@fitlab-ai/agent-infra 0.11.13 → 0.11.14

package/dist/lib/sandbox/mounts.js

@@ -2,10 +2,13 @@ import path from 'node:path';
 import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
 import { sandboxWorkspaceViewStatePaths } from './workspace-view.js';
 import { SANDBOX_GIT_COMMON_DIR } from './git-metadata.js';
-export function sandboxCoreBindMounts(config, branch, overrides) {
-    const taskSources = overrides.taskSources ?? [];
-    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
-    const workspaceMounts = sandboxWorkspaceViewStatePaths(overrides.workspaceViewRoot).map(({ state, hostPath }) => taskBound && state === 'active'
+function workspaceStateMounts(workspaceViewRoot, taskBound) {
+    return sandboxWorkspaceViewStatePaths(workspaceViewRoot)
+        // The writable completed-task mount below is nested under this path. Keep
+        // the worktree target visible so Docker can mount it without creating a
+        // mountpoint inside a read-only parent bind mount.
+        .filter(({ state }) => !(taskBound && state === 'completed'))
+        .map(({ state, hostPath }) => taskBound && state === 'active'
         ? {
             hostPaths: [path.join(hostPath, '.short-ids.json')],
             containerPath: '/workspace/.agents/workspace/active/.short-ids.json',
@@ -16,17 +19,69 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: path.posix.join('/workspace/.agents/workspace', state),
             readOnly: true
         });
+}
+function assertGitMetadataPair(overrides) {
     if (Boolean(overrides.gitCommonDir) !== Boolean(overrides.worktreeGitFile)) {
         throw new Error('SANDBOX_GIT_METADATA_INCOMPLETE');
     }
-    const gitCommonMount = overrides.gitCommonDir
-        ? { hostPaths: [overrides.gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }
-        : null;
-    const worktreeGitFileMount = overrides.worktreeGitFile
-        ? { hostPaths: [overrides.worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }
-        : null;
+}
+function gitCommonMount(gitCommonDir) {
+    return gitCommonDir ? [{ hostPaths: [gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }] : [];
+}
+function worktreeGitFileMount(worktreeGitFile) {
+    return worktreeGitFile ? [{ hostPaths: [worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }] : [];
+}
+function taskWorkspaceMounts(taskSources, taskBound, overrides) {
+    if (!taskBound)
+        return [];
+    const taskId = overrides.taskId;
+    const mounts = [{
+            hostPaths: taskSources,
+            containerPath: path.posix.join('/workspace/.agents/workspace/active', taskId),
+            readOnly: false
+        }];
+    if (overrides.completedTaskSource)
+        mounts.push({
+            hostPaths: [overrides.completedTaskSource],
+            containerPath: path.posix.join('/workspace/.agents/workspace/completed', taskId),
+            readOnly: false
+        });
+    return mounts;
+}
+function sharedMounts(config, branch, shellConfigHostDir) {
+    return [{
+            hostPaths: [shareCommonDir(config)], containerPath: '/share/common', readOnly: false
+        }, {
+            hostPaths: [shareBranchDir(config, branch)], containerPath: '/share/branch', readOnly: false
+        }, {
+            hostPaths: shellConfigHostDir ? [shellConfigHostDir] : shellConfigDirCandidates(config, branch),
+            containerPath: '/home/devuser/.host-shell-config', readOnly: true
+        }];
+}
+function controlMounts(overrides, taskBound) {
+    const mounts = [{
+            hostPaths: [overrides.controlStatusDir], containerPath: '/run/agent-infra/control-status', readOnly: true
+        }, {
+            hostPaths: [overrides.controlDir], containerPath: '/run/agent-infra/control', readOnly: false
+        }];
+    if (taskBound && overrides.runtimeDir)
+        mounts.push({
+            hostPaths: [overrides.runtimeDir], containerPath: '/run/agent-infra/runtime', readOnly: false
+        });
+    if (taskBound && overrides.controlRootDir)
+        mounts.push({
+            hostPaths: [overrides.controlRootDir], containerPath: '/run/agent-infra/control-root', readOnly: false
+        });
+    return mounts;
+}
+export function sandboxCoreBindMounts(config, branch, overrides) {
+    const taskSources = overrides.taskSources ?? [];
+    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
+    assertGitMetadataPair(overrides);
+    if (taskBound && !overrides.controlRootDir)
+        throw new Error('SANDBOX_CONTROL_ROOT_MISSING');
     const mounts = [
-        ...(gitCommonMount ? [gitCommonMount] : []),
+        ...gitCommonMount(overrides.gitCommonDir),
         {
             hostPaths: overrides.worktree
                 ? [overrides.worktree]
@@ -34,55 +89,12 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: '/workspace',
             readOnly: false
         },
-        ...(worktreeGitFileMount ? [worktreeGitFileMount] : []),
-        ...workspaceMounts,
+        ...worktreeGitFileMount(overrides.worktreeGitFile),
+        ...workspaceStateMounts(overrides.workspaceViewRoot, taskBound),
+        ...taskWorkspaceMounts(taskSources, taskBound, overrides),
+        ...sharedMounts(config, branch, overrides.shellConfigHostDir),
+        ...controlMounts(overrides, taskBound)
     ];
-    if (taskBound) {
-        const taskMountPath = path.posix.join('/workspace/.agents/workspace/active', overrides.taskId);
-        mounts.push({
-            hostPaths: taskSources,
-            containerPath: taskMountPath,
-            readOnly: false
-        });
-        if (overrides.completedTaskSource) {
-            mounts.push({
-                hostPaths: [overrides.completedTaskSource],
-                containerPath: path.posix.join('/workspace/.agents/workspace/completed', overrides.taskId),
-                readOnly: false
-            });
-        }
-    }
-    mounts.push({
-        hostPaths: [shareCommonDir(config)],
-        containerPath: '/share/common',
-        readOnly: false
-    }, {
-        hostPaths: [shareBranchDir(config, branch)],
-        containerPath: '/share/branch',
-        readOnly: false
-    }, {
-        hostPaths: overrides.shellConfigHostDir
-            ? [overrides.shellConfigHostDir]
-            : shellConfigDirCandidates(config, branch),
-        containerPath: '/home/devuser/.host-shell-config',
-        readOnly: true
-    });
-    mounts.push({
-        hostPaths: [overrides.controlStatusDir],
-        containerPath: '/run/agent-infra/control-status',
-        readOnly: true
-    }, {
-        hostPaths: [overrides.controlDir],
-        containerPath: '/run/agent-infra/control',
-        readOnly: false
-    });
-    if (taskBound && overrides.runtimeDir) {
-        mounts.push({
-            hostPaths: [overrides.runtimeDir],
-            containerPath: '/run/agent-infra/runtime',
-            readOnly: false
-        });
-    }
     return mounts;
 }
 //# sourceMappingURL=mounts.js.map

