@fitlab-ai/agent-infra 0.11.11 → 0.11.13

package/dist/lib/agent-clients/adapters/codex-lifecycle/controller-operation.js

@@ -0,0 +1,131 @@
+import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, readCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
+import { computeLifecycleBuildIdentity } from './build-identity.js';
+function validProcess(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const process = value;
+    return Object.keys(process).sort().join(',') === 'pid,startTime'
+        && Number.isSafeInteger(process.pid) && process.pid > 0
+        && Number.isSafeInteger(process.startTime) && process.startTime >= 0;
+}
+function validProof(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const proof = value;
+    return Object.keys(proof).sort().join(',') === 'controllerProcess,leaseId,leaseSecret,version'
+        && proof.version === 1
+        && typeof proof.leaseId === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseId)
+        && typeof proof.leaseSecret === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseSecret)
+        && validProcess(proof.controllerProcess);
+}
+function validate(params) {
+    const { operation, payload, manifest } = params;
+    const expectedKeys = operation === 'controller.open' ? ['controllerProcess'] : ['proof'];
+    if (!['controller.open', 'controller.close', 'controller.verify'].includes(operation)
+        || Object.keys(payload).sort().join(',') !== expectedKeys.sort().join(',')
+        || (operation === 'controller.open'
+            ? !validProcess(payload.controllerProcess)
+            : !validProof(payload.proof))) {
+        throw new Error('SANDBOX_CONTROL_REQUEST_INVALID: controller operation payload is invalid');
+    }
+    if (manifest.mode !== 'task-bound' || !manifest.taskId) {
+        throw new Error('SANDBOX_CONTROL_BRANCH_ONLY: controller operations require a task-bound sandbox');
+    }
+}
+async function execute(params) {
+    const { operation, payload, manifest, manifestPath } = params;
+    try {
+        const result = operation === 'controller.open'
+            ? openCodexControllerRegistration({
+                manifest,
+                manifestPath,
+                controllerProcess: payload.controllerProcess,
+                buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot)
+            })
+            : operation === 'controller.close'
+                ? closeCodexControllerRegistration({
+                    manifest,
+                    manifestPath,
+                    proof: payload.proof
+                })
+                : (() => {
+                    const binding = resolveCodexControllerBinding({
+                        manifest,
+                        manifestPath,
+                        proof: payload.proof,
+                        buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot)
+                    });
+                    return {
+                        version: 1,
+                        status: 'verified',
+                        changed: false,
+                        lease: null,
+                        binding: {
+                            taskId: manifest.taskId,
+                            controlGeneration: binding.controlGeneration,
+                            controllerInstanceDigest: binding.instanceDigest
+                        },
+                        error: null
+                    };
+                })();
+        return { exitCode: 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = error instanceof CodexControllerRegistrationError
+            ? error.code
+            : /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+        return {
+            exitCode: 1,
+            stdout: `${JSON.stringify({
+                version: 1,
+                status: 'failed',
+                changed: false,
+                lease: null,
+                error: { code, message, retryable: false }
+            })}\n`,
+            stderr: ''
+        };
+    }
+}
+function recover(params) {
+    if (params.stdout === null)
+        return { consistent: false };
+    let output;
+    try {
+        const parsed = JSON.parse(params.stdout);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+            return { consistent: false };
+        output = parsed;
+    }
+    catch {
+        return { consistent: false };
+    }
+    if (output.error !== null || typeof output.status !== 'string')
+        return { consistent: false };
+    try {
+        const registration = readCodexControllerRegistration(params.manifestPath);
