@fitlab-ai/agent-infra 0.11.11 → 0.11.13

package/lib/sandbox/control/server.ts

@@ -72,11 +72,10 @@ import {
 import type { BrokerOwner } from './lifecycle.ts';
 import { nextSandboxControlBackoff } from './timing.ts';
 import { readTaskFinalizationReceipt } from '../../task/finalization.ts';
-import { readCodexControllerRegistration } from './controller-registration.ts';
+import { recoverAgentClientOperation, validateAgentClientOperation } from './agent-operation.ts';
 import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   mergeSandboxTaskView,
-  taskViewAfterFinalization,
   taskViewForManifest,
   type SandboxTaskView
 } from './task-view.ts';
@@ -91,34 +90,6 @@ type ActiveExecution = {
   settled: boolean;
 };
 
-async function taskViewForFinalizationResult(
-  manifest: SandboxControlManifest,
-  request: SandboxControlRequest,
-  result: SandboxControlExecutionResult | null
-): Promise<SandboxTaskView | null> {
-  if (request.family !== 'task-finalization' || result?.exitCode !== 0 || !manifest.taskId) return null;
-  let receipt: unknown = null;
-  for (let attempt = 0; attempt < 100 && !receipt; attempt += 1) {
-    try {
-      receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
-    } catch {
-      // A missing or temporarily moving task directory is retried before publishing completion.
-    }
-    if (!receipt) await new Promise((resolve) => setTimeout(resolve, 10));
-  }
-  const finalized = taskViewAfterFinalization({
-    taskId: manifest.taskId,
-    generation: manifest.generation,
-    requestId: request.id,
-    receipt
-  });
-  if (finalized.state === 'unknown') return finalized;
-  const canonical = taskViewForManifest({ ...manifest, receipt });
-  return canonical.state === 'current' && canonical.observedSource === 'completed'
-    ? canonical
-    : finalized;
-}
-
 function appendBrokerAudit(
   manifest: SandboxControlManifest,
   event: string,
@@ -128,9 +99,8 @@ function appendBrokerAudit(
 }
 
 function operationKey(request: SandboxControlRequest): string | null {
-  if (request.family === 'task-finalization') return request.operation;
   if (request.family === 'task-create') return 'create';
-  if (request.family === 'codex-controller') return request.command;
+  if (request.family === 'agent-client') return request.operation;
   if (request.family !== 'task-lifecycle') return null;
   try {
     const operation = parseTaskControlOperation(request.family, request.args);
@@ -318,46 +288,6 @@ function taskCreateDomainEvidence(
   }
 }
 
-function controllerDomainEvidence(
-  manifest: SandboxControlManifest,
-  manifestPath: string,
-  request: SandboxControlRequest,
-  output: Record<string, unknown> | null
-): Readonly<Record<string, unknown>> {
-  if (!output || output.error !== null || typeof output.status !== 'string') return { consistent: false };
-  try {
-    const registration = readCodexControllerRegistration(manifestPath);
-    if (request.family !== 'codex-controller') return { consistent: false };
-    if (request.command === 'open') {
-      const lease = output.lease && typeof output.lease === 'object' && !Array.isArray(output.lease)
-        ? output.lease as Record<string, unknown> : null;
-      return {
-        consistent: output.status === 'opened' && output.changed === true
-          && lease?.taskId === registration.taskId
-          && lease.controlGeneration === registration.controlGeneration
-          && lease.controllerInstanceDigest === registration.controllerInstanceDigest
-          && registration.taskId === manifest.taskId
-          && registration.controlGeneration === manifest.generation
-      };
-    }
-    if (request.command === 'verify') {
-      const binding = output.binding && typeof output.binding === 'object' && !Array.isArray(output.binding)
-        ? output.binding as Record<string, unknown> : null;
-      return {
-        consistent: output.status === 'verified' && output.changed === false
-          && binding?.taskId === registration.taskId
-          && binding.controlGeneration === registration.controlGeneration
-          && binding.controllerInstanceDigest === registration.controllerInstanceDigest
-      };
-    }
-    return { consistent: false };
-  } catch (error) {
-    return { consistent: request.family === 'codex-controller' && request.command === 'close'
-      && (error as { code?: string }).code === 'CODEX_SANDBOX_CONTROLLER_REGISTRATION_MISSING'
-      && output?.status === 'closed' && typeof output.changed === 'boolean' };
-  }
-}
-
 async function readRecoveryDomain(
   manifest: SandboxControlManifest,
   manifestPath: string,
@@ -367,11 +297,9 @@ async function readRecoveryDomain(
   payloadOutput: string | null
 ): Promise<RecoveryDomainEvidence> {
   if (!operation) return { domain: null };
-  const taskRef = request.family === 'task-finalization'
-    ? manifest.taskId
-    : 'args' in request ? request.args[0] ?? null : manifest.taskId;
+  const taskRef = 'args' in request ? request.args[0] ?? null : manifest.taskId;
   const output = parseControlOutput(payloadOutput);
-  if (!taskRef && operation.family !== 'task-create' && operation.family !== 'codex-controller') {
+  if (!taskRef && operation.family !== 'task-create' && operation.family !== 'agent-client') {
     return { domain: null };
   }
 
