@fitlab-ai/agent-infra 0.11.13 → 0.11.15

package/dist/lib/sandbox/environment.js

@@ -5,14 +5,13 @@ export const SANDBOX_CONTROL_STATUS_MOUNT = '/run/agent-infra/control-status';
 const TASK_MARKER_KEYS = [
     'AGENT_INFRA_SANDBOX',
     'AGENT_INFRA_TASK_ID',
-    'AGENT_INFRA_CONTROL_TOKEN',
     'AGENT_INFRA_CONTROL_GENERATION',
     'AGENT_INFRA_CONTROL_DIR',
+    'AGENT_INFRA_CONTROL_ROOT_DIR',
     'AGENT_INFRA_CONTROL_STATUS_DIR',
     'AGENT_INFRA_RUNTIME_DIR'
 ];
 const TASK_CONTROL_MARKER_KEYS = [
-    'AGENT_INFRA_CONTROL_TOKEN',
     'AGENT_INFRA_CONTROL_GENERATION',
     'AGENT_INFRA_CONTROL_DIR',
     'AGENT_INFRA_CONTROL_STATUS_DIR'
@@ -77,7 +76,6 @@ export function hasSandboxControlMarker(env = process.env) {
 export function resolveSandboxControlTransport(env = process.env, options = {}) {
     const markerState = sandboxTaskMarkerState(env);
     const hasAnyMarker = markerState !== 'none'
-        || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING)
         || Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
     const fixedStatusDir = options.statusMountPath ?? SANDBOX_CONTROL_STATUS_MOUNT;
     const fixedStatusProbe = path.isAbsolute(fixedStatusDir)
@@ -98,6 +96,10 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
     if (!hasCompleteConfig) {
         return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
     }
+    if (markerState === 'task-bound'
+        && (!env.AGENT_INFRA_CONTROL_ROOT_DIR || !path.isAbsolute(env.AGENT_INFRA_CONTROL_ROOT_DIR))) {
+        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
+    }
     const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
     const configuredStatusProbe = configuredStatusDir && path.isAbsolute(configuredStatusDir)
         ? nativeDirectoryProbe(configuredStatusDir) : 'absent';
@@ -108,7 +110,7 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
         ? configuredStatusProbe === 'present' ? configuredStatusDir : null
         : fixedStatusMounted ? fixedStatusDir : null;
     const statusMounted = statusDir !== null;
-    if (env.AGENT_INFRA_EXECUTOR_MANIFEST || env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING) {
+    if (env.AGENT_INFRA_EXECUTOR_MANIFEST) {
         return { kind: 'fail-closed', reasonCode: 'TASK_CONTROL_TRANSPORT_INVALID' };
     }
     const taskBound = Boolean(env.AGENT_INFRA_TASK_ID);
@@ -124,9 +126,6 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
                     ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
                     : 'SANDBOX_CONTROL_IDENTITY_MALFORMED' };
         }
-        if (sentinel.generation !== env.AGENT_INFRA_CONTROL_GENERATION) {
-            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH' };
-        }
         if (sentinel.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH' };
         }
@@ -134,7 +133,7 @@ export function resolveSandboxControlTransport(env = process.env, options = {})
             && (sentinel.taskId !== env.AGENT_INFRA_TASK_ID || !runtime)) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
         }
-        if (sentinel.mode === 'branch-only' && (taskBound || runtime)) {
+        if (sentinel.mode === 'branch-only' && (taskBound || runtime || Boolean(env.AGENT_INFRA_CONTROL_ROOT_DIR))) {
             return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
         }
         return { kind: options.localWorkflow ? 'sandbox-local' : 'broker-client', reasonCode: null };

