@fitlab-ai/agent-infra 0.11.12 → 0.11.14

package/dist/lib/sandbox/mounts.js

@@ -2,10 +2,13 @@ import path from 'node:path';
 import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
 import { sandboxWorkspaceViewStatePaths } from './workspace-view.js';
 import { SANDBOX_GIT_COMMON_DIR } from './git-metadata.js';
-export function sandboxCoreBindMounts(config, branch, overrides) {
-    const taskSources = overrides.taskSources ?? [];
-    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
-    const workspaceMounts = sandboxWorkspaceViewStatePaths(overrides.workspaceViewRoot).map(({ state, hostPath }) => taskBound && state === 'active'
+function workspaceStateMounts(workspaceViewRoot, taskBound) {
+    return sandboxWorkspaceViewStatePaths(workspaceViewRoot)
+        // The writable completed-task mount below is nested under this path. Keep
+        // the worktree target visible so Docker can mount it without creating a
+        // mountpoint inside a read-only parent bind mount.
+        .filter(({ state }) => !(taskBound && state === 'completed'))
+        .map(({ state, hostPath }) => taskBound && state === 'active'
         ? {
             hostPaths: [path.join(hostPath, '.short-ids.json')],
             containerPath: '/workspace/.agents/workspace/active/.short-ids.json',
@@ -16,17 +19,69 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: path.posix.join('/workspace/.agents/workspace', state),
             readOnly: true
         });
+}
+function assertGitMetadataPair(overrides) {
     if (Boolean(overrides.gitCommonDir) !== Boolean(overrides.worktreeGitFile)) {
         throw new Error('SANDBOX_GIT_METADATA_INCOMPLETE');
     }
-    const gitCommonMount = overrides.gitCommonDir
-        ? { hostPaths: [overrides.gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }
-        : null;
-    const worktreeGitFileMount = overrides.worktreeGitFile
-        ? { hostPaths: [overrides.worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }
-        : null;
+}
+function gitCommonMount(gitCommonDir) {
+    return gitCommonDir ? [{ hostPaths: [gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }] : [];
+}
+function worktreeGitFileMount(worktreeGitFile) {
+    return worktreeGitFile ? [{ hostPaths: [worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }] : [];
+}
+function taskWorkspaceMounts(taskSources, taskBound, overrides) {
+    if (!taskBound)
+        return [];
+    const taskId = overrides.taskId;
+    const mounts = [{
+            hostPaths: taskSources,
+            containerPath: path.posix.join('/workspace/.agents/workspace/active', taskId),
+            readOnly: false
+        }];
+    if (overrides.completedTaskSource)
+        mounts.push({
+            hostPaths: [overrides.completedTaskSource],
+            containerPath: path.posix.join('/workspace/.agents/workspace/completed', taskId),
+            readOnly: false
+        });
+    return mounts;
+}
+function sharedMounts(config, branch, shellConfigHostDir) {
+    return [{
+            hostPaths: [shareCommonDir(config)], containerPath: '/share/common', readOnly: false
+        }, {
+            hostPaths: [shareBranchDir(config, branch)], containerPath: '/share/branch', readOnly: false
+        }, {
+            hostPaths: shellConfigHostDir ? [shellConfigHostDir] : shellConfigDirCandidates(config, branch),
+            containerPath: '/home/devuser/.host-shell-config', readOnly: true
+        }];
+}
+function controlMounts(overrides, taskBound) {
+    const mounts = [{
+            hostPaths: [overrides.controlStatusDir], containerPath: '/run/agent-infra/control-status', readOnly: true
+        }, {
+            hostPaths: [overrides.controlDir], containerPath: '/run/agent-infra/control', readOnly: false
+        }];
+    if (taskBound && overrides.runtimeDir)
+        mounts.push({
+            hostPaths: [overrides.runtimeDir], containerPath: '/run/agent-infra/runtime', readOnly: false
+        });
+    if (taskBound && overrides.controlRootDir)
+        mounts.push({
+            hostPaths: [overrides.controlRootDir], containerPath: '/run/agent-infra/control-root', readOnly: false