package/dist/lib/sandbox/recovery.js

@@ -174,7 +174,6 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
 async function ensureSandboxControlBroker(params) {
     const control = sandboxControlPaths({
         base: params.config.controlBase ?? path.join(params.config.home, '.agent-infra', 'sandbox-control'),
-        repoRoot: params.config.repoRoot,
         project: params.config.project,
         container: params.container,
         identity: params.workspace
@@ -523,7 +522,6 @@ function expectedMounts(params) {
     });
     const control = sandboxControlPaths({
         base: config.controlBase ?? path.join(config.home, '.agent-infra', 'sandbox-control'),
-        repoRoot: config.repoRoot,
         project: config.project,
         container: params.container,
         identity: params.workspace
@@ -546,6 +544,7 @@ function expectedMounts(params) {
             }),
         workspaceViewRoot: view.root,
         controlDir: control.channelDir,
+        ...(params.workspace.mode === 'task-bound' ? { controlRootDir: control.root } : {}),
         controlStatusDir: control.statusDir,
         ...(taskSources === null
             ? {}
@@ -926,7 +925,7 @@ export async function ensureSandboxReady(params) {
             let completedReentry = null;
             if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
                 const control = sandboxControlPaths({
-                    base: params.config.controlBase, repoRoot: params.config.repoRoot, project: params.config.project,
+                    base: params.config.controlBase, project: params.config.project,
                     container: params.row.name, identity: params.workspace
                 });
                 const manifest = readSandboxControlManifest(control.manifestPath);

