@fitlab-ai/agent-infra 0.11.13 → 0.11.14

package/lib/sandbox/control/client.ts

@@ -2,17 +2,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import {
-  SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
   SANDBOX_CONTROL_MAX_BYTES,
   SANDBOX_CONTROL_STATUS_STALE_MS,
   isSandboxControlFamily,
   type SandboxControlError,
   type SandboxControlRequest,
   type SandboxControlResponse,
-  type SandboxAgentClientRequest,
   type SandboxTaskCreateRequest
 } from './protocol.ts';
-import { isAgentClientId } from '../../agent-clients/types.ts';
 import { readSandboxControlPayload, readSandboxControlStatus } from './state.ts';
 import type { TaskCreateCandidateV1 } from '../../task/create.ts';
 import { accessSandboxTaskView, taskViewFromStatus, type TaskViewAccessEffect } from './task-view.ts';
@@ -53,11 +50,10 @@ function clientError(
 
 function preflight(
   statusDir: string,
-  generation: string,
   taskViewEffect: TaskViewAccessEffect | null = null,
   now = Date.now(),
   env: NodeJS.ProcessEnv = process.env
-): void {
+): string {
   if (fs.existsSync(statusDir)) {
     let identity;
     try {
@@ -68,9 +64,6 @@ function preflight(
         : 'SANDBOX_CONTROL_IDENTITY_MALFORMED';
       clientError(code, 'sandbox control identity is missing or invalid', false);
     }
-    if (identity.generation !== generation) {
-      clientError('SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH', 'sandbox control identity generation does not match the request', false);
-    }
     if (env.AGENT_INFRA_CONTROL_ROOT_ID && identity.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
       clientError('SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH', 'sandbox control identity root does not match the client configuration', false);
     }
@@ -81,9 +74,6 @@ function preflight(
   } catch {
     clientError('SANDBOX_CONTROL_BROKER_UNAVAILABLE', 'broker status is missing or invalid', true);
   }
-  if (status.generation !== generation) {
-    clientError('SANDBOX_CONTROL_GENERATION_INVALID', 'broker status generation does not match this sandbox', false);
-  }
   if (now - status.updatedAt > SANDBOX_CONTROL_STATUS_STALE_MS || status.updatedAt > now + 1_000) {
     clientError('SANDBOX_CONTROL_BROKER_UNAVAILABLE', 'broker status heartbeat is stale', true);
   }
@@ -107,6 +97,7 @@ function preflight(
       );
     }
   }
+  return status.generation;
 }
 
 function taskViewEffectForRequest(request: SandboxControlRequest): TaskViewAccessEffect | null {
@@ -201,7 +192,7 @@ function exchangeSandboxControl(request: SandboxControlRequest, params: Readonly
   const channelDir = params.channelDir ?? process.env.AGENT_INFRA_CONTROL_DIR ?? '/run/agent-infra/control';
   const statusDir = params.statusDir ?? process.env.AGENT_INFRA_CONTROL_STATUS_DIR ?? '/run/agent-infra/control-status';
   const taskViewEffect = taskViewEffectForRequest(request);
-  preflight(statusDir, request.generation, taskViewEffect);
+  const hostGeneration = preflight(statusDir, taskViewEffect);
   const identityPath = path.join(statusDir, 'identity.json');
   if (fs.existsSync(statusDir)) {
     const identity = readSandboxControlIdentitySentinel(statusDir);
@@ -246,7 +237,7 @@ function exchangeSandboxControl(request: SandboxControlRequest, params: Readonly
       try {
         // The request-specific terminal proves the broker claimed the request; preserve recovery evidence if marker cleanup won the race.
         accepted = true;
-        response = readPublishedResponse(raw, request.id, channelDir, accepted, request.generation);
+        response = readPublishedResponse(raw, request.id, channelDir, accepted, hostGeneration);
         malformedResponseRaw = null;
       } catch (error) {
         if (!(error instanceof SyntaxError)) throw error;
@@ -268,7 +259,7 @@ function exchangeSandboxControl(request: SandboxControlRequest, params: Readonly
     }
     if (!accepted) {
       try {
-        preflight(statusDir, request.generation, taskViewEffect);
+        preflight(statusDir, taskViewEffect);
       } catch (error) {
         if (cancelPendingRequest(requestPath)) throw error;
         clientError(
@@ -314,6 +305,9 @@ export function recoverSandboxControl(requestId: string, params: Readonly<{
       const config = loadConfig();
       const response = recoverSandboxControlFromHost(requestId, {
         managedRoot: path.join(config.controlBase, config.project),
+        controlBase: config.controlBase,
+        project: config.project,
+        repoRoot: config.repoRoot,
         timeoutMs: params.timeoutMs
       });
       if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') {
@@ -402,72 +396,30 @@ export function recoverSandboxControlFromChannel(requestId: string, params: Read
   );
 }
 
