@fitlab-ai/agent-infra 0.11.12 → 0.11.14

package/dist/lib/task/control-authority.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { isAgentClientId } from '../agent-clients/types.js';
+import { sandboxControlPaths } from '../sandbox/workspace-view.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
 import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, awaitOrchestrationDelegationActivation, beginOrResumeOrchestration, dispatchOrchestrationDelegation, OrchestrationStateError, pauseOrchestration, prepareOrchestrationDelegation, recoverPreparedOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from './orchestration.js';
 import { applyTaskFinalization } from './finalization.js';
@@ -25,21 +26,14 @@ function absolute(name, value) {
         invalidContext(`${name} must be absolute`);
     return path.resolve(value);
 }
-function binding(value) {
-    if (value === null || value === undefined)
-        return value;
-    if (!/^[a-f0-9]{64}$/u.test(value.instanceDigest) || !value.controlGeneration) {
-        invalidContext('controller binding is invalid');
-    }
-    return value;
-}
 export function createDirectHostExecutionContext(params) {
     return {
         source: 'direct-host',
         mode: 'direct-host',
         repoRoot: absolute('repoRoot', params.repoRoot),
-        ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) }),
-        ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
+        ...(params.controlBase === undefined ? {} : { controlBase: absolute('controlBase', params.controlBase) }),
+        ...(params.project === undefined ? {} : { project: params.project }),
+        ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) })
     };
 }
 export function createSandboxExecutorExecutionContext(params) {
@@ -59,8 +53,7 @@ export function createSandboxExecutorExecutionContext(params) {
         taskId: params.taskId,
         generation: params.generation,
         manifestPath: absolute('manifestPath', params.manifestPath),
-        requestId: params.requestId,
-        ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
+        requestId: params.requestId
     };
 }
 export function assertTaskControlExecutionContext(context) {
@@ -70,7 +63,10 @@ export function assertTaskControlExecutionContext(context) {
         absolute('repoRoot', context.repoRoot);
         if (context.runtimeDir !== undefined)
             absolute('runtimeDir', context.runtimeDir);
-        binding(context.controllerBinding);
+        if (Boolean(context.controlBase) !== Boolean(context.project))
+            invalidContext('control configuration is incomplete');
+        if (context.controlBase !== undefined)
+            absolute('controlBase', context.controlBase);
         return;
     }
     if (context.mode !== 'task-bound-sandbox' || !/^TASK-\d{8}-\d{6}$/u.test(context.taskId)
@@ -84,7 +80,6 @@ export function assertTaskControlExecutionContext(context) {
     if (path.resolve(context.runtimeDir) !== path.join(path.dirname(path.resolve(context.manifestPath)), 'runtime')) {
         invalidContext('runtimeDir is not bound to the manifest control root');
     }
-    binding(context.controllerBinding);
 }
 function boundTaskRef(context, taskRef) {
     return context.source === 'sandbox-executor' ? context.taskId : taskRef;
@@ -115,6 +110,8 @@ function lifecycleTaskId(request, repoRoot) {
     }
 }
 async function applyLifecycleWithAuthority(context, request) {
+    const taskId = lifecycleTaskId(request, context.repoRoot);
+    const controlRoot = taskId ? controlRootForTask(context, taskId) : undefined;
     const execute = async (underTaskLock = false) => {
         if (request.intent === 'recover-started') {
             const adapter = isAgentClientId(request.agent)
@@ -130,10 +127,17 @@ async function applyLifecycleWithAuthority(context, request) {
             return adapter.recoverStarted(request, { repoRoot: context.repoRoot });
         }
         return underTaskLock
-            ? applyTaskLifecycleWithinTaskLock(request, { repoRoot: context.repoRoot }, taskId)
-            : applyTaskLifecycle(request, { repoRoot: context.repoRoot });
+            ? applyTaskLifecycleWithinTaskLock(request, {
+                repoRoot: context.repoRoot,
+                ...(controlRoot ? { controlRoot } : {}),
+                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+            }, taskId)
+            : applyTaskLifecycle(request, {
+                repoRoot: context.repoRoot,
+                ...(controlRoot ? { controlRoot } : {}),
+                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+            });
     };
-    const taskId = lifecycleTaskId(request, context.repoRoot);
     if (!taskId)
         return await execute();
     try {
@@ -153,6 +157,18 @@ async function applyLifecycleWithAuthority(context, request) {
         return taskLifecycleFailure(request, { code: error.code, message: error.message }, taskId);
     }
 }
+function controlRootForTask(context, taskId) {
+    if (context.source === 'sandbox-executor')
+        return path.dirname(context.manifestPath);
+    if (!context.controlBase || !context.project)
+        return undefined;
+    return sandboxControlPaths({
+        base: context.controlBase,
+        project: context.project,
+        container: '',
+        identity: { mode: 'task-bound', taskId }
+    }).root;
+}
 function orchestration(context, operation) {
     const taskRef = boundTaskRef(context, operation.taskRef);
     const input = operation.input;
@@ -219,6 +235,10 @@ export function dispatchTaskControlOperation(context, operation) {
         });
     }
     if (operation.family === 'task-finalization') {
+        const resolved = resolveTaskRef(boundTaskRef(context, operation.request.taskRef), { repoRoot: context.repoRoot });
+        const controlRoot = context.source === 'sandbox-executor'
+            ? path.dirname(context.manifestPath)
+            : resolved.ok ? controlRootForTask(context, resolved.taskId) : undefined;
         return applyTaskFinalization({
             ...operation.request,
             taskRef: boundTaskRef(context, operation.request.taskRef)
@@ -228,6 +248,8 @@ export function dispatchTaskControlOperation(context, operation) {
                 controlBinding: { generation: context.generation, requestId: context.requestId },
                 manifestPath: context.manifestPath
             } : {}),
+            ...(controlRoot ? { controlRoot } : {}),
+            ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {}),
             preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
         });
     }
@@ -320,6 +342,8 @@ export function parseTaskControlOperation(family, args) {
     const taskRef = args[0];
     const intent = args[1];
     if (family === 'task-lifecycle') {
+        if (intent === 'complete')
+            operationInvalid('complete must use task-finalization');
         const values = parseValues(args, 2, LIFECYCLE_FLAGS);
         const agent = normalizeAgentToken(value(values, '--agent') ?? '');
         if (!agent)