package/dist/lib/sandbox/removal.js

@@ -568,7 +568,7 @@ function resolveRmTarget(config, tools, cleanupTarget, options = {}) {
         ? matchedContainers
         : [...new Set([...containerNameCandidates(config, effectiveBranch), ...matchedContainers])];
     const controlRoots = containers.flatMap((container) => identities.map((identity) => sandboxControlPaths({
-        base: config.controlBase, repoRoot: config.repoRoot, project: config.project, container, identity
+        base: config.controlBase, project: config.project, container, identity
     }).root));
     const workspaceViewRoots = containers.flatMap((container) => identities.map((identity) => sandboxWorkspaceViewPaths({
         base: config.workspaceViewBase, project: config.project, container, identity
@@ -763,6 +763,21 @@ async function rmPurgeCore(config, tools, prompt = {}) {
     const containers = runEngine(engine, 'docker', [
         'ps', '-a', '--filter', `label=${sandboxLabel(config)}`, '--format', '{{.Names}}'
     ]).split('\n').filter(Boolean);
+    const controlRoots = rows.flatMap((row) => {
+        if (!row.branch)
+            return [];
+        const identity = row.workspaceMode === 'task-bound' && row.taskId
+            ? { mode: 'task-bound', taskId: row.taskId }
+            : row.workspaceMode === 'branch-only'
+                ? { mode: 'branch-only' }
+                : null;
+        if (!identity)
+            return [];
+        return [sandboxControlPaths({
+                base: config.controlBase, project: config.project,
+                container: row.name, identity
+            }).root];
+    });
     const completedTaskIds = [...new Set(rows
             .filter((row) => row.workspaceMode === 'task-bound' && row.taskId)
             .map((row) => row.taskId))];
@@ -801,9 +816,9 @@ async function rmPurgeCore(config, tools, prompt = {}) {
         else
             cleanupCompleted = false;
     }
-    for (const base of [config.workspaceViewBase, config.controlBase]) {
-        fs.rmSync(path.join(base, config.project), { recursive: true, force: true });
-    }
+    fs.rmSync(path.join(config.workspaceViewBase, config.project), { recursive: true, force: true });
+    for (const root of new Set(controlRoots))
+        fs.rmSync(root, { recursive: true, force: true });
     if (cleanupCompleted) {
         for (const taskId of completedTaskIds)
             releaseStaleShortIdRegistry(config.repoRoot, taskId);