-function authority(params: { token?: string; generation?: string }): { token: string; generation: string } {
-  const token = params.token ?? process.env.AGENT_INFRA_CONTROL_TOKEN;
-  const generation = params.generation ?? process.env.AGENT_INFRA_CONTROL_GENERATION;
-  if (!token || !generation) clientError('SANDBOX_CONTROL_UNAVAILABLE', 'control authority is missing', false);
-  return { token, generation };
-}
-
 export function requestSandboxControl(params: Readonly<{
   family: string; args: string[]; channelDir?: string; statusDir?: string;
-  token?: string; generation?: string; timeoutMs?: number;
+  timeoutMs?: number;
 }>): SandboxControlResponse {
   if (!isSandboxControlFamily(params.family)) clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' is not allowed`, false);
-  if (params.family === 'task-create' || params.family === 'agent-client') {
+  if (params.family === 'task-create') {
     clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' requires a typed request`, false);
   }
   if (params.args[1] === 'complete') {
     clientError('SANDBOX_CONTROL_COMMAND_DENIED', 'complete must use task-finalization', false);
   }
-  const auth = authority(params);
-  const issuedAt = Date.now();
   const request: SandboxControlRequest = {
-    version: 4, id: randomUUID(), ...auth, issuedAt,
-    expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+    version: 5, id: randomUUID(),
     family: params.family as 'task-lifecycle', args: params.args
   };
   return exchangeSandboxControl(request, params);
 }
 
-export function requestSandboxAgentOperation(params: Readonly<{
-  agentClient: string;
-  operation: string;
-  payload: Record<string, unknown>;
-  channelDir?: string;
-  statusDir?: string;
-  token?: string;
-  generation?: string;
-  timeoutMs?: number;
-}>): SandboxControlResponse {
-  if (!isAgentClientId(params.agentClient)) {
-    clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client id is invalid', false);
-  }
-  const auth = authority(params);
-  const issuedAt = Date.now();
-  const request: SandboxAgentClientRequest = {
-    version: 4,
-    id: randomUUID(),
-    ...auth,
-    issuedAt,
-    expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
-    family: 'agent-client',
-    agentClient: params.agentClient,
-    operation: params.operation,
-    payload: params.payload
-  };
-  return exchangeSandboxControl(request, params);
-}
-
 export function requestSandboxTaskCreate(params: Readonly<{
   candidate: TaskCreateCandidateV1; channelDir?: string; statusDir?: string;
-  token?: string; generation?: string; timeoutMs?: number;
+  timeoutMs?: number;
 }>): SandboxControlResponse {
-  const auth = authority(params);
-  const issuedAt = Date.now();
   const request: SandboxTaskCreateRequest = {
-    version: 4, id: randomUUID(), ...auth, issuedAt,
-    expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+    version: 5, id: randomUUID(),
     family: 'task-create', candidate: params.candidate,
   };
   return exchangeSandboxControl(request, { ...params, timeoutMs: params.timeoutMs ?? 120_000 });