+        if (params.operation === 'controller.open') {
+            const lease = output.lease;
+            return { consistent: output.status === 'opened' && output.changed === true
+                    && lease?.controlGeneration === registration.controlGeneration
+                    && lease?.controllerInstanceDigest === registration.controllerInstanceDigest
+                    && registration.controlGeneration === params.manifest.generation };
+        }
+        if (params.operation === 'controller.verify') {
+            const binding = output.binding;
+            return { consistent: output.status === 'verified' && output.changed === false
+                    && binding?.controlGeneration === registration.controlGeneration
+                    && binding?.controllerInstanceDigest === registration.controllerInstanceDigest };
+        }
+        return { consistent: false };
+    }
+    catch (error) {
+        return { consistent: params.operation === 'controller.close'
+                && error.code === 'CODEX_SANDBOX_CONTROLLER_REGISTRATION_MISSING'
+                && output.status === 'closed' && typeof output.changed === 'boolean' };
+    }
+}
+const codexControllerOperation = Object.freeze({ validate, execute, recover });
+export { codexControllerOperation };
+//# sourceMappingURL=controller-operation.js.map

package/dist/lib/{sandbox/control → agent-clients/adapters/codex-lifecycle}/controller-registration.js

@@ -1,8 +1,8 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { parseLinuxProcessStat } from '../../server/process-state.js';
-import { commandForEngine, runProbe } from '../shell.js';
+import { parseLinuxProcessStat } from '../../../server/process-state.js';
+import { commandForEngine, runProbe } from '../../../sandbox/shell.js';
 const CONTROLLER_TTL_MS = 4 * 60 * 60 * 1_000;
 const HEX_256 = /^[a-f0-9]{64}$/u;
 const REGISTRATION_KEYS = [

package/dist/lib/agent-clients/adapters/codex-lifecycle/evidence.js

@@ -1,3 +1,50 @@
+function isCodexLifecycleActivationEvidence(value, parentId) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const state = value;
+    const evidence = state.activationEvidence;
+    if (!evidence || typeof evidence !== 'object' || Array.isArray(evidence))
+        return false;
+    const activation = evidence;
+    return activation.kind === 'codex-lifecycle-v2'
+        && typeof activation.hookDefinitionHash === 'string'
+        && activation.hookDefinitionHash.trim() !== ''
+        && Number.isSafeInteger(activation.startRevision)
+        && activation.startRevision >= 1
+        && activation.capabilitySessionId === parentId;
+}
+function isCodexDelegationReceiptEvidence(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const receipt = value;
+    if (receipt.client !== 'codex' || typeof receipt.id !== 'string')
+        return false;
+    const status = receipt.status;
+    if (!['activated', 'stage-completed', 'sealed', 'consumed', 'aborted'].includes(status))
+        return true;
+    const adapterEvidence = receipt.adapterEvidence;
+    if (!adapterEvidence || typeof adapterEvidence !== 'object' || Array.isArray(adapterEvidence))
+        return false;
+    const codex = adapterEvidence.codex;
+    if (!codex || typeof codex !== 'object' || Array.isArray(codex))
+        return false;
+    const state = codex;
+    if (!isCodexLifecycleActivationEvidence(state, String(receipt.parentId ?? '')))
+        return false;
+    if (!['sealed', 'consumed', 'aborted'].includes(status))
+        return true;
+    const records = state.records;
+    if (!records || typeof records !== 'object' || Array.isArray(records))
+        return false;
+    return Object.values(records).some((record) => {
+        if (!record || typeof record !== 'object' || Array.isArray(record))
+            return false;
+        const evidence = record;
+        return evidence.consumer === receipt.id
+            && typeof evidence.consumedAt === 'string'
+            && evidence.consumedAt.trim() !== '';
+    });
+}
 function createCodexLifecycleState(cliVersion) {
     if (!cliVersion.trim())
         throw new Error('Codex CLI version is required');
@@ -185,5 +232,5 @@ function expireCodexLifecycleState(state) {
         })
     });
 }
-export { createCodexLifecycleState, expireCodexLifecycleState, reduceCodexLifecycleEvent };
+export { createCodexLifecycleState, expireCodexLifecycleState, isCodexLifecycleActivationEvidence, isCodexDelegationReceiptEvidence, reduceCodexLifecycleEvent };
 //# sourceMappingURL=evidence.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/recovery.js

