@fitlab-ai/agent-infra 0.11.12 → 0.11.13

package/dist/lib/task/short-id.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { parseTypedTaskFrontmatter } from './frontmatter.js';
 const REGISTRY_NAME = '.short-ids.json';
 const LOCK_NAME = '.short-ids.json.lock';
 function normalizeShortIdInput(input, opts) {
@@ -90,20 +91,33 @@ function resolveShortIdReadOnly(input, repoRoot, opts) {
     const taskId = ids[key];
     if (!taskId) {
         const message = Object.keys(ids).length === 0
-            ? `short id '${key}' not found; active task registry is empty.`
-            : `short id '${key}' not found in active task registry (it may have been cleaned up after archival; check 'task-short-id.js list').`;
+            ? `short id '${key}' not found; task short-id registry is empty.`
+            : `short id '${key}' not found in task short-id registry.`;
         return shortIdFailure('SHORT_ID_NOT_FOUND', message);
     }
-    const taskMdPath = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
-    if (!fs.existsSync(taskMdPath)) {
-        const remainingActiveEntries = Object.values(ids).filter((candidateTaskId) => fs.existsSync(path.join(repoRoot, '.agents', 'workspace', 'active', candidateTaskId, 'task.md')));
-        const message = remainingActiveEntries.length === 0
-            ? `short id '${key}' not found; active task registry is empty.`
-            : `short id '${key}' not found in active task registry (it may have been cleaned up after archival; check 'task-short-id.js list').`;
-        return shortIdFailure('SHORT_ID_STALE', message, taskId);
+    const activeTask = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
+    const completedTask = path.join(repoRoot, '.agents', 'workspace', 'completed', taskId, 'task.md');
+    let isValidCompletedTask = false;
+    try {
+        const task = parseTypedTaskFrontmatter(fs.readFileSync(completedTask, 'utf8'));
+        isValidCompletedTask = task.id === taskId && task.status === 'completed';
+    }
+    catch { /* a mapping is valid only while its task content is present */ }
+    if (!fs.existsSync(activeTask) && !isValidCompletedTask) {
+        return shortIdFailure('SHORT_ID_STALE', `short id '${key}' points to no active or completed task content.`, taskId);
     }
     return { ok: true, taskId };
 }
+function hasRetainedCompletedTask(activeDir, taskId) {
+    try {
+        const taskPath = path.join(path.dirname(activeDir), 'completed', taskId, 'task.md');
+        const task = parseTypedTaskFrontmatter(fs.readFileSync(taskPath, 'utf8'));
+        return task.id === taskId && task.status === 'completed';
+    }
+    catch {
+        return false;
+    }
+}
 function configuredShortIdLength(repoRoot) {
     try {
         const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
@@ -206,7 +220,8 @@ function mutateShortIdRegistryAt(activeDir, width, taskId, requested, onlyReleas
         const original = JSON.stringify(registry.ids);
         if (pruneOrphans) {
             for (const [key, candidate] of Object.entries(registry.ids)) {
-                if (candidate !== taskId && !fs.existsSync(path.join(activeDir, candidate, 'task.md')))
+                if (candidate !== taskId && !fs.existsSync(path.join(activeDir, candidate, 'task.md'))
+                    && !hasRetainedCompletedTask(activeDir, candidate))
                     delete registry.ids[key];
             }
         }
@@ -277,34 +292,29 @@ function executeShortIdCommand(request) {
             if (normalized.kind !== 'shortId') {
                 throw Object.assign(new Error(`invalid short id format '${request.argument}'`), { code: 'SHORT_ID_FORMAT_INVALID' });
             }
-            return withRegistryLock(request.activeDir, () => {
-                const registry = readRegistryStrict(registryPath, request.shortIdLength);
-                let changed = false;
-                for (const [key, taskId] of Object.entries(registry.ids)) {
-                    if (!fs.existsSync(path.join(request.activeDir, taskId, 'task.md'))) {
-                        delete registry.ids[key];
-                        changed = true;
-                    }
-                }
-                if (changed)
-                    writeRegistry(registryPath, registry);
-                const taskId = registry.ids[normalized.value];
-                if (!taskId)
-                    throw Object.assign(new Error(`short id '${normalized.value}' not found in active task registry`), { code: 'SHORT_ID_NOT_FOUND' });
-                return { status: changed ? 'applied' : 'no-op', changed, output: taskId, error: null };
-            });
+            const registry = readRegistryStrict(registryPath, request.shortIdLength);
+            const taskId = registry.ids[normalized.value];
+            if (!taskId)
+                throw Object.assign(new Error(`short id '${normalized.value}' not found in task short-id registry`), { code: 'SHORT_ID_NOT_FOUND' });
+            if (!fs.existsSync(path.join(request.activeDir, taskId, 'task.md'))
+                && !hasRetainedCompletedTask(request.activeDir, taskId)) {
+                throw Object.assign(new Error(`short id '${normalized.value}' points to a task without active or completed task content`), { code: 'SHORT_ID_STALE' });
+            }
+            return { status: 'no-op', changed: false, output: taskId, error: null };
         }
         const registry = readRegistryStrict(registryPath, request.shortIdLength);
         if (request.verify) {
             const active = fs.existsSync(request.activeDir)
                 ? fs.readdirSync(request.activeDir).filter((entry) => /^TASK-\d{8}-\d{6}$/.test(entry) && fs.existsSync(path.join(request.activeDir, entry, 'task.md')))
                 : [];
+            const retained = Object.values(registry.ids).filter((taskId) => hasRetainedCompletedTask(request.activeDir, taskId));
+            const validTasks = new Set([...active, ...retained]);
             const registered = new Map();
             for (const [key, taskId] of Object.entries(registry.ids))
                 registered.set(taskId, [...(registered.get(taskId) ?? []), key]);
             const diff = {
                 missing_in_registry: active.filter((taskId) => !registered.has(taskId)).map((taskId) => ({ taskId })),
-                orphans_in_registry: Object.entries(registry.ids).filter(([, taskId]) => !active.includes(taskId)).map(([key, taskId]) => ({ key, taskId })),
+                orphans_in_registry: Object.entries(registry.ids).filter(([, taskId]) => !validTasks.has(taskId)).map(([key, taskId]) => ({ key, taskId })),
                 duplicate_registry_keys: [...registered.entries()].filter(([, keys]) => keys.length > 1).map(([taskId, keys]) => ({ taskId, keys }))
             };
             const clean = Object.values(diff).every((items) => items.length === 0);

