@fitlab-ai/agent-infra 0.11.13 → 0.11.15

package/dist/lib/agent-clients/adapters/codex-lifecycle/controller-operation.js

@@ -1,131 +0,0 @@
-import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, readCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
-import { computeLifecycleBuildIdentity } from './build-identity.js';
-function validProcess(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const process = value;
-    return Object.keys(process).sort().join(',') === 'pid,startTime'
-        && Number.isSafeInteger(process.pid) && process.pid > 0
-        && Number.isSafeInteger(process.startTime) && process.startTime >= 0;
-}
-function validProof(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const proof = value;
-    return Object.keys(proof).sort().join(',') === 'controllerProcess,leaseId,leaseSecret,version'
-        && proof.version === 1
-        && typeof proof.leaseId === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseId)
-        && typeof proof.leaseSecret === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseSecret)
-        && validProcess(proof.controllerProcess);
-}
-function validate(params) {
-    const { operation, payload, manifest } = params;
-    const expectedKeys = operation === 'controller.open' ? ['controllerProcess'] : ['proof'];
-    if (!['controller.open', 'controller.close', 'controller.verify'].includes(operation)
-        || Object.keys(payload).sort().join(',') !== expectedKeys.sort().join(',')
-        || (operation === 'controller.open'
-            ? !validProcess(payload.controllerProcess)
-            : !validProof(payload.proof))) {
-        throw new Error('SANDBOX_CONTROL_REQUEST_INVALID: controller operation payload is invalid');
-    }
-    if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-        throw new Error('SANDBOX_CONTROL_BRANCH_ONLY: controller operations require a task-bound sandbox');
-    }
-}
-async function execute(params) {
-    const { operation, payload, manifest, manifestPath } = params;
-    try {
-        const result = operation === 'controller.open'
-            ? openCodexControllerRegistration({
-                manifest,
-                manifestPath,
-                controllerProcess: payload.controllerProcess,
-                buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot)
-            })
-            : operation === 'controller.close'
-                ? closeCodexControllerRegistration({
-                    manifest,
-                    manifestPath,
-                    proof: payload.proof
-                })
-                : (() => {
-                    const binding = resolveCodexControllerBinding({
-                        manifest,
-                        manifestPath,
-                        proof: payload.proof,
-                        buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot)
-                    });
-                    return {
-                        version: 1,
-                        status: 'verified',
-                        changed: false,
-                        lease: null,
-                        binding: {
-                            taskId: manifest.taskId,
-                            controlGeneration: binding.controlGeneration,
-                            controllerInstanceDigest: binding.instanceDigest
-                        },
-                        error: null
-                    };
-                })();
-        return { exitCode: 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const code = error instanceof CodexControllerRegistrationError
-            ? error.code
-            : /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
-        return {
-            exitCode: 1,
-            stdout: `${JSON.stringify({
-                version: 1,
-                status: 'failed',
-                changed: false,
-                lease: null,
-                error: { code, message, retryable: false }
-            })}\n`,
-            stderr: ''
-        };
-    }
-}
-function recover(params) {
-    if (params.stdout === null)
-        return { consistent: false };
-    let output;
-    try {
-        const parsed = JSON.parse(params.stdout);
-        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
-            return { consistent: false };
-        output = parsed;
-    }
-    catch {
-        return { consistent: false };
-    }
-    if (output.error !== null || typeof output.status !== 'string')
-        return { consistent: false };
-    try {
-        const registration = readCodexControllerRegistration(params.manifestPath);
-        if (params.operation === 'controller.open') {
-            const lease = output.lease;
-            return { consistent: output.status === 'opened' && output.changed === true
