@fitlab-ai/agent-infra 0.11.12 → 0.11.14

package/dist/lib/sandbox/control/host-recovery.js

@@ -19,30 +19,92 @@ function manifestDigest(manifest) {
         generation: manifest.generation, controlRootId: manifest.controlRootId
     });
 }
-function managedManifestPaths(managedRoot) {
-    if (!fs.existsSync(managedRoot))
-        return [];
-    const rootStat = fs.lstatSync(managedRoot);
-    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+function readManagedManifest(manifestPath) {
+    try {
+        return readSandboxControlManifest(manifestPath);
+    }
+    catch {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-    const result = [];
-    for (const container of fs.readdirSync(managedRoot, { withFileTypes: true })) {
-        if (!container.isDirectory() || container.isSymbolicLink())
+    }
+}
+function branchOnlyManifests(parentPath) {
+    const manifests = [];
+    for (const identity of fs.readdirSync(parentPath, { withFileTypes: true })) {
+        if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name))
             continue;
-        const containerPath = path.join(managedRoot, container.name);
-        for (const identity of fs.readdirSync(containerPath, { withFileTypes: true })) {
-            if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name))
-                continue;
-            result.push(path.join(containerPath, identity.name, 'manifest.json'));
+        manifests.push(readManagedManifest(path.join(parentPath, identity.name, 'manifest.json')));
+    }
+    return manifests;
+}
+function taskBoundManifests(params) {
+    assertDirectory(params.tasksRoot);
+    const canonicalManagedRoot = fs.realpathSync.native(path.dirname(params.tasksRoot));
+    const canonicalTasksRoot = fs.realpathSync.native(params.tasksRoot);
+    if (path.dirname(canonicalTasksRoot) !== canonicalManagedRoot)
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const canonicalRepoRoot = fs.realpathSync.native(params.repoRoot);
+    const manifests = [];
+    for (const task of fs.readdirSync(params.tasksRoot, { withFileTypes: true })) {
+        if (!/^TASK-\d{8}-\d{6}$/u.test(task.name))
+            continue;
+        if (!task.isDirectory() || task.isSymbolicLink())
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+        const taskRoot = path.join(params.tasksRoot, task.name);
+        assertNoSymlinkPath(params.controlBase, taskRoot);
+        const canonicalTaskRoot = fs.realpathSync.native(taskRoot);
+        if (path.dirname(canonicalTaskRoot) !== canonicalTasksRoot)
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+        const manifestPath = path.join(taskRoot, 'manifest.json');
+        if (!fs.existsSync(manifestPath))
+            continue;
+        const manifest = readManagedManifest(manifestPath);
+        if (manifest.mode !== 'task-bound' || manifest.taskId !== task.name || manifest.project !== params.project
+            || fs.realpathSync.native(manifest.repoRoot) !== canonicalRepoRoot
+            || path.dirname(fs.realpathSync.native(manifestPath)) !== canonicalTaskRoot) {
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
         }
+        manifests.push(manifest);
+    }
+    return manifests;
+}
+function managedManifestCandidates(params) {
+    const managedRoot = params.managedRoot;
+    const { controlBase, project, repoRoot } = params;
+    if (controlBase && project && path.resolve(managedRoot) !== path.resolve(controlBase, project)) {
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
-    return result;
+    if (!fs.existsSync(managedRoot))
+        return [];
+    assertDirectory(managedRoot);
+    return fs.readdirSync(managedRoot, { withFileTypes: true })
+        .flatMap((parent) => {
+        const parentPath = path.join(managedRoot, parent.name);
+        if (parent.name === 'tasks' && controlBase && project && repoRoot) {
+            return taskBoundManifests({ tasksRoot: parentPath, controlBase, project, repoRoot });
+        }
+        if (!parent.isDirectory() || parent.isSymbolicLink())
+            return [];
+        return branchOnlyManifests(parentPath);
+    });
 }
 function assertDirectory(directory) {
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
 }
+function assertNoSymlinkPath(root, target) {
+    const relative = path.relative(root, target);
+    if (relative.startsWith('..') || path.isAbsolute(relative))
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    let current = path.resolve(root);
+    if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink())
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink())
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    }
+}
 function readAudit(manifest) {
     const root = path.dirname(path.resolve(manifest.publicStatusDir));
     const records = [];
@@ -80,12 +142,16 @@ function auditProof(manifest, requestId) {
         return [];
     return related;
 }
-function publishedEvidence(records, generation) {
