@fitlab-ai/agent-infra 0.11.13 → 0.11.14

package/dist/lib/sandbox/control/client.js

@@ -1,8 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { SANDBOX_CONTROL_ADMISSION_WINDOW_MS, SANDBOX_CONTROL_MAX_BYTES, SANDBOX_CONTROL_STATUS_STALE_MS, isSandboxControlFamily } from './protocol.js';
-import { isAgentClientId } from '../../agent-clients/types.js';
+import { SANDBOX_CONTROL_MAX_BYTES, SANDBOX_CONTROL_STATUS_STALE_MS, isSandboxControlFamily } from './protocol.js';
 import { readSandboxControlPayload, readSandboxControlStatus } from './state.js';
 import { accessSandboxTaskView, taskViewFromStatus } from './task-view.js';
 import { readSandboxControlIdentitySentinel } from './identity-sentinel.js';
@@ -29,7 +28,7 @@ function sleep(milliseconds) {
 function clientError(code, message, retryable, accepted = false, requestId = null) {
     throw new SandboxControlClientError({ code, message: `${code}: ${message}`, retryable }, accepted, requestId);
 }
-function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(), env = process.env) {
+function preflight(statusDir, taskViewEffect = null, now = Date.now(), env = process.env) {
     if (fs.existsSync(statusDir)) {
         let identity;
         try {
@@ -41,9 +40,6 @@ function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(
                 : 'SANDBOX_CONTROL_IDENTITY_MALFORMED';
             clientError(code, 'sandbox control identity is missing or invalid', false);
         }
-        if (identity.generation !== generation) {
-            clientError('SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH', 'sandbox control identity generation does not match the request', false);
-        }
         if (env.AGENT_INFRA_CONTROL_ROOT_ID && identity.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
             clientError('SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH', 'sandbox control identity root does not match the client configuration', false);
         }
@@ -55,9 +51,6 @@ function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(
     catch {
         clientError('SANDBOX_CONTROL_BROKER_UNAVAILABLE', 'broker status is missing or invalid', true);
     }
-    if (status.generation !== generation) {
-        clientError('SANDBOX_CONTROL_GENERATION_INVALID', 'broker status generation does not match this sandbox', false);
-    }
     if (now - status.updatedAt > SANDBOX_CONTROL_STATUS_STALE_MS || status.updatedAt > now + 1_000) {
         clientError('SANDBOX_CONTROL_BROKER_UNAVAILABLE', 'broker status heartbeat is stale', true);
     }
@@ -79,6 +72,7 @@ function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(
             clientError(access.reasonCode ?? 'SANDBOX_TASK_VIEW_DENIED', access.message ?? 'task view denied', false);
         }
     }
+    return status.generation;
 }
 function taskViewEffectForRequest(request) {
     if (request.family === 'task-lifecycle')
@@ -165,7 +159,7 @@ function exchangeSandboxControl(request, params) {
     const channelDir = params.channelDir ?? process.env.AGENT_INFRA_CONTROL_DIR ?? '/run/agent-infra/control';
     const statusDir = params.statusDir ?? process.env.AGENT_INFRA_CONTROL_STATUS_DIR ?? '/run/agent-infra/control-status';
     const taskViewEffect = taskViewEffectForRequest(request);
-    preflight(statusDir, request.generation, taskViewEffect);
+    const hostGeneration = preflight(statusDir, taskViewEffect);
     const identityPath = path.join(statusDir, 'identity.json');
     if (fs.existsSync(statusDir)) {
         const identity = readSandboxControlIdentitySentinel(statusDir);
@@ -213,7 +207,7 @@ function exchangeSandboxControl(request, params) {
             try {
                 // The request-specific terminal proves the broker claimed the request; preserve recovery evidence if marker cleanup won the race.
                 accepted = true;
-                response = readPublishedResponse(raw, request.id, channelDir, accepted, request.generation);
+                response = readPublishedResponse(raw, request.id, channelDir, accepted, hostGeneration);
                 malformedResponseRaw = null;
             }
             catch (error) {
@@ -239,7 +233,7 @@ function exchangeSandboxControl(request, params) {
         }
         if (!accepted) {
             try {
-                preflight(statusDir, request.generation, taskViewEffect);
+                preflight(statusDir, taskViewEffect);
             }
             catch (error) {
                 if (cancelPendingRequest(requestPath))
@@ -266,6 +260,9 @@ export function recoverSandboxControl(requestId, params = {}) {
             const config = loadConfig();
             const response = recoverSandboxControlFromHost(requestId, {
                 managedRoot: path.join(config.controlBase, config.project),
+                controlBase: config.controlBase,
+                project: config.project,
+                repoRoot: config.repoRoot,
                 timeoutMs: params.timeoutMs
             });
             if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') {
@@ -352,56 +349,24 @@ export function recoverSandboxControlFromChannel(requestId, params) {
     }
     clientError('SANDBOX_CONTROL_RESULT_UNKNOWN', 'request did not produce a final result; inspect domain state before retrying', false, accepted, requestId);
 }
-function authority(params) {
-    const token = params.token ?? process.env.AGENT_INFRA_CONTROL_TOKEN;
-    const generation = params.generation ?? process.env.AGENT_INFRA_CONTROL_GENERATION;
-    if (!token || !generation)
-        clientError('SANDBOX_CONTROL_UNAVAILABLE', 'control authority is missing', false);
-    return { token, generation };
-}
 export function requestSandboxControl(params) {
     if (!isSandboxControlFamily(params.family))
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' is not allowed`, false);
-    if (params.family === 'task-create' || params.family === 'agent-client') {
+    if (params.family === 'task-create') {
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' requires a typed request`, false);
     }
     if (params.args[1] === 'complete') {
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', 'complete must use task-finalization', false);
     }
-    const auth = authority(params);
-    const issuedAt = Date.now();
     const request = {
-        version: 4, id: randomUUID(), ...auth, issuedAt,
-        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+        version: 5, id: randomUUID(),
         family: params.family, args: params.args
     };
     return exchangeSandboxControl(request, params);
 }
-export function requestSandboxAgentOperation(params) {
-    if (!isAgentClientId(params.agentClient)) {
-        clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client id is invalid', false);
-    }
-    const auth = authority(params);
-    const issuedAt = Date.now();
-    const request = {
-        version: 4,
-        id: randomUUID(),
-        ...auth,
-        issuedAt,
-        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
-        family: 'agent-client',
-        agentClient: params.agentClient,
-        operation: params.operation,
-        payload: params.payload
-    };
-    return exchangeSandboxControl(request, params);
-}
 export function requestSandboxTaskCreate(params) {
-    const auth = authority(params);
-    const issuedAt = Date.now();
     const request = {
-        version: 4, id: randomUUID(), ...auth, issuedAt,
-        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+        version: 5, id: randomUUID(),
         family: 'task-create', candidate: params.candidate,
     };
     return exchangeSandboxControl(request, { ...params, timeoutMs: params.timeoutMs ?? 120_000 });