-                    && lease?.controlGeneration === registration.controlGeneration
-                    && lease?.controllerInstanceDigest === registration.controllerInstanceDigest
-                    && registration.controlGeneration === params.manifest.generation };
-        }
-        if (params.operation === 'controller.verify') {
-            const binding = output.binding;
-            return { consistent: output.status === 'verified' && output.changed === false
-                    && binding?.controlGeneration === registration.controlGeneration
-                    && binding?.controllerInstanceDigest === registration.controllerInstanceDigest };
-        }
-        return { consistent: false };
-    }
-    catch (error) {
-        return { consistent: params.operation === 'controller.close'
-                && error.code === 'CODEX_SANDBOX_CONTROLLER_REGISTRATION_MISSING'
-                && output.status === 'closed' && typeof output.changed === 'boolean' };
-    }
-}
-const codexControllerOperation = Object.freeze({ validate, execute, recover });
-export { codexControllerOperation };
-//# sourceMappingURL=controller-operation.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/controller-registration.js

@@ -1,275 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { parseLinuxProcessStat } from '../../../server/process-state.js';
-import { commandForEngine, runProbe } from '../../../sandbox/shell.js';
-const CONTROLLER_TTL_MS = 4 * 60 * 60 * 1_000;
-const HEX_256 = /^[a-f0-9]{64}$/u;
-const REGISTRATION_KEYS = [
-    'buildIdentity', 'containerId', 'controlGeneration', 'controllerInstanceDigest',
-    'controllerProcess', 'expiresAt', 'issuedAt', 'leaseId', 'leaseSecretHash',
-    'taskId', 'version'
-].sort().join(',');
-export class CodexControllerRegistrationError extends Error {
-    code;
-    constructor(code, message) {
-        super(`${code}: ${message}`);
-        this.name = code;
-        this.code = code;
-    }
-}
-function fail(code, message) {
-    throw new CodexControllerRegistrationError(code, message);
-}
-function exactKeys(value, keys) {
-    return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
-}
-function validProcess(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const processValue = value;
-    return exactKeys(processValue, ['pid', 'startTime'])
-        && Number.isSafeInteger(processValue.pid) && processValue.pid > 0
-        && Number.isSafeInteger(processValue.startTime) && processValue.startTime >= 0;
-}
-function validBuild(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const build = value;
-    return exactKeys(build, [
-        'internalExecutableBuildHash', 'lifecycleContractHash', 'packageVersion', 'protocolVersion'
-    ])
-        && build.protocolVersion === 3
-        && typeof build.packageVersion === 'string' && build.packageVersion.length > 0
-        && typeof build.internalExecutableBuildHash === 'string' && HEX_256.test(build.internalExecutableBuildHash)
-        && typeof build.lifecycleContractHash === 'string' && HEX_256.test(build.lifecycleContractHash);
-}
-function parseRegistration(raw) {
-    let value;
-    try {
-        value = JSON.parse(raw);
-    }
-    catch {
-        fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration is malformed');
-    }
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration is invalid');
-    }
-    const registration = value;
-    if (Object.keys(registration).sort().join(',') !== REGISTRATION_KEYS
-        || registration.version !== 1
-        || typeof registration.taskId !== 'string'
-        || typeof registration.controlGeneration !== 'string'
-        || typeof registration.containerId !== 'string'
-        || typeof registration.leaseId !== 'string' || !HEX_256.test(registration.leaseId)
-        || typeof registration.leaseSecretHash !== 'string' || !HEX_256.test(registration.leaseSecretHash)
-        || typeof registration.controllerInstanceDigest !== 'string' || !HEX_256.test(registration.controllerInstanceDigest)
-        || !validProcess(registration.controllerProcess)
-        || !validBuild(registration.buildIdentity)
-        || !Number.isSafeInteger(registration.issuedAt)
-        || !Number.isSafeInteger(registration.expiresAt)
-        || registration.expiresAt <= registration.issuedAt) {
-        fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration schema is invalid');
-    }
-    return registration;
-}
-function registrationPath(manifestPath) {
-    return path.join(path.dirname(path.resolve(manifestPath)), 'codex-controller.json');
-}
-function readRaw(file) {
-    try {
-        const stat = fs.lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink()
-            || (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600)) {