package/dist/lib/sandbox/mounts.js

@@ -2,10 +2,13 @@ import path from 'node:path';
 import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
 import { sandboxWorkspaceViewStatePaths } from './workspace-view.js';
 import { SANDBOX_GIT_COMMON_DIR } from './git-metadata.js';
-export function sandboxCoreBindMounts(config, branch, overrides) {
-    const taskSources = overrides.taskSources ?? [];
-    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
-    const workspaceMounts = sandboxWorkspaceViewStatePaths(overrides.workspaceViewRoot).map(({ state, hostPath }) => taskBound && state === 'active'
+function workspaceStateMounts(workspaceViewRoot, taskBound) {
+    return sandboxWorkspaceViewStatePaths(workspaceViewRoot)
+        // The writable completed-task mount below is nested under this path. Keep
+        // the worktree target visible so Docker can mount it without creating a
+        // mountpoint inside a read-only parent bind mount.
+        .filter(({ state }) => !(taskBound && state === 'completed'))
+        .map(({ state, hostPath }) => taskBound && state === 'active'
         ? {
             hostPaths: [path.join(hostPath, '.short-ids.json')],
             containerPath: '/workspace/.agents/workspace/active/.short-ids.json',
@@ -16,17 +19,69 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: path.posix.join('/workspace/.agents/workspace', state),
             readOnly: true
         });
+}
+function assertGitMetadataPair(overrides) {
     if (Boolean(overrides.gitCommonDir) !== Boolean(overrides.worktreeGitFile)) {
         throw new Error('SANDBOX_GIT_METADATA_INCOMPLETE');
     }
-    const gitCommonMount = overrides.gitCommonDir
-        ? { hostPaths: [overrides.gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }
-        : null;
-    const worktreeGitFileMount = overrides.worktreeGitFile
-        ? { hostPaths: [overrides.worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }
-        : null;
+}
+function gitCommonMount(gitCommonDir) {
+    return gitCommonDir ? [{ hostPaths: [gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }] : [];
+}
+function worktreeGitFileMount(worktreeGitFile) {
+    return worktreeGitFile ? [{ hostPaths: [worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }] : [];
+}
+function taskWorkspaceMounts(taskSources, taskBound, overrides) {
+    if (!taskBound)
+        return [];
+    const taskId = overrides.taskId;
+    const mounts = [{
+            hostPaths: taskSources,
+            containerPath: path.posix.join('/workspace/.agents/workspace/active', taskId),
+            readOnly: false
+        }];
+    if (overrides.completedTaskSource)
+        mounts.push({
+            hostPaths: [overrides.completedTaskSource],
+            containerPath: path.posix.join('/workspace/.agents/workspace/completed', taskId),
+            readOnly: false
+        });
+    return mounts;
+}
+function sharedMounts(config, branch, shellConfigHostDir) {
+    return [{
+            hostPaths: [shareCommonDir(config)], containerPath: '/share/common', readOnly: false
+        }, {
+            hostPaths: [shareBranchDir(config, branch)], containerPath: '/share/branch', readOnly: false
+        }, {
+            hostPaths: shellConfigHostDir ? [shellConfigHostDir] : shellConfigDirCandidates(config, branch),
+            containerPath: '/home/devuser/.host-shell-config', readOnly: true
+        }];
+}
+function controlMounts(overrides, taskBound) {
+    const mounts = [{
+            hostPaths: [overrides.controlStatusDir], containerPath: '/run/agent-infra/control-status', readOnly: true
+        }, {
+            hostPaths: [overrides.controlDir], containerPath: '/run/agent-infra/control', readOnly: false
+        }];
+    if (taskBound && overrides.runtimeDir)
+        mounts.push({
+            hostPaths: [overrides.runtimeDir], containerPath: '/run/agent-infra/runtime', readOnly: false
+        });
+    if (taskBound && overrides.controlRootDir)
+        mounts.push({
+            hostPaths: [overrides.controlRootDir], containerPath: '/run/agent-infra/control-root', readOnly: false
+        });
+    return mounts;
+}
+export function sandboxCoreBindMounts(config, branch, overrides) {
+    const taskSources = overrides.taskSources ?? [];
+    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
+    assertGitMetadataPair(overrides);
+    if (taskBound && !overrides.controlRootDir)
+        throw new Error('SANDBOX_CONTROL_ROOT_MISSING');
     const mounts = [
-        ...(gitCommonMount ? [gitCommonMount] : []),
+        ...gitCommonMount(overrides.gitCommonDir),
         {
             hostPaths: overrides.worktree
                 ? [overrides.worktree]
@@ -34,55 +89,12 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
             containerPath: '/workspace',
             readOnly: false
         },
-        ...(worktreeGitFileMount ? [worktreeGitFileMount] : []),
-        ...workspaceMounts,
+        ...worktreeGitFileMount(overrides.worktreeGitFile),
+        ...workspaceStateMounts(overrides.workspaceViewRoot, taskBound),
+        ...taskWorkspaceMounts(taskSources, taskBound, overrides),
+        ...sharedMounts(config, branch, overrides.shellConfigHostDir),
+        ...controlMounts(overrides, taskBound)
     ];
-    if (taskBound) {
-        const taskMountPath = path.posix.join('/workspace/.agents/workspace/active', overrides.taskId);
-        mounts.push({
-            hostPaths: taskSources,
-            containerPath: taskMountPath,
-            readOnly: false
-        });
-        if (overrides.completedTaskSource) {
-            mounts.push({
-                hostPaths: [overrides.completedTaskSource],
-                containerPath: path.posix.join('/workspace/.agents/workspace/completed', overrides.taskId),
-                readOnly: false
-            });
-        }
-    }
-    mounts.push({
-        hostPaths: [shareCommonDir(config)],
-        containerPath: '/share/common',
-        readOnly: false
-    }, {
-        hostPaths: [shareBranchDir(config, branch)],
-        containerPath: '/share/branch',
-        readOnly: false
-    }, {
-        hostPaths: overrides.shellConfigHostDir
-            ? [overrides.shellConfigHostDir]
-            : shellConfigDirCandidates(config, branch),
-        containerPath: '/home/devuser/.host-shell-config',
-        readOnly: true
-    });
-    mounts.push({
-        hostPaths: [overrides.controlStatusDir],
-        containerPath: '/run/agent-infra/control-status',
-        readOnly: true
-    }, {
-        hostPaths: [overrides.controlDir],
-        containerPath: '/run/agent-infra/control',
-        readOnly: false
-    });
-    if (taskBound && overrides.runtimeDir) {
-        mounts.push({
-            hostPaths: [overrides.runtimeDir],
-            containerPath: '/run/agent-infra/runtime',
-            readOnly: false
-        });
-    }
     return mounts;
 }
 //# sourceMappingURL=mounts.js.map