+        });
+    return mounts;
+}
+export function sandboxCoreBindMounts(config, branch, overrides) {
+    const taskSources = overrides.taskSources ?? [];
+    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
+    assertGitMetadataPair(overrides);
+    if (taskBound && !overrides.controlRootDir)
+        throw new Error('SANDBOX_CONTROL_ROOT_MISSING');
     const mounts = [
-        ...(gitCommonMount ? [gitCommonMount] : []),
+        ...gitCommonMount(overrides.gitCommonDir),
         {
             hostPaths: overrides.worktree
                 ? [overrides.worktree]
@@ -34,48 +89,12 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: '/workspace',
             readOnly: false
         },
-        ...(worktreeGitFileMount ? [worktreeGitFileMount] : []),
-        ...workspaceMounts,
+        ...worktreeGitFileMount(overrides.worktreeGitFile),
+        ...workspaceStateMounts(overrides.workspaceViewRoot, taskBound),
+        ...taskWorkspaceMounts(taskSources, taskBound, overrides),
+        ...sharedMounts(config, branch, overrides.shellConfigHostDir),
+        ...controlMounts(overrides, taskBound)
     ];
-    if (taskBound) {
-        const taskMountPath = path.posix.join('/workspace/.agents/workspace/active', overrides.taskId);
-        mounts.push({
-            hostPaths: taskSources,
-            containerPath: taskMountPath,
-            readOnly: false
-        });
-    }
-    mounts.push({
-        hostPaths: [shareCommonDir(config)],
-        containerPath: '/share/common',
-        readOnly: false
-    }, {
-        hostPaths: [shareBranchDir(config, branch)],
-        containerPath: '/share/branch',
-        readOnly: false
-    }, {
-        hostPaths: overrides.shellConfigHostDir
-            ? [overrides.shellConfigHostDir]
-            : shellConfigDirCandidates(config, branch),
-        containerPath: '/home/devuser/.host-shell-config',
-        readOnly: true
-    });
-    mounts.push({
-        hostPaths: [overrides.controlStatusDir],
-        containerPath: '/run/agent-infra/control-status',
-        readOnly: true
-    }, {
-        hostPaths: [overrides.controlDir],
-        containerPath: '/run/agent-infra/control',
-        readOnly: false
-    });
-    if (taskBound && overrides.runtimeDir) {
-        mounts.push({
-            hostPaths: [overrides.runtimeDir],
-            containerPath: '/run/agent-infra/runtime',
-            readOnly: false
-        });
-    }
     return mounts;
 }
 //# sourceMappingURL=mounts.js.map

package/dist/lib/sandbox/recovery.js

@@ -9,7 +9,7 @@ import { createSandboxCapabilityPlan } from './agent-client-reconciler.js';
 import { toEnginePath } from './engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from './mounts.js';
 import { resolveSandboxGitMetadata } from './git-metadata.js';
-import { assertSandboxTaskSource, sandboxControlPaths, sandboxWorkspaceViewPaths } from './workspace-view.js';
+import { assertSandboxTaskSource, sandboxCompletedTaskMountSource, sandboxControlPaths, sandboxWorkspaceViewPaths } from './workspace-view.js';
 import { resolveTaskWorkspace } from './task-resolver.js';
 import { parseSandboxWorkspaceIdentity, sameSandboxWorkspaceIdentity } from './workspace-identity.js';
 import { inspectWorktree } from './worktree-safety.js';
@@ -174,7 +174,6 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
 async function ensureSandboxControlBroker(params) {
     const control = sandboxControlPaths({
         base: params.config.controlBase ?? path.join(params.config.home, '.agent-infra', 'sandbox-control'),
-        repoRoot: params.config.repoRoot,
         project: params.config.project,
         container: params.container,
         identity: params.workspace
@@ -460,25 +459,38 @@ export function startCompletedSandboxContainer(params) {
     const activeRoot = path.join(params.config.repoRoot, '.agents', 'workspace', 'active');
     const historicalSource = path.join(activeRoot, params.taskId);
     fs.mkdirSync(activeRoot, { recursive: true });
+    let replacedEmptyRoot = false;
+    let emptyRootMode = 0o700;
     try {
-        fs.lstatSync(historicalSource);