+function publishedEvidence(records, manifest) {
     const publications = records.filter((record) => record.event === 'executor-result-published');
     let selected = null;
     let selectedSummary = null;
+    const digest = manifestDigest(manifest);
     for (const record of publications) {
-        if (record.version !== 2 || record.requestGeneration !== generation
+        if (record.version !== 2 || record.generation !== manifest.generation || record.identityDigest !== digest
+            || typeof record.requestFamily !== 'string'
+            || !['task-lifecycle', 'task-create'].includes(record.requestFamily)
+            || (record.sandboxTaskId !== null && typeof record.sandboxTaskId !== 'string')
             || !Number.isSafeInteger(record.exitCode)
             || !Number.isSafeInteger(record.outputBytes) || !Number.isSafeInteger(record.errorBytes)
             || typeof record.outputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.outputDigest)
@@ -93,7 +159,7 @@ function publishedEvidence(records, generation) {
             throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
         }
         const summary = JSON.stringify([
-            record.requestFamily ?? null, record.requestGeneration, record.exitCode,
+            record.requestFamily, record.sandboxTaskId, record.generation, record.identityDigest, record.exitCode,
             record.outputBytes, record.errorBytes, record.outputDigest, record.errorDigest
         ]);
         if (selectedSummary !== null && summary !== selectedSummary) {
@@ -102,6 +168,9 @@ function publishedEvidence(records, generation) {
         selected ??= record;
         selectedSummary ??= summary;
     }
+    if (selected && selected.sandboxTaskId !== manifest.taskId) {
+        throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
+    }
     return selected;
 }
 function verifiedResponse(manifest, requestId, records) {
@@ -131,7 +200,7 @@ function verifiedResponse(manifest, requestId, records) {
     if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN')
         return unknown(requestId);
     const evidencePath = path.join(manifest.processingDir, requestId, 'result.json');
-    const published = publishedEvidence(records, manifest.generation);
+    const published = publishedEvidence(records, manifest);
     if (!published)
         return unknown(requestId);
     let evidence = null;
@@ -187,15 +256,8 @@ export function recoverSandboxControlFromHost(requestId, params) {
     let candidates = [];
     while (Date.now() < deadline) {
         candidates = [];
-        for (const manifestPath of managedManifestPaths(params.managedRoot)) {
-            let manifest;
-            try {
-                manifest = readSandboxControlManifest(manifestPath);
-            }
-            catch {
-                throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-            }
-            if (manifest.project !== path.basename(path.resolve(params.managedRoot)) || !manifest.generation) {
+        for (const manifest of managedManifestCandidates(params)) {
+            if (manifest.project !== (params.project ?? path.basename(path.resolve(params.managedRoot))) || !manifest.generation) {
                 throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
             }
             const records = auditProof(manifest, requestId);

package/dist/lib/sandbox/control/lifecycle.js

@@ -9,6 +9,7 @@ import { DEFAULT_SANDBOX_CONTROL_TIMING } from './protocol.js';
 import { inspectSandboxControlContainer } from './container-identity.js';
 import { acquireSandboxResourceLock, resolveSandboxLockNamespace } from './native-file-lock.js';
 import { isSandboxAuthorityEvidence } from '../engines/authority.js';
+import { validateSandboxControlIdentity } from './identity-sentinel.js';
 import { parseSandboxControlStatus, readExecution, terminateSandboxControlExecution } from './state.js';
 const DEFAULT_QUIESCE_TIMEOUT_MS = DEFAULT_SANDBOX_CONTROL_TIMING.quiesceDeadlineMs;
 const QUIESCING_FILE = 'quiescing.json';
@@ -500,6 +501,45 @@ function markSandboxControlRootQuiescing(root) {
             throw new Error('SANDBOX_CONTROL_CHANNEL_INVALID');
     }
 }
+function readTaskCompletionManifest(root, binding) {
+    const manifest = readSandboxControlManifest(path.join(root, 'manifest.json'));
+    const identity = validateSandboxControlIdentity({
+        publicStatusDir: binding.statusDir,
+        root,
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+    if (identity.state !== 'valid' || manifest.mode !== 'task-bound'
+        || manifest.taskId !== binding.taskId || manifest.generation !== binding.generation
+        || manifest.controlRootId !== binding.controlRootId) {
+        throw new Error('SANDBOX_CONTROL_IDENTITY_MISMATCH');
+    }
+    return manifest;
+}
+export async function quiesceSandboxControlForTaskCompletion(root, binding, timeoutMs = DEFAULT_QUIESCE_TIMEOUT_MS) {