package/dist/lib/sandbox/recovery.js

@@ -174,7 +174,6 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
 async function ensureSandboxControlBroker(params) {
     const control = sandboxControlPaths({
         base: params.config.controlBase ?? path.join(params.config.home, '.agent-infra', 'sandbox-control'),
-        repoRoot: params.config.repoRoot,
         project: params.config.project,
         container: params.container,
         identity: params.workspace
@@ -523,7 +522,6 @@ function expectedMounts(params) {
     });
     const control = sandboxControlPaths({
         base: config.controlBase ?? path.join(config.home, '.agent-infra', 'sandbox-control'),
-        repoRoot: config.repoRoot,
         project: config.project,
         container: params.container,
         identity: params.workspace
@@ -546,6 +544,7 @@ function expectedMounts(params) {
             }),
         workspaceViewRoot: view.root,
         controlDir: control.channelDir,
+        ...(params.workspace.mode === 'task-bound' ? { controlRootDir: control.root } : {}),
         controlStatusDir: control.statusDir,
         ...(taskSources === null
             ? {}
@@ -926,7 +925,7 @@ export async function ensureSandboxReady(params) {
             let completedReentry = null;
             if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
                 const control = sandboxControlPaths({
-                    base: params.config.controlBase, repoRoot: params.config.repoRoot, project: params.config.project,
+                    base: params.config.controlBase, project: params.config.project,
                     container: params.row.name, identity: params.workspace
                 });
                 const manifest = readSandboxControlManifest(control.manifestPath);