-        throw new Error(`SANDBOX_COMPLETED_SOURCE_CONFLICT: historical task source already exists at ${historicalSource}`);
+        const existing = fs.lstatSync(historicalSource);
+        if (existing.isSymbolicLink() || !existing.isDirectory() || fs.readdirSync(historicalSource).length > 0) {
+            throw new Error(`SANDBOX_COMPLETED_SOURCE_CONFLICT: historical task source already exists at ${historicalSource}`);
+        }
+        emptyRootMode = existing.mode & 0o777;
+        fs.rmdirSync(historicalSource);
+        replacedEmptyRoot = true;
     }
     catch (error) {
         if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
             throw error;
     }
-    fs.symlinkSync(completedSource, historicalSource, process.platform === 'win32' ? 'junction' : 'dir');
+    let temporaryLink = false;
     try {
+        fs.symlinkSync(completedSource, historicalSource, process.platform === 'win32' ? 'junction' : 'dir');
+        temporaryLink = true;
         params.start(params.engine, params.container);
     }
     finally {
-        const temporarySource = fs.lstatSync(historicalSource);
-        const resolvedSource = fs.realpathSync.native(historicalSource);
-        if (!temporarySource.isSymbolicLink() || resolvedSource !== completedSource) {
-            throw new Error(`SANDBOX_COMPLETED_SOURCE_CHANGED: refusing to remove unexpected path at ${historicalSource}`);
+        if (temporaryLink) {
+            const temporarySource = fs.lstatSync(historicalSource);
+            const resolvedSource = fs.realpathSync.native(historicalSource);
+            if (!temporarySource.isSymbolicLink() || resolvedSource !== completedSource) {
+                throw new Error(`SANDBOX_COMPLETED_SOURCE_CHANGED: refusing to remove unexpected path at ${historicalSource}`);
+            }
+            fs.unlinkSync(historicalSource);
         }
-        fs.unlinkSync(historicalSource);
+        if (replacedEmptyRoot)
+            fs.mkdirSync(historicalSource, { mode: emptyRootMode });
     }
 }
 function sameHostSource(left, right) {
@@ -510,7 +522,6 @@ function expectedMounts(params) {
     });
     const control = sandboxControlPaths({
         base: config.controlBase ?? path.join(config.home, '.agent-infra', 'sandbox-control'),
-        repoRoot: config.repoRoot,
         project: config.project,
         container: params.container,
         identity: params.workspace
@@ -519,6 +530,7 @@ function expectedMounts(params) {
         ? recoveryTaskSources(config.repoRoot, params.workspace.taskId)
         : null;
     const taskId = params.workspace.mode === 'task-bound' ? params.workspace.taskId : null;
+    const completedTaskSource = taskId ? sandboxCompletedTaskMountSource(config.repoRoot, taskId) : null;
     const worktrees = worktreeDirCandidates(config, branch).filter((candidate) => fs.existsSync(path.join(candidate, '.git')));
     const gitMetadata = worktrees.length === 1
         ? resolveSandboxGitMetadata(worktrees[0], control.channelDir)
@@ -532,12 +544,14 @@ function expectedMounts(params) {
             }),
         workspaceViewRoot: view.root,
         controlDir: control.channelDir,
+        ...(params.workspace.mode === 'task-bound' ? { controlRootDir: control.root } : {}),
         controlStatusDir: control.statusDir,
         ...(taskSources === null
             ? {}
             : {
                 runtimeDir: control.runtimeDir,
                 taskSources: taskSources.accessiblePaths,
+                completedTaskSource: completedTaskSource,
                 taskId: taskId
             })
     }).map((mount) => ({
@@ -548,6 +562,10 @@ function expectedMounts(params) {
             && mount.containerPath === `/workspace/.agents/workspace/active/${taskId}`
             ? { sourceAccessiblePaths: taskSources.accessiblePaths }
             : {}),
+        ...(completedTaskSource !== null && taskId !== null
+            && mount.containerPath === `/workspace/.agents/workspace/completed/${taskId}`
+            ? { sourceAccessiblePaths: [completedTaskSource] }
+            : {}),
         expectedRW: !mount.readOnly
     }));