-            fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration file is unsafe');
-        }
-        return { raw: fs.readFileSync(file, 'utf8'), stat };
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return null;
-        throw error;
-    }
-}
-function sameFile(left, right) {
-    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode
-        && left.size === right.size && left.mtimeMs === right.mtimeMs;
-}
-function secretHash(secret) {
-    return crypto.createHash('sha256')
-        .update('agent-infra/codex-controller-lease/v1\0')
-        .update(secret)
-        .digest('hex');
-}
-function safeEqual(left, right) {
-    if (!HEX_256.test(left) || !HEX_256.test(right))
-        return false;
-    return crypto.timingSafeEqual(Buffer.from(left, 'hex'), Buffer.from(right, 'hex'));
-}
-function defaultProbe(manifest, identity) {
-    const command = commandForEngine(manifest.engine, 'docker', [
-        'exec', manifest.containerIdentity.id, 'cat', `/proc/${identity.pid}/stat`
-    ]);
-    const result = runProbe(command.cmd, command.args, { timeout: 2_000 });
-    if (result.status !== 0) {
-        const stderr = typeof result.stderr === 'string' ? result.stderr : result.stderr?.toString('utf8') ?? '';
-        return /no such (?:file|container)|not found|does not exist/iu.test(stderr) ? 'dead' : 'unknown';
-    }
-    const stdout = typeof result.stdout === 'string' ? result.stdout : result.stdout?.toString('utf8') ?? '';
-    const stat = parseLinuxProcessStat(stdout);
-    if (!stat)
-        return 'unknown';
-    if (stat.state === 'Z' || stat.startTime !== identity.startTime)
-        return 'dead';
-    return 'alive';
-}
-function assertRegistrationBinding(registration, manifest, buildIdentity) {
-    if (registration.taskId !== manifest.taskId
-        || registration.controlGeneration !== manifest.generation
-        || registration.containerId !== manifest.containerIdentity.id) {
-        fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration binding is invalid');
-    }
-    if (registration.buildIdentity.protocolVersion !== buildIdentity.protocolVersion) {
-        fail('CODEX_LIFECYCLE_PROTOCOL_MISMATCH', 'Codex lifecycle protocol version does not match');
-    }
-}
-function atomicWrite(file, value) {
-    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);
-    try {
-        fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { mode: 0o600, flag: 'wx' });
-        fs.chmodSync(temporary, 0o600);
-        fs.renameSync(temporary, file);
-    }
-    finally {
-        fs.rmSync(temporary, { force: true });
-    }
-}
-export function readCodexControllerRegistration(manifestPath) {
-    const existing = readRaw(registrationPath(manifestPath));
-    if (!existing)
-        fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_MISSING', 'controller registration is missing');
-    return parseRegistration(existing.raw);
-}
-export function openCodexControllerRegistration(params, options = {}) {
-    if (params.manifest.mode !== 'task-bound' || !params.manifest.taskId) {
-        fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot register a Codex controller');
-    }
-    if (!validProcess(params.controllerProcess)) {
-        fail('CODEX_SANDBOX_CONTROLLER_PROCESS_INACTIVE', 'requested controller process is invalid');
-    }
-    const file = registrationPath(params.manifestPath);
-    const now = (options.now ?? Date.now)();
-    const initial = readRaw(file);
-    if (initial) {
-        const existing = parseRegistration(initial.raw);
-        assertRegistrationBinding(existing, params.manifest, params.buildIdentity);
-        if (existing.expiresAt > now) {
-            const oldState = (options.probeProcess ?? ((identity) => defaultProbe(params.manifest, identity)))(existing.controllerProcess);
-            if (oldState === 'alive')
-                fail('CODEX_SANDBOX_CONTROLLER_BUSY', 'an active controller registration already exists');
-            if (oldState === 'unknown')
-                fail('CODEX_SANDBOX_CONTROLLER_PROCESS_UNKNOWN', 'existing controller process state is unknown');
-        }
-    }
-    const requestedState = (options.probeProcess ?? ((identity) => defaultProbe(params.manifest, identity)))(params.controllerProcess);
-    if (requestedState === 'dead')
-        fail('CODEX_SANDBOX_CONTROLLER_PROCESS_INACTIVE', 'requested controller process is not alive');
-    if (requestedState === 'unknown')
-        fail('CODEX_SANDBOX_CONTROLLER_PROCESS_UNKNOWN', 'requested controller process state is unknown');
-    const randomHex = options.randomHex ?? (() => crypto.randomBytes(32).toString('hex'));
-    const leaseId = randomHex();
-    const leaseSecret = randomHex();