package/lib/sandbox/control/executor.ts

@@ -33,8 +33,6 @@ import {
   type TaskControlOperation
 } from '../../task/control-authority.ts';
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest, type BrokerOwner } from './lifecycle.ts';
-import { executeAgentClientOperation, validateAgentClientOperation } from './agent-operation.ts';
-import type { AgentClientSandboxControlOperation } from '../../agent-clients/adapter.ts';
 
 export type SandboxControlExecutionResult = {
   exitCode: number;
@@ -256,7 +254,6 @@ function taskCreateExecutionFailure(requestId: string, code: string, message: st
 
 type ExecuteRequestOptions = Readonly<{
   createTask?: typeof createTask;
-  agentClientOperation?: AgentClientSandboxControlOperation;
 }>;
 
 async function executeRequestInner(
@@ -279,10 +276,6 @@ async function executeRequestInner(
       return taskCreateExecutionFailure(request.id, code, detail);
     }
   }
-  if (request.family === 'agent-client') {
-    validateAgentClientOperation(request, manifest);
-    return executeAgentClientOperation(request, manifest, manifestPath, options.agentClientOperation);
-  }
   const boundArgs = bindSandboxControlTask(request, manifest.taskId!);
   let operation: TaskControlOperation;
   try {
@@ -346,9 +339,10 @@ export async function runSandboxControlExecutor(requestPath: string, nonce: stri
   const gate = await waitForGate(nonce);
   const gateOwner = gate.owner;
   process.disconnect?.();
-  const manifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
-  if (!manifestPath) throw new Error('SANDBOX_CONTROL_EXECUTOR_MANIFEST_MISSING');
-  const manifest = readSandboxControlManifest(manifestPath);
+  const requestedManifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
+  if (!requestedManifestPath) throw new Error('SANDBOX_CONTROL_EXECUTOR_MANIFEST_MISSING');
+  const manifest = readSandboxControlManifest(requestedManifestPath);
+  const manifestPath = fs.realpathSync.native(requestedManifestPath);
   const identity = validateSandboxControlIdentity({
     publicStatusDir: manifest.publicStatusDir,
     root: path.dirname(path.resolve(manifestPath)),
@@ -390,17 +384,17 @@ export async function runSandboxControlExecutor(requestPath: string, nonce: stri
   let result: SandboxControlExecutionResult;
   try {
     assertSandboxControlExecutorAuthority(manifest, gateOwner);
-  const operation = request.family === 'task-lifecycle'
+    const operation = request.family === 'task-lifecycle'
       ? (() => {
         try { return parseTaskControlOperation(request.family, request.args); } catch { return null; }
       })()
-      : request.family === 'agent-client' ? request.operation : null;
+      : null;
     const context = createSandboxControlAuditContext(manifest, {
       requestId: request.id,
       family: request.family,
       operation: operation && typeof operation === 'object' && 'family' in operation && operation.family === 'task-lifecycle'
         ? operation.request.intent
-        : request.family === 'agent-client' ? request.operation : null,
+        : null,
       phase: 'started-committed',
       outcome: 'in-progress'
     });

package/lib/sandbox/control/host-recovery.ts

@@ -24,20 +24,73 @@ function manifestDigest(manifest: SandboxControlManifest): string {
   });
 }
 