package/dist/lib/task/verification-engine.js

@@ -147,14 +147,9 @@ function checkOrchestrationState({ taskDir }) {
         return failResult('orchestration-state', 'Paused run requires a stable pause code and message');
     }
     if (run.status === 'completed') {
-        if (run.completionEvidence != null) {
-            const evidenceError = validateCleanCompletionEvidence(run);
-            if (evidenceError)
-                return failResult('orchestration-state', evidenceError);
-        }
-        else if (run.pendingDelegation !== null || !run.commitAuthorization?.consumedAt) {
-            return failResult('orchestration-state', 'Completed run must consume commit authorization and clear pending delegation');
-        }
+        const evidenceError = validateCleanCompletionEvidence(run);
+        if (evidenceError)
+            return failResult('orchestration-state', evidenceError);
     }
     else if (run.completionEvidence != null) {
         return failResult('orchestration-state', 'Clean completion evidence requires a completed run');
@@ -186,10 +181,8 @@ function validateCleanCompletionEvidence(run) {
     }
     if (run.status !== 'completed'
         || run.pendingDelegation !== null
-        || run.commitAuthorization?.issuedAt !== null
-        || run.commitAuthorization?.consumedAt !== null
         || run.receipts.some((receipt) => receipt.stage === 'commit')) {
-        return 'Clean completion evidence conflicts with commit delegation state';
+        return 'Clean completion evidence conflicts with pending delegation or commit receipt state';
     }
     return null;
 }

