@fitlab-ai/agent-infra 0.11.13 → 0.11.15

package/lib/sandbox/control/host-recovery.ts

@@ -24,20 +24,73 @@ function manifestDigest(manifest: SandboxControlManifest): string {
   });
 }
 
-function managedManifestPaths(managedRoot: string): string[] {
-  if (!fs.existsSync(managedRoot)) return [];
-  const rootStat = fs.lstatSync(managedRoot);
-  if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-  const result: string[] = [];
-  for (const container of fs.readdirSync(managedRoot, { withFileTypes: true })) {
-    if (!container.isDirectory() || container.isSymbolicLink()) continue;
-    const containerPath = path.join(managedRoot, container.name);
-    for (const identity of fs.readdirSync(containerPath, { withFileTypes: true })) {
-      if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name)) continue;
-      result.push(path.join(containerPath, identity.name, 'manifest.json'));
+function readManagedManifest(manifestPath: string): SandboxControlManifest {
+  try { return readSandboxControlManifest(manifestPath); } catch { throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID'); }
+}
+
+function branchOnlyManifests(parentPath: string): SandboxControlManifest[] {
+  const manifests: SandboxControlManifest[] = [];
+  for (const identity of fs.readdirSync(parentPath, { withFileTypes: true })) {
+    if (!identity.isDirectory() || identity.isSymbolicLink() || !/^[a-f0-9]{16}$/u.test(identity.name)) continue;
+    manifests.push(readManagedManifest(path.join(parentPath, identity.name, 'manifest.json')));
+  }
+  return manifests;
+}
+
+function taskBoundManifests(params: Readonly<{
+  tasksRoot: string;
+  controlBase: string;
+  project: string;
+  repoRoot: string;
+}>): SandboxControlManifest[] {
+  assertDirectory(params.tasksRoot);
+  const canonicalManagedRoot = fs.realpathSync.native(path.dirname(params.tasksRoot));
+  const canonicalTasksRoot = fs.realpathSync.native(params.tasksRoot);
+  if (path.dirname(canonicalTasksRoot) !== canonicalManagedRoot) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  const canonicalRepoRoot = fs.realpathSync.native(params.repoRoot);
+  const manifests: SandboxControlManifest[] = [];
+  for (const task of fs.readdirSync(params.tasksRoot, { withFileTypes: true })) {
+    if (!/^TASK-\d{8}-\d{6}$/u.test(task.name)) continue;
+    if (!task.isDirectory() || task.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const taskRoot = path.join(params.tasksRoot, task.name);
+    assertNoSymlinkPath(params.controlBase, taskRoot);
+    const canonicalTaskRoot = fs.realpathSync.native(taskRoot);
+    if (path.dirname(canonicalTaskRoot) !== canonicalTasksRoot) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const manifestPath = path.join(taskRoot, 'manifest.json');
+    if (!fs.existsSync(manifestPath)) continue;
+    const manifest = readManagedManifest(manifestPath);
+    if (manifest.mode !== 'task-bound' || manifest.taskId !== task.name || manifest.project !== params.project
+      || fs.realpathSync.native(manifest.repoRoot) !== canonicalRepoRoot
+      || path.dirname(fs.realpathSync.native(manifestPath)) !== canonicalTaskRoot) {
+      throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
+    manifests.push(manifest);
+  }
+  return manifests;
+}
+
+function managedManifestCandidates(params: Readonly<{
+  managedRoot: string;
+  controlBase?: string;
+  project?: string;
+  repoRoot?: string;
+}>): SandboxControlManifest[] {
+  const managedRoot = params.managedRoot;
+  const { controlBase, project, repoRoot } = params;
+  if (controlBase && project && path.resolve(managedRoot) !== path.resolve(controlBase, project)) {
+    throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   }
-  return result;
+  if (!fs.existsSync(managedRoot)) return [];
+  assertDirectory(managedRoot);
+  return fs.readdirSync(managedRoot, { withFileTypes: true })
+    .flatMap((parent) => {
+      const parentPath = path.join(managedRoot, parent.name);
+      if (parent.name === 'tasks' && controlBase && project && repoRoot) {
+        return taskBoundManifests({ tasksRoot: parentPath, controlBase, project, repoRoot });
+      }
+      if (!parent.isDirectory() || parent.isSymbolicLink()) return [];
+      return branchOnlyManifests(parentPath);
+    });
 }
 
 function assertDirectory(directory: string): void {
@@ -45,6 +98,17 @@ function assertDirectory(directory: string): void {
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
 }
 