package/dist/lib/sandbox/control/executor.js

@@ -10,7 +10,6 @@ import { requestAuditFields, resultAuditFields, appendDiagnosticAudit, createSan
 import { validateSandboxControlIdentity } from './identity-sentinel.js';
 import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../../task/control-authority.js';
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest } from './lifecycle.js';
-import { executeAgentClientOperation, validateAgentClientOperation } from './agent-operation.js';
 function sameBrokerOwner(left, right) {
     return left.version === right.version
         && left.pid === right.pid
@@ -206,10 +205,6 @@ async function executeRequestInner(manifest, manifestPath, request, options = {}
             return taskCreateExecutionFailure(request.id, code, detail);
         }
     }
-    if (request.family === 'agent-client') {
-        validateAgentClientOperation(request, manifest);
-        return executeAgentClientOperation(request, manifest, manifestPath, options.agentClientOperation);
-    }
     const boundArgs = bindSandboxControlTask(request, manifest.taskId);
     let operation;
     try {
@@ -269,10 +264,11 @@ export async function runSandboxControlExecutor(requestPath, nonce) {
     const gate = await waitForGate(nonce);
     const gateOwner = gate.owner;
     process.disconnect?.();
-    const manifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
-    if (!manifestPath)
+    const requestedManifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
+    if (!requestedManifestPath)
         throw new Error('SANDBOX_CONTROL_EXECUTOR_MANIFEST_MISSING');
-    const manifest = readSandboxControlManifest(manifestPath);
+    const manifest = readSandboxControlManifest(requestedManifestPath);
+    const manifestPath = fs.realpathSync.native(requestedManifestPath);
     const identity = validateSandboxControlIdentity({
         publicStatusDir: manifest.publicStatusDir,
         root: path.dirname(path.resolve(manifestPath)),
@@ -324,13 +320,13 @@ export async function runSandboxControlExecutor(requestPath, nonce) {
                     return null;
                 }
             })()
-            : request.family === 'agent-client' ? request.operation : null;
+            : null;
         const context = createSandboxControlAuditContext(manifest, {
             requestId: request.id,
             family: request.family,
             operation: operation && typeof operation === 'object' && 'family' in operation && operation.family === 'task-lifecycle'
                 ? operation.request.intent
-                : request.family === 'agent-client' ? request.operation : null,
+                : null,
             phase: 'started-committed',
             outcome: 'in-progress'
         });