package/dist/lib/sandbox/removal.js

@@ -568,7 +568,7 @@ function resolveRmTarget(config, tools, cleanupTarget, options = {}) {
         ? matchedContainers
         : [...new Set([...containerNameCandidates(config, effectiveBranch), ...matchedContainers])];
     const controlRoots = containers.flatMap((container) => identities.map((identity) => sandboxControlPaths({
-        base: config.controlBase, repoRoot: config.repoRoot, project: config.project, container, identity
+        base: config.controlBase, project: config.project, container, identity
     }).root));
     const workspaceViewRoots = containers.flatMap((container) => identities.map((identity) => sandboxWorkspaceViewPaths({
         base: config.workspaceViewBase, project: config.project, container, identity
@@ -763,6 +763,21 @@ async function rmPurgeCore(config, tools, prompt = {}) {
     const containers = runEngine(engine, 'docker', [
         'ps', '-a', '--filter', `label=${sandboxLabel(config)}`, '--format', '{{.Names}}'
     ]).split('\n').filter(Boolean);
+    const controlRoots = rows.flatMap((row) => {
+        if (!row.branch)
+            return [];
+        const identity = row.workspaceMode === 'task-bound' && row.taskId
+            ? { mode: 'task-bound', taskId: row.taskId }
+            : row.workspaceMode === 'branch-only'
+                ? { mode: 'branch-only' }
+                : null;
+        if (!identity)
+            return [];
+        return [sandboxControlPaths({
+                base: config.controlBase, project: config.project,
+                container: row.name, identity
+            }).root];
+    });
     const completedTaskIds = [...new Set(rows
             .filter((row) => row.workspaceMode === 'task-bound' && row.taskId)
             .map((row) => row.taskId))];
@@ -801,9 +816,9 @@ async function rmPurgeCore(config, tools, prompt = {}) {
         else
             cleanupCompleted = false;
     }
-    for (const base of [config.workspaceViewBase, config.controlBase]) {
-        fs.rmSync(path.join(base, config.project), { recursive: true, force: true });
-    }
+    fs.rmSync(path.join(config.workspaceViewBase, config.project), { recursive: true, force: true });
+    for (const root of new Set(controlRoots))
+        fs.rmSync(root, { recursive: true, force: true });
     if (cleanupCompleted) {
         for (const taskId of completedTaskIds)
             releaseStaleShortIdRegistry(config.repoRoot, taskId);