+function assertNoSymlinkPath(root: string, target: string): void {
+  const relative = path.relative(root, target);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  let current = path.resolve(root);
+  if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  for (const segment of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, segment);
+    if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink()) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+  }
+}
+
 type AuditRecord = Record<string, unknown>;
 
 function readAudit(manifest: SandboxControlManifest): AuditRecord[] {
@@ -77,12 +141,16 @@ function auditProof(manifest: SandboxControlManifest, requestId: string): AuditR
   return related;
 }
 
-function publishedEvidence(records: AuditRecord[], generation: string): AuditRecord | null {
+function publishedEvidence(records: AuditRecord[], manifest: SandboxControlManifest): AuditRecord | null {
   const publications = records.filter((record) => record.event === 'executor-result-published');
   let selected: AuditRecord | null = null;
   let selectedSummary: string | null = null;
+  const digest = manifestDigest(manifest);
   for (const record of publications) {
-    if (record.version !== 2 || record.requestGeneration !== generation
+    if (record.version !== 2 || record.generation !== manifest.generation || record.identityDigest !== digest
+      || typeof record.requestFamily !== 'string'
+      || !['task-lifecycle', 'task-create'].includes(record.requestFamily)
+      || (record.sandboxTaskId !== null && typeof record.sandboxTaskId !== 'string')
       || !Number.isSafeInteger(record.exitCode)
       || !Number.isSafeInteger(record.outputBytes) || !Number.isSafeInteger(record.errorBytes)
       || typeof record.outputDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(record.outputDigest)
@@ -90,7 +158,7 @@ function publishedEvidence(records: AuditRecord[], generation: string): AuditRec
       throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
     }
     const summary = JSON.stringify([
-      record.requestFamily ?? null, record.requestGeneration, record.exitCode,
+      record.requestFamily, record.sandboxTaskId, record.generation, record.identityDigest, record.exitCode,
       record.outputBytes, record.errorBytes, record.outputDigest, record.errorDigest
     ]);
     if (selectedSummary !== null && summary !== selectedSummary) {
@@ -99,6 +167,9 @@ function publishedEvidence(records: AuditRecord[], generation: string): AuditRec
     selected ??= record;
     selectedSummary ??= summary;
   }
+  if (selected && selected.sandboxTaskId !== manifest.taskId) {
+    throw new Error('SANDBOX_CONTROL_RESULT_EVIDENCE_INVALID');
+  }
   return selected;
 }
 
@@ -118,7 +189,7 @@ function verifiedResponse(manifest: SandboxControlManifest, requestId: string, r
   if (!['completed', 'rejected'].includes(response.phase)) throw new Error('SANDBOX_CONTROL_RESPONSE_INVALID');
   if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') return unknown(requestId);
   const evidencePath = path.join(manifest.processingDir, requestId, 'result.json');
-  const published = publishedEvidence(records, manifest.generation);
+  const published = publishedEvidence(records, manifest);
   if (!published) return unknown(requestId);
   let evidence = null;
   if (fs.existsSync(evidencePath)) {
@@ -167,17 +238,19 @@ function verifiedResponse(manifest: SandboxControlManifest, requestId: string, r
 }
 
 export function recoverSandboxControlFromHost(requestId: string, params: Readonly<{
-  managedRoot: string; timeoutMs?: number;
+  managedRoot: string;
+  controlBase?: string;
+  project?: string;
+  repoRoot?: string;
+  timeoutMs?: number;
 }>): SandboxControlResponse {
   if (!REQUEST_ID.test(requestId)) throw new Error('SANDBOX_CONTROL_REQUEST_INVALID');
   const deadline = Date.now() + (params.timeoutMs ?? 30_000);
   let candidates: Array<{ manifest: SandboxControlManifest; records: AuditRecord[] }> = [];
   while (Date.now() < deadline) {
     candidates = [];
-    for (const manifestPath of managedManifestPaths(params.managedRoot)) {
-      let manifest: SandboxControlManifest;
-      try { manifest = readSandboxControlManifest(manifestPath); } catch { throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID'); }
-      if (manifest.project !== path.basename(path.resolve(params.managedRoot)) || !manifest.generation) {
+    for (const manifest of managedManifestCandidates(params)) {
+      if (manifest.project !== (params.project ?? path.basename(path.resolve(params.managedRoot))) || !manifest.generation) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
       }
       const records = auditProof(manifest, requestId);

package/lib/sandbox/control/lifecycle.ts

@@ -661,28 +661,11 @@ function readTaskCompletionManifest(
   return manifest;
 }
 