     const live = tools.flatMap((tool) => (tool.hostLiveMounts ?? []).flatMap(({ hostPath, containerSubpath }) => {
@@ -907,7 +925,7 @@ export async function ensureSandboxReady(params) {
             let completedReentry = null;
             if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
                 const control = sandboxControlPaths({
-                    base: params.config.controlBase, repoRoot: params.config.repoRoot, project: params.config.project,
+                    base: params.config.controlBase, project: params.config.project,
                     container: params.row.name, identity: params.workspace
                 });
                 const manifest = readSandboxControlManifest(control.manifestPath);

package/dist/lib/sandbox/removal.js

@@ -568,7 +568,7 @@ function resolveRmTarget(config, tools, cleanupTarget, options = {}) {
         ? matchedContainers
         : [...new Set([...containerNameCandidates(config, effectiveBranch), ...matchedContainers])];
     const controlRoots = containers.flatMap((container) => identities.map((identity) => sandboxControlPaths({
-        base: config.controlBase, repoRoot: config.repoRoot, project: config.project, container, identity
+        base: config.controlBase, project: config.project, container, identity
     }).root));
     const workspaceViewRoots = containers.flatMap((container) => identities.map((identity) => sandboxWorkspaceViewPaths({
         base: config.workspaceViewBase, project: config.project, container, identity
@@ -758,11 +758,35 @@ async function rmPurgeCore(config, tools, prompt = {}) {
     const confirm = prompt.confirm ?? p.confirm;
     const isCancel = prompt.isCancel ?? p.isCancel;
     p.intro(pc.cyan(`Removing all sandboxes for ${config.project}`));
+    const listed = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config), { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) });
+    const rows = [...listed.running, ...listed.nonRunning];
     const containers = runEngine(engine, 'docker', [
         'ps', '-a', '--filter', `label=${sandboxLabel(config)}`, '--format', '{{.Names}}'
     ]).split('\n').filter(Boolean);
+    const controlRoots = rows.flatMap((row) => {
+        if (!row.branch)
+            return [];
+        const identity = row.workspaceMode === 'task-bound' && row.taskId
+            ? { mode: 'task-bound', taskId: row.taskId }
+            : row.workspaceMode === 'branch-only'
+                ? { mode: 'branch-only' }
+                : null;
+        if (!identity)
+            return [];
+        return [sandboxControlPaths({
+                base: config.controlBase, project: config.project,
+                container: row.name, identity
+            }).root];
+    });
+    const completedTaskIds = [...new Set(rows
+            .filter((row) => row.workspaceMode === 'task-bound' && row.taskId)
+            .map((row) => row.taskId))];
     for (const name of containers)
         runSafeEngine(engine, 'docker', ['rm', '-f', name]);
+    if (!sandboxContainersRemoved(engine, containers)) {
+        throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${containers.join(', ')}`);
+    }
+    let cleanupCompleted = true;
     const worktrees = fs.existsSync(config.worktreeBase)
         ? fs.readdirSync(config.worktreeBase).map((entry) => path.join(config.worktreeBase, entry))
         : [];
@@ -773,6 +797,8 @@ async function rmPurgeCore(config, tools, prompt = {}) {
                 fs.rmSync(worktree, { recursive: true, force: true });
             runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
         }
+        else
+            cleanupCompleted = false;
     }
     for (const dir of projectToolDirs(config, tools))
         fs.rmSync(dir, { recursive: true, force: true });
@@ -780,14 +806,22 @@ async function rmPurgeCore(config, tools, prompt = {}) {
         const selected = await confirm({ message: `Remove all shell config dirs in ${config.shellConfigBase}?`, initialValue: true });
         if (!isCancel(selected) && selected)
             fs.rmSync(config.shellConfigBase, { recursive: true, force: true });
+        else
+            cleanupCompleted = false;