package/dist/lib/sandbox/control/host-recovery.js

@@ -19,30 +19,92 @@ function manifestDigest(manifest) {
         generation: manifest.generation, controlRootId: manifest.controlRootId
     });
 }
-function managedManifestPaths(managedRoot) {
-    if (!fs.existsSync(managedRoot))
-        return [];
-    const rootStat = fs.lstatSync(managedRoot);
-    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+function readManagedManifest(manifestPath) {
+    try {
+        return readSandboxControlManifest(manifestPath);
+    }
+    catch {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-    const result = [];
-    for (const container of fs.readdirSync(managedRoot, { withFileTypes: true })) {
-        if (!container.isDirectory() || container.isSymbolicLink())
+    }
+}
+function branchOnlyManifests(parentPath) {
+    const manifests = [];
+    for (const identity of fs.readdirSync(parentPath, { withFileTypes: true })) {
+        if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name))
             continue;
-        const containerPath = path.join(managedRoot, container.name);
-        for (const identity of fs.readdirSync(containerPath, { withFileTypes: true })) {
-            if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name))
-                continue;
-            result.push(path.join(containerPath, identity.name, 'manifest.json'));
+        manifests.push(readManagedManifest(path.join(parentPath, identity.name, 'manifest.json')));
+    }
+    return manifests;
+}
+function taskBoundManifests(params) {
+    assertDirectory(params.tasksRoot);
+    const canonicalManagedRoot = fs.realpathSync.native(path.dirname(params.tasksRoot));
+    const canonicalTasksRoot = fs.realpathSync.native(params.tasksRoot);
+    if (path.dirname(canonicalTasksRoot) !== canonicalManagedRoot)
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const canonicalRepoRoot = fs.realpathSync.native(params.repoRoot);
+    const manifests = [];
+    for (const task of fs.readdirSync(params.tasksRoot, { withFileTypes: true })) {
+        if (!/^TASK-\d{8}-\d{6}$/u.test(task.name))
+            continue;
+        if (!task.isDirectory() || task.isSymbolicLink())
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+        const taskRoot = path.join(params.tasksRoot, task.name);
+        assertNoSymlinkPath(params.controlBase, taskRoot);
+        const canonicalTaskRoot = fs.realpathSync.native(taskRoot);
+        if (path.dirname(canonicalTaskRoot) !== canonicalTasksRoot)
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+        const manifestPath = path.join(taskRoot, 'manifest.json');
+        if (!fs.existsSync(manifestPath))
+            continue;
+        const manifest = readManagedManifest(manifestPath);
+        if (manifest.mode !== 'task-bound' || manifest.taskId !== task.name || manifest.project !== params.project
+            || fs.realpathSync.native(manifest.repoRoot) !== canonicalRepoRoot
+            || path.dirname(fs.realpathSync.native(manifestPath)) !== canonicalTaskRoot) {
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
         }
+        manifests.push(manifest);
+    }
+    return manifests;
+}
+function managedManifestCandidates(params) {
+    const managedRoot = params.managedRoot;
+    const { controlBase, project, repoRoot } = params;
+    if (controlBase && project && path.resolve(managedRoot) !== path.resolve(controlBase, project)) {
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
-    return result;
+    if (!fs.existsSync(managedRoot))
+        return [];
+    assertDirectory(managedRoot);
+    return fs.readdirSync(managedRoot, { withFileTypes: true })
+        .flatMap((parent) => {
+        const parentPath = path.join(managedRoot, parent.name);
+        if (parent.name === 'tasks' && controlBase && project && repoRoot) {
+            return taskBoundManifests({ tasksRoot: parentPath, controlBase, project, repoRoot });
+        }
+        if (!parent.isDirectory() || parent.isSymbolicLink())
+            return [];
+        return branchOnlyManifests(parentPath);
+    });
 }
 function assertDirectory(directory) {
     const stat = fs.lstatSync(directory);