@@ -399,8 +327,13 @@ async function readRecoveryDomain(
   if (operation.family === 'task-create') {
     return { domain: taskCreateDomainEvidence(manifest, output) };
   }
-  if (operation.family === 'codex-controller') {
-    return { domain: controllerDomainEvidence(manifest, manifestPath, request, output) };
+  if (operation.family === 'agent-client' && request.family === 'agent-client') {
+    return { domain: recoverAgentClientOperation({
+      request,
+      manifest,
+      manifestPath,
+      stdout: payloadOutput
+    }) };
   }
   return { domain: null };
 }
@@ -638,6 +571,7 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
         request = validateSandboxControlRequest(rawRequest, manifest, {
           now: typeof rawRequest.issuedAt === 'number' ? rawRequest.issuedAt : undefined
         });
+        if (request.family === 'agent-client') validateAgentClientOperation(request, manifest);
       } catch {
         // Missing or malformed request evidence remains fail-closed below.
       }
@@ -876,6 +810,7 @@ export async function serveSandboxControl(
   let bindingBackoffMs: number = timing.parkedBindingInitialMs;
   try {
     if (!brokerOwns()) return;
+    if (isSandboxControlRootQuiescing(root)) return;
     if (taskView.state === 'current' && taskView.observedSource === 'completed') {
       // Recheck durable re-entry evidence before publishing a trusted startup view.
       const unverified = { ...taskView, state: 'unknown' as const,
@@ -966,11 +901,6 @@ export async function serveSandboxControl(
         settledExecution = active;
         active = null;
       }
-      const finalizationView = settledExecution
-        ? await taskViewForFinalizationResult(manifest, settledExecution.request, settledExecution.result)
-        : null;
-      if (finalizationView) taskView = finalizationView;
-
       let reasonCode: string | null = null;
       try {
         if (!brokerOwns()) break;
@@ -1039,7 +969,9 @@ export async function serveSandboxControl(
       }
 