-function managedManifestPaths(managedRoot: string): string[] {
-  if (!fs.existsSync(managedRoot)) return [];
-  const rootStat = fs.lstatSync(managedRoot);
-  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-  const result: string[] = [];
-  for (const container of fs.readdirSync(managedRoot, { withFileTypes: true })) {
-    if (!container.isDirectory() || container.isSymbolicLink()) continue;
-    const containerPath = path.join(managedRoot, container.name);
-    for (const identity of fs.readdirSync(containerPath, { withFileTypes: true })) {
-      if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name)) continue;
-      result.push(path.join(containerPath, identity.name, 'manifest.json'));
+function readManagedManifest(manifestPath: string): SandboxControlManifest {
+  try { return readSandboxControlManifest(manifestPath); } catch { throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID'); }
+}
+
+function branchOnlyManifests(parentPath: string): SandboxControlManifest[] {
+  const manifests: SandboxControlManifest[] = [];
+  for (const identity of fs.readdirSync(parentPath, { withFileTypes: true })) {
+    if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name)) continue;
+    manifests.push(readManagedManifest(path.join(parentPath, identity.name, 'manifest.json')));
+  }
+  return manifests;
+}
+
+function taskBoundManifests(params: Readonly<{
+  tasksRoot: string;
+  controlBase: string;
+  project: string;
+  repoRoot: string;
+}>): SandboxControlManifest[] {
+  assertDirectory(params.tasksRoot);
+  const canonicalManagedRoot = fs.realpathSync.native(path.dirname(params.tasksRoot));
+  const canonicalTasksRoot = fs.realpathSync.native(params.tasksRoot);
+  if (path.dirname(canonicalTasksRoot) !== canonicalManagedRoot) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  const canonicalRepoRoot = fs.realpathSync.native(params.repoRoot);
+  const manifests: SandboxControlManifest[] = [];
+  for (const task of fs.readdirSync(params.tasksRoot, { withFileTypes: true })) {
+    if (!/^TASK-\d{8}-\d{6}$/u.test(task.name)) continue;
+    if (!task.isDirectory() || task.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const taskRoot = path.join(params.tasksRoot, task.name);
+    assertNoSymlinkPath(params.controlBase, taskRoot);
+    const canonicalTaskRoot = fs.realpathSync.native(taskRoot);
+    if (path.dirname(canonicalTaskRoot) !== canonicalTasksRoot) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const manifestPath = path.join(taskRoot, 'manifest.json');
+    if (!fs.existsSync(manifestPath)) continue;
+    const manifest = readManagedManifest(manifestPath);
+    if (manifest.mode !== 'task-bound' || manifest.taskId !== task.name || manifest.project !== params.project
+      || fs.realpathSync.native(manifest.repoRoot) !== canonicalRepoRoot
+      || path.dirname(fs.realpathSync.native(manifestPath)) !== canonicalTaskRoot) {
+      throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
+    manifests.push(manifest);
+  }
+  return manifests;
+}
+
+function managedManifestCandidates(params: Readonly<{
+  managedRoot: string;
+  controlBase?: string;
+  project?: string;
+  repoRoot?: string;
+}>): SandboxControlManifest[] {
+  const managedRoot = params.managedRoot;
+  const { controlBase, project, repoRoot } = params;
+  if (controlBase && project && path.resolve(managedRoot) !== path.resolve(controlBase, project)) {
+    throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   }
-  return result;
+  if (!fs.existsSync(managedRoot)) return [];
+  assertDirectory(managedRoot);
+  return fs.readdirSync(managedRoot, { withFileTypes: true })
+    .flatMap((parent) => {
+      const parentPath = path.join(managedRoot, parent.name);
+      if (parent.name === 'tasks' && controlBase && project && repoRoot) {
+        return taskBoundManifests({ tasksRoot: parentPath, controlBase, project, repoRoot });
+      }
+      if (!parent.isDirectory() || parent.isSymbolicLink()) return [];
+      return branchOnlyManifests(parentPath);
+    });
 }
 
 function assertDirectory(directory: string): void {
@@ -45,6 +98,17 @@ function assertDirectory(directory: string): void {
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
 }
 
+function assertNoSymlinkPath(root: string, target: string): void {
+  const relative = path.relative(root, target);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  let current = path.resolve(root);
+  if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  for (const segment of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  }
+}
+
 type AuditRecord = Record<string, unknown>;
 
 function readAudit(manifest: SandboxControlManifest): AuditRecord[] {
@@ -77,12 +141,16 @@ function auditProof(manifest: SandboxControlManifest, requestId: string): AuditR
   return related;
 }
 