package/dist/lib/sandbox/workspace-identity.js

@@ -1,8 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { isRemovedHashShortIdInput } from '../task/short-id.js';
-import { resolveTaskRef } from '../task/resolve-ref.js';
-import { resolveTaskWorkspace } from './task-resolver.js';
+import { configuredShortIdLength, inspectShortIdRegistry, isRemovedHashShortIdInput, normalizeShortIdInput } from '../task/short-id.js';
+import { TASK_WORKSPACE_STATES, listTaskWorkspaces, resolveTaskWorkspace } from './task-resolver.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 const SHORT_ID_RE = /^\d+$/;
 function stripQuotes(value) {
@@ -42,12 +41,30 @@ function taskIdentity(repoRoot, taskId, registry) {
 function cleanupTaskId(requestedRef, repoRoot) {
     if (TASK_ID_RE.test(requestedRef))
         return requestedRef;
-    if (!SHORT_ID_RE.test(requestedRef))
+    const shortIdLength = configuredShortIdLength(repoRoot);
+    const normalized = normalizeShortIdInput(requestedRef, { shortIdLength });
+    if (normalized.kind === 'error')
+        throw new Error(normalized.message);
+    if (normalized.kind !== 'shortId')
         return null;
-    const task = resolveTaskRef(requestedRef, { repoRoot });
-    if (!task.ok)
-        throw new Error(task.message);
-    return task.taskId;
+    const registry = inspectShortIdRegistry(repoRoot, shortIdLength);
+    if (registry.status !== 'valid')
+        throw new Error(registry.error.message);
+    const match = [...registry.shortIds].find(([, shortId]) => shortId === normalized.value);
+    if (!match) {
+        throw new Error(`Short id '${normalized.value}' not found in active task registry`);
+    }
+    return match[0];
+}
+function cleanupTaskIdByBranch(requestedRef, repoRoot) {
+    const taskIds = new Set(TASK_WORKSPACE_STATES
+        .flatMap((state) => listTaskWorkspaces(repoRoot, state))
+        .filter((task) => task.branch === requestedRef)
+        .map((task) => task.taskId));
+    if (taskIds.size > 1) {
+        throw new Error(`SANDBOX_TASK_IDENTITY_AMBIGUOUS: branch '${requestedRef}' is bound to multiple tasks`);
+    }
+    return taskIds.values().next().value ?? null;
 }
 export function resolveSandboxTarget(requestedRef, repoRoot) {
     if (isRemovedHashShortIdInput(requestedRef)) {
@@ -94,7 +111,8 @@ export function resolveSandboxCleanupTarget(requestedRef, repoRoot, options = {}
     if (isRemovedHashShortIdInput(requestedRef)) {
         throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
     }
-    const taskId = cleanupTaskId(requestedRef, repoRoot);
+    const taskId = cleanupTaskId(requestedRef, repoRoot)
+        ?? cleanupTaskIdByBranch(requestedRef, repoRoot);
     if (taskId) {
         let task;
         try {
@@ -123,14 +141,11 @@ export function resolveSandboxCleanupTarget(requestedRef, repoRoot, options = {}
             taskState: task.state
         };
     }
-    const target = resolveSandboxTarget(requestedRef, repoRoot);
     return {
         requestedRef,
-        branch: target.branch,
-        workspace: target.workspace.mode === 'task-bound'
-            ? { mode: 'task-bound', taskId: target.workspace.taskId }
-            : { mode: 'branch-only' },
-        taskState: target.workspace.mode === 'task-bound' ? 'active' : 'branch-only'
+        branch: requestedRef,
+        workspace: { mode: 'branch-only' },
+        taskState: 'branch-only'
     };
 }
 export function parseSandboxWorkspaceIdentity(labels, keys) {

