@fitlab-ai/agent-infra 0.11.11 → 0.11.12

package/dist/lib/internal/agent-client.js

@@ -3,10 +3,10 @@ import path from 'node:path';
 import { AgentClientConfigError, normalizeAgentClients } from '../agent-clients/config.js';
 import { normalizeCustomToolInvocations } from '../agent-clients/custom-tool-invocations.js';
 import { renderNextStepCommands } from '../agent-clients/next-steps.js';
-import { getAgentClientModelSelection } from '../agent-clients/registry.js';
+import { getAgentClientAdapter, getAgentClientModelSelection } from '../agent-clients/registry.js';
 import { isAgentClientId } from '../agent-clients/types.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal agent-client <next-steps|model-selection> [options]\n';
+const USAGE = 'Usage: agent-infra-internal agent-client <next-steps|model-selection|launch-carrier> [options]\n';
 function failure(code, message) {
     process.stdout.write(`${JSON.stringify({
         status: 'failed',
@@ -72,71 +72,113 @@ function parseArgs(args) {
         format
     };
 }
-function agentClient(args = []) {
-    if (!ensureInternalHandlerRoute('agent-client', args))
-        return;
-    if (internalHandlerRoute('agent-client', 'model-selection', args[0] ?? '')) {
-        const values = {};
-        const seen = new Set();
-        for (let index = 1; index < args.length; index += 1) {
-            const flag = args[index];
-            if (!['--client', '--format'].includes(flag) || seen.has(flag)) {
-                failure('AGENT_CLIENT_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
-                return;
-            }
-            const value = args[++index];
-            if (!value || value.startsWith('--')) {
-                failure('AGENT_CLIENT_PAYLOAD_INVALID', `option '${flag}' requires a value`);
-                return;
-            }
-            seen.add(flag);
-            values[flag] = value;
+function parseLaunchCarrierArgs(args) {
+    const allowed = new Set(['--client', '--adapter-context', '--stage', '--round', '--role', '--format']);
+    const values = {};
+    const seen = new Set();
+    for (let index = 1; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!allowed.has(flag) || seen.has(flag)) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
+            return null;
         }
-        const client = values['--client'];
-        const format = values['--format'] ?? 'text';
-        if (!isAgentClientId(client) || !['text', 'json'].includes(format)) {
-            failure('AGENT_CLIENT_PAYLOAD_INVALID', 'model-selection requires a known --client and text|json format');
-            return;
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `option '${flag}' requires a value`);
+            return null;
         }
-        const context = getAgentClientModelSelection(client);
-        if (format === 'json') {
-            process.stdout.write(`${JSON.stringify({
-                status: 'resolved', changed: false, client, context, error: null
-            })}\n`);
+        seen.add(flag);
+        values[flag] = value;
+    }
+    const round = Number(values['--round']);
+    if (!isAgentClientId(values['--client']) || !values['--adapter-context'] || !values['--stage'] || !values['--role']
+        || !Number.isSafeInteger(round) || round < 1 || (values['--format'] ?? 'json') !== 'json') {
+        failure('AGENT_CLIENT_PAYLOAD_INVALID', 'launch-carrier requires client, adapter context, stage, positive round, role, and json format');
+        return null;
+    }
+    return {
+        client: values['--client'],
+        adapterContext: values['--adapter-context'],
+        stage: values['--stage'],
+        round,
+        role: values['--role']
+    };
+}
+function launchCarrier(args) {
+    const parsed = parseLaunchCarrierArgs(args);
+    if (!parsed)
+        return;
+    const createCarrier = getAgentClientAdapter(parsed.client).orchestrationAdapter?.createLaunchCarrier;
+    if (!createCarrier) {
+        process.stdout.write(`${JSON.stringify({
+            status: 'failed', changed: false, client: parsed.client, carrier: null,
+            error: { code: 'AGENT_CLIENT_LAUNCH_CARRIER_UNSUPPORTED', message: `Agent Client '${parsed.client}' does not support lifecycle launch carriers` }
+        })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const carrier = createCarrier(parsed.adapterContext, { stage: parsed.stage, round: parsed.round, role: parsed.role });
+        process.stdout.write(`${JSON.stringify({ status: 'ready', changed: false, client: parsed.client, carrier, error: null })}\n`);
+    }
+    catch (error) {
+        process.stdout.write(`${JSON.stringify({
+            status: 'failed', changed: false, client: parsed.client, carrier: null,
+            error: { code: error instanceof Error && error.name ? error.name : 'AGENT_CLIENT_LAUNCH_CARRIER_INVALID', message: error instanceof Error ? error.message : String(error) }
+        })}\n`);
+        process.exitCode = 1;
+    }
+}
+function modelSelection(args) {
+    const values = {};
+    const seen = new Set();
+    for (let index = 1; index < args.length; index += 1) {
+        const flag = args[index];
+        if (!['--client', '--format'].includes(flag) || seen.has(flag)) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
             return;
         }
-        if (context.kind === 'interactive-only') {
-            process.stdout.write(`Model selection: interactive-only\nCommand: ${context.command}\n${context.guidance}\n`);