@@ -1,12 +1,11 @@
 import fs from 'node:fs';
-import { createCodexLifecycleStore } from './store.js';
+import { createCodexLifecycleStore, readCodexLifecycleActivationEvidence } from './store.js';
 import { managedDelegationRole } from '../../../task/delegation-receipts.js';
 import { normalizeAgentToken } from '../../tokens.js';
 import { locateActivityLog, pairEntries, appendActivityEntry } from '../../../task/activity-log.js';
 import { captureTaskWriteMetadata, writeTask } from '../../../task/write.js';
 import { parseTypedTaskFrontmatter } from '../../../task/frontmatter.js';
 import { resolveTaskRef } from '../../../task/resolve-ref.js';
-import { resolveAgentRuntimeStoreRoot } from '../../../runtime/agent-runtime.js';
 import { recoverActivatedOrchestrationDelegationUnderLock, readRun } from '../../../task/orchestration.js';
 const ACTIONS = {
     analysis: 'Analyze Task',
@@ -47,9 +46,10 @@ function rowForReceipt(rows, receipt) {
     const pattern = actionPattern(receipt);
     return pattern ? rows.filter((row) => pattern.test(row.step)) : [];
 }
-function readLifecycleStore(options, repoRoot) {
+function readLifecycleStore(options, repoRoot, taskId) {
     return options.lifecycleStore ?? createCodexLifecycleStore({
-        root: resolveAgentRuntimeStoreRoot({ repoRoot, store: 'lifecycle' }),
+        repoRoot,
+        taskId,
         cliVersion: 'recovery',
         now: options.now
     });
@@ -66,37 +66,10 @@ function readStoredEvidence(store, childId) {
     }
 }
 function validateStopRecord(record, receipt) {
-    const start = record.state.startEvidence;
-    const stop = record.state.stopEvidence;
-    const provenance = receipt.lifecycleProvenance;
-    const host = receipt.hostEvidence;
-    if (receipt.client !== 'codex'
-        || !provenance
-        || host?.kind !== 'codex-lifecycle-v2'
-        || !start
-        || !stop
-        || record.state.status !== 'stop-ready'
-        || stop.terminalStatus !== 'completed'
-        || stop.hookStopObserved !== true
-        || start.childThreadId !== receipt.childId
-        || start.parentThreadId !== receipt.parentId
-        || managedDelegationRole(start.nativeAgent) !== receipt.role
-        || start.hookDefinitionHash !== provenance.hookDefinitionHash
-        || host.hookDefinitionHash !== provenance.hookDefinitionHash
-        || host.capabilitySessionId !== provenance.capabilitySessionId
-        || host.capabilityTurnId !== provenance.capabilityTurnId
-        || host.capabilityToolUseId !== provenance.capabilityToolUseId
-        || host.spawnToolUseId !== start.spawnToolUseId
-        || !host.spawnObservedAt
-        || host.spawnObservedAt !== record.spawnObservedAt
-        || host.controllerInstanceDigest !== provenance.controllerInstanceDigest
-        || host.controlGeneration !== provenance.controlGeneration
-        || typeof host.controllerInstanceDigest !== 'string'
-        || typeof host.controlGeneration !== 'string'
-        || host.startRevision < 1
-        || record.revision <= host.startRevision
-        || record.state.child?.childThreadId !== receipt.childId
-        || record.state.stop?.childThreadId !== receipt.childId) {
+    if (!stopRecordMatchesReceipt(record, receipt)) {
+        return { ok: false, code: 'RECOVERY_TASK_BINDING_MISMATCH', message: 'lifecycle evidence belongs to a different task receipt' };
+    }
+    if (!stopEvidenceMatchesReceipt(record, receipt)) {
         return { ok: false, code: 'RECOVERY_STOP_EVIDENCE_INVALID', message: 'Codex stop evidence does not match the activated receipt' };
     }
     if (record.consumer !== null && record.consumer !== receipt.id) {
@@ -104,6 +77,77 @@ function validateStopRecord(record, receipt) {
     }
     return { ok: true };
 }
+function stopRecordMatchesReceipt(record, receipt) {
+    return record.taskBinding?.runId === receipt.runId
+        && record.taskBinding.receiptId === receipt.id;
+}
+function stopEvidenceMatchesReceipt(record, receipt) {
+    const start = record.state.startEvidence;
+    const stop = record.state.stopEvidence;
+    const host = readCodexLifecycleActivationEvidence(receipt);
+    if (!stopRecordHasRequiredEvidence(record, receipt, start, stop, host))
+        return false;
+    return spawnMatchesReceipt(record, receipt, host, start)
+        && childMatchesReceipt(record, receipt, start, stop)
+        && hostEvidenceMatches(record, receipt, host, start);
+}
+function stopRecordHasRequiredEvidence(record, receipt, start, stop, host) {