     }
     if (fs.existsSync(config.shareBase)) {
         const selected = await confirm({ message: `Remove all share dirs for project (${config.shareBase})?`, initialValue: true });
         if (!isCancel(selected) && selected)
             fs.rmSync(config.shareBase, { recursive: true, force: true });
+        else
+            cleanupCompleted = false;
     }
-    for (const base of [config.workspaceViewBase, config.controlBase]) {
-        fs.rmSync(path.join(base, config.project), { recursive: true, force: true });
+    fs.rmSync(path.join(config.workspaceViewBase, config.project), { recursive: true, force: true });
+    for (const root of new Set(controlRoots))
+        fs.rmSync(root, { recursive: true, force: true });
+    if (cleanupCompleted) {
+        for (const taskId of completedTaskIds)
+            releaseStaleShortIdRegistry(config.repoRoot, taskId);
     }
     const removeImage = await confirm({ message: `Remove image ${config.imageName}?`, initialValue: false });
     if (!isCancel(removeImage) && removeImage)

package/dist/lib/sandbox/workspace-identity.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { isRemovedHashShortIdInput } from '../task/short-id.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
 import { resolveTaskWorkspace } from './task-resolver.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 const SHORT_ID_RE = /^\d+$/;
@@ -38,6 +39,16 @@ function taskIdentity(repoRoot, taskId, registry) {
     }
     return { mode: 'task-bound', taskId, shortId: shortIds[0] };
 }
+function cleanupTaskId(requestedRef, repoRoot) {
+    if (TASK_ID_RE.test(requestedRef))
+        return requestedRef;
+    if (!SHORT_ID_RE.test(requestedRef))
+        return null;
+    const task = resolveTaskRef(requestedRef, { repoRoot });
+    if (!task.ok)
+        throw new Error(task.message);
+    return task.taskId;
+}
 export function resolveSandboxTarget(requestedRef, repoRoot) {
     if (isRemovedHashShortIdInput(requestedRef)) {
         throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
@@ -83,26 +94,27 @@ export function resolveSandboxCleanupTarget(requestedRef, repoRoot, options = {}
     if (isRemovedHashShortIdInput(requestedRef)) {
         throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
     }
-    if (TASK_ID_RE.test(requestedRef)) {
+    const taskId = cleanupTaskId(requestedRef, repoRoot);
+    if (taskId) {
         let task;
         try {
-            task = resolveTaskWorkspace(requestedRef, repoRoot);
+            task = resolveTaskWorkspace(taskId, repoRoot);
         }
         catch (error) {
-            if (!(error instanceof Error && error.message === `Task not found: ${requestedRef}`))
+            if (!(error instanceof Error && error.message === `Task not found: ${taskId}`))
                 throw error;
-            const branch = options.resolveMissingTask?.(requestedRef);
+            const branch = options.resolveMissingTask?.(taskId);
             if (!branch)
                 throw error;
             return {
                 requestedRef,
                 branch,
-                workspace: { mode: 'task-bound', taskId: requestedRef },
+                workspace: { mode: 'task-bound', taskId },
                 taskState: 'unknown'
             };
         }
         if (!options.allowProtected && (task.state === 'blocked' || task.state === 'archive')) {
-            throw new Error(`SANDBOX_CLEANUP_STATE_UNSUPPORTED: task ${requestedRef} is ${task.state}`);
+            throw new Error(`SANDBOX_CLEANUP_STATE_UNSUPPORTED: task ${taskId} is ${task.state}`);
         }
         return {
             requestedRef,

package/dist/lib/sandbox/workspace-view.js

@@ -2,7 +2,6 @@ import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolveTaskWorkspace } from './task-resolver.js';
-import { resolveTaskRuntimeRoot } from '../task/runtime-paths.js';
 import { createSandboxControlIdentitySentinel, writeSandboxControlIdentitySentinel } from './control/identity-sentinel.js';
 export const SANDBOX_WORKSPACE_VIEW_STATES = Object.freeze([
     'active',
@@ -27,7 +26,17 @@ export function sandboxWorkspaceViewPaths(params) {