-        }
-        else {
-            process.stdout.write(`Model selection: ${context.completeness} catalog\nSource: ${context.source}\n`);
-            for (const model of context.models) {
-                const efforts = model.reasoningEfforts?.length
-                    ? ` (${model.reasoningEfforts.join(', ')})`
-                    : '';
-                process.stdout.write(`- ${model.id}${efforts}\n`);
-            }
-            if (context.guidance)
-                process.stdout.write(`${context.guidance}\n`);
+        const value = args[++index];
+        if (!value || value.startsWith('--')) {
+            failure('AGENT_CLIENT_PAYLOAD_INVALID', `option '${flag}' requires a value`);
+            return;
         }
+        seen.add(flag);
+        values[flag] = value;
+    }
+    const client = values['--client'];
+    const format = values['--format'] ?? 'text';
+    if (!isAgentClientId(client) || !['text', 'json'].includes(format)) {
+        failure('AGENT_CLIENT_PAYLOAD_INVALID', 'model-selection requires a known --client and text|json format');
         return;
     }
-    const parsed = parseArgs(args);
-    if (!parsed || process.exitCode)
+    const context = getAgentClientModelSelection(client);
+    if (format === 'json') {
+        process.stdout.write(`${JSON.stringify({ status: 'resolved', changed: false, client, context, error: null })}\n`);
         return;
-    let config;
-    try {
-        const configPath = path.join(process.cwd(), '.agents', '.airc.json');
-        const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
-        if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
-            throw new Error('configuration root must be an object');
-        }
-        config = raw;
     }
-    catch (error) {
-        failure('AGENT_CLIENT_CONFIG_INVALID', String(error));
+    renderModelSelection(context);
+}
+function renderModelSelection(context) {
+    if (context.kind === 'interactive-only') {
+        process.stdout.write(`Model selection: interactive-only\nCommand: ${context.command}\n${context.guidance}\n`);
         return;
     }
+    process.stdout.write(`Model selection: ${context.completeness} catalog\nSource: ${context.source}\n`);
+    for (const model of context.models) {
+        const efforts = model.reasoningEfforts?.length ? ` (${model.reasoningEfforts.join(', ')})` : '';
+        process.stdout.write(`- ${model.id}${efforts}\n`);
+    }
+    if (context.guidance)
+        process.stdout.write(`${context.guidance}\n`);
+}
+function renderNextSteps(args) {
+    const parsed = parseArgs(args);
+    if (!parsed || process.exitCode)
+        return;
+    const config = readAgentClientConfig();
+    if (!config)
+        return;
     try {
         const clients = normalizeAgentClients(config);
         const custom = normalizeCustomToolInvocations(config);
@@ -148,22 +190,7 @@ function agentClient(args = []) {
             ...(parsed.taskRef ? { taskRef: parsed.taskRef } : {}),
             ...(parsed.version ? { version: parsed.version } : {})
         });
-        if (parsed.format === 'json') {
-            process.stdout.write(`${JSON.stringify({
-                status: 'rendered',
-                changed: false,
-                commands,
-                diagnostics: custom.diagnostics,
-                error: null
-            })}\n`);
-            return;
-        }
-        for (const command of commands) {
-            process.stdout.write(`  - ${command.displayName}: ${command.command}\n`);
-        }
-        for (const diagnostic of custom.diagnostics) {
-            process.stderr.write(`${diagnostic.code} at ${diagnostic.path}\n`);
-        }
+        writeNextStepOutput(parsed.format, commands, custom.diagnostics);
     }
     catch (error) {
         if (error instanceof AgentClientConfigError) {
@@ -173,5 +200,38 @@ function agentClient(args = []) {
         failure('AGENT_CLIENT_RENDER_INVALID', error instanceof Error ? error.message : String(error));
     }
 }
+function readAgentClientConfig() {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(process.cwd(), '.agents', '.airc.json'), 'utf8'));
+        if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+            throw new Error('configuration root must be an object');
+        return raw;
+    }
+    catch (error) {
+        failure('AGENT_CLIENT_CONFIG_INVALID', String(error));
+        return null;
+    }
+}
+function writeNextStepOutput(format, commands, diagnostics) {
+    if (format === 'json') {
+        process.stdout.write(`${JSON.stringify({ status: 'rendered', changed: false, commands, diagnostics, error: null })}\n`);
+        return;
+    }
+    for (const command of commands)
+        process.stdout.write(`  - ${command.displayName}: ${command.command}\n`);
+    for (const diagnostic of diagnostics)
+        process.stderr.write(`${diagnostic.code} at ${diagnostic.path}\n`);
+}
+function agentClient(args = []) {
+    if (!ensureInternalHandlerRoute('agent-client', args))
+        return;
+    if (internalHandlerRoute('agent-client', 'launch-carrier', args[0] ?? '')) {
+        return launchCarrier(args);
+    }
+    if (internalHandlerRoute('agent-client', 'model-selection', args[0] ?? '')) {
+        return modelSelection(args);
+    }
+    renderNextSteps(args);
+}
 export { agentClient };
 //# sourceMappingURL=agent-client.js.map