-export async function quiesceSandboxControlForTaskCompletion(
+export function validateSandboxControlTaskIdentity(
   root: string,
-  binding: Readonly<{ taskId: string; generation: string; controlRootId: string; statusDir: string }>,
-  timeoutMs = DEFAULT_QUIESCE_TIMEOUT_MS
-): Promise<void> {
-  const resolvedRoot = path.resolve(root);
-  const manifest = readTaskCompletionManifest(resolvedRoot, binding);
-  markSandboxControlRootQuiescing(resolvedRoot);
-  const deadline = Date.now() + timeoutMs;
-  const startupPath = path.join(resolvedRoot, BROKER_STARTING_FILE);
-  const brokerPath = path.join(resolvedRoot, 'broker.json');
-  while (true) {
-    const startup = readStartupOwner(startupPath);
-    if (fs.existsSync(startupPath) && !startup) throw new Error('SANDBOX_CONTROL_BROKER_START_TRANSITION');
-    const broker = readBrokerOwner(brokerPath);
-    if (broker && (broker.token !== manifest.token || broker.generation !== manifest.generation)) {
-      throw new Error('SANDBOX_CONTROL_OWNER_MISMATCH');
-    }
-    if (!startup && !broker) return;
-    if (Date.now() >= deadline) throw new Error('SANDBOX_CONTROL_BROKER_DRAIN_TIMEOUT');
-    await new Promise((resolve) => setTimeout(resolve, 25));
-  }
+  binding: Readonly<{ taskId: string; generation: string; controlRootId: string; statusDir: string }>
+): void {
+  readTaskCompletionManifest(path.resolve(root), binding);
 }
 
 function recordSandboxRemovalPending(
@@ -1155,30 +1138,32 @@ function readSandboxControlManifestValue(manifestPath: string): SandboxControlMa
     || !isSandboxAuthorityEvidence(candidate.authorityEvidence)) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   const root = path.dirname(path.resolve(manifestPath));
   const canonicalRoot = fs.realpathSync.native(root);
-  const matchesControlChildPath = (candidatePath: string, name: string): boolean => {
-    const resolved = path.resolve(candidatePath);
-    if (path.basename(resolved) !== name) return false;
+  const resolveControlChildPath = (candidatePath: string, name: string): string | null => {
+    if (path.isAbsolute(candidatePath) || candidatePath !== name) return null;
+    const resolved = path.resolve(root, candidatePath);
     const expected = path.join(canonicalRoot, name);
     try {
-      return fs.realpathSync.native(resolved) === expected;
+      const stat = fs.lstatSync(resolved);
+      if (!stat.isDirectory() || stat.isSymbolicLink()) return null;
+      return fs.realpathSync.native(resolved) === expected ? expected : null;
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error;
       try {
-        return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot;
+        return fs.realpathSync.native(path.dirname(resolved)) === canonicalRoot ? expected : null;
       } catch (parentError) {
         if ((parentError as NodeJS.ErrnoException).code !== 'ENOENT') throw parentError;
-        return false;
+        return null;
       }
     }
   };
-  if (!matchesControlChildPath(candidate.channelDir, 'channel')
-    || !matchesControlChildPath(candidate.publicStatusDir, 'public')
-    || !matchesControlChildPath(candidate.processingDir, 'processing')) {
-    throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
-  }
-  if (!matchesControlChildPath(candidate.runtimeDir, 'runtime')) {
+  const channelDir = resolveControlChildPath(candidate.channelDir, 'channel');
+  const publicStatusDir = resolveControlChildPath(candidate.publicStatusDir, 'public');
+  const processingDir = resolveControlChildPath(candidate.processingDir, 'processing');
+  const runtimeDir = resolveControlChildPath(candidate.runtimeDir, 'runtime');
+  if (!channelDir || !publicStatusDir || !processingDir) {
     throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   }
+  if (!runtimeDir) throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
   const normalized: SandboxControlManifest = {
     engine: candidate.engine,
     repoRoot: candidate.repoRoot,
@@ -1196,10 +1181,10 @@ function readSandboxControlManifestValue(manifestPath: string): SandboxControlMa
     token: candidate.token,
     generation: candidate.generation,
     controlRootId: candidate.controlRootId,
-    channelDir: candidate.channelDir,
-    publicStatusDir: candidate.publicStatusDir,
-    processingDir: candidate.processingDir,
-    runtimeDir: candidate.runtimeDir,
+    channelDir,
+    publicStatusDir,
+    processingDir,
+    runtimeDir,
   };
   return normalized;
 }