       let retiring = false;
-      for (const name of fs.readdirSync(requestsDir).sort()) {
+      const quiescing = isSandboxControlRootQuiescing(root);
+      if (quiescing && !active) break;
+      if (!quiescing) for (const name of fs.readdirSync(requestsDir).sort()) {
         if (!/^[a-f0-9-]{16,64}\.json$/.test(name)) continue;
         const id = name.slice(0, -5);
         const source = path.join(requestsDir, name);
@@ -1047,6 +979,10 @@ export async function serveSandboxControl(
         let validatedRequest: SandboxControlRequest | null = null;
         let prepared: PreparedSandboxControlExecution | null = null;
         try {
+          if (isSandboxControlRootQuiescing(root)) {
+            retiring = true;
+            break;
+          }
           if (!brokerOwns()) {
             retiring = true;
             break;
@@ -1070,6 +1006,7 @@ export async function serveSandboxControl(
           if (reasonCode) throw new Error(reasonCode);
           if (active) throw new Error('SANDBOX_CONTROL_BUSY');
           const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
+          if (request.family === 'agent-client') validateAgentClientOperation(request, manifest);
           validatedRequest = request;
           criticalRequestPhase(manifest, request, 'validated', 'in-progress');
           appendBrokerAudit(manifest, 'request-validated', {
@@ -1162,12 +1099,6 @@ export async function serveSandboxControl(
             retiring = true;
             continue;
           }
-          if (!brokerOwns()) {
-            prepared.terminate(false);
-            active = null;
-            retiring = true;
-            continue;
-          }
           criticalRequestPhase(manifest, request, 'accepted-authorized', 'in-progress');
           writeAcceptedResponse(manifest, {
             version: 2, id, phase: 'accepted', exitCode: null, stdout: '', stderr: '', error: null
@@ -1269,11 +1200,6 @@ export async function serveSandboxControl(
         }
       }
       if (owned && active.result && active.resultEvidenceWritten) {
-        const finalizationView = await taskViewForFinalizationResult(manifest, active.request, active.result);
-        if (finalizationView) {
-          taskView = finalizationView;
-          writeSandboxControlStatus(manifest, broker, 'healthy', null, null, Date.now(), taskView);
-        }
         if (publishExecutionResult(manifest, active.request, active.result, brokerOwns)) {
           if (brokerOwns()) {
             removeAcceptedResponse(manifest, active.request.id);

package/lib/sandbox/control/task-view.ts

@@ -180,25 +180,6 @@ export function projectSandboxTaskView(input: TaskViewProjectionInput): SandboxT
   };
 }
 
-export function taskViewAfterFinalization(params: Readonly<{
-  taskId: string;
-  generation: string;
-  requestId: string;
-  receipt: unknown;
-}>): SandboxTaskView {
-  const receipt = receiptIdentity(params.receipt, params.generation, params.requestId);
-  if (!receipt) {
-    return {
-      state: 'unknown', taskId: params.taskId, observedSource: 'unknown', receipt: null,
-      reasonCode: 'SANDBOX_TASK_VIEW_RECEIPT_INVALID'
-    };
-  }
-  return {
-    state: 'finalized-stale', taskId: params.taskId, observedSource: 'active', receipt,
-    reasonCode: 'SANDBOX_TASK_VIEW_FINALIZED'
-  };
-}
-
 export function mergeSandboxTaskView(
   canonical: SandboxTaskView,
   previous: SandboxTaskView

package/lib/sandbox/mounts.ts

@@ -31,6 +31,7 @@ export function sandboxCoreBindMounts(
     worktreeGitFile?: string;
     runtimeDir?: string;
     taskSources?: string[];
+    completedTaskSource?: string;
     taskId?: string;
   }
 ): SandboxBindMountDeclaration[] {
@@ -71,11 +72,19 @@ export function sandboxCoreBindMounts(
     ...workspaceMounts,
   ];
   if (taskBound) {
+    const taskMountPath = path.posix.join('/workspace/.agents/workspace/active', overrides.taskId!);
     mounts.push({
       hostPaths: taskSources,
-      containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId!),
+      containerPath: taskMountPath,
       readOnly: false
     });
+    if (overrides.completedTaskSource) {
+      mounts.push({
+        hostPaths: [overrides.completedTaskSource],
+        containerPath: path.posix.join('/workspace/.agents/workspace/completed', overrides.taskId!),
+        readOnly: false
+      });
+    }
   }
   mounts.push(
     {