+    const resolvedRoot = path.resolve(root);
+    const manifest = readTaskCompletionManifest(resolvedRoot, binding);
+    markSandboxControlRootQuiescing(resolvedRoot);
+    const deadline = Date.now() + timeoutMs;
+    const startupPath = path.join(resolvedRoot, BROKER_STARTING_FILE);
+    const brokerPath = path.join(resolvedRoot, 'broker.json');
+    while (true) {
+        const startup = readStartupOwner(startupPath);
+        if (fs.existsSync(startupPath) && !startup)
+            throw new Error('SANDBOX_CONTROL_BROKER_START_TRANSITION');
+        const broker = readBrokerOwner(brokerPath);
+        if (broker && (broker.token !== manifest.token || broker.generation !== manifest.generation)) {
+            throw new Error('SANDBOX_CONTROL_OWNER_MISMATCH');
+        }
+        if (!startup && !broker)
+            return;
+        if (Date.now() >= deadline)
+            throw new Error('SANDBOX_CONTROL_BROKER_DRAIN_TIMEOUT');
+        await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+}
 function recordSandboxRemovalPending(root, manifest, phase, journal) {
     const pendingPath = path.join(root, 'removal-pending.json');
     const temporary = `${pendingPath}.${process.pid}.${randomUUID()}.tmp`;
@@ -934,14 +974,40 @@ function readSandboxControlManifestValue(manifestPath) {
         || !isSandboxAuthorityEvidence(candidate.authorityEvidence))
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     const root = path.dirname(path.resolve(manifestPath));
-    if (path.resolve(candidate.channelDir) !== path.join(root, 'channel')
-        || path.resolve(candidate.publicStatusDir) !== path.join(root, 'public')
-        || path.resolve(candidate.processingDir) !== path.join(root, 'processing')) {
+    const canonicalRoot = fs.realpathSync.native(root);
+    const resolveControlChildPath = (candidatePath, name) => {
+        if (path.isAbsolute(candidatePath) || candidatePath !== name)
+            return null;
+        const resolved = path.resolve(root, candidatePath);
+        const expected = path.join(canonicalRoot, name);
+        try {
+            const stat = fs.lstatSync(resolved);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                return null;
+            return fs.realpathSync.native(resolved) === expected ? expected : null;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            try {
+                return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot ? expected : null;
+            }
+            catch (parentError) {
+                if (parentError.code !== 'ENOENT')
+                    throw parentError;
+                return null;
+            }
+        }
+    };
+    const channelDir = resolveControlChildPath(candidate.channelDir, 'channel');
+    const publicStatusDir = resolveControlChildPath(candidate.publicStatusDir, 'public');
+    const processingDir = resolveControlChildPath(candidate.processingDir, 'processing');
+    const runtimeDir = resolveControlChildPath(candidate.runtimeDir, 'runtime');
+    if (!channelDir || !publicStatusDir || !processingDir) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
-    if (path.resolve(candidate.runtimeDir) !== path.join(root, 'runtime')) {
+    if (!runtimeDir)
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-    }
     const normalized = {
         engine: candidate.engine,
         repoRoot: candidate.repoRoot,
@@ -959,10 +1025,10 @@ function readSandboxControlManifestValue(manifestPath) {
         token: candidate.token,
         generation: candidate.generation,
         controlRootId: candidate.controlRootId,
-        channelDir: candidate.channelDir,
-        publicStatusDir: candidate.publicStatusDir,
-        processingDir: candidate.processingDir,
-        runtimeDir: candidate.runtimeDir,
+        channelDir,
+        publicStatusDir,
+        processingDir,
+        runtimeDir,
     };
     return normalized;
 }

package/dist/lib/sandbox/control/protocol.js

@@ -1,17 +1,14 @@
 import { createHash } from 'node:crypto';
 import { validateTaskCreateCandidate } from '../../task/create.js';
-import { normalizeAgentToken } from '../../agent-clients/tokens.js';
-import { isAgentClientId } from '../../agent-clients/types.js';
 export const SANDBOX_CONTROL_MAX_BYTES = 64 * 1024;
 export const SANDBOX_CONTROL_MAX_LOGICAL_RECORDS = 1024;
 export const SANDBOX_CONTROL_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 export const SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES = 1024 * 1024;
 export const SANDBOX_CONTROL_RESERVATION_BYTES = SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES + 4 * 1024;
-export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-finalization', 'task-create', 'agent-client'];
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create'];
 export const DEFAULT_SANDBOX_CONTROL_TIMING = Object.freeze({
     controlTickMs: 250,
     parkedBindingInitialMs: 1_000,
