@fitlab-ai/agent-infra 0.11.11 → 0.11.12

package/dist/lib/sandbox/control/executor.js

@@ -12,8 +12,7 @@ import { requestAuditFields, resultAuditFields, appendDiagnosticAudit, createSan
 import { validateSandboxControlIdentity } from './identity-sentinel.js';
 import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../../task/control-authority.js';
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest } from './lifecycle.js';
-import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
-import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
+import { executeAgentClientOperation, validateAgentClientOperation } from './agent-operation.js';
 function sameBrokerOwner(left, right) {
     return left.version === right.version
         && left.pid === right.pid
@@ -169,23 +168,6 @@ function waitForGate(nonce, timeoutMs = 2_000) {
         });
     });
 }
-function controllerFailure(error) {
-    const code = error instanceof CodexControllerRegistrationError
-        ? error.code
-        : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
-            ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
-    const message = error instanceof CodexControllerRegistrationError
-        ? error.message
-        : `${code}: controller operation failed; inspect the sandbox controller and rebuild the sandbox if needed`;
-    const payload = {
-        version: 1,
-        status: 'failed',
-        changed: false,
-        lease: null,
-        error: { code, message, retryable: false }
-    };
-    return { exitCode: 1, stdout: `${JSON.stringify(payload)}\n`, stderr: '' };
-}
 function lifecycleFailure(code, message) {
     return {
         exitCode: 1,
@@ -241,59 +223,9 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
             return taskCreateExecutionFailure(request.id, code, detail);
         }
     }
-    if (request.family === 'codex-controller') {
-        try {
-            if (request.command === 'verify') {
-                const binding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
-                    manifest,
-                    manifestPath,
-                    proof: request.controllerProof,
-                    buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
-                });
-                return {
-                    exitCode: 0,
-                    stdout: `${JSON.stringify({
-                        version: 1,
-                        status: 'verified',
-                        changed: false,
-                        lease: null,
-                        binding: {
-                            taskId: manifest.taskId,
-                            controlGeneration: binding.controlGeneration,
-                            controllerInstanceDigest: binding.instanceDigest
-                        },
-                        error: null
-                    })}\n`,
-                    stderr: ''
-                };
-            }
-            const result = request.command === 'open'
-                ? openCodexControllerRegistration({
-                    manifest,
-                    manifestPath,
-                    controllerProcess: request.controllerProcess,
-                    buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
-                })
-                : closeCodexControllerRegistration({
-                    manifest,
-                    manifestPath,
-                    proof: request.controllerProof
-                });
-            return { exitCode: 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
-        }
-        catch (error) {
-            const errorCode = error instanceof CodexControllerRegistrationError
-                ? error.code
-                : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
-                    ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
-            appendExecutorAudit(manifest, 'controller-operation-failed', {
-                ...requestAuditFields(manifest, request),
-                controllerCommand: request.command,
-                errorCode,
-                errorType: error instanceof Error ? error.name : typeof error,
-            });
-            return controllerFailure(error);
-        }
+    if (request.family === 'agent-client') {
+        validateAgentClientOperation(request, manifest);
+        return executeAgentClientOperation(request, manifest, manifestPath, options.agentClientOperation);
     }
     if (request.family === 'task-finalization') {
         const parsed = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
@@ -346,7 +278,8 @@ export async function executeRequest(manifest, manifestPath, request, options =
     const fields = requestAuditFields(manifest, request);
     appendExecutorAudit(manifest, 'executor-request-start', fields);
     try {
-        const result = await executeRequestInner(manifest, manifestPath, request, options);
+        let result;
+        result = await executeRequestInner(manifest, manifestPath, request, options);
         appendExecutorAudit(manifest, 'executor-request-finished', {
             requestId: request.id,
             requestFamily: request.family,
@@ -424,13 +357,13 @@ export async function runSandboxControlExecutor(requestPath, nonce) {
                     return null;
                 }
             })()
-            : null;
+            : request.family === 'agent-client' ? request.operation : null;
         const context = createSandboxControlAuditContext(manifest, {
             requestId: request.id,
             family: request.family,
-            operation: operation?.family === 'task-lifecycle'
+            operation: operation && typeof operation === 'object' && 'family' in operation && operation.family === 'task-lifecycle'
                 ? operation.request.intent
-                : request.family === 'task-finalization' ? request.operation : null,
+                : request.family === 'task-finalization' || request.family === 'agent-client' ? request.operation : null,
             phase: 'started-committed',
             outcome: 'in-progress'
         });