     if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
 }
+function assertNoSymlinkPath(root, target) {
+    const relative = path.relative(root, target);
+    if (relative.startsWith('..') || path.isAbsolute(relative))
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    let current = path.resolve(root);
+    if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink())
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink())
+            throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    }
+}
 function readAudit(manifest) {
     const root = path.dirname(path.resolve(manifest.publicStatusDir));
     const records = [];
@@ -80,12 +142,16 @@ function auditProof(manifest, requestId) {
         return [];
     return related;
 }
-function publishedEvidence(records, generation) {
+function publishedEvidence(records, manifest) {
     const publications = records.filter((record) => record.event === 'executor-result-published');
     let selected = null;
     let selectedSummary = null;
+    const digest = manifestDigest(manifest);
     for (const record of publications) {
-        if (record.version !== 2 || record.requestGeneration !== generation
+        if (record.version !== 2 || record.generation !== manifest.generation || record.identityDigest !== digest
+            || typeof record.requestFamily !== 'string'
+            || !['task-lifecycle', 'task-create'].includes(record.requestFamily)
+            || (record.sandboxTaskId !== null && typeof record.sandboxTaskId !== 'string')
             || !Number.isSafeInteger(record.exitCode)
             || !Number.isSafeInteger(record.outputBytes) || !Number.isSafeInteger(record.errorBytes)
             || typeof record.outputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.outputDigest)
@@ -93,7 +159,7 @@ function publishedEvidence(records, generation) {
             throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
         }
         const summary = JSON.stringify([
-            record.requestFamily ?? null, record.requestGeneration, record.exitCode,
+            record.requestFamily, record.sandboxTaskId, record.generation, record.identityDigest, record.exitCode,
             record.outputBytes, record.errorBytes, record.outputDigest, record.errorDigest
         ]);
         if (selectedSummary !== null && summary !== selectedSummary) {
@@ -102,6 +168,9 @@ function publishedEvidence(records, generation) {
         selected ??= record;
         selectedSummary ??= summary;
     }
+    if (selected && selected.sandboxTaskId !== manifest.taskId) {
+        throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
+    }
     return selected;
 }
 function verifiedResponse(manifest, requestId, records) {
@@ -131,7 +200,7 @@ function verifiedResponse(manifest, requestId, records) {
     if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN')
         return unknown(requestId);
     const evidencePath = path.join(manifest.processingDir, requestId, 'result.json');
-    const published = publishedEvidence(records, manifest.generation);
+    const published = publishedEvidence(records, manifest);
     if (!published)
         return unknown(requestId);
     let evidence = null;
@@ -187,15 +256,8 @@ export function recoverSandboxControlFromHost(requestId, params) {
     let candidates = [];
     while (Date.now() < deadline) {
         candidates = [];
-        for (const manifestPath of managedManifestPaths(params.managedRoot)) {
-            let manifest;
-            try {
-                manifest = readSandboxControlManifest(manifestPath);
-            }
-            catch {
-                throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-            }
-            if (manifest.project !== path.basename(path.resolve(params.managedRoot)) || !manifest.generation) {
+        for (const manifest of managedManifestCandidates(params)) {
+            if (manifest.project !== (params.project ?? path.basename(path.resolve(params.managedRoot))) || !manifest.generation) {
                 throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
             }
             const records = auditProof(manifest, requestId);