package/dist/lib/sandbox/workspace-view.js

@@ -2,7 +2,6 @@ import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import { resolveTaskWorkspace } from './task-resolver.js';
-import { resolveTaskRuntimeRoot } from '../task/runtime-paths.js';
 import { createSandboxControlIdentitySentinel, writeSandboxControlIdentitySentinel } from './control/identity-sentinel.js';
 export const SANDBOX_WORKSPACE_VIEW_STATES = Object.freeze([
     'active',
@@ -27,7 +26,17 @@ export function sandboxWorkspaceViewPaths(params) {
 }
 export function sandboxControlPaths(params) {
     const root = params.identity.mode === 'task-bound'
-        ? path.join(resolveTaskRuntimeRoot(params.identity.taskId, { repoRoot: params.repoRoot }), 'sandbox-control')
+        ? (() => {
+            if (!/^TASK-\d{8}-\d{6}$/.test(params.identity.taskId)
+                || !params.project || path.basename(params.project) !== params.project || params.project === '.' || params.project === '..') {
+                throw new Error('SANDBOX_CONTROL_ROOT_INVALID');
+            }
+            const candidate = path.resolve(params.base, params.project, 'tasks', params.identity.taskId);
+            const relative = path.relative(path.resolve(params.base), candidate);
+            if (relative.startsWith('..') || path.isAbsolute(relative))
+                throw new Error('SANDBOX_CONTROL_ROOT_INVALID');
+            return candidate;
+        })()
         : (() => {
             const digest = createHash('sha256').update('branch-only').digest('hex').slice(0, 16);
             return path.resolve(params.base, params.project, params.container, digest);
@@ -50,6 +59,22 @@ function assertSafeDirectory(directory, expectedBase) {
         throw new Error(`Sandbox workspace view must not be a symbolic link: ${directory}`);
     }
 }
+function assertSafeTaskBoundControlRoot(basePath, root) {
+    const relative = path.relative(basePath, root);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Sandbox control root escapes its configured base: ${root}`);
+    }
+    if (fs.existsSync(basePath) && fs.lstatSync(basePath).isSymbolicLink()) {
+        throw new Error(`Sandbox control base must not be a symbolic link: ${basePath}`);
+    }
+    let current = basePath;
+    for (const segment of relative.split(path.sep)) {
+        current = path.join(current, segment);
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) {
+            throw new Error(`Sandbox control root must not contain a symbolic link: ${current}`);
+        }
+    }
+}
 function assertSafeMountTargetPath(target, worktreeRoot, canonicalWorktreeRoot) {
     const relative = path.relative(worktreeRoot, target);
     if (relative.startsWith('..') || path.isAbsolute(relative)) {
@@ -203,7 +228,12 @@ export function materializeSandboxWorkspaceView(params) {
 }
 export function materializeSandboxControl(params) {
     const { root, channelDir, statusDir, processingDir, runtimeDir, manifestPath } = sandboxControlPaths(params);
-    assertSafeDirectory(root, params.identity.mode === 'task-bound' ? path.dirname(root) : path.resolve(params.base));
+    if (params.identity.mode === 'task-bound') {
+        assertSafeTaskBoundControlRoot(path.resolve(params.base), root);
+    }
+    else {
+        assertSafeDirectory(root, path.resolve(params.base));
+    }
     if (fs.existsSync(root)) {
         if (!params.replacementLease || path.resolve(params.replacementLease.root) !== root) {
             throw new Error('SANDBOX_CONTROL_REPLACEMENT_REQUIRED');
@@ -261,9 +291,16 @@ export function finalizeSandboxControlManifest(setup, identity) {
         containerIdentity: { id: identity.id, labels: { ...identity.labels } },
         authorityEvidence: identity.authorityEvidence
     };
+    const persistedManifest = {
+        ...manifest,
+        channelDir: 'channel',
+        publicStatusDir: 'public',
+        processingDir: 'processing',
+        runtimeDir: 'runtime'
+    };
     const temporary = `${setup.manifestPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
     try {
-        fs.writeFileSync(temporary, `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: 'wx' });
+        fs.writeFileSync(temporary, `${JSON.stringify(persistedManifest)}\n`, { mode: 0o600, flag: 'wx' });
         fs.renameSync(temporary, setup.manifestPath);
     }
     finally {