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.12",
-  "sourceInputHash": "9d9be72538afb23d15312d9d5eeac8e0a9fb79b4b9b4f8715f0f0218c3f7cfdd",
-  "internalExecutableBuildHash": "6f21c8843c158d538c95d789a9e048df47bb25080e7f935d00cf60bcb85163db"
+  "packageVersion": "0.11.13",
+  "sourceInputHash": "70e89f362895c1f8f976011715a86b47e06c105ca4285eacbb3fa51d0459a282",
+  "internalExecutableBuildHash": "f183e6d39ba985dbb2962eb951b4019af9594361ca3c46b88bf65fff325d7ad4"
 }

package/lib/agent-clients/adapters/codex-lifecycle/store.ts

@@ -307,18 +307,23 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
     return matches[0]!;
   }
 
-  function consume(
+  function consumeWithLockMode(
     childThreadId: string,
     consumer: string,
-    expectedHookDefinitionHash?: string,
-    expectedTaskBinding?: CodexLifecycleTaskBinding
+    expectedHookDefinitionHash: string | undefined,
+    expectedTaskBinding: CodexLifecycleTaskBinding | undefined,
+    taskLockHeld: boolean
   ): StoredCodexLifecycle {
     if (!consumer.trim()) throw new Error('Codex lifecycle consumer is required');
     const current = read(childThreadId);
     const binding = expectedTaskBinding ?? current.taskBinding;
     if (!binding) throw new Error('Codex lifecycle task receipt binding is missing');
     const spawn = current.state.spawn;
-    if (!spawn) throw new Error('Codex lifecycle spawn evidence is missing');
+    if (!spawn) {
+      throw new Error(taskLockHeld
+        ? 'Codex lifecycle task receipt binding is missing'
+        : 'Codex lifecycle spawn evidence is missing');
+    }
     const key = recordKey(spawn.sessionId, spawn.turnId, spawn.toolUseId);
     return update(binding, key, (latest) => {
       if (!latest || expectedTaskBinding && JSON.stringify(latest.taskBinding) !== JSON.stringify(expectedTaskBinding)) {
@@ -333,7 +338,16 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
       }
       if (latest.consumer) return latest;
       return Object.freeze({ ...latest, revision: latest.revision + 1, consumer, consumedAt: now(), updatedAt: now() });
-    });
+    }, taskLockHeld);
+  }
+
+  function consume(
+    childThreadId: string,
+    consumer: string,
+    expectedHookDefinitionHash?: string,
+    expectedTaskBinding?: CodexLifecycleTaskBinding
+  ): StoredCodexLifecycle {
+    return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, false);
   }
 
   function consumeWithinTaskLock(
@@ -342,24 +356,7 @@ function createCodexLifecycleStore(options: CodexLifecycleStoreOptions) {
     expectedHookDefinitionHash?: string,
     expectedTaskBinding?: CodexLifecycleTaskBinding
   ): StoredCodexLifecycle {
-    if (!consumer.trim()) throw new Error('Codex lifecycle consumer is required');
-    const current = read(childThreadId);
-    const binding = expectedTaskBinding ?? current.taskBinding;
-    if (!binding || !current.state.spawn) throw new Error('Codex lifecycle task receipt binding is missing');
-    const key = recordKey(current.state.spawn.sessionId, current.state.spawn.turnId, current.state.spawn.toolUseId);
-    return update(binding, key, (latest) => {
-      if (!latest || expectedTaskBinding && JSON.stringify(latest.taskBinding) !== JSON.stringify(expectedTaskBinding)) {
-        throw new Error('Codex lifecycle task binding does not match the expected receipt');
-      }
-      if (latest.consumer && latest.consumer !== consumer) {
-        throw new Error(`Codex lifecycle evidence was already consumed by '${latest.consumer}'`);
-      }
-      if (latest.state.status !== 'stop-ready') throw new Error('Codex lifecycle evidence is not stop-ready');
-      if (expectedHookDefinitionHash && latest.state.startEvidence?.hookDefinitionHash !== expectedHookDefinitionHash) {
-        throw new Error('Codex lifecycle hook definition hash is stale');
-      }
-      return latest.consumer ? latest : Object.freeze({ ...latest, revision: latest.revision + 1, consumer, consumedAt: now(), updatedAt: now() });
-    }, true);
+    return consumeWithLockMode(childThreadId, consumer, expectedHookDefinitionHash, expectedTaskBinding, true);
   }
 