package/dist/lib/sandbox/workspace-view.js

@@ -2,7 +2,6 @@ import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolveTaskWorkspace } from './task-resolver.js';
-import { resolveTaskRuntimeRoot } from '../task/runtime-paths.js';
 import { createSandboxControlIdentitySentinel, writeSandboxControlIdentitySentinel } from './control/identity-sentinel.js';
 export const SANDBOX_WORKSPACE_VIEW_STATES = Object.freeze([
     'active',
@@ -27,7 +26,17 @@ export function sandboxWorkspaceViewPaths(params) {
 }
 export function sandboxControlPaths(params) {
     const root = params.identity.mode === 'task-bound'
-        ? path.join(resolveTaskRuntimeRoot(params.identity.taskId, { repoRoot: params.repoRoot }), 'sandbox-control')
+        ? (() => {
+            if (!/^TASK-\d{8}-\d{6}$/.test(params.identity.taskId)
+                || !params.project || path.basename(params.project) !== params.project || params.project === '.' || params.project === '..') {
+                throw new Error('SANDBOX_CONTROL_ROOT_INVALID');
+            }
+            const candidate = path.resolve(params.base, params.project, 'tasks', params.identity.taskId);
+            const relative = path.relative(path.resolve(params.base), candidate);
+            if (relative.startsWith('..') || path.isAbsolute(relative))
+                throw new Error('SANDBOX_CONTROL_ROOT_INVALID');
+            return candidate;
+        })()
         : (() => {
             const digest = createHash('sha256').update('branch-only').digest('hex').slice(0, 16);
             return path.resolve(params.base, params.project, params.container, digest);
@@ -50,6 +59,22 @@ function assertSafeDirectory(directory, expectedBase) {
         throw new Error(`Sandbox workspace view must not be a symbolic link: ${directory}`);
     }
 }
+function assertSafeTaskBoundControlRoot(basePath, root) {
+    const relative = path.relative(basePath, root);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Sandbox control root escapes its configured base: ${root}`);
+    }
+    if (fs.existsSync(basePath) && fs.lstatSync(basePath).isSymbolicLink()) {
+        throw new Error(`Sandbox control base must not be a symbolic link: ${basePath}`);
+    }
+    let current = basePath;
+    for (const segment of relative.split(path.sep)) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) {
+            throw new Error(`Sandbox control root must not contain a symbolic link: ${current}`);
+        }
+    }
+}
 function assertSafeMountTargetPath(target, worktreeRoot, canonicalWorktreeRoot) {
     const relative = path.relative(worktreeRoot, target);
     if (relative.startsWith('..') || path.isAbsolute(relative)) {
@@ -203,7 +228,12 @@ export function materializeSandboxWorkspaceView(params) {
 }
 export function materializeSandboxControl(params) {
     const { root, channelDir, statusDir, processingDir, runtimeDir, manifestPath } = sandboxControlPaths(params);
-    assertSafeDirectory(root, params.identity.mode === 'task-bound' ? path.dirname(root) : path.resolve(params.base));
+    if (params.identity.mode === 'task-bound') {
+        assertSafeTaskBoundControlRoot(path.resolve(params.base), root);
+    }
+    else {
+        assertSafeDirectory(root, path.resolve(params.base));
+    }
     if (fs.existsSync(root)) {
         if (!params.replacementLease || path.resolve(params.replacementLease.root) !== root) {
             throw new Error('SANDBOX_CONTROL_REPLACEMENT_REQUIRED');
@@ -261,9 +291,16 @@ export function finalizeSandboxControlManifest(setup, identity) {
         containerIdentity: { id: identity.id, labels: { ...identity.labels } },
         authorityEvidence: identity.authorityEvidence
     };
+    const persistedManifest = {
+        ...manifest,
+        channelDir: 'channel',
+        publicStatusDir: 'public',
+        processingDir: 'processing',
+        runtimeDir: 'runtime'
+    };
     const temporary = `${setup.manifestPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
     try {
-        fs.writeFileSync(temporary, `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: 'wx' });
+        fs.writeFileSync(temporary, `${JSON.stringify(persistedManifest)}\n`, { mode: 0o600, flag: 'wx' });
         fs.renameSync(temporary, setup.manifestPath);
     }
     finally {