 }
 export function sandboxControlPaths(params) {
     const root = params.identity.mode === 'task-bound'
-        ? path.join(resolveTaskRuntimeRoot(params.identity.taskId, { repoRoot: params.repoRoot }), 'sandbox-control')
+        ? (() => {
+            if (!/^TASK-\d{8}-\d{6}$/.test(params.identity.taskId)
+                || !params.project || path.basename(params.project) !== params.project || params.project === '.' || params.project === '..') {
+                throw new Error('SANDBOX_CONTROL_ROOT_INVALID');
+            }
+            const candidate = path.resolve(params.base, params.project, 'tasks', params.identity.taskId);
+            const relative = path.relative(path.resolve(params.base), candidate);
+            if (relative.startsWith('..') || path.isAbsolute(relative))
+                throw new Error('SANDBOX_CONTROL_ROOT_INVALID');
+            return candidate;
+        })()
         : (() => {
             const digest = createHash('sha256').update('branch-only').digest('hex').slice(0, 16);
             return path.resolve(params.base, params.project, params.container, digest);
@@ -50,6 +59,22 @@ function assertSafeDirectory(directory, expectedBase) {
         throw new Error(`Sandbox workspace view must not be a symbolic link: ${directory}`);
     }
 }
+function assertSafeTaskBoundControlRoot(basePath, root) {
+    const relative = path.relative(basePath, root);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Sandbox control root escapes its configured base: ${root}`);
+    }
+    if (fs.existsSync(basePath) && fs.lstatSync(basePath).isSymbolicLink()) {
+        throw new Error(`Sandbox control base must not be a symbolic link: ${basePath}`);
+    }
+    let current = basePath;
+    for (const segment of relative.split(path.sep)) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) {
+            throw new Error(`Sandbox control root must not contain a symbolic link: ${current}`);
+        }
+    }
+}
 function assertSafeMountTargetPath(target, worktreeRoot, canonicalWorktreeRoot) {
     const relative = path.relative(worktreeRoot, target);
     if (relative.startsWith('..') || path.isAbsolute(relative)) {
@@ -111,13 +136,16 @@ export function assertSandboxTaskSource(repoRoot, taskId) {
     }
     return canonical;
 }
-export function prepareSandboxWorkspaceMountTargets(worktreeRoot) {
+export function prepareSandboxWorkspaceMountTargets(worktreeRoot, taskId) {
     const resolvedWorktreeRoot = path.resolve(worktreeRoot);
     const canonicalWorktreeRoot = fs.realpathSync.native(resolvedWorktreeRoot);
     const workspaceRoot = path.resolve(resolvedWorktreeRoot, '.agents', 'workspace');
     const statePaths = sandboxWorkspaceViewStatePaths(workspaceRoot);
     const registryTarget = path.join(workspaceRoot, 'active', '.short-ids.json');
-    for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget]) {
+    const completedTaskTarget = taskId ? path.join(workspaceRoot, 'completed', taskId) : null;
+    if (taskId && !/^TASK-\d{8}-\d{6}$/.test(taskId))
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget, ...(completedTaskTarget ? [completedTaskTarget] : [])]) {
         assertSafeMountTargetPath(target, resolvedWorktreeRoot, canonicalWorktreeRoot);
     }
     fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 });
@@ -125,9 +153,52 @@ export function prepareSandboxWorkspaceMountTargets(worktreeRoot) {
         fs.mkdirSync(hostPath, { recursive: true, mode: 0o700 });
         fs.chmodSync(hostPath, 0o700);
     }
+    if (completedTaskTarget)
+        fs.mkdirSync(completedTaskTarget, { recursive: true, mode: 0o700 });
     fs.chmodSync(workspaceRoot, 0o700);
     fs.closeSync(fs.openSync(registryTarget, 'a', 0o600));
 }
+export function prepareSandboxCompletedTaskMountSource(repoRoot, taskId) {
+    if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    const workspaceRoot = path.resolve(repoRoot, '.agents', 'workspace');
+    fs.mkdirSync(path.join(workspaceRoot, 'completed'), { recursive: true, mode: 0o700 });
+    const completedRoot = path.join(workspaceRoot, 'completed');