package/lib/sandbox/control/protocol.ts

@@ -1,6 +1,5 @@
 import { createHash } from 'node:crypto';
 import { validateTaskCreateCandidate, type TaskCreateCandidateV1 } from '../../task/create.ts';
-import { isAgentClientId } from '../../agent-clients/types.ts';
 import type { ProcessIdentity } from '../../server/process-state.ts';
 import type { SandboxAuthorityEvidenceV1 } from '../engines/authority.ts';
 import type { SandboxTaskView } from './task-view.ts';
@@ -10,11 +9,10 @@ export const SANDBOX_CONTROL_MAX_LOGICAL_RECORDS = 1024;
 export const SANDBOX_CONTROL_MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
 export const SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES = 1024 * 1024;
 export const SANDBOX_CONTROL_RESERVATION_BYTES = SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES + 4 * 1024;
-export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create', 'agent-client'] as const;
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-create'] as const;
 export type SandboxControlTimingPolicy = Readonly<{
   controlTickMs: number;
   parkedBindingInitialMs: number;
@@ -55,22 +53,14 @@ export type SandboxControlExecutorGateV2 = Readonly<{
   owner: SandboxControlBrokerOwner;
   requestId: string;
 }>;
-type RequestBase = Readonly<{
-  version: 4; id: string; token: string; generation: string; issuedAt: number; expiresAt: number;
-}>;
+type RequestBase = Readonly<{ version: 5; id: string }>;
 export type SandboxTaskCommandRequest = RequestBase & Readonly<{
   family: 'task-lifecycle'; args: string[];
 }>;
 export type SandboxTaskCreateRequest = RequestBase & Readonly<{
   family: 'task-create'; candidate: TaskCreateCandidateV1;
 }>;
-export type SandboxAgentClientRequest = RequestBase & Readonly<{
-  family: 'agent-client';
-  agentClient: string;
-  operation: string;
-  payload: Record<string, unknown>;
-}>;
-export type SandboxControlRequest = SandboxTaskCommandRequest | SandboxTaskCreateRequest | SandboxAgentClientRequest;
+export type SandboxControlRequest = SandboxTaskCommandRequest | SandboxTaskCreateRequest;
 export type SandboxControlError = Readonly<{ code: string; message: string; retryable: boolean }>;
 export type SandboxControlResultEvidence = Readonly<{
   version: 1;
@@ -220,53 +210,28 @@ export function isSandboxControlFamily(value: string): value is SandboxControlFa
 