   function expireBefore(cutoff: string): number {

package/lib/internal/sandbox-control.ts

@@ -1,33 +1,12 @@
 import {
   recoverSandboxControl,
   requestSandboxControl,
-  requestSandboxTaskFinalization,
   SandboxControlClientError
 } from '../sandbox/control/client.ts';
-import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.ts';
 import { serveSandboxControl } from '../sandbox/control/server.ts';
 import { runSandboxControlExecutor } from '../sandbox/control/executor.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 import { parseTaskCreateResult, taskCreateExitCode } from '../task/create-service.ts';
-import { serializeTaskFinalizationEnvelope, type TaskFinalizationEnvelope } from '../task/finalization-envelope.ts';
-
-type FinalizationStatus = 'completed' | 'failed' | 'blocked' | 'unknown';
-
-function writeFinalizationEnvelope(
-  status: FinalizationStatus,
-  accepted: boolean,
-  error: { code: string; message: string; retryable: boolean },
-  changed: boolean | null = false,
-  result: unknown = null,
-  requestId: string | null = null
-): void {
-  process.stdout.write(serializeTaskFinalizationEnvelope({ status, changed, accepted, requestId, result, error }));
-}
-
-function finalizationErrorStatus(error: { retryable: boolean; code: string }): FinalizationStatus {
-  if (error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') return 'unknown';
-  return error.retryable ? 'blocked' : 'failed';
-}
 
 function writeClientError(error: SandboxControlClientError): void {
   process.stderr.write(`${error.detail.message}\n`);
@@ -45,78 +24,6 @@ function recoveredExitCode(response: Awaited<ReturnType<typeof recoverSandboxCon
   return response.exitCode ?? 1;
 }
 
-function finalizationResponseOutput(response: Awaited<ReturnType<typeof requestSandboxTaskFinalization>>): string {
-  try {
-    const value = JSON.parse(response.stdout) as Partial<TaskFinalizationEnvelope>;
-    if (value.version === 2
-      && value.status
-      && ['completed', 'failed', 'blocked', 'unknown'].includes(value.status)
-      && (typeof value.changed === 'boolean' || value.changed === null)) {
-      return serializeTaskFinalizationEnvelope({
-        status: value.status,
-        changed: value.changed,
-        accepted: true,
-        requestId: response.id,
-        result: value.result ?? null,
-        error: value.error ?? null
-      });
-    }
-  } catch {
-    // Preserve non-envelope output for diagnostics from the executor.
-  }
-  return response.stdout;
-}
-
-function sandboxFinalizationClient(args: string[]): void {
-  if (args.length !== 4 || !args[0] || args[1] !== 'complete' || args[2] !== '--agent' || !args[3]) {
-    const error = { code: 'TASK_FINALIZATION_PAYLOAD_INVALID', message: 'task ref, complete intent, and --agent are required', retryable: false };
-    writeFinalizationEnvelope('failed', false, error);
-    process.stderr.write('Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n');
-    process.exitCode = 1;
-    return;
-  }
-  const agent = normalizeAgentToken(args[3]);
-  if (!agent) {
-    const error = { code: 'TASK_FINALIZATION_PAYLOAD_INVALID', message: `invalid --agent: ${AGENT_USAGE_HINT}`, retryable: false };
-    writeFinalizationEnvelope('failed', false, error);
-    process.exitCode = 1;
-    return;
-  }
-  let response;
-  try {
-    response = requestSandboxTaskFinalization({ agent });
-  } catch (error) {
-    if (!(error instanceof SandboxControlClientError)) throw error;
-    const status = finalizationErrorStatus(error.detail);
-    writeFinalizationEnvelope(status, error.accepted, error.detail, status === 'unknown' ? null : false, null, error.requestId);
-    writeClientError(error);
-    process.exitCode = error.detail.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 1 : error.detail.retryable ? 2 : 1;
-    return;
-  }
-  if (response.phase === 'rejected') {
-    const error = response.error ?? {
-      code: 'SANDBOX_CONTROL_REJECTED',
-      message: 'sandbox control rejected the finalization request',
-      retryable: false
-    };
-    const status = finalizationErrorStatus(error);
-    writeFinalizationEnvelope(
-      status,
-      error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN',
-      error,
-      status === 'unknown' ? null : false,
-      null,
-      response.id
-    );
-    process.stderr.write(`${error.message}\n`);
-    process.exitCode = error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 1 : error.retryable ? 2 : 1;
-    return;
-  }
-  process.stdout.write(finalizationResponseOutput(response));
-  process.stderr.write(response.stderr);
-  process.exitCode = response.exitCode ?? 1;
-}
-
 async function sandboxControl(args: string[]): Promise<void> {
   if (!ensureInternalHandlerRoute('sandbox-control', args)) return;
   const [operation, ...rest] = args;
@@ -165,10 +72,6 @@ async function sandboxControl(args: string[]): Promise<void> {
   }
   if (internalHandlerRoute('sandbox-control', 'client', operation ?? '')) {
     const [family = '', ...commandArgs] = rest;
-    if (family === 'task-finalization') {
-      sandboxFinalizationClient(commandArgs);
-      return;
-    }
     let response;
     try {
       response = requestSandboxControl({ family, args: commandArgs });