package/dist/lib/task/control-authority.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { isAgentClientId } from '../agent-clients/types.js';
+import { sandboxControlPaths } from '../sandbox/workspace-view.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
 import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, awaitOrchestrationDelegationActivation, beginOrResumeOrchestration, dispatchOrchestrationDelegation, OrchestrationStateError, pauseOrchestration, prepareOrchestrationDelegation, recoverPreparedOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from './orchestration.js';
 import { applyTaskFinalization } from './finalization.js';
@@ -25,21 +26,14 @@ function absolute(name, value) {
         invalidContext(`${name} must be absolute`);
     return path.resolve(value);
 }
-function binding(value) {
-    if (value === null || value === undefined)
-        return value;
-    if (!/^[a-f0-9]{64}$/u.test(value.instanceDigest) || !value.controlGeneration) {
-        invalidContext('controller binding is invalid');
-    }
-    return value;
-}
 export function createDirectHostExecutionContext(params) {
     return {
         source: 'direct-host',
         mode: 'direct-host',
         repoRoot: absolute('repoRoot', params.repoRoot),
-        ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) }),
-        ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
+        ...(params.controlBase === undefined ? {} : { controlBase: absolute('controlBase', params.controlBase) }),
+        ...(params.project === undefined ? {} : { project: params.project }),
+        ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) })
     };
 }
 export function createSandboxExecutorExecutionContext(params) {
@@ -59,8 +53,7 @@ export function createSandboxExecutorExecutionContext(params) {
         taskId: params.taskId,
         generation: params.generation,
         manifestPath: absolute('manifestPath', params.manifestPath),
-        requestId: params.requestId,
-        ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
+        requestId: params.requestId
     };
 }
 export function assertTaskControlExecutionContext(context) {
@@ -70,7 +63,10 @@ export function assertTaskControlExecutionContext(context) {
         absolute('repoRoot', context.repoRoot);
         if (context.runtimeDir !== undefined)
             absolute('runtimeDir', context.runtimeDir);
-        binding(context.controllerBinding);
+        if (Boolean(context.controlBase) !== Boolean(context.project))
+            invalidContext('control configuration is incomplete');
+        if (context.controlBase !== undefined)
+            absolute('controlBase', context.controlBase);
         return;
     }
     if (context.mode !== 'task-bound-sandbox' || !/^TASK-\d{8}-\d{6}$/u.test(context.taskId)
@@ -84,7 +80,6 @@ export function assertTaskControlExecutionContext(context) {
     if (path.resolve(context.runtimeDir) !== path.join(path.dirname(path.resolve(context.manifestPath)), 'runtime')) {
         invalidContext('runtimeDir is not bound to the manifest control root');
     }
-    binding(context.controllerBinding);
 }
 function boundTaskRef(context, taskRef) {
     return context.source === 'sandbox-executor' ? context.taskId : taskRef;
@@ -115,6 +110,8 @@ function lifecycleTaskId(request, repoRoot) {
     }
 }
 async function applyLifecycleWithAuthority(context, request) {
+    const taskId = lifecycleTaskId(request, context.repoRoot);
+    const controlRoot = taskId ? controlRootForTask(context, taskId) : undefined;
     const execute = async (underTaskLock = false) => {
         if (request.intent === 'recover-started') {
             const adapter = isAgentClientId(request.agent)
@@ -130,10 +127,17 @@ async function applyLifecycleWithAuthority(context, request) {
             return adapter.recoverStarted(request, { repoRoot: context.repoRoot });
         }
         return underTaskLock
-            ? applyTaskLifecycleWithinTaskLock(request, { repoRoot: context.repoRoot }, taskId)
-            : applyTaskLifecycle(request, { repoRoot: context.repoRoot });
+            ? applyTaskLifecycleWithinTaskLock(request, {
+                repoRoot: context.repoRoot,
+                ...(controlRoot ? { controlRoot } : {}),
+                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+            }, taskId)
+            : applyTaskLifecycle(request, {
+                repoRoot: context.repoRoot,
+                ...(controlRoot ? { controlRoot } : {}),
+                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+            });
     };
-    const taskId = lifecycleTaskId(request, context.repoRoot);
     if (!taskId)
         return await execute();
     try {
@@ -153,6 +157,18 @@ async function applyLifecycleWithAuthority(context, request) {
         return taskLifecycleFailure(request, { code: error.code, message: error.message }, taskId);
     }
 }
+function controlRootForTask(context, taskId) {
+    if (context.source === 'sandbox-executor')
+        return path.dirname(context.manifestPath);
+    if (!context.controlBase || !context.project)
+        return undefined;
+    return sandboxControlPaths({
+        base: context.controlBase,
+        project: context.project,
+        container: '',
+        identity: { mode: 'task-bound', taskId }
+    }).root;
+}
 function orchestration(context, operation) {
     const taskRef = boundTaskRef(context, operation.taskRef);
     const input = operation.input;
@@ -219,6 +235,10 @@ export function dispatchTaskControlOperation(context, operation) {
         });
     }
     if (operation.family === 'task-finalization') {
+        const resolved = resolveTaskRef(boundTaskRef(context, operation.request.taskRef), { repoRoot: context.repoRoot });
+        const controlRoot = context.source === 'sandbox-executor'
+            ? path.dirname(context.manifestPath)
+            : resolved.ok ? controlRootForTask(context, resolved.taskId) : undefined;
         return applyTaskFinalization({
             ...operation.request,
             taskRef: boundTaskRef(context, operation.request.taskRef)
@@ -228,6 +248,8 @@ export function dispatchTaskControlOperation(context, operation) {
                 controlBinding: { generation: context.generation, requestId: context.requestId },
                 manifestPath: context.manifestPath
             } : {}),
+            ...(controlRoot ? { controlRoot } : {}),
+            ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {}),
             preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
         });
     }