package/dist/lib/sandbox/control/protocol.js

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { validateTaskCreateCandidate } from '../../task/create.js';
 import { normalizeAgentToken } from '../../agent-clients/tokens.js';
+import { isAgentClientId } from '../../agent-clients/types.js';
 export const SANDBOX_CONTROL_MAX_BYTES = 64 * 1024;
 export const SANDBOX_CONTROL_MAX_LOGICAL_RECORDS = 1024;
 export const SANDBOX_CONTROL_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
@@ -10,7 +11,7 @@ export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-finalization', 'task-create', 'codex-controller'];
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-finalization', 'task-create', 'agent-client'];
 export const DEFAULT_SANDBOX_CONTROL_TIMING = Object.freeze({
     controlTickMs: 250,
     parkedBindingInitialMs: 1_000,
@@ -131,39 +132,31 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         fail('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit');
     }
     if (request.family === 'task-create') {
-        const expected = ['candidate', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+        const expected = ['candidate', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
         }
-        if (request.controllerProcess !== null || request.controllerProof !== null) {
-            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-create cannot carry controller authority');
-        }
         return { ...request, candidate: validateTaskCreateCandidate(request.candidate) };
     }
-    if (request.family === 'codex-controller') {
-        const expected = ['args', 'command', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    if (request.family === 'agent-client') {
+        const expected = ['agentClient', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'payload', 'token', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
-            || !Array.isArray(request.args) || request.args.length !== 0
-            || !['open', 'close', 'verify'].includes(request.command)
-            || !validControllerProcess(request.controllerProcess)
-            || (request.command === 'open' && request.controllerProof !== null)
-            || (request.command !== 'open' && !validControllerProof(request.controllerProof))
-            || (request.command === 'verify'
-                && JSON.stringify(request.controllerProcess) !== JSON.stringify(request.controllerProof.controllerProcess))) {
-            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'controller request schema is invalid');
+            || !isAgentClientId(request.agentClient)
+            || typeof request.operation !== 'string' || !/^[a-z][a-z0-9.-]{0,63}$/u.test(request.operation)
+            || !request.payload || typeof request.payload !== 'object' || Array.isArray(request.payload)) {
+            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client request schema is invalid');
         }
         if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot register a Codex controller');
+            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot coordinate agent clients');
         }
         return request;
     }
     if (request.family === 'task-finalization') {
-        const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+        const expected = ['agent', 'args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
             || request.operation !== 'complete'
             || !Array.isArray(request.args) || request.args.length !== 0
-            || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
-            || request.controllerProcess !== null || request.controllerProof !== null) {
+            || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
         }
         if (manifest.mode !== 'task-bound' || !manifest.taskId) {
@@ -171,7 +164,7 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         }
         return request;
     }
-    const expected = ['args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    const expected = ['args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
         || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
@@ -179,37 +172,16 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
     if (manifest.mode !== 'task-bound' || !manifest.taskId) {
         fail('SANDBOX_CONTROL_BRANCH_ONLY', "branch-only sandboxes cannot coordinate tasks; return to the host and run 'ai sandbox start --recreate <task-ref-or-correct-branch>'");
     }
-    if (request.controllerProcess !== null || request.controllerProof !== null) {
-        fail('SANDBOX_CONTROL_REQUEST_INVALID', 'controller authority is invalid');
-    }
     return request;
 }
 export function bindSandboxControlTask(request, taskId) {
-    if (request.family === 'task-create' || request.family === 'codex-controller' || request.family === 'task-finalization') {
+    if (request.family === 'task-create' || request.family === 'agent-client' || request.family === 'task-finalization') {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
     }
     if (request.args.length === 0)
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'command arguments are required');
     return [taskId, ...request.args.slice(1)];
 }
-function validControllerProcess(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const processValue = value;
-    return Object.keys(processValue).sort().join(',') === 'pid,startTime'
-        && Number.isSafeInteger(processValue.pid) && processValue.pid > 0
-        && Number.isSafeInteger(processValue.startTime) && processValue.startTime >= 0;
-}
-function validControllerProof(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const proof = value;
-    return Object.keys(proof).sort().join(',') === 'controllerProcess,leaseId,leaseSecret,version'
-        && proof.version === 1
-        && typeof proof.leaseId === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseId)
-        && typeof proof.leaseSecret === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseSecret)
-        && validControllerProcess(proof.controllerProcess);
-}
 export function controlError(error) {
     if (error instanceof SandboxControlProtocolError) {
         return { code: error.code, message: error.message, retryable: error.retryable };