+    return receipt.client === 'codex'
+        && host?.kind === 'codex-lifecycle-v2'
+        && Boolean(start && stop && record.state.spawn && record.state.child && record.state.stop)
+        && record.state.status === 'stop-ready'
+        && stop?.terminalStatus === 'completed'
+        && stop.hookStopObserved === true;
+}
+function spawnMatchesReceipt(record, receipt, host, start) {
+    const spawn = record.state.spawn;
+    return Boolean(spawn)
+        && spawn.sessionId === start.parentThreadId
+        && spawn.turnId === host.capabilityTurnId
+        && spawn.toolUseId === host.spawnToolUseId
+        && spawn.nativeAgent === start.nativeAgent
+        && spawn.hookDefinitionHash === host.hookDefinitionHash
+        && spawn.requestedModel === receipt.requestedModel
+        && spawn.requestedReasoningEffort === receipt.requestedReasoningEffort
+        && spawn.taskBinding?.runId === receipt.runId
+        && spawn.taskBinding.receiptId === receipt.id;
+}
+function childMatchesReceipt(record, receipt, start, stop) {
+    const child = record.state.child;
+    const stopState = record.state.stop;
+    return Boolean(child && stopState)
+        && child.sessionId === start.parentThreadId
+        && stopState.turnId === child.turnId
+        && (stopState.source === 'parent-rollout'
+            ? stop.turnId === record.state.terminal?.turnId
+            : child.turnId === stop.turnId)
+        && child.childThreadId === receipt.childId
+        && child.nativeAgent === start.nativeAgent
+        && stopState.childThreadId === receipt.childId
+        && stopState.nativeAgent === start.nativeAgent
+        && start.childThreadId === receipt.childId
+        && start.parentThreadId === receipt.parentId
+        && managedDelegationRole(start.nativeAgent) === receipt.role;
+}
+function hostEvidenceMatches(record, receipt, host, start) {
+    return start.hookDefinitionHash === host.hookDefinitionHash
+        && host.capabilitySessionId === start.parentThreadId
+        && host.capabilityTurnId === record.state.spawn?.turnId
+        && host.spawnToolUseId === start.spawnToolUseId
+        && Boolean(host.spawnObservedAt)
+        && host.spawnObservedAt === record.spawnObservedAt
+        && typeof host.controllerInstanceDigest === 'string'
+        && typeof host.controlGeneration === 'string'
+        && hostRevisionMatches(record, receipt, host);
+}
+function hostRevisionMatches(record, receipt, host) {
+    return typeof host.controllerInstanceDigest === 'string'
+        && typeof host.controlGeneration === 'string'
+        && host.startRevision >= 1
+        && record.revision > host.startRevision
+        && record.state.child?.childThreadId === receipt.childId
+        && record.state.stop?.childThreadId === receipt.childId;
+}
 function abortedCandidates(run, rows) {
     const candidates = run.receipts.flatMap((receipt) => {
         if (receipt.status !== 'aborted' || receipt.activatedAt === null || receipt.client !== 'codex')
@@ -165,15 +209,20 @@ function recoverStartedLifecycleUnderLock(request, options = {}) {
         return result(request, 'no-op', { taskId });
     const rows = openRows(section);
     const pending = run.pendingDelegation;
-    if (!pending) {
-        const candidates = abortedCandidates(run, rows);
-        if (candidates.length === 0)
-            return result(request, 'no-op', { taskId });
-        if (candidates.length > 1) {
-            return failure(request, 'conflict', 'RECOVERY_CANDIDATE_AMBIGUOUS', 'more than one aborted delegation has an open lifecycle row', { taskId });
-        }
-        return appendRecoveryLog(request, taskId, section, candidates[0], resolved.repoRoot, options.writeTask ?? writeTask);
+    if (!pending)
+        return recoverAbortedLifecycle(request, taskId, section, resolved.repoRoot, run, rows, options);
+    return recoverActiveLifecycle(request, taskId, section, resolved.repoRoot, run, rows, pending, options);
+}
+function recoverAbortedLifecycle(request, taskId, section, repoRoot, run, rows, options) {
+    const candidates = abortedCandidates(run, rows);
+    if (candidates.length === 0)
+        return result(request, 'no-op', { taskId });
+    if (candidates.length > 1) {
+        return failure(request, 'conflict', 'RECOVERY_CANDIDATE_AMBIGUOUS', 'more than one aborted delegation has an open lifecycle row', { taskId });
     }
+    return appendRecoveryLog(request, taskId, section, candidates[0], repoRoot, options.writeTask ?? writeTask);
+}
+function recoverActiveLifecycle(request, taskId, section, repoRoot, run, rows, pending, options) {
