.some((key) => Boolean(env[key]))
-        || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING)
-        || Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
-    const fixedStatusDir = options.statusMountPath
-        ?? SANDBOX_CONTROL_STATUS_MOUNT;
-    const fixedStatusProbe = path.isAbsolute(fixedStatusDir)
-        ? nativeDirectoryProbe(fixedStatusDir) : 'absent';
-    if (fixedStatusProbe === 'unknown') {
-        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_UNAVAILABLE' };
-    }
-    const fixedStatusMounted = fixedStatusProbe === 'present';
-    // A fixed status mount is installed only in a task-bound sandbox. Its
-    // presence is not mutable by the sandbox process, so marker removal must
-    // never make that process look like a direct host invocation.
-    if (!hasAnyMarker) {
-        return fixedStatusMounted
-            ? { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' }
-            : { kind: 'direct-host', reasonCode: null };
-    }
-    const hasCompleteConfig = TASK_CONTROL_CONFIG_KEYS.every((key) => Boolean(env[key]));
-    if (!hasCompleteConfig) {
-        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
-    }
-    const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
-    const configuredStatusProbe = configuredStatusDir && path.isAbsolute(configuredStatusDir)
-        ? nativeDirectoryProbe(configuredStatusDir) : 'absent';
-    if (configuredStatusProbe === 'unknown') {
-        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_UNAVAILABLE' };
-    }
-    const statusDir = configuredStatusDir && path.isAbsolute(configuredStatusDir)
-        ? configuredStatusProbe === 'present' ? configuredStatusDir : null
-        : fixedStatusMounted ? fixedStatusDir : null;
-    const statusMounted = statusDir !== null;
-    if (env.AGENT_INFRA_EXECUTOR_MANIFEST || env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING) {
-        return { kind: 'fail-closed', reasonCode: 'TASK_CONTROL_TRANSPORT_INVALID' };
-    }
-    const taskBound = Boolean(env.AGENT_INFRA_TASK_ID);
-    const runtime = Boolean(env.AGENT_INFRA_RUNTIME_DIR);
-    if (statusMounted) {
-        let sentinel;
-        try {
-            sentinel = readSandboxControlIdentitySentinel(statusDir);
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : '';
-            return { kind: 'fail-closed', reasonCode: message.endsWith('MISSING')
-                    ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
-                    : 'SANDBOX_CONTROL_IDENTITY_MALFORMED' };
-        }
-        if (sentinel.generation !== env.AGENT_INFRA_CONTROL_GENERATION) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH' };
-        }
-        if (env.AGENT_INFRA_CONTROL_ROOT_ID && sentinel.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH' };
-        }
-        if (sentinel.mode === 'task-bound'
-            && (sentinel.taskId !== env.AGENT_INFRA_TASK_ID || !runtime)) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
-        }
-        if (sentinel.mode === 'branch-only' && (taskBound || runtime)) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
-        }
-        if (!hasCompleteConfig) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
-        }
-        return { kind: options.localWorkflow ? 'sandbox-local' : 'broker-client', reasonCode: null };
-    }
-    if (!hasAnyMarker)
-        return { kind: 'direct-host', reasonCode: null };
-    if (!hasCompleteConfig || (taskBound && !runtime) || (!taskBound && runtime)) {
-        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
-    }
-    return options.localWorkflow
-        ? { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_MISSING' }
-        : { kind: 'broker-client', reasonCode: null };
-}
-export function hasTaskBoundMarker(env = process.env) {
-    return taskMarkerState(env) === 'task-bound';
-}
 function explicitTaskRefForOperation(dispatcher, command, args, selected) {
     if (selected.taskRefSource === 'none' || selected.taskRefSource === 'environment')
         return null;
@@ -446,7 +312,7 @@ function isSandboxExecutorRoute(dispatcher, command, args, env) {
         && first(args) === 'execute'
         && Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST)
         && Boolean(env.AGENT_INFRA_RUNTIME_DIR)
-        && !TASK_CONTROL_MARKER_KEYS.some((key) => Boolean(env[key]));
+        && !hasSandboxControlMarker(env);
 }
 function viewFromEnvironment(env) {
     const statusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
@@ -492,7 +358,7 @@ export function guardTaskOperation(dispatcher, command, args = [], options = {})
             taskView: null
         };
     }
-    const markerState = taskMarkerState(env);
+    const markerState = sandboxTaskMarkerState(env);
     if (markerState === 'incomplete' && !isSandboxExecutorRoute(dispatcher, command, args, env)) {
         throw new TaskViewOperationError('SANDBOX_TASK_VIEW_MARKER_INVALID', 'sandbox task markers are incomplete; refusing to infer host-direct authority');
     }