 export function validateSandboxControlRequest(
   value: unknown,
-  manifest: SandboxControlManifest,
-  options: { now?: number } = {}
+  manifest: SandboxControlManifest
 ): SandboxControlRequest {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
     fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request must be an object');
   }
   const request = value as Record<string, unknown>;
   if (
-    request.version !== 4 || typeof request.id !== 'string'
-    || !/^[a-f0-9-]{16,64}$/.test(request.id) || request.token !== manifest.token
+    request.version !== 5 || typeof request.id !== 'string'
+    || !/^[a-f0-9-]{16,64}$/.test(request.id)
     || typeof request.family !== 'string' || !isSandboxControlFamily(request.family)
-    || !Number.isSafeInteger(request.issuedAt) || !Number.isSafeInteger(request.expiresAt)
   ) fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
-  if (request.generation !== manifest.generation) {
-    fail('SANDBOX_CONTROL_GENERATION_INVALID', 'request generation does not match the broker');
-  }
-  const issuedAt = request.issuedAt as number;
-  const expiresAt = request.expiresAt as number;
-  const now = options.now ?? Date.now();
-  if (expiresAt <= issuedAt || expiresAt - issuedAt > SANDBOX_CONTROL_ADMISSION_WINDOW_MS || issuedAt > now + SANDBOX_CONTROL_FUTURE_SKEW_MS) {
-    fail('SANDBOX_CONTROL_REQUEST_DEADLINE_INVALID', 'request admission deadline is invalid');
-  }
-  if (now > expiresAt) fail('SANDBOX_CONTROL_REQUEST_EXPIRED', 'request admission deadline has passed', true);
   if (Buffer.byteLength(JSON.stringify(request), 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
     fail('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit');
   }
   if (request.family === 'task-create') {
-    const expected = ['candidate', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    const expected = ['candidate', 'family', 'id', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')) {
       fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
     }
     return { ...request, candidate: validateTaskCreateCandidate(request.candidate) } as SandboxTaskCreateRequest;
   }
-  if (request.family === 'agent-client') {
-    const expected = ['agentClient', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'payload', 'token', 'version'];
-    if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
-      || !isAgentClientId(request.agentClient)
-      || typeof request.operation !== 'string' || !/^[a-z][a-z0-9.-]{0,63}$/u.test(request.operation)
-      || !request.payload || typeof request.payload !== 'object' || Array.isArray(request.payload)) {
-      fail('SANDBOX_CONTROL_REQUEST_INVALID', 'agent-client request schema is invalid');
-    }
-    if (manifest.mode !== 'task-bound' || !manifest.taskId) {
-      fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot coordinate agent clients');
-    }
-    return request as SandboxAgentClientRequest;
-  }
-  const expected = ['args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+  const expected = ['args', 'family', 'id', 'version'];
   if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
     || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
     fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
@@ -284,7 +249,7 @@ export function validateSandboxControlRequest(
 }
 
 export function bindSandboxControlTask(request: SandboxControlRequest, taskId: string): string[] {
-  if (request.family === 'task-create' || request.family === 'agent-client') {
+  if (request.family === 'task-create') {
     fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
   }
   if (request.args.length === 0) fail('SANDBOX_CONTROL_REQUEST_INVALID', 'command arguments are required');
@@ -300,7 +265,6 @@ export function controlError(error: unknown): SandboxControlError {
   const retryable = new Set([
     'SANDBOX_CONTROL_BUSY',
     'SANDBOX_CONTROL_HANDOFF_ACTIVE',
-    'SANDBOX_CONTROL_REQUEST_EXPIRED',
     'SANDBOX_WORKTREE_BINDING_LOST'
   ]).has(code);
   return { code, message, retryable };

package/lib/sandbox/control/server.ts

@@ -72,7 +72,6 @@ import {
 import type { BrokerOwner } from './lifecycle.ts';
 import { nextSandboxControlBackoff } from './timing.ts';
 import { readTaskFinalizationReceipt } from '../../task/finalization.ts';
-import { recoverAgentClientOperation, validateAgentClientOperation } from './agent-operation.ts';
 import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   mergeSandboxTaskView,
@@ -100,8 +99,6 @@ function appendBrokerAudit(
 
 function operationKey(request: SandboxControlRequest): string | null {
   if (request.family === 'task-create') return 'create';
-  if (request.family === 'agent-client') return request.operation;
-  if (request.family !== 'task-lifecycle') return null;
   try {
     const operation = parseTaskControlOperation(request.family, request.args);
     return operation.family === 'task-lifecycle' ? operation.request.intent : null;
@@ -299,7 +296,7 @@ async function readRecoveryDomain(
   if (!operation) return { domain: null };
   const taskRef = 'args' in request ? request.args[0] ?? null : manifest.taskId;
   const output = parseControlOutput(payloadOutput);
-  if (!taskRef && operation.family !== 'task-create' && operation.family !== 'agent-client') {
+  if (!taskRef && operation.family !== 'task-create') {
     return { domain: null };
   }
 
@@ -327,14 +324,6 @@ async function readRecoveryDomain(
   if (operation.family === 'task-create') {
     return { domain: taskCreateDomainEvidence(manifest, output) };
   }
-  if (operation.family === 'agent-client' && request.family === 'agent-client') {
-    return { domain: recoverAgentClientOperation({
-      request,
-      manifest,
-      manifestPath,
-      stdout: payloadOutput
-    }) };
-  }
   return { domain: null };
 }
 