     if (pending.status !== 'activated')
         return result(request, 'no-op', { taskId });
     if (pending.client !== 'codex' || run.status !== 'running' || run.pause !== null) {
@@ -181,51 +230,64 @@ function recoverStartedLifecycleUnderLock(request, options = {}) {
             taskId, receiptId: pending.id, childId: pending.childId
         });
     }
+    const rowResult = matchingActiveRecoveryRow(request, taskId, rows, pending);
+    if ('result' in rowResult)
+        return rowResult.result;
+    const evidenceResult = consumeRecoveryEvidence(request, taskId, repoRoot, pending, options);
+    if ('result' in evidenceResult)
+        return evidenceResult.result;
+    return finishActiveRecovery(request, taskId, section, repoRoot, pending, rowResult.row, options);
+}
+function matchingActiveRecoveryRow(request, taskId, rows, pending) {
     const matchingRows = rowForReceipt(rows, pending);
     if (matchingRows.length !== 1 || normalizeAgentToken(matchingRows[0].agent) !== 'codex' || matchingRows[0].note !== 'started') {
-        return failure(request, 'conflict', 'RECOVERY_LOG_CONFLICT', 'activated delegation does not have one matching open lifecycle row', {
-            taskId, receiptId: pending.id, childId: pending.childId
-        });
+        return { result: failure(request, 'conflict', 'RECOVERY_LOG_CONFLICT', 'activated delegation does not have one matching open lifecycle row', {
+                taskId, receiptId: pending.id, childId: pending.childId
+            }) };
     }
     if (!pending.childId) {
-        return failure(request, 'conflict', 'RECOVERY_DELEGATION_INVALID', 'activated delegation has no child identity', { taskId, receiptId: pending.id });
+        return { result: failure(request, 'conflict', 'RECOVERY_DELEGATION_INVALID', 'activated delegation has no child identity', { taskId, receiptId: pending.id }) };
     }
-    const store = readLifecycleStore(options, resolved.repoRoot);
+    return { row: matchingRows[0] };
+}
+function consumeRecoveryEvidence(request, taskId, repoRoot, pending, options) {
+    const store = readLifecycleStore(options, repoRoot, taskId);
     const stored = readStoredEvidence(store, pending.childId);
     if ('error' in stored)
-        return failure(request, 'owner-unknown', 'RECOVERY_STORE_UNKNOWN', stored.error.message, { taskId, receiptId: pending.id, childId: pending.childId });
+        return { result: failure(request, 'owner-unknown', 'RECOVERY_STORE_UNKNOWN', stored.error.message, { taskId, receiptId: pending.id, childId: pending.childId }) };
     if ('missing' in stored)
-        return failure(request, 'owner-unknown', 'RECOVERY_STOP_EVIDENCE_MISSING', 'matching Codex lifecycle stop evidence is missing', { taskId, receiptId: pending.id, childId: pending.childId });
+        return { result: failure(request, 'owner-unknown', 'RECOVERY_STOP_EVIDENCE_MISSING', 'matching Codex lifecycle stop evidence is missing', { taskId, receiptId: pending.id, childId: pending.childId }) };
     const evidence = validateStopRecord(stored, pending);
     if (!evidence.ok)
-        return failure(request, evidence.code === 'RECOVERY_CONSUMER_CONFLICT' ? 'conflict' : 'owner-unknown', evidence.code, evidence.message, { taskId, receiptId: pending.id, childId: pending.childId });
+        return { result: failure(request, evidence.code === 'RECOVERY_CONSUMER_CONFLICT' ? 'conflict' : 'owner-unknown', evidence.code, evidence.message, { taskId, receiptId: pending.id, childId: pending.childId }) };
     let consumed = stored;
     if (stored.consumer === null) {
         try {
-            consumed = store.consume(pending.childId, pending.id, pending.hostEvidence?.hookDefinitionHash);
+            consumed = store.consumeWithinTaskLock(pending.childId, pending.id, stored.state.startEvidence?.hookDefinitionHash, {
+                taskId: pending.taskId, runId: pending.runId, receiptId: pending.id
+            });
         }
         catch (error) {
-            return failure(request, 'owner-unknown', 'RECOVERY_EVIDENCE_CONSUME_FAILED', error instanceof Error ? error.message : String(error), { taskId, receiptId: pending.id, childId: pending.childId });
+            return { result: failure(request, 'owner-unknown', 'RECOVERY_EVIDENCE_CONSUME_FAILED', error instanceof Error ? error.message : String(error), { taskId, receiptId: pending.id, childId: pending.childId }) };
         }
     }
-    if (!consumed.consumedAt) {