package/dist/lib/internal/task-validate.js

@@ -152,7 +152,7 @@ function inplaceValidation(config, target, options) {
     if (!row)
         throw new Error('SANDBOX_VALIDATION_CONTAINER_NOT_FOUND');
     const control = sandboxControlPaths({
-        base: config.controlBase, project: config.project,
+        base: config.controlBase, repoRoot: config.repoRoot, project: config.project,
         container: row.name, identity: target.workspace
     });
     const manifest = readSandboxControlManifest(control.manifestPath);

package/dist/lib/platform/issues.js

@@ -472,7 +472,8 @@ async function syncPlatformIssueImpl(taskRef, options) {
     let providerMetadata = null;
     let repositoryLabels = [];
     let milestones = [];
-    if (base.context.capabilities.triage && (options.status !== undefined || options.inLabels !== undefined || options.milestone !== undefined || options.issueType || options.fields)) {
+    if (base.context.capabilities.triage && (options.status !== undefined || options.inLabels !== undefined || options.milestone !== undefined
+        || (base.context.capabilities.push && (options.issueType || options.fields)))) {
         const metadata = base.provider.issues?.describeRepository
             ? await base.provider.issues.describeRepository({ context: providerOperationContext(base.loadedContext) })
             : unsupportedProviderOperation(base.provider, 'issues.describeRepository');
@@ -551,18 +552,29 @@ async function syncPlatformIssueImpl(taskRef, options) {
         }
     }
     if (options.issueType || options.fields) {
-        plan.operations.push(...(providerMetadata
-            ? planProviderMetadata(inspected.value, providerMetadata, base.frontmatter, options, base.context.capabilities)
-            : [{ name: 'issue-type', status: 'skipped', reasonCode: 'ISSUE_TYPES_UNSUPPORTED' }]));
+        plan.operations.push(...(!base.context.capabilities.push
+            ? [
+                ...(options.issueType ? [{ name: 'issue-type', status: 'skipped', reasonCode: 'PUSH_REQUIRED' }] : []),
+                ...(options.fields ? [{ name: 'fields', status: 'skipped', reasonCode: 'PUSH_REQUIRED' }] : [])
+            ]
+            : providerMetadata
+                ? planProviderMetadata(inspected.value, providerMetadata, base.frontmatter, options, base.context.capabilities)
+                : [{ name: 'issue-type', status: 'skipped', reasonCode: 'ISSUE_TYPES_UNSUPPORTED' }]));
     }
     const failure = plan.operations.find((operation) => operation.status === 'failed');
     if (failure)
         return result('failed', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: { code: failure.reasonCode || 'ISSUE_SYNC_FAILED', message: `Operation ${failure.name} failed`, retryable: false } });
     const planned = plan.operations.filter((operation) => operation.status === 'planned');
     if (options.dryRun)
-        return result(planned.length ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
+        return result(planned.length ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            issue: snapshot, operations: plan.operations, error: null
+        });
     if (planned.length === 0)
-        return result('no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
+        return result('no-op', base.resolved.taskId, base.issueNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            issue: snapshot, operations: plan.operations, error: null
+        });
     const payload = applyRestOperations(snapshot, planned);
     const updated = base.provider.issues?.update
         ? await base.provider.issues.update({ context: providerOperationContext(base.loadedContext), target: base.issueIdentity, currentLabels: snapshot.labels, patch: payload, mutation: { idempotencyKey: `issue:update:${base.resolved.taskId}` } })