package/lib/sandbox/recovery.ts

@@ -25,6 +25,7 @@ import { sandboxCoreBindMounts } from './mounts.ts';
 import { resolveSandboxGitMetadata } from './git-metadata.ts';
 import {
   assertSandboxTaskSource,
+  sandboxCompletedTaskMountSource,
   sandboxControlPaths,
   sandboxWorkspaceViewPaths
 } from './workspace-view.ts';
@@ -341,6 +342,7 @@ async function ensureSandboxControlBroker(params: {
 }): Promise<void> {
   const control = sandboxControlPaths({
     base: params.config.controlBase ?? path.join(params.config.home, '.agent-infra', 'sandbox-control'),
+    repoRoot: params.config.repoRoot,
     project: params.config.project,
     container: params.container,
     identity: params.workspace
@@ -672,31 +674,43 @@ export function startCompletedSandboxContainer(params: {
   const activeRoot = path.join(params.config.repoRoot, '.agents', 'workspace', 'active');
   const historicalSource = path.join(activeRoot, params.taskId);
   fs.mkdirSync(activeRoot, { recursive: true });
+  let replacedEmptyRoot = false;
+  let emptyRootMode = 0o700;
   try {
-    fs.lstatSync(historicalSource);
-    throw new Error(
-      `SANDBOX_COMPLETED_SOURCE_CONFLICT: historical task source already exists at ${historicalSource}`
-    );
+    const existing = fs.lstatSync(historicalSource);
+    if (existing.isSymbolicLink() || !existing.isDirectory() || fs.readdirSync(historicalSource).length > 0) {
+      throw new Error(
+        `SANDBOX_COMPLETED_SOURCE_CONFLICT: historical task source already exists at ${historicalSource}`
+      );
+    }
+    emptyRootMode = existing.mode & 0o777;
+    fs.rmdirSync(historicalSource);
+    replacedEmptyRoot = true;
   } catch (error) {
     if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) throw error;
   }
 
-  fs.symlinkSync(
-    completedSource,
-    historicalSource,
-    process.platform === 'win32' ? 'junction' : 'dir'
-  );
+  let temporaryLink = false;
   try {
+    fs.symlinkSync(
+      completedSource,
+      historicalSource,
+      process.platform === 'win32' ? 'junction' : 'dir'
+    );
+    temporaryLink = true;
     params.start(params.engine, params.container);
   } finally {
-    const temporarySource = fs.lstatSync(historicalSource);
-    const resolvedSource = fs.realpathSync.native(historicalSource);
-    if (!temporarySource.isSymbolicLink() || resolvedSource !== completedSource) {
-      throw new Error(
-        `SANDBOX_COMPLETED_SOURCE_CHANGED: refusing to remove unexpected path at ${historicalSource}`
-      );
+    if (temporaryLink) {
+      const temporarySource = fs.lstatSync(historicalSource);
+      const resolvedSource = fs.realpathSync.native(historicalSource);
+      if (!temporarySource.isSymbolicLink() || resolvedSource !== completedSource) {
+        throw new Error(
+          `SANDBOX_COMPLETED_SOURCE_CHANGED: refusing to remove unexpected path at ${historicalSource}`
+        );
+      }
+      fs.unlinkSync(historicalSource);
     }
-    fs.unlinkSync(historicalSource);
+    if (replacedEmptyRoot) fs.mkdirSync(historicalSource, { mode: emptyRootMode });
   }
 }
 