package/dist/lib/internal/cli-route-inventory.js

@@ -33,8 +33,8 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'task-create': ['input'],
     'task-qualification': ['proposal', 'confirm', 'supersede', 'revoke'],
     'sandbox-control': ['serve', 'execute', 'recover', 'client'],
-    'agent-client': ['next-steps', 'model-selection'],
-    'codex-lifecycle': ['preflight', 'capability-arm', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
+    'agent-client': ['next-steps', 'model-selection', 'launch-carrier'],
+    'codex-lifecycle': ['preflight', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
     'codex-sandbox-controller': ['verify-context', 'run'],
     'git-workflow': ['inspect', 'preview-tree', 'snapshot', 'compare-trees', 'commit', 'push-rebased'],
     'task-delivery': ['deliver'],

package/dist/lib/internal/task-operation-registry.js

@@ -19,8 +19,8 @@ function internalTaskRoutes() {
         descriptor('internal', 'sandbox-control', 'client', 'conditional', 'progress', 'delegated'),
         descriptor('internal', 'agent-client', 'next-steps', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'agent-client', 'model-selection', 'non-task', 'diagnostic', 'none'),
+        descriptor('internal', 'agent-client', 'launch-carrier', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'codex-lifecycle', 'preflight', 'non-task', 'diagnostic', 'none'),
-        descriptor('internal', 'codex-lifecycle', 'capability-arm', 'conditional', 'progress'),
         descriptor('internal', 'codex-lifecycle', 'hook-event', 'conditional', 'progress'),
         descriptor('internal', 'codex-lifecycle', 'resolve-start', 'conditional', 'progress'),
         descriptor('internal', 'codex-lifecycle', 'resolve-stop', 'conditional', 'progress'),

package/dist/lib/internal/task-validate.js

@@ -152,7 +152,7 @@ function inplaceValidation(config, target, options) {
     if (!row)
         throw new Error('SANDBOX_VALIDATION_CONTAINER_NOT_FOUND');
     const control = sandboxControlPaths({
-        base: config.controlBase, project: config.project,
+        base: config.controlBase, repoRoot: config.repoRoot, project: config.project,
         container: row.name, identity: target.workspace
     });
     const manifest = readSandboxControlManifest(control.manifestPath);