package/dist/lib/sandbox/control/server.js

@@ -18,7 +18,7 @@ import { inspectSandboxControlContainer } from './container-identity.js';
 import { acquireSandboxControlBrokerStartup, garbageCollectSandboxControlRoot, isSandboxControlRootQuiescing, readSandboxControlManifest } from './lifecycle.js';
 import { nextSandboxControlBackoff } from './timing.js';
 import { readTaskFinalizationReceipt } from '../../task/finalization.js';
-import { readCodexControllerRegistration } from './controller-registration.js';
+import { recoverAgentClientOperation, validateAgentClientOperation } from './agent-operation.js';
 import { validateSandboxControlIdentity } from './identity-sentinel.js';
 import { mergeSandboxTaskView, taskViewAfterFinalization, taskViewForManifest } from './task-view.js';
 import { taskCreateOutputUnavailableResult } from '../../task/create-service.js';
@@ -57,8 +57,8 @@ function operationKey(request) {
         return request.operation;
     if (request.family === 'task-create')
         return 'create';
-    if (request.family === 'codex-controller')
-        return request.command;
+    if (request.family === 'agent-client')
+        return request.operation;
     if (request.family !== 'task-lifecycle')
         return null;
     try {
@@ -217,43 +217,6 @@ function taskCreateDomainEvidence(manifest, output) {
         return { consistent: false };
     }
 }
-function controllerDomainEvidence(manifest, manifestPath, request, output) {
-    if (!output || output.error !== null || typeof output.status !== 'string')
-        return { consistent: false };
-    try {
-        const registration = readCodexControllerRegistration(manifestPath);
-        if (request.family !== 'codex-controller')
-            return { consistent: false };
-        if (request.command === 'open') {
-            const lease = output.lease && typeof output.lease === 'object' && !Array.isArray(output.lease)
-                ? output.lease : null;
-            return {
-                consistent: output.status === 'opened' && output.changed === true
-                    && lease?.taskId === registration.taskId
-                    && lease.controlGeneration === registration.controlGeneration
-                    && lease.controllerInstanceDigest === registration.controllerInstanceDigest
-                    && registration.taskId === manifest.taskId
-                    && registration.controlGeneration === manifest.generation
-            };
-        }
-        if (request.command === 'verify') {
-            const binding = output.binding && typeof output.binding === 'object' && !Array.isArray(output.binding)
-                ? output.binding : null;
-            return {
-                consistent: output.status === 'verified' && output.changed === false
-                    && binding?.taskId === registration.taskId
-                    && binding.controlGeneration === registration.controlGeneration
-                    && binding.controllerInstanceDigest === registration.controllerInstanceDigest
-            };
-        }
-        return { consistent: false };
-    }
-    catch (error) {
-        return { consistent: request.family === 'codex-controller' && request.command === 'close'
-                && error.code === 'CODEX_SANDBOX_CONTROLLER_REGISTRATION_MISSING'
-                && output?.status === 'closed' && typeof output.changed === 'boolean' };
-    }
-}
 async function readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payloadOutput) {
     if (!operation)
         return { domain: null };
@@ -261,7 +224,7 @@ async function readRecoveryDomain(manifest, manifestPath, request, operation, te
         ? manifest.taskId
         : 'args' in request ? request.args[0] ?? null : manifest.taskId;
     const output = parseControlOutput(payloadOutput);
-    if (!taskRef && operation.family !== 'task-create' && operation.family !== 'codex-controller') {
+    if (!taskRef && operation.family !== 'task-create' && operation.family !== 'agent-client') {
         return { domain: null };
     }
     if (operation.family === 'task-lifecycle') {
@@ -289,8 +252,13 @@ async function readRecoveryDomain(manifest, manifestPath, request, operation, te
     if (operation.family === 'task-create') {
         return { domain: taskCreateDomainEvidence(manifest, output) };
     }
-    if (operation.family === 'codex-controller') {
-        return { domain: controllerDomainEvidence(manifest, manifestPath, request, output) };
+    if (operation.family === 'agent-client' && request.family === 'agent-client') {
+        return { domain: recoverAgentClientOperation({
+                request,
+                manifest,
+                manifestPath,
+                stdout: payloadOutput
+            }) };
     }
     return { domain: null };
 }
@@ -509,6 +477,8 @@ async function recoverProcessing(manifest, manifestPath, broker, brokerOwns) {
                 request = validateSandboxControlRequest(rawRequest, manifest, {
                     now: typeof rawRequest.issuedAt === 'number' ? rawRequest.issuedAt : undefined
                 });
+                if (request.family === 'agent-client')
+                    validateAgentClientOperation(request, manifest);
             }
             catch {
                 // Missing or malformed request evidence remains fail-closed below.
@@ -982,6 +952,8 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                     if (active)
                         throw new Error('SANDBOX_CONTROL_BUSY');
                     const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
+                    if (request.family === 'agent-client')
+                        validateAgentClientOperation(request, manifest);
                     validatedRequest = request;
                     criticalRequestPhase(manifest, request, 'validated', 'in-progress');
                     appendBrokerAudit(manifest, 'request-validated', {
@@ -1075,12 +1047,6 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         retiring = true;
                         continue;
                     }
-                    if (!brokerOwns()) {
-                        prepared.terminate(false);
-                        active = null;
-                        retiring = true;
-                        continue;
-                    }
                     criticalRequestPhase(manifest, request, 'accepted-authorized', 'in-progress');
                     writeAcceptedResponse(manifest, {
                         version: 2, id, phase: 'accepted', exitCode: null, stdout: '', stderr: '', error: null