@@ -739,6 +753,7 @@ function expectedMounts(params: {
   });
   const control = sandboxControlPaths({
     base: config.controlBase ?? path.join(config.home, '.agent-infra', 'sandbox-control'),
+    repoRoot: config.repoRoot,
     project: config.project,
     container: params.container,
     identity: params.workspace
@@ -747,6 +762,7 @@ function expectedMounts(params: {
     ? recoveryTaskSources(config.repoRoot, params.workspace.taskId)
     : null;
   const taskId = params.workspace.mode === 'task-bound' ? params.workspace.taskId : null;
+  const completedTaskSource = taskId ? sandboxCompletedTaskMountSource(config.repoRoot, taskId) : null;
   const worktrees = worktreeDirCandidates(config, branch).filter((candidate) =>
     fs.existsSync(path.join(candidate, '.git'))
   );
@@ -768,6 +784,7 @@ function expectedMounts(params: {
       : {
         runtimeDir: control.runtimeDir,
         taskSources: taskSources!.accessiblePaths,
+        completedTaskSource: completedTaskSource!,
         taskId: taskId!
       })
   }).map((mount) => ({
@@ -778,6 +795,10 @@ function expectedMounts(params: {
       && mount.containerPath === `/workspace/.agents/workspace/active/${taskId}`
       ? { sourceAccessiblePaths: taskSources!.accessiblePaths }
       : {}),
+    ...(completedTaskSource !== null && taskId !== null
+      && mount.containerPath === `/workspace/.agents/workspace/completed/${taskId}`
+      ? { sourceAccessiblePaths: [completedTaskSource] }
+      : {}),
     expectedRW: !mount.readOnly
   }));
   const live = tools.flatMap((tool) =>
@@ -1275,7 +1296,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
       let completedReentry: { manifest: SandboxControlManifest; evidence: Awaited<ReturnType<typeof prepareCompletedReentry>> } | null = null;
       if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
         const control = sandboxControlPaths({
-          base: params.config.controlBase, project: params.config.project,
+          base: params.config.controlBase, repoRoot: params.config.repoRoot, project: params.config.project,
           container: params.row.name, identity: params.workspace
         });
         const manifest = readSandboxControlManifest(control.manifestPath);

package/lib/sandbox/removal.ts

@@ -829,7 +829,7 @@ function resolveRmTarget(
     ? matchedContainers
     : [...new Set([...containerNameCandidates(config, effectiveBranch), ...matchedContainers])];
   const controlRoots = containers.flatMap((container) => identities.map((identity) => sandboxControlPaths({
-    base: config.controlBase, project: config.project, container, identity
+    base: config.controlBase, repoRoot: config.repoRoot, project: config.project, container, identity
   }).root));
   const workspaceViewRoots = containers.flatMap((container) => identities.map((identity) => sandboxWorkspaceViewPaths({
     base: config.workspaceViewBase, project: config.project, container, identity
@@ -1007,7 +1007,9 @@ async function removeUncheckedSandbox(
   }
   for (const root of controlRoots) {
     fs.rmSync(root, { recursive: true, force: true });
-    removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
+    if (target.workspace.mode !== 'task-bound') {
+      removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
+    }
   }
   for (const root of workspaceViewRoots) {
     fs.rmSync(root, { recursive: true, force: true });
@@ -1027,14 +1029,19 @@ async function removeUncheckedSandbox(
     assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
     runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
   }
-  if (target.workspace.mode === 'task-bound') {
-    releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
-  }
+  releaseTaskBoundSandboxIdentity(config.repoRoot, target.workspace);
 
   if (!options.quiet) p.outro('Sandbox removed');
   return null;
 }
 
+function releaseTaskBoundSandboxIdentity(
+  repoRoot: string,
+  workspace: SandboxWorkspaceKey
+): void {
+  if (workspace.mode === 'task-bound') releaseStaleShortIdRegistry(repoRoot, workspace.taskId);
+}
+
 async function rmOneCore(
   config: SandboxConfig,
   tools: SandboxTool[],
@@ -1066,11 +1073,25 @@ async function rmPurgeCore(
   const confirm = prompt.confirm ?? p.confirm;
   const isCancel = prompt.isCancel ?? p.isCancel;
   p.intro(pc.cyan(`Removing all sandboxes for ${config.project}`));
-
+  const listed = fetchSandboxRows(
+    engine,
+    sandboxLabel(config),
+    sandboxBranchLabel(config),
+    { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) }
+  );
+  const rows = [...listed.running, ...listed.nonRunning];
   const containers = runEngine(engine, 'docker', [
     'ps', '-a', '--filter', `label=${sandboxLabel(config)}`, '--format', '{{.Names}}'
   ]).split('\n').filter(Boolean);
+  const completedTaskIds = [...new Set(rows
+    .filter((row) => row.workspaceMode === 'task-bound' && row.taskId)
+    .map((row) => row.taskId!))];
   for (const name of containers) runSafeEngine(engine, 'docker', ['rm', '-f', name]);
+  if (!sandboxContainersRemoved(engine, containers)) {
+    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${containers.join(', ')}`);
+  }
+
+  let cleanupCompleted = true;
 