-function publishedEvidence(records: AuditRecord[], generation: string): AuditRecord | null {
+function publishedEvidence(records: AuditRecord[], manifest: SandboxControlManifest): AuditRecord | null {
   const publications = records.filter((record) => record.event === 'executor-result-published');
   let selected: AuditRecord | null = null;
   let selectedSummary: string | null = null;
+  const digest = manifestDigest(manifest);
   for (const record of publications) {
-    if (record.version !== 2 || record.requestGeneration !== generation
+    if (record.version !== 2 || record.generation !== manifest.generation || record.identityDigest !== digest
+      || typeof record.requestFamily !== 'string'
+      || !['task-lifecycle', 'task-create'].includes(record.requestFamily)
+      || (record.sandboxTaskId !== null && typeof record.sandboxTaskId !== 'string')
       || !Number.isSafeInteger(record.exitCode)
       || !Number.isSafeInteger(record.outputBytes) || !Number.isSafeInteger(record.errorBytes)
       || typeof record.outputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.outputDigest)
@@ -90,7 +158,7 @@ function publishedEvidence(records: AuditRecord[], generation: string): AuditRec
       throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
     }
     const summary = JSON.stringify([
-      record.requestFamily ?? null, record.requestGeneration, record.exitCode,
+      record.requestFamily, record.sandboxTaskId, record.generation, record.identityDigest, record.exitCode,
       record.outputBytes, record.errorBytes, record.outputDigest, record.errorDigest
     ]);
     if (selectedSummary !== null && summary !== selectedSummary) {
@@ -99,6 +167,9 @@ function publishedEvidence(records: AuditRecord[], generation: string): AuditRec
     selected ??= record;
     selectedSummary ??= summary;
   }
+  if (selected && selected.sandboxTaskId !== manifest.taskId) {
+    throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
+  }
   return selected;
 }
 
@@ -118,7 +189,7 @@ function verifiedResponse(manifest: SandboxControlManifest, requestId: string, r
   if (!['completed', 'rejected'].includes(response.phase)) throw new Error('SANDBOX_CONTROL_RESPONSE_INVALID');
   if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') return unknown(requestId);
   const evidencePath = path.join(manifest.processingDir, requestId, 'result.json');
-  const published = publishedEvidence(records, manifest.generation);
+  const published = publishedEvidence(records, manifest);
   if (!published) return unknown(requestId);
   let evidence = null;
   if (fs.existsSync(evidencePath)) {
@@ -167,17 +238,19 @@ function verifiedResponse(manifest: SandboxControlManifest, requestId: string, r
 }
 
 export function recoverSandboxControlFromHost(requestId: string, params: Readonly<{
-  managedRoot: string; timeoutMs?: number;
+  managedRoot: string;
+  controlBase?: string;
+  project?: string;
+  repoRoot?: string;
+  timeoutMs?: number;
 }>): SandboxControlResponse {
   if (!REQUEST_ID.test(requestId)) throw new Error('SANDBOX_CONTROL_REQUEST_INVALID');
   const deadline = Date.now() + (params.timeoutMs ?? 30_000);
   let candidates: Array<{ manifest: SandboxControlManifest; records: AuditRecord[] }> = [];
   while (Date.now() < deadline) {
     candidates = [];
-    for (const manifestPath of managedManifestPaths(params.managedRoot)) {
-      let manifest: SandboxControlManifest;
-      try { manifest = readSandboxControlManifest(manifestPath); } catch { throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID'); }
-      if (manifest.project !== path.basename(path.resolve(params.managedRoot)) || !manifest.generation) {
+    for (const manifest of managedManifestCandidates(params)) {
+      if (manifest.project !== (params.project ?? path.basename(path.resolve(params.managedRoot))) || !manifest.generation) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
       }
       const records = auditProof(manifest, requestId);