package/dist/lib/sandbox/control/lifecycle.js

@@ -975,35 +975,39 @@ function readSandboxControlManifestValue(manifestPath) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     const root = path.dirname(path.resolve(manifestPath));
     const canonicalRoot = fs.realpathSync.native(root);
-    const matchesControlChildPath = (candidatePath, name) => {
-        const resolved = path.resolve(candidatePath);
-        if (path.basename(resolved) !== name)
-            return false;
+    const resolveControlChildPath = (candidatePath, name) => {
+        if (path.isAbsolute(candidatePath) || candidatePath !== name)
+            return null;
+        const resolved = path.resolve(root, candidatePath);
         const expected = path.join(canonicalRoot, name);
         try {
-            return fs.realpathSync.native(resolved) === expected;
+            const stat = fs.lstatSync(resolved);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                return null;
+            return fs.realpathSync.native(resolved) === expected ? expected : null;
         }
         catch (error) {
             if (error.code !== 'ENOENT')
                 throw error;
             try {
-                return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot;
+                return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot ? expected : null;
             }
             catch (parentError) {
                 if (parentError.code !== 'ENOENT')
                     throw parentError;
-                return false;
+                return null;
             }
         }
     };
-    if (!matchesControlChildPath(candidate.channelDir, 'channel')
-        || !matchesControlChildPath(candidate.publicStatusDir, 'public')
-        || !matchesControlChildPath(candidate.processingDir, 'processing')) {
+    const channelDir = resolveControlChildPath(candidate.channelDir, 'channel');
+    const publicStatusDir = resolveControlChildPath(candidate.publicStatusDir, 'public');
+    const processingDir = resolveControlChildPath(candidate.processingDir, 'processing');
+    const runtimeDir = resolveControlChildPath(candidate.runtimeDir, 'runtime');
+    if (!channelDir || !publicStatusDir || !processingDir) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
-    if (!matchesControlChildPath(candidate.runtimeDir, 'runtime')) {
+    if (!runtimeDir)
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-    }
     const normalized = {
         engine: candidate.engine,
         repoRoot: candidate.repoRoot,
@@ -1021,10 +1025,10 @@ function readSandboxControlManifestValue(manifestPath) {
         token: candidate.token,
         generation: candidate.generation,
         controlRootId: candidate.controlRootId,
-        channelDir: candidate.channelDir,
-        publicStatusDir: candidate.publicStatusDir,
-        processingDir: candidate.processingDir,
-        runtimeDir: candidate.runtimeDir,
+        channelDir,
+        publicStatusDir,
+        processingDir,
+        runtimeDir,
     };
     return normalized;
 }

package/dist/lib/sandbox/control/protocol.js

@@ -1,16 +1,14 @@
 import { createHash } from 'node:crypto';
 import { validateTaskCreateCandidate } from '../../task/create.js';
-import { isAgentClientId } from '../../agent-clients/types.js';
 export const SANDBOX_CONTROL_MAX_BYTES = 64 * 1024;
 export const SANDBOX_CONTROL_MAX_LOGICAL_RECORDS = 1024;
 export const SANDBOX_CONTROL_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 export const SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES = 1024 * 1024;
 export const SANDBOX_CONTROL_RESERVATION_BYTES = SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES + 4 * 1024;
-export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create', 'agent-client'];
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create'];
 export const DEFAULT_SANDBOX_CONTROL_TIMING = Object.freeze({
     controlTickMs: 250,
     parkedBindingInitialMs: 1_000,
@@ -106,51 +104,26 @@ export function parseSandboxControlReservation(value) {
 export function isSandboxControlFamily(value) {
     return SANDBOX_CONTROL_FAMILIES.includes(value);
 }
-export function validateSandboxControlRequest(value, manifest, options = {}) {
+export function validateSandboxControlRequest(value, manifest) {
     if (!value || typeof value !== 'object' || Array.isArray(value)) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request must be an object');
     }
     const request = value;
-    if (request.version !== 4 || typeof request.id !== 'string'
-        || !/^[a-f0-9-]{16,64}$/.test(request.id) || request.token !== manifest.token
-        || typeof request.family !== 'string' || !isSandboxControlFamily(request.family)
-        || !Number.isSafeInteger(request.issuedAt) || !Number.isSafeInteger(request.expiresAt))
+    if (request.version !== 5 || typeof request.id !== 'string'
+        || !/^[a-f0-9-]{16,64}$/.test(request.id)
+        || typeof request.family !== 'string' || !isSandboxControlFamily(request.family))
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
-    if (request.generation !== manifest.generation) {
-        fail('SANDBOX_CONTROL_GENERATION_INVALID', 'request generation does not match the broker');
-    }
-    const issuedAt = request.issuedAt;
-    const expiresAt = request.expiresAt;
-    const now = options.now ?? Date.now();
-    if (expiresAt <= issuedAt || expiresAt - issuedAt > SANDBOX_CONTROL_ADMISSION_WINDOW_MS || issuedAt > now + SANDBOX_CONTROL_FUTURE_SKEW_MS) {
-        fail('SANDBOX_CONTROL_REQUEST_DEADLINE_INVALID', 'request admission deadline is invalid');
-    }
-    if (now > expiresAt)
-        fail('SANDBOX_CONTROL_REQUEST_EXPIRED', 'request admission deadline has passed', true);
     if (Buffer.byteLength(JSON.stringify(request), 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
         fail('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit');
     }
     if (request.family === 'task-create') {
-        const expected = ['candidate', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+        const expected = ['candidate', 'family', 'id', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
         }
         return { ...request, candidate: validateTaskCreateCandidate(request.candidate) };
     }
-    if (request.family === 'agent-client') {
-        const expected = ['agentClient', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'payload', 'token', 'version'];
-        if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
-            || !isAgentClientId(request.agentClient)
-            || typeof request.operation !== 'string' || !/^[a-z][a-z0-9.-]{0,63}$/u.test(request.operation)
-            || !request.payload || typeof request.payload !== 'object' || Array.isArray(request.payload)) {
-            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client request schema is invalid');
-        }
-        if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot coordinate agent clients');
-        }
-        return request;
-    }
-    const expected = ['args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    const expected = ['args', 'family', 'id', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
         || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
@@ -164,7 +137,7 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
     return request;
 }
 export function bindSandboxControlTask(request, taskId) {
-    if (request.family === 'task-create' || request.family === 'agent-client') {
+    if (request.family === 'task-create') {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
     }
     if (request.args.length === 0)
@@ -180,7 +153,6 @@ export function controlError(error) {
     const retryable = new Set([
         'SANDBOX_CONTROL_BUSY',
         'SANDBOX_CONTROL_HANDOFF_ACTIVE',
-        'SANDBOX_CONTROL_REQUEST_EXPIRED',
         'SANDBOX_WORKTREE_BINDING_LOST'
     ]).has(code);
     return { code, message, retryable };