package/lib/internal/task-finalization.ts

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import {
   createDirectHostExecutionContext,
   dispatchTaskControlOperation,
@@ -6,8 +7,10 @@ import {
 import { applyTaskFinalization } from '../task/finalization.ts';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.ts';
 import { resolveSandboxControlTransport } from './task-operation-registry.ts';
-import { requestSandboxTaskFinalization, SandboxControlClientError } from '../sandbox/control/client.ts';
+import { quiesceSandboxControlForTaskCompletion } from '../sandbox/control/lifecycle.ts';
+import { resolveTaskRuntimeRoot } from '../task/runtime-paths.ts';
 import { serializeTaskFinalizationEnvelope } from '../task/finalization-envelope.ts';
+import { verifyTaskEvent } from '../task/verification.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = 'Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n';
@@ -79,25 +82,34 @@ async function taskFinalization(args: string[] = []): Promise<void> {
   };
   const transport = resolveSandboxControlTransport(process.env, { localWorkflow: true });
   if (transport.kind === 'sandbox-local') {
-    try {
-      const response = requestSandboxTaskFinalization({ agent: boundOperation.request.agent });
-      process.stdout.write(response.stdout);
-      process.stderr.write(response.stderr);
-      process.exitCode = response.exitCode ?? 1;
-      return;
-    } catch (error) {
-      const clientError = error instanceof SandboxControlClientError ? error : null;
-      const detail = clientError
-        ? clientError.detail
-        : { code: 'SANDBOX_CONTROL_CLIENT_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false };
-      const status = detail.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN'
-        ? 'unknown'
-        : detail.retryable ? 'blocked' : 'failed';
-      const changed = status === 'unknown' ? null : false;
-      process.stdout.write(envelope(status, changed, clientError?.accepted ?? false, null, detail, clientError?.requestId ?? null));
-      process.exitCode = exitCode(status);
+    const statusDir = process.env.AGENT_INFRA_CONTROL_STATUS_DIR;
+    const taskId = process.env.AGENT_INFRA_TASK_ID;
+    const generation = process.env.AGENT_INFRA_CONTROL_GENERATION;
+    const controlRootId = process.env.AGENT_INFRA_CONTROL_ROOT_ID;
+    if (!statusDir || !taskId || !generation || !controlRootId || taskId !== resolved.taskId) {
+      const detail = { code: 'TASK_CONTROL_TRANSPORT_INVALID', message: 'sandbox task control identity is incomplete', retryable: false };
+      process.stdout.write(envelope('failed', false, true, null, detail));
+      process.exitCode = 1;
       return;
     }
+    const result = await applyTaskFinalization(boundOperation.request, {
+      repoRoot,
+      beforeLifecycle: async (currentTaskId) => {
+        if (currentTaskId !== taskId) throw new Error('SANDBOX_CONTROL_IDENTITY_MISMATCH');
+        await quiesceSandboxControlForTaskCompletion(
+          path.join(resolveTaskRuntimeRoot(taskId, { repoRoot }), 'sandbox-control'),
+          { taskId, generation, controlRootId, statusDir }
+        );
+      },
+      preflight: (request, options) => verifyTaskEvent(
+        { ...request, event: 'complete-task.hard-preflight' }, options
+      )
+    });
+    const status = result.status === 'prepared' ? 'failed' : result.status;
+    process.stdout.write(envelope(status, result.changed, true, result, result.error
+      ?? (result.status === 'prepared' ? { code: 'TASK_FINALIZATION_PREPARATION_INCOMPLETE', message: 'finalization did not commit', retryable: true } : null)));
+    process.exitCode = exitCode(status);
+    return;
   }
   const result = await dispatchTaskControlOperation(
     createDirectHostExecutionContext({ repoRoot }),