package/dist/lib/platform/issues.js

@@ -472,7 +472,8 @@ async function syncPlatformIssueImpl(taskRef, options) {
     let providerMetadata = null;
     let repositoryLabels = [];
     let milestones = [];
-    if (base.context.capabilities.triage && (options.status !== undefined || options.inLabels !== undefined || options.milestone !== undefined || options.issueType || options.fields)) {
+    if (base.context.capabilities.triage && (options.status !== undefined || options.inLabels !== undefined || options.milestone !== undefined
+        || (base.context.capabilities.push && (options.issueType || options.fields)))) {
         const metadata = base.provider.issues?.describeRepository
             ? await base.provider.issues.describeRepository({ context: providerOperationContext(base.loadedContext) })
             : unsupportedProviderOperation(base.provider, 'issues.describeRepository');
@@ -551,18 +552,29 @@ async function syncPlatformIssueImpl(taskRef, options) {
         }
     }
     if (options.issueType || options.fields) {
-        plan.operations.push(...(providerMetadata
-            ? planProviderMetadata(inspected.value, providerMetadata, base.frontmatter, options, base.context.capabilities)
-            : [{ name: 'issue-type', status: 'skipped', reasonCode: 'ISSUE_TYPES_UNSUPPORTED' }]));
+        plan.operations.push(...(!base.context.capabilities.push
+            ? [
+                ...(options.issueType ? [{ name: 'issue-type', status: 'skipped', reasonCode: 'PUSH_REQUIRED' }] : []),
+                ...(options.fields ? [{ name: 'fields', status: 'skipped', reasonCode: 'PUSH_REQUIRED' }] : [])
+            ]
+            : providerMetadata
+                ? planProviderMetadata(inspected.value, providerMetadata, base.frontmatter, options, base.context.capabilities)
+                : [{ name: 'issue-type', status: 'skipped', reasonCode: 'ISSUE_TYPES_UNSUPPORTED' }]));
     }
     const failure = plan.operations.find((operation) => operation.status === 'failed');
     if (failure)
         return result('failed', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: { code: failure.reasonCode || 'ISSUE_SYNC_FAILED', message: `Operation ${failure.name} failed`, retryable: false } });
     const planned = plan.operations.filter((operation) => operation.status === 'planned');
     if (options.dryRun)
-        return result(planned.length ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
+        return result(planned.length ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            issue: snapshot, operations: plan.operations, error: null
+        });
     if (planned.length === 0)
-        return result('no-op', base.resolved.taskId, base.issueNumber, { issue: snapshot, operations: plan.operations, error: null });
+        return result('no-op', base.resolved.taskId, base.issueNumber, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            issue: snapshot, operations: plan.operations, error: null
+        });
     const payload = applyRestOperations(snapshot, planned);
     const updated = base.provider.issues?.update
         ? await base.provider.issues.update({ context: providerOperationContext(base.loadedContext), target: base.issueIdentity, currentLabels: snapshot.labels, patch: payload, mutation: { idempotencyKey: `issue:update:${base.resolved.taskId}` } })