package/dist/lib/task/control-authority.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { isAgentClientId } from '../agent-clients/types.js';
+import { sandboxControlPaths } from '../sandbox/workspace-view.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
 import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, awaitOrchestrationDelegationActivation, beginOrResumeOrchestration, dispatchOrchestrationDelegation, OrchestrationStateError, pauseOrchestration, prepareOrchestrationDelegation, recoverPreparedOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from './orchestration.js';
 import { applyTaskFinalization } from './finalization.js';
@@ -25,21 +26,14 @@ function absolute(name, value) {
         invalidContext(`${name} must be absolute`);
     return path.resolve(value);
 }
-function binding(value) {
-    if (value === null || value === undefined)
-        return value;
-    if (!/^[a-f0-9]{64}$/u.test(value.instanceDigest) || !value.controlGeneration) {
-        invalidContext('controller binding is invalid');
-    }
-    return value;
-}
 export function createDirectHostExecutionContext(params) {
     return {
         source: 'direct-host',
         mode: 'direct-host',
         repoRoot: absolute('repoRoot', params.repoRoot),
-        ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) }),
-        ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
+        ...(params.controlBase === undefined ? {} : { controlBase: absolute('controlBase', params.controlBase) }),
+        ...(params.project === undefined ? {} : { project: params.project }),
+        ...(params.runtimeDir === undefined ? {} : { runtimeDir: absolute('runtimeDir', params.runtimeDir) })
     };
 }
 export function createSandboxExecutorExecutionContext(params) {
@@ -59,8 +53,7 @@ export function createSandboxExecutorExecutionContext(params) {
         taskId: params.taskId,
         generation: params.generation,
         manifestPath: absolute('manifestPath', params.manifestPath),
-        requestId: params.requestId,
-        ...(params.controllerBinding === undefined ? {} : { controllerBinding: binding(params.controllerBinding) }),
+        requestId: params.requestId
     };
 }
 export function assertTaskControlExecutionContext(context) {
@@ -70,7 +63,10 @@ export function assertTaskControlExecutionContext(context) {
         absolute('repoRoot', context.repoRoot);
         if (context.runtimeDir !== undefined)
             absolute('runtimeDir', context.runtimeDir);
-        binding(context.controllerBinding);
+        if (Boolean(context.controlBase) !== Boolean(context.project))
+            invalidContext('control configuration is incomplete');
+        if (context.controlBase !== undefined)
+            absolute('controlBase', context.controlBase);
         return;
     }
     if (context.mode !== 'task-bound-sandbox' || !/^TASK-\d{8}-\d{6}$/u.test(context.taskId)
@@ -84,7 +80,6 @@ export function assertTaskControlExecutionContext(context) {
     if (path.resolve(context.runtimeDir) !== path.join(path.dirname(path.resolve(context.manifestPath)), 'runtime')) {
         invalidContext('runtimeDir is not bound to the manifest control root');
     }
-    binding(context.controllerBinding);
 }
 function boundTaskRef(context, taskRef) {
     return context.source === 'sandbox-executor' ? context.taskId : taskRef;
@@ -115,6 +110,8 @@ function lifecycleTaskId(request, repoRoot) {
     }
 }
 async function applyLifecycleWithAuthority(context, request) {
+    const taskId = lifecycleTaskId(request, context.repoRoot);
+    const controlRoot = taskId ? controlRootForTask(context, taskId) : undefined;
     const execute = async (underTaskLock = false) => {
         if (request.intent === 'recover-started') {
             const adapter = isAgentClientId(request.agent)
@@ -130,10 +127,17 @@ async function applyLifecycleWithAuthority(context, request) {
             return adapter.recoverStarted(request, { repoRoot: context.repoRoot });
         }
         return underTaskLock
-            ? applyTaskLifecycleWithinTaskLock(request, { repoRoot: context.repoRoot }, taskId)
-            : applyTaskLifecycle(request, { repoRoot: context.repoRoot });
+            ? applyTaskLifecycleWithinTaskLock(request, {
+                repoRoot: context.repoRoot,
+                ...(controlRoot ? { controlRoot } : {}),
+                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+            }, taskId)
+            : applyTaskLifecycle(request, {
+                repoRoot: context.repoRoot,
+                ...(controlRoot ? { controlRoot } : {}),
+                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+            });
     };
-    const taskId = lifecycleTaskId(request, context.repoRoot);
     if (!taskId)
         return await execute();
     try {
@@ -153,6 +157,18 @@ async function applyLifecycleWithAuthority(context, request) {
         return taskLifecycleFailure(request, { code: error.code, message: error.message }, taskId);
     }
 }
+function controlRootForTask(context, taskId) {
+    if (context.source === 'sandbox-executor')
+        return path.dirname(context.manifestPath);
+    if (!context.controlBase || !context.project)
+        return undefined;
+    return sandboxControlPaths({
+        base: context.controlBase,
+        project: context.project,
+        container: '',
+        identity: { mode: 'task-bound', taskId }
+    }).root;
+}
 function orchestration(context, operation) {
     const taskRef = boundTaskRef(context, operation.taskRef);
     const input = operation.input;
@@ -219,6 +235,10 @@ export function dispatchTaskControlOperation(context, operation) {
         });
     }
     if (operation.family === 'task-finalization') {
+        const resolved = resolveTaskRef(boundTaskRef(context, operation.request.taskRef), { repoRoot: context.repoRoot });
+        const controlRoot = context.source === 'sandbox-executor'
+            ? path.dirname(context.manifestPath)
+            : resolved.ok ? controlRootForTask(context, resolved.taskId) : undefined;
         return applyTaskFinalization({
             ...operation.request,
             taskRef: boundTaskRef(context, operation.request.taskRef)
@@ -228,6 +248,8 @@ export function dispatchTaskControlOperation(context, operation) {
                 controlBinding: { generation: context.generation, requestId: context.requestId },
                 manifestPath: context.manifestPath
             } : {}),
+            ...(controlRoot ? { controlRoot } : {}),
+            ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {}),
             preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
         });
     }