package/lib/sandbox/control/lifecycle.ts

@@ -1155,30 +1155,32 @@ function readSandboxControlManifestValue(manifestPath: string): SandboxControlMa
     || !isSandboxAuthorityEvidence(candidate.authorityEvidence)) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   const root = path.dirname(path.resolve(manifestPath));
   const canonicalRoot = fs.realpathSync.native(root);
-  const matchesControlChildPath = (candidatePath: string, name: string): boolean => {
-    const resolved = path.resolve(candidatePath);
-    if (path.basename(resolved) !== name) return false;
+  const resolveControlChildPath = (candidatePath: string, name: string): string | null => {
+    if (path.isAbsolute(candidatePath) || candidatePath !== name) return null;
+    const resolved = path.resolve(root, candidatePath);
     const expected = path.join(canonicalRoot, name);
     try {
-      return fs.realpathSync.native(resolved) === expected;
+      const stat = fs.lstatSync(resolved);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) return null;
+      return fs.realpathSync.native(resolved) === expected ? expected : null;
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
       try {
-        return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot;
+        return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot ? expected : null;
       } catch (parentError) {
         if ((parentError as NodeJS.ErrnoException).code !== 'ENOENT') throw parentError;
-        return false;
+        return null;
       }
     }
   };
-  if (!matchesControlChildPath(candidate.channelDir, 'channel')
-    || !matchesControlChildPath(candidate.publicStatusDir, 'public')
-    || !matchesControlChildPath(candidate.processingDir, 'processing')) {
-    throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-  }
-  if (!matchesControlChildPath(candidate.runtimeDir, 'runtime')) {
+  const channelDir = resolveControlChildPath(candidate.channelDir, 'channel');
+  const publicStatusDir = resolveControlChildPath(candidate.publicStatusDir, 'public');
+  const processingDir = resolveControlChildPath(candidate.processingDir, 'processing');
+  const runtimeDir = resolveControlChildPath(candidate.runtimeDir, 'runtime');
+  if (!channelDir || !publicStatusDir || !processingDir) {
     throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   }
+  if (!runtimeDir) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   const normalized: SandboxControlManifest = {
     engine: candidate.engine,
     repoRoot: candidate.repoRoot,
@@ -1196,10 +1198,10 @@ function readSandboxControlManifestValue(manifestPath: string): SandboxControlMa
     token: candidate.token,
     generation: candidate.generation,
     controlRootId: candidate.controlRootId,
-    channelDir: candidate.channelDir,
-    publicStatusDir: candidate.publicStatusDir,
-    processingDir: candidate.processingDir,
-    runtimeDir: candidate.runtimeDir,
+    channelDir,
+    publicStatusDir,
+    processingDir,
+    runtimeDir,
   };
   return normalized;
 }