package/dist/lib/sandbox/mounts.js

@@ -38,9 +38,10 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
         ...workspaceMounts,
     ];
     if (taskBound) {
+        const taskMountPath = path.posix.join('/workspace/.agents/workspace/active', overrides.taskId);
         mounts.push({
             hostPaths: taskSources,
-            containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId),
+            containerPath: taskMountPath,
             readOnly: false
         });
     }

package/dist/lib/sandbox/recovery.js

@@ -174,6 +174,7 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
 async function ensureSandboxControlBroker(params) {
     const control = sandboxControlPaths({
         base: params.config.controlBase ?? path.join(params.config.home, '.agent-infra', 'sandbox-control'),
+        repoRoot: params.config.repoRoot,
         project: params.config.project,
         container: params.container,
         identity: params.workspace
@@ -509,6 +510,7 @@ function expectedMounts(params) {
     });
     const control = sandboxControlPaths({
         base: config.controlBase ?? path.join(config.home, '.agent-infra', 'sandbox-control'),
+        repoRoot: config.repoRoot,
         project: config.project,
         container: params.container,
         identity: params.workspace
@@ -905,7 +907,7 @@ export async function ensureSandboxReady(params) {
             let completedReentry = null;
             if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
                 const control = sandboxControlPaths({
-                    base: params.config.controlBase, project: params.config.project,
+                    base: params.config.controlBase, repoRoot: params.config.repoRoot, project: params.config.project,
                     container: params.row.name, identity: params.workspace
                 });
                 const manifest = readSandboxControlManifest(control.manifestPath);