package/dist/lib/task/control-recovery.js

@@ -19,8 +19,7 @@ export const SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES = Object.freeze([
 const LIFECYCLE_INTENTS = ['block', 'activate', 'cancel', 'close-codescan', 'close-dependabot', 'restore', 'recover-started'];
 export const SANDBOX_CONTROL_RECOVERY_OPERATIONS = Object.freeze([
     ...LIFECYCLE_INTENTS.map((intent) => ({ family: 'task-lifecycle', intent, class: 'lifecycle-mutation' })),
-    { family: 'task-create', intent: 'create', class: 'task-create' },
-    ...['controller.close', 'controller.verify'].map((intent) => ({ family: 'agent-client', intent, class: 'agent-client-operation' }))
+    { family: 'task-create', intent: 'create', class: 'task-create' }
 ]);
 export function digestControlRecoveryIntent(family, intent) {
     return createHash('sha256').update(`${family}\0${intent}`, 'utf8').digest('hex');

package/dist/lib/task/finalization.js

@@ -894,7 +894,13 @@ async function prepareUnderLock(request, taskId, options) {
             receipt = updateReceipt(repoRoot, receipt, { lifecycle: 'done', lastError: null });
         }
         else {
-            const result = lifecycle({ taskRef: taskId, intent: 'complete', agent: request.agent }, { repoRoot, prepareOnly: true, ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {}) });
+            const result = lifecycle({ taskRef: taskId, intent: 'complete', agent: request.agent }, {
+                repoRoot,
+                prepareOnly: true,
+                ...(options.controlRoot ? { controlRoot: options.controlRoot } : {}),
+                ...(options.controlProject ? { controlProject: options.controlProject } : {}),
+                ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {})
+            });
             lifecycleResult = lifecycleStep(result);
             if (result.status !== 'applied' && result.status !== 'no-op') {
                 receipt = updateReceipt(repoRoot, receipt, { lifecycle: 'pending', lastError: lifecycleResult.error });
@@ -1037,7 +1043,12 @@ async function commitPreparedTaskFinalization(request, options) {
                 });
             receipt = updateReceipt(repoRoot, receipt, { verification: 'pending' });
             const lifecycleRequest = { taskRef: resolved.taskId, intent: 'complete', agent: request.agent };
-            const lifecycleOptions = { repoRoot, ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {}) };
+            const lifecycleOptions = {
+                repoRoot,
+                ...(options.controlRoot ? { controlRoot: options.controlRoot } : {}),
+                ...(options.controlProject ? { controlProject: options.controlProject } : {}),
+                ...(options.metadataProvider ? { metadataProvider: options.metadataProvider } : {})
+            };
             const result = options.lifecycle
                 ? options.lifecycle(lifecycleRequest, lifecycleOptions)
                 : applyTaskLifecycleWithinTaskLock(lifecycleRequest, lifecycleOptions, resolved.taskId);