package/lib/sandbox/control/protocol.ts

@@ -1,6 +1,5 @@
 import { createHash } from 'node:crypto';
 import { validateTaskCreateCandidate, type TaskCreateCandidateV1 } from '../../task/create.ts';
-import { isAgentClientId } from '../../agent-clients/types.ts';
 import type { ProcessIdentity } from '../../server/process-state.ts';
 import type { SandboxAuthorityEvidenceV1 } from '../engines/authority.ts';
 import type { SandboxTaskView } from './task-view.ts';
@@ -10,11 +9,10 @@ export const SANDBOX_CONTROL_MAX_LOGICAL_RECORDS = 1024;
 export const SANDBOX_CONTROL_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 export const SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES = 1024 * 1024;
 export const SANDBOX_CONTROL_RESERVATION_BYTES = SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES + 4 * 1024;
-export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create', 'agent-client'] as const;
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create'] as const;
 export type SandboxControlTimingPolicy = Readonly<{
   controlTickMs: number;
   parkedBindingInitialMs: number;
@@ -55,22 +53,14 @@ export type SandboxControlExecutorGateV2 = Readonly<{
   owner: SandboxControlBrokerOwner;
   requestId: string;
 }>;
-type RequestBase = Readonly<{
-  version: 4; id: string; token: string; generation: string; issuedAt: number; expiresAt: number;
-}>;
+type RequestBase = Readonly<{ version: 5; id: string }>;
 export type SandboxTaskCommandRequest = RequestBase & Readonly<{
   family: 'task-lifecycle'; args: string[];
 }>;
 export type SandboxTaskCreateRequest = RequestBase & Readonly<{
   family: 'task-create'; candidate: TaskCreateCandidateV1;
 }>;
-export type SandboxAgentClientRequest = RequestBase & Readonly<{
-  family: 'agent-client';
-  agentClient: string;
-  operation: string;
-  payload: Record<string, unknown>;
-}>;
-export type SandboxControlRequest = SandboxTaskCommandRequest | SandboxTaskCreateRequest | SandboxAgentClientRequest;
+export type SandboxControlRequest = SandboxTaskCommandRequest | SandboxTaskCreateRequest;
 export type SandboxControlError = Readonly<{ code: string; message: string; retryable: boolean }>;
 export type SandboxControlResultEvidence = Readonly<{
   version: 1;
@@ -220,53 +210,28 @@ export function isSandboxControlFamily(value: string): value is SandboxControlFa
 
 export function validateSandboxControlRequest(
   value: unknown,
-  manifest: SandboxControlManifest,
-  options: { now?: number } = {}
+  manifest: SandboxControlManifest
 ): SandboxControlRequest {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
     fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request must be an object');
   }
   const request = value as Record<string, unknown>;
   if (
-    request.version !== 4 || typeof request.id !== 'string'
-    || !/^[a-f0-9-]{16,64}$/.test(request.id) || request.token !== manifest.token
+    request.version !== 5 || typeof request.id !== 'string'
+    || !/^[a-f0-9-]{16,64}$/.test(request.id)
     || typeof request.family !== 'string' || !isSandboxControlFamily(request.family)
-    || !Number.isSafeInteger(request.issuedAt) || !Number.isSafeInteger(request.expiresAt)
   ) fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
-  if (request.generation !== manifest.generation) {
-    fail('SANDBOX_CONTROL_GENERATION_INVALID', 'request generation does not match the broker');
-  }
-  const issuedAt = request.issuedAt as number;
-  const expiresAt = request.expiresAt as number;
-  const now = options.now ?? Date.now();
-  if (expiresAt <= issuedAt || expiresAt - issuedAt > SANDBOX_CONTROL_ADMISSION_WINDOW_MS || issuedAt > now + SANDBOX_CONTROL_FUTURE_SKEW_MS) {
-    fail('SANDBOX_CONTROL_REQUEST_DEADLINE_INVALID', 'request admission deadline is invalid');
-  }
-  if (now > expiresAt) fail('SANDBOX_CONTROL_REQUEST_EXPIRED', 'request admission deadline has passed', true);
   if (Buffer.byteLength(JSON.stringify(request), 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
     fail('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit');
   }
   if (request.family === 'task-create') {
-    const expected = ['candidate', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    const expected = ['candidate', 'family', 'id', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')) {
       fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
     }
     return { ...request, candidate: validateTaskCreateCandidate(request.candidate) } as SandboxTaskCreateRequest;
   }
-  if (request.family === 'agent-client') {
-    const expected = ['agentClient', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'payload', 'token', 'version'];
-    if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
-      || !isAgentClientId(request.agentClient)
-      || typeof request.operation !== 'string' || !/^[a-z][a-z0-9.-]{0,63}$/u.test(request.operation)
-      || !request.payload || typeof request.payload !== 'object' || Array.isArray(request.payload)) {
-      fail('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client request schema is invalid');
-    }
-    if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-      fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot coordinate agent clients');
-    }
-    return request as SandboxAgentClientRequest;
-  }
-  const expected = ['args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+  const expected = ['args', 'family', 'id', 'version'];
   if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
     || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
     fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
@@ -284,7 +249,7 @@ export function validateSandboxControlRequest(
 }
 