+    const completedStat = fs.lstatSync(completedRoot);
+    if (!completedStat.isDirectory() || completedStat.isSymbolicLink())
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    const target = path.join(completedRoot, taskId);
+    try {
+        const stat = fs.lstatSync(target);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || fs.readdirSync(target).length > 0) {
+            throw new Error(`SANDBOX_COMPLETED_MOUNT_CONFLICT: ${target}`);
+        }
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        fs.mkdirSync(target, { mode: 0o700 });
+    }
+    return sandboxCompletedTaskMountSource(repoRoot, taskId);
+}
+export function sandboxCompletedTaskMountSource(repoRoot, taskId) {
+    if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    const source = path.resolve(repoRoot, '.agents', 'workspace', 'completed', taskId);
+    const stat = fs.lstatSync(source);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    const canonicalWorkspace = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace'));
+    const canonicalSource = fs.realpathSync.native(source);
+    const canonicalRepoRoot = fs.realpathSync.native(repoRoot);
+    const workspaceRelative = path.relative(canonicalRepoRoot, canonicalWorkspace);
+    const relative = path.relative(canonicalWorkspace, canonicalSource);
+    if (workspaceRelative.startsWith('..') || path.isAbsolute(workspaceRelative)
+        || path.dirname(canonicalSource) !== fs.realpathSync.native(path.dirname(source))
+        || relative.startsWith('..') || path.isAbsolute(relative))
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    return canonicalSource;
+}
 export function materializeSandboxWorkspaceView(params) {
     const projectRoot = path.resolve(params.base, params.project);
     const { root } = sandboxWorkspaceViewPaths(params);
@@ -157,7 +228,12 @@ export function materializeSandboxWorkspaceView(params) {
 }
 export function materializeSandboxControl(params) {
     const { root, channelDir, statusDir, processingDir, runtimeDir, manifestPath } = sandboxControlPaths(params);
-    assertSafeDirectory(root, params.identity.mode === 'task-bound' ? path.dirname(root) : path.resolve(params.base));
+    if (params.identity.mode === 'task-bound') {
+        assertSafeTaskBoundControlRoot(path.resolve(params.base), root);
+    }
+    else {
+        assertSafeDirectory(root, path.resolve(params.base));
+    }
     if (fs.existsSync(root)) {
         if (!params.replacementLease || path.resolve(params.replacementLease.root) !== root) {
             throw new Error('SANDBOX_CONTROL_REPLACEMENT_REQUIRED');
@@ -215,9 +291,16 @@ export function finalizeSandboxControlManifest(setup, identity) {
         containerIdentity: { id: identity.id, labels: { ...identity.labels } },
         authorityEvidence: identity.authorityEvidence
     };
+    const persistedManifest = {
+        ...manifest,
+        channelDir: 'channel',
+        publicStatusDir: 'public',
+        processingDir: 'processing',
+        runtimeDir: 'runtime'
+    };
     const temporary = `${setup.manifestPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
     try {
-        fs.writeFileSync(temporary, `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: 'wx' });
+        fs.writeFileSync(temporary, `${JSON.stringify(persistedManifest)}\n`, { mode: 0o600, flag: 'wx' });
         fs.renameSync(temporary, setup.manifestPath);
     }
     finally {

package/dist/lib/task/commands/ls.js

@@ -58,9 +58,9 @@ function collectTasks(repoRoot, state) {
     const dir = path.join(repoRoot, '.agents', 'workspace', state);
     if (!fs.existsSync(dir))
         return [];
-    // Short ids live only in the registry and only for active tasks; archived
-    // (blocked/completed) tasks have released their short id and render '-'.
-    const shortIdByTaskId = state === 'active' ? loadShortIdByTaskId(repoRoot) : new Map();
+    const shortIdByTaskId = state === 'active' || state === 'completed'
+        ? loadShortIdByTaskId(repoRoot)
+        : new Map();
     const rows = [];
     for (const entry of fs.readdirSync(dir).sort()) {
         if (!TASK_ID_RE.test(entry))