package/dist/lib/task/control-recovery.js

@@ -19,8 +19,7 @@ export const SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES = Object.freeze([
 const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'];
 export const SANDBOX_CONTROL_RECOVERY_OPERATIONS = Object.freeze([
     ...LIFECYCLE_INTENTS.map((intent) => ({ family: 'task-lifecycle', intent, class: 'lifecycle-mutation' })),
-    { family: 'task-create', intent: 'create', class: 'task-create' },
-    ...['controller.close', 'controller.verify'].map((intent) => ({ family: 'agent-client', intent, class: 'agent-client-operation' }))
+    { family: 'task-create', intent: 'create', class: 'task-create' }
 ]);
 export function digestControlRecoveryIntent(family, intent) {
     return createHash('sha256').update(`${family}\0${intent}`, 'utf8').digest('hex');

package/dist/lib/task/finalization.js

@@ -894,7 +894,13 @@ async function prepareUnderLock(request, taskId, options) {
             receipt = updateReceipt(repoRoot, receipt, { lifecycle: 'done', lastError: null });
         }
         else {
-            const result = lifecycle({ taskRef: taskId, intent: 'complete', agent: request.agent }, { repoRoot, prepareOnly: true, ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {}) });
+            const result = lifecycle({ taskRef: taskId, intent: 'complete', agent: request.agent }, {
+                repoRoot,
+                prepareOnly: true,
+                ...(options.controlRoot ? { controlRoot: options.controlRoot } : {}),
+                ...(options.controlProject ? { controlProject: options.controlProject } : {}),
+                ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {})
+            });
             lifecycleResult = lifecycleStep(result);
             if (result.status !== 'applied' && result.status !== 'no-op') {
                 receipt = updateReceipt(repoRoot, receipt, { lifecycle: 'pending', lastError: lifecycleResult.error });
@@ -1037,7 +1043,12 @@ async function commitPreparedTaskFinalization(request, options) {
                 });
             receipt = updateReceipt(repoRoot, receipt, { verification: 'pending' });
             const lifecycleRequest = { taskRef: resolved.taskId, intent: 'complete', agent: request.agent };
-            const lifecycleOptions = { repoRoot, ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {}) };
+            const lifecycleOptions = {
+                repoRoot,
+                ...(options.controlRoot ? { controlRoot: options.controlRoot } : {}),
+                ...(options.controlProject ? { controlProject: options.controlProject } : {}),
+                ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {})
+            };
             const result = options.lifecycle
                 ? options.lifecycle(lifecycleRequest, lifecycleOptions)
                 : applyTaskLifecycleWithinTaskLock(lifecycleRequest, lifecycleOptions, resolved.taskId);