package/dist/lib/sandbox/removal.js

@@ -568,7 +568,7 @@ function resolveRmTarget(config, tools, cleanupTarget, options = {}) {
         ? matchedContainers
         : [...new Set([...containerNameCandidates(config, effectiveBranch), ...matchedContainers])];
     const controlRoots = containers.flatMap((container) => identities.map((identity) => sandboxControlPaths({
-        base: config.controlBase, project: config.project, container, identity
+        base: config.controlBase, repoRoot: config.repoRoot, project: config.project, container, identity
     }).root));
     const workspaceViewRoots = containers.flatMap((container) => identities.map((identity) => sandboxWorkspaceViewPaths({
         base: config.workspaceViewBase, project: config.project, container, identity
@@ -711,7 +711,9 @@ async function removeUncheckedSandbox(config, target, options) {
     }
     for (const root of controlRoots) {
         fs.rmSync(root, { recursive: true, force: true });
-        removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
+        if (target.workspace.mode !== 'task-bound') {
+            removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
+        }
     }
     for (const root of workspaceViewRoots) {
         fs.rmSync(root, { recursive: true, force: true });
@@ -735,13 +737,15 @@ async function removeUncheckedSandbox(config, target, options) {
         assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
         runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
     }
-    if (target.workspace.mode === 'task-bound') {
-        releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
-    }
+    releaseTaskBoundSandboxIdentity(config.repoRoot, target.workspace);
     if (!options.quiet)
         p.outro('Sandbox removed');
     return null;
 }
+function releaseTaskBoundSandboxIdentity(repoRoot, workspace) {
+    if (workspace.mode === 'task-bound')
+        releaseStaleShortIdRegistry(repoRoot, workspace.taskId);
+}
 async function rmOneCore(config, tools, branch, options = {}) {
     const target = options.target ?? resolveRmTarget(config, tools, options.cleanupTarget ?? resolveSandboxCleanupTarget(branch, config.repoRoot));
     return removeUncheckedSandbox(config, target, options);

package/dist/lib/sandbox/workspace-view.js

@@ -2,6 +2,7 @@ import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolveTaskWorkspace } from './task-resolver.js';
+import { resolveTaskRuntimeRoot } from '../task/runtime-paths.js';
 import { createSandboxControlIdentitySentinel, writeSandboxControlIdentitySentinel } from './control/identity-sentinel.js';
 export const SANDBOX_WORKSPACE_VIEW_STATES = Object.freeze([
     'active',
@@ -25,11 +26,12 @@ export function sandboxWorkspaceViewPaths(params) {
     return { root };
 }
 export function sandboxControlPaths(params) {
-    const identityKey = params.identity.mode === 'task-bound'
-        ? `task-bound:${params.identity.taskId}`
-        : 'branch-only';
-    const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
-    const root = path.resolve(params.base, params.project, params.container, digest);
+    const root = params.identity.mode === 'task-bound'
+        ? path.join(resolveTaskRuntimeRoot(params.identity.taskId, { repoRoot: params.repoRoot }), 'sandbox-control')
+        : (() => {
+            const digest = createHash('sha256').update('branch-only').digest('hex').slice(0, 16);
+            return path.resolve(params.base, params.project, params.container, digest);
+        })();
     return {
         root,
         channelDir: path.join(root, 'channel'),
@@ -155,7 +157,7 @@ export function materializeSandboxWorkspaceView(params) {
 }
 export function materializeSandboxControl(params) {
     const { root, channelDir, statusDir, processingDir, runtimeDir, manifestPath } = sandboxControlPaths(params);
-    assertSafeDirectory(root, path.resolve(params.base));
+    assertSafeDirectory(root, params.identity.mode === 'task-bound' ? path.dirname(root) : path.resolve(params.base));
     if (fs.existsSync(root)) {
         if (!params.replacementLease || path.resolve(params.replacementLease.root) !== root) {
             throw new Error('SANDBOX_CONTROL_REPLACEMENT_REQUIRED');
@@ -168,18 +170,7 @@ export function materializeSandboxControl(params) {
     fs.mkdirSync(consumedDir, { recursive: true, mode: 0o700 });
     for (const directory of [statusDir, processingDir, runtimeDir]) {
         assertSafeDirectory(directory, root);
-        if (directory === runtimeDir)
-            fs.rmSync(directory, { recursive: true, force: true });
-        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    }
-    for (const directory of [
-        path.join(runtimeDir, 'clients'),
-        path.join(runtimeDir, 'clients', 'codex', 'capabilities'),
-        path.join(runtimeDir, 'clients', 'codex', 'lifecycle')
-    ]) {
-        assertSafeDirectory(directory, runtimeDir);
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-        fs.chmodSync(directory, 0o700);
     }
     for (const queue of ['requests', 'responses']) {
         const directory = path.join(channelDir, queue);