package/dist/lib/runtime/agent-runtime.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-const CLIENT_NAMESPACE = /^[a-z][a-z0-9-]{0,31}$/u;
+import { resolveTaskRuntimeRoot } from '../task/runtime-paths.js';
 function runtimeError(code, message) {
     const error = new Error(`${code}: ${message}`);
     error.name = code;
@@ -9,16 +9,9 @@ function boundControlContext(env) {
     return [
         'AGENT_INFRA_CONTROL_TOKEN',
         'AGENT_INFRA_CONTROL_GENERATION',
-        'AGENT_INFRA_EXECUTOR_MANIFEST',
-        'AGENT_INFRA_CODEX_CONTROLLER_CONTEXT'
+        'AGENT_INFRA_EXECUTOR_MANIFEST'
     ].some((key) => typeof env[key] === 'string' && env[key].length > 0);
 }
-function clientNamespace(client) {
-    if (!CLIENT_NAMESPACE.test(client)) {
-        throw runtimeError('AGENT_INFRA_RUNTIME_CLIENT_INVALID', `invalid runtime client namespace '${client}'`);
-    }
-    return client;
-}
 export function resolveAgentRuntimeRoot(options = {}) {
     const env = options.env ?? process.env;
     const configured = env.AGENT_INFRA_RUNTIME_DIR;
@@ -28,29 +21,13 @@ export function resolveAgentRuntimeRoot(options = {}) {
         }
         return path.resolve(configured);
     }
+    const taskId = env.AGENT_INFRA_TASK_ID;
+    if (taskId) {
+        return resolveTaskRuntimeRoot(taskId, { repoRoot: options.repoRoot });
+    }
     if (boundControlContext(env)) {
         throw runtimeError('AGENT_INFRA_RUNTIME_DIR_REQUIRED', 'task-bound control context requires AGENT_INFRA_RUNTIME_DIR');
     }
     return path.join(path.resolve(options.repoRoot ?? process.cwd()), '.agents', 'workspace', '.runtime');
 }
-export function resolveAgentRuntimeStoreRoot(options = {}) {
-    const client = clientNamespace(options.client ?? 'codex');
-    if (options.explicitRoot)
-        return path.resolve(options.explicitRoot);
-    const env = options.env ?? process.env;
-    const runtimeRoot = resolveAgentRuntimeRoot({ repoRoot: options.repoRoot, env });
-    if (env.AGENT_INFRA_RUNTIME_DIR) {
-        if (!options.store) {
-            throw runtimeError('AGENT_INFRA_RUNTIME_STORE_INVALID', 'store kind is required for task-bound runtime');
-        }
-        return path.join(runtimeRoot, 'clients', client, options.store);
-    }
-    if (client === 'codex' && options.store) {
-        return path.join(runtimeRoot, `codex-${options.store}`);
-    }
-    if (!options.store) {
-        throw runtimeError('AGENT_INFRA_RUNTIME_STORE_INVALID', 'store kind is required');
-    }
-    return path.join(runtimeRoot, 'clients', client, options.store);
-}
 //# sourceMappingURL=agent-runtime.js.map

package/dist/lib/sandbox/commands/control-status.js

@@ -8,6 +8,7 @@ export function readSandboxControlStatusForRow(config, row) {
         : { mode: 'branch-only' };
     const control = sandboxControlPaths({
         base: config.controlBase,
+        repoRoot: config.repoRoot,
         project: config.project,
         container: row.name,
         identity

package/dist/lib/sandbox/commands/create.js

@@ -741,6 +741,7 @@ export async function create(args, { runProjectInitCommand = true, workspace: wo
     const container = containerName(effectiveConfig, branch);
     const controlPaths = sandboxControlPaths({
         base: effectiveConfig.controlBase,
+        repoRoot: effectiveConfig.repoRoot,
         project: effectiveConfig.project,
         container,
         identity: target.workspace

package/dist/lib/sandbox/control/agent-operation.js

@@ -0,0 +1,34 @@
+import { getAgentClientAdapter } from '../../agent-clients/registry.js';
+function operationFor(request) {
+    const adapter = getAgentClientAdapter(request.agentClient);
+    const operation = adapter.sandboxControlOperation;
+    if (!operation)
+        throw new Error('SANDBOX_CONTROL_AGENT_OPERATION_UNSUPPORTED');
+    return operation;
+}
+function validateAgentClientOperation(request, manifest) {
+    operationFor(request).validate({
+        operation: request.operation,
+        payload: request.payload,
+        manifest
+    });
+}
+function executeAgentClientOperation(request, manifest, manifestPath, override) {
+    return (override ?? operationFor(request)).execute({
+        operation: request.operation,
+        payload: request.payload,
+        manifest,
+        manifestPath
+    });
+}
+function recoverAgentClientOperation(params) {
+    const operation = operationFor(params.request);
+    return operation.recover?.({
+        operation: params.request.operation,
+        manifest: params.manifest,
+        manifestPath: params.manifestPath,
+        stdout: params.stdout
+    }) ?? { consistent: false };
+}
+export { executeAgentClientOperation, recoverAgentClientOperation, validateAgentClientOperation };
+//# sourceMappingURL=agent-operation.js.map