package/dist/lib/task/lifecycle.js

@@ -215,6 +215,96 @@ function transferTaskContents(sourcePath, targetPath) {
         throw new Error('completed target does not match task source after copy');
     }
 }
+function pathExists(candidate) {
+    try {
+        fs.lstatSync(candidate);
+        return true;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+function assertTaskControlRootPath(controlRoot, taskId, expectedProject) {
+    if (path.basename(controlRoot) !== taskId || path.basename(path.dirname(controlRoot)) !== 'tasks'
+        || (expectedProject !== undefined && path.basename(path.dirname(path.dirname(controlRoot))) !== expectedProject)) {
+        throw new Error('control root path does not match the task/project layout');
+    }
+    const managedBase = path.dirname(path.dirname(path.dirname(controlRoot)));
+    let current = managedBase;
+    for (const segment of path.relative(managedBase, controlRoot).split(path.sep).filter(Boolean)) {
+        const stat = fs.lstatSync(current);
+        if (stat.isSymbolicLink())
+            throw new Error('control root ancestor is a symbolic link');
+        current = path.join(current, segment);
+    }
+    const stat = fs.lstatSync(controlRoot);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('control root is not a real directory');
+}
+function assertTaskControlManifestIdentity(controlRoot, taskId, repoRoot, expectedProject) {
+    const controlManifest = path.join(controlRoot, 'manifest.json');
+    if (!fs.existsSync(controlManifest))
+        throw new Error('control manifest is missing');
+    const manifestStat = fs.lstatSync(controlManifest);
+    if (!manifestStat.isFile() || manifestStat.isSymbolicLink())
+        throw new Error('control manifest is not a real file');
+    const manifest = JSON.parse(fs.readFileSync(controlManifest, 'utf8'));
+    const project = expectedProject ?? path.basename(path.dirname(path.dirname(controlRoot)));
+    if (manifest.mode !== 'task-bound' || manifest.taskId !== taskId || manifest.project !== project
+        || typeof manifest.repoRoot !== 'string' || fs.realpathSync.native(manifest.repoRoot) !== fs.realpathSync.native(repoRoot)) {
+        throw new Error('control manifest identity does not match the task');
+    }
+}
+function taskBoundControlMoveSafety(request, controlRoot, options, taskId, repoRoot, validateManifestIdentity) {
+    if (!controlRoot)
+        return null;
+    const controlManifest = path.join(controlRoot, 'manifest.json');
+    const controlLease = path.join(controlRoot, 'lease.json');
+    const stateExists = pathExists(controlRoot) || pathExists(controlManifest) || pathExists(controlLease);
+    if (stateExists) {
+        try {
+            assertTaskControlRootPath(controlRoot, taskId, options.controlProject);
+            if (validateManifestIdentity) {
+                assertTaskControlManifestIdentity(controlRoot, taskId, repoRoot, options.controlProject);
+            }
+            else {
+                const manifestStat = fs.lstatSync(controlManifest);
+                if (!manifestStat.isFile() || manifestStat.isSymbolicLink())
+                    throw new Error('control manifest is not a real file');
+            }
+        }
+        catch {
+            return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task-bound sandbox control root is missing, malformed, or belongs to another task' };
+        }
+    }
+    if (request.intent !== 'complete' && (pathExists(controlManifest) || pathExists(controlLease))) {
+        return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task-bound sandbox control state exists; stop and remove the verified sandbox before moving the task directory' };
+    }
+    return null;
+}
+function orchestrationMoveSafety(sourcePath) {
+    const orchestrationPath = path.join(sourcePath, '.runtime', 'orchestration.json');
+    if (!pathExists(orchestrationPath))
+        return null;
+    try {
+        const run = JSON.parse(fs.readFileSync(orchestrationPath, 'utf8'));
+        if (run.status === 'running' || run.pendingDelegation !== null && run.pendingDelegation !== undefined) {
+            return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task orchestration has an active or pending delegation; settle it before moving the task directory' };
+        }
+    }
+    catch {
+        return { code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE', message: 'task orchestration state is unreadable; refusing to move the task directory' };
+    }
+    return null;
+}
+function runtimeMoveSafety(request, movingTaskDirectory, options, taskId, repoRoot, sourcePath, validateControlManifestIdentity) {