   const worktrees = fs.existsSync(config.worktreeBase)
     ? fs.readdirSync(config.worktreeBase).map((entry) => path.join(config.worktreeBase, entry))
@@ -1080,21 +1101,26 @@ async function rmPurgeCore(
     if (!isCancel(selected) && selected) {
       for (const worktree of worktrees) fs.rmSync(worktree, { recursive: true, force: true });
       runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
-    }
+    } else cleanupCompleted = false;
   }
 
   for (const dir of projectToolDirs(config, tools)) fs.rmSync(dir, { recursive: true, force: true });
   if (fs.existsSync(config.shellConfigBase)) {
     const selected = await confirm({ message: `Remove all shell config dirs in ${config.shellConfigBase}?`, initialValue: true });
     if (!isCancel(selected) && selected) fs.rmSync(config.shellConfigBase, { recursive: true, force: true });
+    else cleanupCompleted = false;
   }
   if (fs.existsSync(config.shareBase)) {
     const selected = await confirm({ message: `Remove all share dirs for project (${config.shareBase})?`, initialValue: true });
     if (!isCancel(selected) && selected) fs.rmSync(config.shareBase, { recursive: true, force: true });
+    else cleanupCompleted = false;
   }
   for (const base of [config.workspaceViewBase, config.controlBase]) {
     fs.rmSync(path.join(base, config.project), { recursive: true, force: true });
   }
+  if (cleanupCompleted) {
+    for (const taskId of completedTaskIds) releaseStaleShortIdRegistry(config.repoRoot, taskId);
+  }
   const removeImage = await confirm({ message: `Remove image ${config.imageName}?`, initialValue: false });
   if (!isCancel(removeImage) && removeImage) runSafeEngine(engine, 'docker', ['rmi', config.imageName]);
   p.outro(pc.green('All project sandboxes removed'));

package/lib/sandbox/workspace-identity.ts

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { isRemovedHashShortIdInput } from '../task/short-id.ts';
+import { resolveTaskRef } from '../task/resolve-ref.ts';
 import {
   resolveTaskWorkspace,
   type TaskWorkspaceState
@@ -76,6 +77,14 @@ function taskIdentity(repoRoot: string, taskId: string, registry: Record<string,
   return { mode: 'task-bound', taskId, shortId: shortIds[0]! };
 }
 
+function cleanupTaskId(requestedRef: string, repoRoot: string): string | null {
+  if (TASK_ID_RE.test(requestedRef)) return requestedRef;
+  if (!SHORT_ID_RE.test(requestedRef)) return null;
+  const task = resolveTaskRef(requestedRef, { repoRoot });
+  if (!task.ok) throw new Error(task.message);
+  return task.taskId;
+}
+
 export function resolveSandboxTarget(requestedRef: string, repoRoot: string): SandboxTarget {
   if (isRemovedHashShortIdInput(requestedRef)) {
     throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
@@ -130,23 +139,24 @@ export function resolveSandboxCleanupTarget(
     throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
   }
 