package/dist/lib/sandbox/control/server.js

@@ -18,7 +18,6 @@ import { inspectSandboxControlContainer } from './container-identity.js';
 import { acquireSandboxControlBrokerStartup, garbageCollectSandboxControlRoot, isSandboxControlRootQuiescing, readSandboxControlManifest } from './lifecycle.js';
 import { nextSandboxControlBackoff } from './timing.js';
 import { readTaskFinalizationReceipt } from '../../task/finalization.js';
-import { recoverAgentClientOperation, validateAgentClientOperation } from './agent-operation.js';
 import { validateSandboxControlIdentity } from './identity-sentinel.js';
 import { mergeSandboxTaskView, taskViewForManifest } from './task-view.js';
 import { taskCreateOutputUnavailableResult } from '../../task/create-service.js';
@@ -28,10 +27,6 @@ function appendBrokerAudit(manifest, event, fields = {}) {
 function operationKey(request) {
     if (request.family === 'task-create')
         return 'create';
-    if (request.family === 'agent-client')
-        return request.operation;
-    if (request.family !== 'task-lifecycle')
-        return null;
     try {
         const operation = parseTaskControlOperation(request.family, request.args);
         return operation.family === 'task-lifecycle' ? operation.request.intent : null;
@@ -193,7 +188,7 @@ async function readRecoveryDomain(manifest, manifestPath, request, operation, te
         return { domain: null };
     const taskRef = 'args' in request ? request.args[0] ?? null : manifest.taskId;
     const output = parseControlOutput(payloadOutput);
-    if (!taskRef && operation.family !== 'task-create' && operation.family !== 'agent-client') {
+    if (!taskRef && operation.family !== 'task-create') {
         return { domain: null };
     }
     if (operation.family === 'task-lifecycle') {
@@ -221,14 +216,6 @@ async function readRecoveryDomain(manifest, manifestPath, request, operation, te
     if (operation.family === 'task-create') {
         return { domain: taskCreateDomainEvidence(manifest, output) };
     }
-    if (operation.family === 'agent-client' && request.family === 'agent-client') {
-        return { domain: recoverAgentClientOperation({
-                request,
-                manifest,
-                manifestPath,
-                stdout: payloadOutput
-            }) };
-    }
     return { domain: null };
 }
 function readCommittedCriticalPhases(manifest, requestId) {
@@ -443,11 +430,7 @@ async function recoverProcessing(manifest, manifestPath, broker, brokerOwns) {
             let terminalReconciled = false;
             try {
                 const rawRequest = JSON.parse(fs.readFileSync(path.join(processingDirectory, 'request.json'), 'utf8'));
-                request = validateSandboxControlRequest(rawRequest, manifest, {
-                    now: typeof rawRequest.issuedAt === 'number' ? rawRequest.issuedAt : undefined
-                });
-                if (request.family === 'agent-client')
-                    validateAgentClientOperation(request, manifest);
+                request = validateSandboxControlRequest(rawRequest, manifest);
             }
             catch {
                 // Missing or malformed request evidence remains fail-closed below.
@@ -926,8 +909,6 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         if (active)
                             throw new Error('SANDBOX_CONTROL_BUSY');
                         const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
-                        if (request.family === 'agent-client')
-                            validateAgentClientOperation(request, manifest);
                         validatedRequest = request;
                         criticalRequestPhase(manifest, request, 'validated', 'in-progress');
                         appendBrokerAudit(manifest, 'request-validated', {