package/lib/internal/task-lifecycle.ts

@@ -10,7 +10,7 @@ import type { TaskLifecycleResult } from '../task/lifecycle.ts';
 import type { AgentClientLifecycleRecoveryResult as LifecycleRecoveryResult } from '../agent-clients/adapter.ts';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
-const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\nrecover-started: --auto\n`;
+const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.filter((intent) => intent !== 'complete').join(', ')}\nrecover-started: --auto\n`;
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LIFECYCLE_PAYLOAD_INVALID', message } })}\n`);

package/lib/platform/github-client.ts

@@ -51,6 +51,33 @@ function boundedFailureDetail(result: RunResult): string {
     : `${diagnostic.slice(0, ERROR_DETAIL_LIMIT)}… [truncated]`;
 }
 
+function requestDiagnostics(args: string[], request: RequestOptions, attempt: number, errorMessage: string): string {
+  if (process.env.AGENT_INFRA_GH_DIAGNOSTICS !== '1' && !/rate.?limit/iu.test(errorMessage)) return '';
+
+  const apiIndex = args.indexOf('api');
+  const endpoint = apiIndex < 0
+    ? args.slice(0, 2).filter((arg) => !arg.startsWith('-')).join(' ')
+    : args.slice(apiIndex + 1).find((arg) => !arg.startsWith('-') && !arg.includes('=')) || 'unknown';
+  const safeEndpoint = endpoint.startsWith('http')
+    ? (() => {
+      try {
+        const url = new URL(endpoint);
+        return `${url.host}${url.pathname}`;
+      } catch {
+        return 'unknown';
+      }
+    })()
+    : endpoint.split('?')[0] || 'unknown';
+  const methodIndex = args.findIndex((arg) => arg === '-X' || arg === '--method');
+  const methodFromArgs = methodIndex >= 0 ? args[methodIndex + 1] : undefined;
+  const method = methodFromArgs || request.method || (safeEndpoint === 'graphql' ? 'POST' : 'GET');
+  const tokenEnvironment = ['GH_TOKEN', 'GITHUB_TOKEN', 'GH_ENTERPRISE_TOKEN', 'GITHUB_ENTERPRISE_TOKEN']
+    .filter((name) => Boolean(process.env[name]));
+  const configDirOverride = Boolean(process.env.GH_CONFIG_DIR);
+
+  return ` [gh-diagnostic endpoint=${safeEndpoint} method=${method} attempt=${attempt} tokenEnv=${tokenEnvironment.join(',') || 'none'} ghConfigDirOverride=${configDirOverride}]`;
+}
+
 function defaultRunner(args: string[], options: RunOptions): RunResult {
   const command = process.env.AGENT_INFRA_GH_BIN || 'gh';
   let prefix: string[] = [];
@@ -168,13 +195,17 @@ function createGitHubClient(options: ClientOptions = {}): GitHubClient {
       const result = runner(args, request);
       if (result.status === 0) return { ok: true, value: result.stdout };
       const error = classifyGitHubFailure(result);
-      if (!retryableMethod || !error.requestRetryable) return { ok: false, error: clientError(error) };
+      const requestDetail = requestDiagnostics(args, request, attempt + 1, error.message);
+      const contextualError = requestDetail
+        ? { ...error, message: `${error.message}${requestDetail}` }
+        : error;
+      if (!retryableMethod || !error.requestRetryable) return { ok: false, error: clientError(contextualError) };
       if (attempt >= delays.length) {
         return {
           ok: false,
           error: error.code === 'NETWORK_TRANSIENT'
-            ? { ...clientError(error), code: 'NETWORK_RETRY_EXHAUSTED', message: `${error.message} (retry exhausted)` }
-            : clientError(error)
+            ? { ...clientError(contextualError), code: 'NETWORK_RETRY_EXHAUSTED', message: `${contextualError.message} (retry exhausted)` }
+            : clientError(contextualError)
         };
       }
       sleep(delays[attempt]!);