-    const controllerInstanceDigest = randomHex();
-    if (![leaseId, leaseSecret, controllerInstanceDigest].every((value) => HEX_256.test(value))) {
-        fail('CODEX_SANDBOX_CONTROLLER_CREDENTIAL_INVALID', 'generated controller credential is invalid');
-    }
-    const registration = Object.freeze({
-        version: 1,
-        taskId: params.manifest.taskId,
-        controlGeneration: params.manifest.generation,
-        containerId: params.manifest.containerIdentity.id,
-        leaseId,
-        leaseSecretHash: secretHash(leaseSecret),
-        controllerInstanceDigest,
-        controllerProcess: params.controllerProcess,
-        buildIdentity: params.buildIdentity,
-        issuedAt: now,
-        expiresAt: now + CONTROLLER_TTL_MS
-    });
-    options.beforeCommit?.();
-    const current = readRaw(file);
-    if ((!initial && current)
-        || (initial && (!current || current.raw !== initial.raw || !sameFile(current.stat, initial.stat)))) {
-        fail('CODEX_SANDBOX_CONTROLLER_OWNERSHIP_LOST', 'controller registration changed before commit');
-    }
-    atomicWrite(file, registration);
-    return Object.freeze({
-        version: 1,
-        status: 'opened',
-        changed: true,
-        lease: Object.freeze({
-            version: 1,
-            leaseId,
-            leaseSecret,
-            taskId: registration.taskId,
-            controlGeneration: registration.controlGeneration,
-            controllerInstanceDigest,
-            controllerProcess: registration.controllerProcess,
-            buildIdentity: registration.buildIdentity,
-            issuedAt: registration.issuedAt,
-            expiresAt: registration.expiresAt
-        }),
-        error: null
-    });
-}
-export function closeCodexControllerRegistration(params) {
-    if (params.manifest.mode !== 'task-bound' || !params.manifest.taskId) {
-        fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot close a Codex controller registration');
-    }
-    const file = registrationPath(params.manifestPath);
-    const existingRaw = readRaw(file);
-    if (!existingRaw)
-        return Object.freeze({ version: 1, status: 'closed', changed: false, lease: null, error: null });
-    const existing = parseRegistration(existingRaw.raw);
-    if (existing.taskId !== params.manifest.taskId
-        || existing.controlGeneration !== params.manifest.generation
-        || existing.containerId !== params.manifest.containerIdentity.id
-        || params.proof.version !== 1
-        || existing.leaseId !== params.proof.leaseId
-        || !safeEqual(existing.leaseSecretHash, secretHash(params.proof.leaseSecret))
-        || JSON.stringify(existing.controllerProcess) !== JSON.stringify(params.proof.controllerProcess)) {
-        fail('CODEX_SANDBOX_CONTROLLER_PROOF_INVALID', 'controller close proof is invalid');
-    }
-    const current = readRaw(file);
-    if (!current || current.raw !== existingRaw.raw || !sameFile(current.stat, existingRaw.stat)) {
-        fail('CODEX_SANDBOX_CONTROLLER_OWNERSHIP_LOST', 'controller registration changed before close');
-    }
-    fs.unlinkSync(file);
-    return Object.freeze({ version: 1, status: 'closed', changed: true, lease: null, error: null });
-}
-export function resolveCodexControllerBinding(params) {
-    if (params.manifest.mode !== 'task-bound' || !params.manifest.taskId) {
-        fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot resolve a Codex controller registration');
-    }
-    const registration = readCodexControllerRegistration(params.manifestPath);
-    assertRegistrationBinding(registration, params.manifest, params.buildIdentity);
-    if (registration.expiresAt <= (params.now ?? Date.now())) {
-        fail('CODEX_SANDBOX_CONTROLLER_LEASE_EXPIRED', 'controller lease is expired');
-    }
-    if (params.proof.version !== 1
-        || registration.leaseId !== params.proof.leaseId
-        || !safeEqual(registration.leaseSecretHash, secretHash(params.proof.leaseSecret))
-        || JSON.stringify(registration.controllerProcess) !== JSON.stringify(params.proof.controllerProcess)) {
-        fail('CODEX_SANDBOX_CONTROLLER_PROOF_INVALID', 'controller proof is invalid');
-    }
-    const state = (params.probeProcess ?? ((identity) => defaultProbe(params.manifest, identity)))(registration.controllerProcess);
-    if (state === 'dead')
-        fail('CODEX_SANDBOX_CONTROLLER_PROCESS_INACTIVE', 'controller process is not alive');
-    if (state === 'unknown')
-        fail('CODEX_SANDBOX_CONTROLLER_PROCESS_UNKNOWN', 'controller process state is unknown');
-    return Object.freeze({
-        instanceDigest: registration.controllerInstanceDigest,
-        controlGeneration: registration.controlGeneration
-    });
-}