package/dist/lib/sandbox/environment.js

@@ -5,14 +5,13 @@ export const SANDBOX_CONTROL_STATUS_MOUNT = '/run/agent-infra/control-status';
 const TASK_MARKER_KEYS = [
     'AGENT_INFRA_SANDBOX',
     'AGENT_INFRA_TASK_ID',
-    'AGENT_INFRA_CONTROL_TOKEN',
     'AGENT_INFRA_CONTROL_GENERATION',
     'AGENT_INFRA_CONTROL_DIR',
+    'AGENT_INFRA_CONTROL_ROOT_DIR',
     'AGENT_INFRA_CONTROL_STATUS_DIR',
     'AGENT_INFRA_RUNTIME_DIR'
 ];
 const TASK_CONTROL_MARKER_KEYS = [
-    'AGENT_INFRA_CONTROL_TOKEN',
     'AGENT_INFRA_CONTROL_GENERATION',
     'AGENT_INFRA_CONTROL_DIR',
     'AGENT_INFRA_CONTROL_STATUS_DIR'
@@ -77,7 +76,6 @@ export function hasSandboxControlMarker(env = process.env) {
 export function resolveSandboxControlTransport(env = process.env, options = {}) {
     const markerState = sandboxTaskMarkerState(env);
     const hasAnyMarker = markerState !== 'none'
-        || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING)
         || Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
     const fixedStatusDir = options.statusMountPath ?? SANDBOX_CONTROL_STATUS_MOUNT;
     const fixedStatusProbe = path.isAbsolute(fixedStatusDir)
@@ -98,6 +96,10 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
     if (!hasCompleteConfig) {
         return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
     }
+    if (markerState === 'task-bound'
+        && (!env.AGENT_INFRA_CONTROL_ROOT_DIR || !path.isAbsolute(env.AGENT_INFRA_CONTROL_ROOT_DIR))) {
+        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
+    }
     const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
     const configuredStatusProbe = configuredStatusDir && path.isAbsolute(configuredStatusDir)
         ? nativeDirectoryProbe(configuredStatusDir) : 'absent';
@@ -108,7 +110,7 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
         ? configuredStatusProbe === 'present' ? configuredStatusDir : null
         : fixedStatusMounted ? fixedStatusDir : null;
     const statusMounted = statusDir !== null;
-    if (env.AGENT_INFRA_EXECUTOR_MANIFEST || env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING) {
+    if (env.AGENT_INFRA_EXECUTOR_MANIFEST) {
         return { kind: 'fail-closed', reasonCode: 'TASK_CONTROL_TRANSPORT_INVALID' };
     }
     const taskBound = Boolean(env.AGENT_INFRA_TASK_ID);
@@ -124,9 +126,6 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
                     ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
                     : 'SANDBOX_CONTROL_IDENTITY_MALFORMED' };
         }
-        if (sentinel.generation !== env.AGENT_INFRA_CONTROL_GENERATION) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH' };
-        }
         if (sentinel.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH' };
         }
@@ -134,7 +133,7 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
             && (sentinel.taskId !== env.AGENT_INFRA_TASK_ID || !runtime)) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
         }
-        if (sentinel.mode === 'branch-only' && (taskBound || runtime)) {
+        if (sentinel.mode === 'branch-only' && (taskBound || runtime || Boolean(env.AGENT_INFRA_CONTROL_ROOT_DIR))) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
         }
         return { kind: options.localWorkflow ? 'sandbox-local' : 'broker-client', reasonCode: null };