package/dist/lib/sandbox/control/client.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { SANDBOX_CONTROL_ADMISSION_WINDOW_MS, SANDBOX_CONTROL_MAX_BYTES, SANDBOX_CONTROL_STATUS_STALE_MS, isSandboxControlFamily } from './protocol.js';
+import { isAgentClientId } from '../../agent-clients/types.js';
 import { normalizeAgentToken } from '../../agent-clients/tokens.js';
 import { readSandboxControlPayload, readSandboxControlStatus } from './state.js';
 import { accessSandboxTaskView, taskViewFromStatus } from './task-view.js';
@@ -368,7 +369,7 @@ function authority(params) {
 export function requestSandboxControl(params) {
     if (!isSandboxControlFamily(params.family))
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' is not allowed`, false);
-    if (params.family === 'task-create' || params.family === 'codex-controller' || params.family === 'task-finalization') {
+    if (params.family === 'task-create' || params.family === 'agent-client' || params.family === 'task-finalization') {
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' requires a typed request`, false);
     }
     const auth = authority(params);
@@ -376,9 +377,26 @@ export function requestSandboxControl(params) {
     const request = {
         version: 4, id: randomUUID(), ...auth, issuedAt,
         expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
-        family: params.family, args: params.args,
-        controllerProcess: null,
-        controllerProof: null
+        family: params.family, args: params.args
+    };
+    return exchangeSandboxControl(request, params);
+}
+export function requestSandboxAgentOperation(params) {
+    if (!isAgentClientId(params.agentClient)) {
+        clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client id is invalid', false);
+    }
+    const auth = authority(params);
+    const issuedAt = Date.now();
+    const request = {
+        version: 4,
+        id: randomUUID(),
+        ...auth,
+        issuedAt,
+        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+        family: 'agent-client',
+        agentClient: params.agentClient,
+        operation: params.operation,
+        payload: params.payload
     };
     return exchangeSandboxControl(request, params);
 }
@@ -398,9 +416,7 @@ export function requestSandboxTaskFinalization(params) {
         family: 'task-finalization',
         operation: 'complete',
         agent,
-        args: [],
-        controllerProcess: null,
-        controllerProof: null
+        args: []
     };
     let response;
     try {
@@ -440,147 +456,6 @@ export function recoverAcceptedTaskFinalization(requestId, params, recover = rec
     }
     clientError('SANDBOX_CONTROL_RESULT_UNKNOWN', 'accepted finalization request remained unknown after the automatic recovery budget; inspect the receipt and resume by request id', false, true, requestId);
 }
-function exactKeys(value, keys) {
-    return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
-}
-function validProcess(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const identity = value;
-    return exactKeys(identity, ['pid', 'startTime'])
-        && Number.isSafeInteger(identity.pid) && identity.pid > 0
-        && Number.isSafeInteger(identity.startTime) && identity.startTime >= 0;
-}
-function validBuild(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const build = value;
-    return exactKeys(build, ['internalExecutableBuildHash', 'lifecycleContractHash', 'packageVersion', 'protocolVersion'])
-        && build.protocolVersion === 3
-        && typeof build.packageVersion === 'string' && build.packageVersion.length > 0
-        && typeof build.internalExecutableBuildHash === 'string' && /^[a-f0-9]{64}$/u.test(build.internalExecutableBuildHash)
-        && typeof build.lifecycleContractHash === 'string' && /^[a-f0-9]{64}$/u.test(build.lifecycleContractHash);
-}
-export function parseCodexControllerResult(response) {
-    if (response.phase !== 'completed' || response.error !== null || response.stderr !== '') {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller result outer response is invalid', false, true);
-    }
-    let value;
-    try {
-        if (!response.stdout.endsWith('\n') || response.stdout.slice(0, -1).includes('\n'))
-            throw new Error('not canonical');
-        value = JSON.parse(response.stdout);
-    }
-    catch {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller result payload is invalid', false, true);
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller result payload is invalid', false, true);
-    }
-    const result = value;
-    const resultKeys = result.status === 'verified'
-        ? ['binding', 'changed', 'error', 'lease', 'status', 'version']
-        : ['changed', 'error', 'lease', 'status', 'version'];
-    if (!exactKeys(result, resultKeys)
-        || result.version !== 1 || !['opened', 'closed', 'failed', 'verified'].includes(result.status)) {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller result schema is invalid', false, true);
-    }
-    if (result.status === 'failed') {
-        const error = result.error;
-        if (response.exitCode !== 1 || result.changed !== false || result.lease !== null
-            || !error || !exactKeys(error, ['code', 'message', 'retryable'])