-  if (TASK_ID_RE.test(requestedRef)) {
+  const taskId = cleanupTaskId(requestedRef, repoRoot);
+  if (taskId) {
     let task: ReturnType<typeof resolveTaskWorkspace>;
     try {
-      task = resolveTaskWorkspace(requestedRef, repoRoot);
+      task = resolveTaskWorkspace(taskId, repoRoot);
     } catch (error) {
-      if (!(error instanceof Error && error.message === `Task not found: ${requestedRef}`)) throw error;
-      const branch = options.resolveMissingTask?.(requestedRef);
+      if (!(error instanceof Error && error.message === `Task not found: ${taskId}`)) throw error;
+      const branch = options.resolveMissingTask?.(taskId);
       if (!branch) throw error;
       return {
         requestedRef,
         branch,
-        workspace: { mode: 'task-bound', taskId: requestedRef },
+        workspace: { mode: 'task-bound', taskId },
         taskState: 'unknown'
       };
     }
     if (!options.allowProtected && (task.state === 'blocked' || task.state === 'archive')) {
-      throw new Error(`SANDBOX_CLEANUP_STATE_UNSUPPORTED: task ${requestedRef} is ${task.state}`);
+      throw new Error(`SANDBOX_CLEANUP_STATE_UNSUPPORTED: task ${taskId} is ${task.state}`);
     }
     return {
       requestedRef,

package/lib/sandbox/workspace-view.ts

@@ -4,6 +4,7 @@ import path from 'node:path';
 import type { SandboxWorkspaceIdentity, SandboxWorkspaceKey } from './workspace-identity.ts';
 import { resolveTaskWorkspace } from './task-resolver.ts';
 import type { SandboxControlManifest } from './control/protocol.ts';
+import { resolveTaskRuntimeRoot } from '../task/runtime-paths.ts';
 import {
   createSandboxControlIdentitySentinel,
   writeSandboxControlIdentitySentinel
@@ -63,15 +64,17 @@ export type SandboxControlManifestDraft = Readonly<Omit<SandboxControlManifest,
 
 export function sandboxControlPaths(params: Readonly<{
   base: string;
+  repoRoot?: string;
   project: string;
   container: string;
   identity: SandboxWorkspaceIdentity | SandboxWorkspaceKey;
 }>): Readonly<{ root: string; channelDir: string; statusDir: string; processingDir: string; runtimeDir: string; manifestPath: string }> {
-  const identityKey = params.identity.mode === 'task-bound'
-    ? `task-bound:${params.identity.taskId}`
-    : 'branch-only';
-  const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
-  const root = path.resolve(params.base, params.project, params.container, digest);
+  const root = params.identity.mode === 'task-bound'
+    ? path.join(resolveTaskRuntimeRoot(params.identity.taskId, { repoRoot: params.repoRoot }), 'sandbox-control')
+    : (() => {
+      const digest = createHash('sha256').update('branch-only').digest('hex').slice(0, 16);
+      return path.resolve(params.base, params.project, params.container, digest);
+    })();
   return {
     root,
     channelDir: path.join(root, 'channel'),
@@ -154,13 +157,15 @@ export function assertSandboxTaskSource(repoRoot: string, taskId: string): strin
   return canonical;
 }
 
-export function prepareSandboxWorkspaceMountTargets(worktreeRoot: string): void {
+export function prepareSandboxWorkspaceMountTargets(worktreeRoot: string, taskId?: string): void {
   const resolvedWorktreeRoot = path.resolve(worktreeRoot);
   const canonicalWorktreeRoot = fs.realpathSync.native(resolvedWorktreeRoot);
   const workspaceRoot = path.resolve(resolvedWorktreeRoot, '.agents', 'workspace');
   const statePaths = sandboxWorkspaceViewStatePaths(workspaceRoot);
   const registryTarget = path.join(workspaceRoot, 'active', '.short-ids.json');
-  for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget]) {
+  const completedTaskTarget = taskId ? path.join(workspaceRoot, 'completed', taskId) : null;
+  if (taskId && !/^TASK-\d{8}-\d{6}$/.test(taskId)) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget, ...(completedTaskTarget ? [completedTaskTarget] : [])]) {
     assertSafeMountTargetPath(target, resolvedWorktreeRoot, canonicalWorktreeRoot);
   }
   fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 });
@@ -168,10 +173,47 @@ export function prepareSandboxWorkspaceMountTargets(worktreeRoot: string): void
     fs.mkdirSync(hostPath, { recursive: true, mode: 0o700 });
     fs.chmodSync(hostPath, 0o700);
   }
+  if (completedTaskTarget) fs.mkdirSync(completedTaskTarget, { recursive: true, mode: 0o700 });
   fs.chmodSync(workspaceRoot, 0o700);
   fs.closeSync(fs.openSync(registryTarget, 'a', 0o600));
 }
 