 export function bindSandboxControlTask(request: SandboxControlRequest, taskId: string): string[] {
-  if (request.family === 'task-create' || request.family === 'agent-client') {
+  if (request.family === 'task-create') {
     fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
   }
   if (request.args.length === 0) fail('SANDBOX_CONTROL_REQUEST_INVALID', 'command arguments are required');
@@ -300,7 +265,6 @@ export function controlError(error: unknown): SandboxControlError {
   const retryable = new Set([
     'SANDBOX_CONTROL_BUSY',
     'SANDBOX_CONTROL_HANDOFF_ACTIVE',
-    'SANDBOX_CONTROL_REQUEST_EXPIRED',
     'SANDBOX_WORKTREE_BINDING_LOST'
   ]).has(code);
   return { code, message, retryable };

package/lib/sandbox/control/server.ts

@@ -72,7 +72,6 @@ import {
 import type { BrokerOwner } from './lifecycle.ts';
 import { nextSandboxControlBackoff } from './timing.ts';
 import { readTaskFinalizationReceipt } from '../../task/finalization.ts';
-import { recoverAgentClientOperation, validateAgentClientOperation } from './agent-operation.ts';
 import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   mergeSandboxTaskView,
@@ -100,8 +99,6 @@ function appendBrokerAudit(
 
 function operationKey(request: SandboxControlRequest): string | null {
   if (request.family === 'task-create') return 'create';
-  if (request.family === 'agent-client') return request.operation;
-  if (request.family !== 'task-lifecycle') return null;
   try {
     const operation = parseTaskControlOperation(request.family, request.args);
     return operation.family === 'task-lifecycle' ? operation.request.intent : null;
@@ -299,7 +296,7 @@ async function readRecoveryDomain(
   if (!operation) return { domain: null };
   const taskRef = 'args' in request ? request.args[0] ?? null : manifest.taskId;
   const output = parseControlOutput(payloadOutput);
-  if (!taskRef && operation.family !== 'task-create' && operation.family !== 'agent-client') {
+  if (!taskRef && operation.family !== 'task-create') {
     return { domain: null };
   }
 
@@ -327,14 +324,6 @@ async function readRecoveryDomain(
   if (operation.family === 'task-create') {
     return { domain: taskCreateDomainEvidence(manifest, output) };
   }
-  if (operation.family === 'agent-client' && request.family === 'agent-client') {
-    return { domain: recoverAgentClientOperation({
-      request,
-      manifest,
-      manifestPath,
-      stdout: payloadOutput
-    }) };
-  }
   return { domain: null };
 }
 
@@ -568,10 +557,7 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
       let terminalReconciled = false;
       try {
         const rawRequest = JSON.parse(fs.readFileSync(path.join(processingDirectory, 'request.json'), 'utf8')) as Record<string, unknown>;
-        request = validateSandboxControlRequest(rawRequest, manifest, {
-          now: typeof rawRequest.issuedAt === 'number' ? rawRequest.issuedAt : undefined
-        });
-        if (request.family === 'agent-client') validateAgentClientOperation(request, manifest);
+        request = validateSandboxControlRequest(rawRequest, manifest);
       } catch {
         // Missing or malformed request evidence remains fail-closed below.
       }
@@ -1006,7 +992,6 @@ export async function serveSandboxControl(
           if (reasonCode) throw new Error(reasonCode);
           if (active) throw new Error('SANDBOX_CONTROL_BUSY');
           const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
-          if (request.family === 'agent-client') validateAgentClientOperation(request, manifest);
           validatedRequest = request;
           criticalRequestPhase(manifest, request, 'validated', 'in-progress');
           appendBrokerAudit(manifest, 'request-validated', {