-            || typeof error.code !== 'string' || !/^[A-Z][A-Z0-9_]+$/u.test(error.code)
-            || typeof error.message !== 'string' || error.retryable !== false) {
-            clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller failure result is invalid', false, true);
-        }
-        clientError(error.code, error.message, false, true);
-    }
-    if (response.exitCode !== 0 || result.error !== null) {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller success result is invalid', false, true);
-    }
-    if (result.status === 'closed') {
-        if (typeof result.changed !== 'boolean' || result.lease !== null) {
-            clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller close result is invalid', false, true);
-        }
-        return result;
-    }
-    if (result.status === 'verified') {
-        const binding = result.binding;
-        if (result.changed !== false || result.lease !== null || !binding
-            || !exactKeys(binding, ['controllerInstanceDigest', 'controlGeneration', 'taskId'])
-            || typeof binding.taskId !== 'string' || binding.taskId.length === 0
-            || typeof binding.controlGeneration !== 'string' || binding.controlGeneration.length === 0
-            || typeof binding.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(binding.controllerInstanceDigest)) {
-            clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller verify result is invalid', false, true);
-        }
-        return result;
-    }
-    const lease = result.lease;
-    if (result.changed !== true || !lease
-        || !exactKeys(lease, [
-            'buildIdentity', 'controlGeneration', 'controllerInstanceDigest', 'controllerProcess',
-            'expiresAt', 'issuedAt', 'leaseId', 'leaseSecret', 'taskId', 'version'
-        ])
-        || lease.version !== 1
-        || typeof lease.leaseId !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.leaseId)
-        || typeof lease.leaseSecret !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.leaseSecret)
-        || typeof lease.taskId !== 'string' || lease.taskId.length === 0
-        || typeof lease.controlGeneration !== 'string' || lease.controlGeneration.length === 0
-        || typeof lease.controllerInstanceDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(lease.controllerInstanceDigest)
-        || !validProcess(lease.controllerProcess) || !validBuild(lease.buildIdentity)
-        || !Number.isSafeInteger(lease.issuedAt) || !Number.isSafeInteger(lease.expiresAt)
-        || lease.expiresAt <= lease.issuedAt) {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller open result is invalid', false, true);
-    }
-    return result;
-}
-function requestCodexController(params) {
-    const auth = authority(params);
-    const issuedAt = Date.now();
-    const request = {
-        version: 4,
-        id: randomUUID(),
-        ...auth,
-        issuedAt,
-        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
-        family: 'codex-controller',
-        command: params.command,
-        args: [],
-        controllerProcess: params.controllerProcess,
-        controllerProof: params.controllerProof
-    };
-    const result = parseCodexControllerResult(exchangeSandboxControl(request, params));
-    if (result.status === 'opened'
-        && (result.lease.controlGeneration !== auth.generation
-            || result.lease.controllerProcess.pid !== params.controllerProcess.pid
-            || result.lease.controllerProcess.startTime !== params.controllerProcess.startTime)) {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller result does not match the request', false, true);
-    }
-    return result;
-}
-export function requestCodexControllerOpen(params) {
-    const result = requestCodexController({ ...params, command: 'open', controllerProof: null });
-    if (result.status !== 'opened')
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller open returned the wrong result', false, true);
-    return result;
-}
-export function requestCodexControllerClose(params) {
-    const result = requestCodexController({ ...params, command: 'close' });
-    if (result.status !== 'closed')
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller close returned the wrong result', false, true);
-    return result;
-}
-export function requestCodexControllerVerify(params) {
-    const result = requestCodexController({
-        ...params,
-        controllerProcess: params.controllerProof.controllerProcess,
-        command: 'verify'
-    });
-    if (result.status !== 'verified') {
-        clientError('SANDBOX_CONTROL_RESULT_INVALID', 'controller verify returned the wrong result', false, true);
-    }
-    return result;
-}
 export function requestSandboxTaskCreate(params) {
     const auth = authority(params);
     const issuedAt = Date.now();
@@ -588,8 +463,6 @@ export function requestSandboxTaskCreate(params) {
         version: 4, id: randomUUID(), ...auth, issuedAt,
         expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
         family: 'task-create', candidate: params.candidate,
-        controllerProcess: null,
-        controllerProof: null
     };
     return exchangeSandboxControl(request, { ...params, timeoutMs: params.timeoutMs ?? 120_000 });
 }