package/dist/lib/task/control-recovery.js

@@ -16,12 +16,10 @@ export function parseControlOutput(output) {
 export const SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES = Object.freeze([
     'completed', 'evidence-written', 'publish-authorized'
 ]);
-const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'complete', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'];
+const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'];
 export const SANDBOX_CONTROL_RECOVERY_OPERATIONS = Object.freeze([
     ...LIFECYCLE_INTENTS.map((intent) => ({ family: 'task-lifecycle', intent, class: 'lifecycle-mutation' })),
-    { family: 'task-finalization', intent: 'complete', class: 'finalization' },
-    { family: 'task-create', intent: 'create', class: 'task-create' },
-    ...['controller.close', 'controller.verify'].map((intent) => ({ family: 'agent-client', intent, class: 'agent-client-operation' }))
+    { family: 'task-create', intent: 'create', class: 'task-create' }
 ]);
 export function digestControlRecoveryIntent(family, intent) {
     return createHash('sha256').update(`${family}\0${intent}`, 'utf8').digest('hex');

package/dist/lib/task/finalization.js

@@ -894,7 +894,13 @@ async function prepareUnderLock(request, taskId, options) {
             receipt = updateReceipt(repoRoot, receipt, { lifecycle: 'done', lastError: null });
         }
         else {
-            const result = lifecycle({ taskRef: taskId, intent: 'complete', agent: request.agent }, { repoRoot, prepareOnly: true, ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {}) });
+            const result = lifecycle({ taskRef: taskId, intent: 'complete', agent: request.agent }, {
+                repoRoot,
+                prepareOnly: true,
+                ...(options.controlRoot ? { controlRoot: options.controlRoot } : {}),
+                ...(options.controlProject ? { controlProject: options.controlProject } : {}),
+                ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {})
+            });
             lifecycleResult = lifecycleStep(result);
             if (result.status !== 'applied' && result.status !== 'no-op') {
                 receipt = updateReceipt(repoRoot, receipt, { lifecycle: 'pending', lastError: lifecycleResult.error });
@@ -1037,7 +1043,12 @@ async function commitPreparedTaskFinalization(request, options) {
                 });
             receipt = updateReceipt(repoRoot, receipt, { verification: 'pending' });
             const lifecycleRequest = { taskRef: resolved.taskId, intent: 'complete', agent: request.agent };
-            const lifecycleOptions = { repoRoot, ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {}) };
+            const lifecycleOptions = {
+                repoRoot,
+                ...(options.controlRoot ? { controlRoot: options.controlRoot } : {}),
+                ...(options.controlProject ? { controlProject: options.controlProject } : {}),
+                ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {})
+            };
             const result = options.lifecycle
                 ? options.lifecycle(lifecycleRequest, lifecycleOptions)
                 : applyTaskLifecycleWithinTaskLock(lifecycleRequest, lifecycleOptions, resolved.taskId);
@@ -1133,6 +1144,20 @@ async function applyTaskFinalization(request, options) {
     const prepared = await prepareTaskFinalization(request, options);
     if (prepared.status !== 'prepared')
         return prepared;
+    if (options.beforeLifecycle) {
+        try {
+            await options.beforeLifecycle(prepared.taskId);
+        }
+        catch (error) {
+            const detail = errorOf(error, 'TASK_FINALIZATION_PRE_LIFECYCLE_FAILED', true);
+            return failed(prepared.taskId, detail, {
+                changed: prepared.changed,
+                completedSteps: prepared.completedSteps,
+                pendingSteps: prepared.pendingSteps,
+                warnings: prepared.warnings
+            });
+        }
+    }
     return commitPreparedTaskFinalization(request, options);
 }
 export { applyFinalizationReceiptMutation, commitPreparedTaskFinalization, applyTaskFinalization, prepareTaskFinalization, issueCapability as createFinalizationCapability, readTaskFinalizationReceipt, terminalResult };