package/lib/sandbox/commands/create.ts

@@ -91,6 +91,7 @@ import {
   materializeSandboxControl,
   materializeSandboxWorkspaceView,
   prepareSandboxWorkspaceMountTargets,
+  prepareSandboxCompletedTaskMountSource,
   sandboxControlPaths,
 } from '../workspace-view.ts';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.ts';
@@ -1451,7 +1452,10 @@ export async function create(
             const taskSource = target.workspace.mode === 'task-bound'
               ? assertSandboxTaskSource(effectiveConfig.repoRoot, target.workspace.taskId)
               : null;
-            prepareSandboxWorkspaceMountTargets(worktree);
+            const completedTaskSource = target.workspace.mode === 'task-bound'
+              ? prepareSandboxCompletedTaskMountSource(effectiveConfig.repoRoot, target.workspace.taskId)
+              : null;
+            prepareSandboxWorkspaceMountTargets(worktree, target.workspace.mode === 'task-bound' ? target.workspace.taskId : undefined);
             if (previousCutoverSnapshot) {
               assertSandboxControlCutoverSnapshot(previousCutoverSnapshot);
               if (previousManifest) {
@@ -1494,6 +1498,7 @@ export async function create(
               ...(target.workspace.mode === 'task-bound'
                 ? {
                   taskSources: [taskSource!],
+                  completedTaskSource: completedTaskSource!,
                   taskId: target.workspace.taskId
                 }
                 : {})

package/lib/sandbox/commands/ls.ts

@@ -18,11 +18,10 @@ export { containerListFormat, parseLabels } from './list-running.ts';
 const USAGE = `Usage: ai sandbox ls
 
 Lists all containers for the current project. The '#' column is a
-display-only row number; the 'SHORT' column shows the active task short
-id bound to each container's branch (via
-.agents/workspace/active/.short-ids.json), or '-' if no active task is
-bound. Pass the SHORT value to "ai sandbox exec" (e.g. 'ai sandbox exec 11').
-A SHORT value of '-' means this container has no active task short id and may
+display-only row number; the 'SHORT' column shows the task short id bound to
+each task-bound container, or '-' if no short id is registered. Pass the
+SHORT value to "ai sandbox exec" (e.g. 'ai sandbox exec 11').
+A SHORT value of '-' means this container has no task short id and may
 be eligible for "ai sandbox rm --unbound" cleanup. Use a full TASK-id to
 remove a specific task-bound sandbox.
 

package/lib/sandbox/commands/rm.ts

@@ -13,7 +13,7 @@ import { fetchSandboxRows } from './list-running.ts';
 import { rmOne, rmPurge, rmUnbound } from '../removal.ts';
 
 const USAGE = `Usage:
-  ai sandbox rm <branch | TASK-id | short id> Remove one sandbox; use a full TASK-id for a task-bound sandbox and a branch for branch-only sandboxes
+  ai sandbox rm <branch | TASK-id | short id> Remove one sandbox; use a retained short id or full TASK-id for a task-bound sandbox and a branch for branch-only sandboxes
   ai sandbox rm --unbound [--dry-run] [--yes] Remove sandboxes not bound to an active task short id
   ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;