+    if (!movingTaskDirectory)
+        return null;
+    const controlSafety = taskBoundControlMoveSafety(request, options.controlRoot, options, taskId, repoRoot, validateControlManifestIdentity);
+    return controlSafety ?? orchestrationMoveSafety(sourcePath);
+}
 function targetContainsTask(targetPath, taskId, request) {
     try {
         const stat = fs.lstatSync(targetPath);
@@ -546,37 +636,6 @@ function applyTaskLifecycleUnlocked(requestInput, options = {}) {
     const targetPath = path.join(repoRoot, '.agents', 'workspace', spec.target, taskId);
     const requiredSteps = stepsForIntent(request.intent);
     const movingTaskDirectory = sourcePath !== targetPath;
-    const assertRuntimeMoveSafe = () => {
-        if (!movingTaskDirectory)
-            return null;
-        const controlManifest = path.join(sourcePath, '.runtime', 'sandbox-control', 'manifest.json');
-        const controlLease = path.join(sourcePath, '.runtime', 'sandbox-control', 'lease.json');
-        if (request.intent !== 'complete' && (fs.existsSync(controlManifest) || fs.existsSync(controlLease))) {
-            return {
-                code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE',
-                message: 'task-bound sandbox control state exists; stop and remove the verified sandbox before moving the task directory'
-            };
-        }
-        const orchestrationPath = path.join(sourcePath, '.runtime', 'orchestration.json');
-        if (fs.existsSync(orchestrationPath)) {
-            try {
-                const run = JSON.parse(fs.readFileSync(orchestrationPath, 'utf8'));
-                if (run.status === 'running' || run.pendingDelegation !== null && run.pendingDelegation !== undefined) {
-                    return {
-                        code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE',
-                        message: 'task orchestration has an active or pending delegation; settle it before moving the task directory'
-                    };
-                }
-            }
-            catch {
-                return {
-                    code: 'LIFECYCLE_RUNTIME_MOVE_UNSAFE',
-                    message: 'task orchestration state is unreadable; refusing to move the task directory'
-                };
-            }
-        }
-        return null;
-    };
     const currentTaskFile = path.join(sourcePath, 'task.md');
     const existingJournal = fs.existsSync(path.join(sourcePath, '.task-lifecycle.json'));
     if (sourceState === spec.target && !existingJournal) {
@@ -599,7 +658,7 @@ function applyTaskLifecycleUnlocked(requestInput, options = {}) {
         && !(request.intent === 'complete' && targetContainsTask(targetPath, taskId, request))) {
         return failed(request, { code: 'LIFECYCLE_TARGET_CONFLICT', message: `target directory already exists: ${targetPath}` }, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     }
-    const moveSafety = assertRuntimeMoveSafe();
+    const moveSafety = runtimeMoveSafety(request, movingTaskDirectory, options, taskId, repoRoot, sourcePath, true);
     if (moveSafety)
         return failed(request, moveSafety, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath });
     const content = io.readFileSync(currentTaskFile);
@@ -757,7 +816,7 @@ function applyTaskLifecycleUnlocked(requestInput, options = {}) {
     if (fs.existsSync(targetPath) && !fs.existsSync(path.join(sourcePath, 'task.md')))
         completed.add('directory-moved');
     if (!completed.has('directory-moved')) {
-        const moveSafety = assertRuntimeMoveSafe();
+        const moveSafety = runtimeMoveSafety(request, movingTaskDirectory, options, taskId, repoRoot, sourcePath, false);
         if (moveSafety)
             return failed(request, moveSafety, { taskId, sourceState, targetState: spec.target, sourcePath, targetPath, journalPath, completedSteps: [...completed], changed: completed.size > 0, timestamp: journal.metadata.timestamp, agentInfraVersion: journal.metadata.agentInfraVersion });
         fs.mkdirSync(path.dirname(targetPath), { recursive: true });

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.11.13",
-  "sourceInputHash": "70e89f362895c1f8f976011715a86b47e06c105ca4285eacbb3fa51d0459a282",
-  "internalExecutableBuildHash": "f183e6d39ba985dbb2962eb951b4019af9594361ca3c46b88bf65fff325d7ad4"
+  "packageVersion": "0.11.14",
+  "sourceInputHash": "24a7d69b687f9ea8fdee5f47f7e59d1b53e13452a7f4f8edd9ca5b494cb5a0d4",
+  "internalExecutableBuildHash": "9825f6d7ca5d82e4c5f774b94f0d5e94e1b312583406eeb89a74d717ad757c4a"
 }