-//# sourceMappingURL=controller-registration.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/sandbox-controller-cli.js

@@ -1,106 +0,0 @@
-import { runCodexSandboxController, verifyCodexSandboxControllerContextWithWarnings } from './sandbox-controller.js';
-import { ensureInternalHandlerRoute, internalHandlerRoute } from '../../../internal/cli-route-inventory.js';
-const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
-function fail(code, message, exitCode = 1) {
-    process.stdout.write(`${JSON.stringify({
-        status: 'failed',
-        changed: false,
-        error: { code, message }
-    })}\n`);
-    process.exitCode = exitCode;
-}
-function parse(args) {
-    if (args[0] === '--help' || args[0] === '-h') {
-        process.stdout.write(USAGE);
-        return null;
-    }
-    const operation = args[0];
-    if (!operation || ![
-        internalHandlerRoute('codex-sandbox-controller', 'run', operation),
-        internalHandlerRoute('codex-sandbox-controller', 'verify-context', operation)
-    ].some(Boolean)) {
-        process.stderr.write(USAGE);
-        fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', 'operation must be run or verify-context', 2);
-        return null;
-    }
-    const allowed = new Set([
-        '--context',
-        '--executor-model',
-        '--executor-reasoning-effort',
-        '--reviewer-model',
-        '--reviewer-reasoning-effort'
-    ]);
-    const values = {};
-    for (let index = 1; index < args.length; index += 1) {
-        const flag = args[index];
-        if (flag === '--task-id' || flag.startsWith('--task-id=')
-            || flag === '--task-ref' || flag.startsWith('--task-ref=')) {
-            fail('CODEX_SANDBOX_CONTROLLER_IDENTITY_OPTION_UNSUPPORTED', 'controller task identity options are not supported', 2);
-            return null;
-        }
-        const value = args[++index];
-        if (!allowed.has(flag) || Object.hasOwn(values, flag) || !value || value.startsWith('--')) {
-            fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', `invalid option '${flag}'`, 2);
-            return null;
-        }
-        values[flag] = value;
-    }
-    return { operation, values };
-}
-async function codexSandboxController(args = []) {
-    if (!ensureInternalHandlerRoute('codex-sandbox-controller', args))
-        return;
-    const parsed = parse(args);
-    if (!parsed || process.exitCode)
-        return;
-    try {
-        if (internalHandlerRoute('codex-sandbox-controller', 'verify-context', parsed.operation)) {
-            const contextPath = parsed.values['--context']
-                ?? process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
-            if (!contextPath)
-                throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_MISSING');
-            const verified = verifyCodexSandboxControllerContextWithWarnings(contextPath);
-            const context = verified.context;
-            process.stdout.write(`${JSON.stringify({
-                status: 'ready',
-                changed: false,
-                context: {
-                    taskId: context.taskId,
-                    controlGeneration: context.controlGeneration,
-                    controllerInstanceDigest: context.controllerInstanceDigest,
-                    expiresAt: context.expiresAt,
-                    buildIdentity: context.buildIdentity,
-                    hookDefinitionHash: context.hookDefinitionHash,
-                },
-                ...(verified.warnings.length > 0 ? { warnings: verified.warnings } : {}),
-                error: null
-            })}\n`);
-            return;
-        }
-        const policy = [
-            '--executor-model',
-            '--executor-reasoning-effort',
-            '--reviewer-model',
-            '--reviewer-reasoning-effort'
-        ];
-        if (policy.some((flag) => parsed.values[flag] !== undefined)
-            && policy.some((flag) => parsed.values[flag] === undefined)) {
-            throw new Error('CODEX_SANDBOX_CONTROLLER_MODEL_POLICY_INVALID');
-        }
-        const exitCode = await runCodexSandboxController({
-            executorModel: parsed.values['--executor-model'],
-            executorReasoningEffort: parsed.values['--executor-reasoning-effort'],
-            reviewerModel: parsed.values['--reviewer-model'],
-            reviewerReasoningEffort: parsed.values['--reviewer-reasoning-effort']
-        });
-        process.exitCode = exitCode;
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const code = /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1]
-            ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
-        fail(code, message);
-    }
-}
-export { codexSandboxController };
-//# sourceMappingURL=sandbox-controller-cli.js.map