-        return failure(request, 'owner-unknown', 'RECOVERY_EVIDENCE_INVALID', 'consumed stop evidence has no timestamp', { taskId, receiptId: pending.id, childId: pending.childId });
-    }
+    return consumed.consumedAt
+        ? { consumed }
+        : { result: failure(request, 'owner-unknown', 'RECOVERY_EVIDENCE_INVALID', 'consumed stop evidence has no timestamp', { taskId, receiptId: pending.id, childId: pending.childId }) };
+}
+function finishActiveRecovery(request, taskId, section, repoRoot, pending, row, options) {
     const recovered = recoverActivatedOrchestrationDelegationUnderLock(taskId, {
         receiptId: pending.id,
         stage: pending.stage,
         round: pending.round,
         artifact: pending.artifact,
         startedAgent: request.agent,
-        childId: pending.childId,
-        stopRevision: consumed.revision,
-        consumer: pending.id,
-        consumedAt: consumed.consumedAt
-    }, { ...options.orchestration, repoRoot: resolved.repoRoot, now: options.now });
+        childId: pending.childId
+    }, { ...options.orchestration, repoRoot, now: options.now });
     if (recovered.status === 'failed' || !recovered.run) {
         return failure(request, 'owner-unknown', recovered.error?.code ?? 'RECOVERY_ORCHESTRATION_FAILED', recovered.error?.message ?? 'orchestration recovery failed', { taskId, receiptId: pending.id, childId: pending.childId });
     }
-    return appendRecoveryLog(request, taskId, section, { receipt: recovered.run.receipts.at(-1), row: matchingRows[0] }, resolved.repoRoot, options.writeTask ?? writeTask);
+    return appendRecoveryLog(request, taskId, section, { receipt: recovered.run.receipts.at(-1), row }, repoRoot, options.writeTask ?? writeTask);
 }
 function recoverStartedLifecycleFromAdapter(request, options = {}) {
     return recoverStartedLifecycleUnderLock(request, options);

package/dist/lib/{internal/codex-sandbox-controller.js → agent-clients/adapters/codex-lifecycle/sandbox-controller-cli.js}

@@ -1,5 +1,5 @@
-import { runCodexSandboxController, verifyCodexSandboxControllerContextWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
-import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+import { runCodexSandboxController, verifyCodexSandboxControllerContextWithWarnings } from './sandbox-controller.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from '../../../internal/cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
 function fail(code, message, exitCode = 1) {
     process.stdout.write(`${JSON.stringify({
@@ -103,4 +103,4 @@ async function codexSandboxController(args = []) {
     }
 }
 export { codexSandboxController };
-//# sourceMappingURL=codex-sandbox-controller.js.map
+//# sourceMappingURL=sandbox-controller-cli.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/sandbox-controller.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import semver from 'semver';
 import * as toml from 'smol-toml';
-import { requestCodexControllerClose, requestCodexControllerOpen, requestCodexControllerVerify } from '../../../sandbox/control/client.js';
+import { requestCodexControllerClose, requestCodexControllerOpen, requestCodexControllerVerify } from './controller-client.js';
 import { getProcessStartTime } from '../../../server/process-state.js';
 import { LIFECYCLE_PROTOCOL_VERSION } from './build-identity.js';
 import { contextFromControllerLease, controllerProofFromContext, verifyCodexSandboxControllerContextWithWarnings as verifyContextFileWithWarnings, writeCodexSandboxControllerContext } from './controller-context.js';
@@ -62,8 +62,7 @@ function verifyControllerBinding(context, control, requestControllerVerify) {
         ...control,
         timeoutMs: 30_000
     });
-    if (verified.binding.taskId !== context.taskId
-        || verified.binding.controlGeneration !== context.controlGeneration
+    if (verified.binding.controlGeneration !== context.controlGeneration
         || verified.binding.controllerInstanceDigest !== context.controllerInstanceDigest) {
         throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_BINDING_INVALID');
     }
@@ -82,8 +81,7 @@ function verifyCodexSandboxControllerContextWithWarnings(contextPath, options =
         ...control,
         timeoutMs: 30_000
     });
-    if (verified.binding.taskId !== context.taskId
-        || verified.binding.controlGeneration !== context.controlGeneration
+    if (verified.binding.controlGeneration !== context.controlGeneration
         || verified.binding.controllerInstanceDigest !== context.controllerInstanceDigest) {
         throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_INVALID');
     }