+export function prepareSandboxCompletedTaskMountSource(repoRoot: string, taskId: string): string {
+  if (!/^TASK-\d{8}-\d{6}$/.test(taskId)) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  const workspaceRoot = path.resolve(repoRoot, '.agents', 'workspace');
+  fs.mkdirSync(path.join(workspaceRoot, 'completed'), { recursive: true, mode: 0o700 });
+  const completedRoot = path.join(workspaceRoot, 'completed');
+  const completedStat = fs.lstatSync(completedRoot);
+  if (!completedStat.isDirectory() || completedStat.isSymbolicLink()) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  const target = path.join(completedRoot, taskId);
+  try {
+    const stat = fs.lstatSync(target);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || fs.readdirSync(target).length > 0) {
+      throw new Error(`SANDBOX_COMPLETED_MOUNT_CONFLICT: ${target}`);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
+    fs.mkdirSync(target, { mode: 0o700 });
+  }
+  return sandboxCompletedTaskMountSource(repoRoot, taskId);
+}
+
+export function sandboxCompletedTaskMountSource(repoRoot: string, taskId: string): string {
+  if (!/^TASK-\d{8}-\d{6}$/.test(taskId)) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  const source = path.resolve(repoRoot, '.agents', 'workspace', 'completed', taskId);
+  const stat = fs.lstatSync(source);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  const canonicalWorkspace = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace'));
+  const canonicalSource = fs.realpathSync.native(source);
+  const canonicalRepoRoot = fs.realpathSync.native(repoRoot);
+  const workspaceRelative = path.relative(canonicalRepoRoot, canonicalWorkspace);
+  const relative = path.relative(canonicalWorkspace, canonicalSource);
+  if (workspaceRelative.startsWith('..') || path.isAbsolute(workspaceRelative)
+    || path.dirname(canonicalSource) !== fs.realpathSync.native(path.dirname(source))
+    || relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+  return canonicalSource;
+}
+
 export function materializeSandboxWorkspaceView(params: Readonly<{
   base: string;
   project: string;
@@ -221,7 +263,7 @@ export function materializeSandboxControl(params: Readonly<{
   }>;
 }>): SandboxControlSetup {
   const { root, channelDir, statusDir, processingDir, runtimeDir, manifestPath } = sandboxControlPaths(params);
-  assertSafeDirectory(root, path.resolve(params.base));
+  assertSafeDirectory(root, params.identity.mode === 'task-bound' ? path.dirname(root) : path.resolve(params.base));
   if (fs.existsSync(root)) {
     if (!params.replacementLease || path.resolve(params.replacementLease.root) !== root) {
       throw new Error('SANDBOX_CONTROL_REPLACEMENT_REQUIRED');
@@ -234,17 +276,7 @@ export function materializeSandboxControl(params: Readonly<{
   fs.mkdirSync(consumedDir, { recursive: true, mode: 0o700 });
   for (const directory of [statusDir, processingDir, runtimeDir]) {
     assertSafeDirectory(directory, root);
-    if (directory === runtimeDir) fs.rmSync(directory, { recursive: true, force: true });
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-  }
-  for (const directory of [
-    path.join(runtimeDir, 'clients'),
-    path.join(runtimeDir, 'clients', 'codex', 'capabilities'),
-    path.join(runtimeDir, 'clients', 'codex', 'lifecycle')
-  ]) {
-    assertSafeDirectory(directory, runtimeDir);
     fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    fs.chmodSync(directory, 0o700);
   }
   for (const queue of ['requests', 'responses']) {
     const directory = path.join(channelDir, queue);