@@ -107,75 +104,40 @@ export function parseSandboxControlReservation(value) {
 export function isSandboxControlFamily(value) {
     return SANDBOX_CONTROL_FAMILIES.includes(value);
 }
-export function validateSandboxControlRequest(value, manifest, options = {}) {
+export function validateSandboxControlRequest(value, manifest) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request must be an object');
     }
     const request = value;
-    if (request.version !== 4 || typeof request.id !== 'string'
-        || !/^[a-f0-9-]{16,64}$/.test(request.id) || request.token !== manifest.token
-        || typeof request.family !== 'string' || !isSandboxControlFamily(request.family)
-        || !Number.isSafeInteger(request.issuedAt) || !Number.isSafeInteger(request.expiresAt))
+    if (request.version !== 5 || typeof request.id !== 'string'
+        || !/^[a-f0-9-]{16,64}$/.test(request.id)
+        || typeof request.family !== 'string' || !isSandboxControlFamily(request.family))
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
-    if (request.generation !== manifest.generation) {
-        fail('SANDBOX_CONTROL_GENERATION_INVALID', 'request generation does not match the broker');
-    }
-    const issuedAt = request.issuedAt;
-    const expiresAt = request.expiresAt;
-    const now = options.now ?? Date.now();
-    if (expiresAt <= issuedAt || expiresAt - issuedAt > SANDBOX_CONTROL_ADMISSION_WINDOW_MS || issuedAt > now + SANDBOX_CONTROL_FUTURE_SKEW_MS) {
-        fail('SANDBOX_CONTROL_REQUEST_DEADLINE_INVALID', 'request admission deadline is invalid');
-    }
-    if (now > expiresAt)
-        fail('SANDBOX_CONTROL_REQUEST_EXPIRED', 'request admission deadline has passed', true);
     if (Buffer.byteLength(JSON.stringify(request), 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
         fail('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit');
     }
     if (request.family === 'task-create') {
-        const expected = ['candidate', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+        const expected = ['candidate', 'family', 'id', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
         }
         return { ...request, candidate: validateTaskCreateCandidate(request.candidate) };
     }
-    if (request.family === 'agent-client') {
-        const expected = ['agentClient', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'payload', 'token', 'version'];
-        if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
-            || !isAgentClientId(request.agentClient)
-            || typeof request.operation !== 'string' || !/^[a-z][a-z0-9.-]{0,63}$/u.test(request.operation)
-            || !request.payload || typeof request.payload !== 'object' || Array.isArray(request.payload)) {
-            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client request schema is invalid');
-        }
-        if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot coordinate agent clients');
-        }
-        return request;
-    }
-    if (request.family === 'task-finalization') {
-        const expected = ['agent', 'args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
-        if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
-            || request.operation !== 'complete'
-            || !Array.isArray(request.args) || request.args.length !== 0
-            || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent) {
-            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
-        }
-        if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot finalize tasks');
-        }
-        return request;
-    }
-    const expected = ['args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    const expected = ['args', 'family', 'id', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
         || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
     }
+    if (request.args[1] === 'complete') {
+        fail('SANDBOX_CONTROL_COMMAND_DENIED', 'complete must use task-finalization');
+    }
     if (manifest.mode !== 'task-bound' || !manifest.taskId) {
         fail('SANDBOX_CONTROL_BRANCH_ONLY', "branch-only sandboxes cannot coordinate tasks; return to the host and run 'ai sandbox start --recreate <task-ref-or-correct-branch>'");
     }
     return request;
 }
 export function bindSandboxControlTask(request, taskId) {
-    if (request.family === 'task-create' || request.family === 'agent-client' || request.family === 'task-finalization') {
+    if (request.family === 'task-create') {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
     }
     if (request.args.length === 0)
@@ -191,7 +153,6 @@ export function controlError(error) {
     const retryable = new Set([
         'SANDBOX_CONTROL_BUSY',
         'SANDBOX_CONTROL_HANDOFF_ACTIVE',
-        'SANDBOX_CONTROL_REQUEST_EXPIRED',
         'SANDBOX_WORKTREE_BINDING_LOST'
     ]).has(code);
     return { code, message, retryable };