@@ -568,10 +557,7 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
       let terminalReconciled = false;
       try {
         const rawRequest = JSON.parse(fs.readFileSync(path.join(processingDirectory, 'request.json'), 'utf8')) as Record<string, unknown>;
-        request = validateSandboxControlRequest(rawRequest, manifest, {
-          now: typeof rawRequest.issuedAt === 'number' ? rawRequest.issuedAt : undefined
-        });
-        if (request.family === 'agent-client') validateAgentClientOperation(request, manifest);
+        request = validateSandboxControlRequest(rawRequest, manifest);
       } catch {
         // Missing or malformed request evidence remains fail-closed below.
       }
@@ -1006,7 +992,6 @@ export async function serveSandboxControl(
           if (reasonCode) throw new Error(reasonCode);
           if (active) throw new Error('SANDBOX_CONTROL_BUSY');
           const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
-          if (request.family === 'agent-client') validateAgentClientOperation(request, manifest);
           validatedRequest = request;
           criticalRequestPhase(manifest, request, 'validated', 'in-progress');
           appendBrokerAudit(manifest, 'request-validated', {

package/lib/sandbox/environment.ts

@@ -12,14 +12,13 @@ export const SANDBOX_CONTROL_STATUS_MOUNT = '/run/agent-infra/control-status';
 const TASK_MARKER_KEYS = [
   'AGENT_INFRA_SANDBOX',
   'AGENT_INFRA_TASK_ID',
-  'AGENT_INFRA_CONTROL_TOKEN',
   'AGENT_INFRA_CONTROL_GENERATION',
   'AGENT_INFRA_CONTROL_DIR',
+  'AGENT_INFRA_CONTROL_ROOT_DIR',
   'AGENT_INFRA_CONTROL_STATUS_DIR',
   'AGENT_INFRA_RUNTIME_DIR'
 ] as const;
 const TASK_CONTROL_MARKER_KEYS = [
-  'AGENT_INFRA_CONTROL_TOKEN',
   'AGENT_INFRA_CONTROL_GENERATION',
   'AGENT_INFRA_CONTROL_DIR',
   'AGENT_INFRA_CONTROL_STATUS_DIR'
@@ -88,7 +87,6 @@ export function resolveSandboxControlTransport(
 ): SandboxControlTransportDecision {
   const markerState = sandboxTaskMarkerState(env);
   const hasAnyMarker = markerState !== 'none'
-    || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING)
     || Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
   const fixedStatusDir = options.statusMountPath ?? SANDBOX_CONTROL_STATUS_MOUNT;
   const fixedStatusProbe = path.isAbsolute(fixedStatusDir)
@@ -109,6 +107,10 @@ export function resolveSandboxControlTransport(
   if (!hasCompleteConfig) {
     return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
   }
+  if (markerState === 'task-bound'
+    && (!env.AGENT_INFRA_CONTROL_ROOT_DIR || !path.isAbsolute(env.AGENT_INFRA_CONTROL_ROOT_DIR))) {
+    return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
+  }
   const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
   const configuredStatusProbe = configuredStatusDir && path.isAbsolute(configuredStatusDir)
     ? nativeDirectoryProbe(configuredStatusDir) : 'absent';
@@ -119,7 +121,7 @@ export function resolveSandboxControlTransport(
     ? configuredStatusProbe === 'present' ? configuredStatusDir : null
     : fixedStatusMounted ? fixedStatusDir : null;
   const statusMounted = statusDir !== null;
-  if (env.AGENT_INFRA_EXECUTOR_MANIFEST || env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING) {
+  if (env.AGENT_INFRA_EXECUTOR_MANIFEST) {
     return { kind: 'fail-closed', reasonCode: 'TASK_CONTROL_TRANSPORT_INVALID' };
   }
   const taskBound = Boolean(env.AGENT_INFRA_TASK_ID);
@@ -134,9 +136,6 @@ export function resolveSandboxControlTransport(
         ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
         : 'SANDBOX_CONTROL_IDENTITY_MALFORMED' };
     }
-    if (sentinel.generation !== env.AGENT_INFRA_CONTROL_GENERATION) {
-      return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH' };
-    }
     if (sentinel.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
       return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH' };
     }
@@ -144,7 +143,7 @@ export function resolveSandboxControlTransport(
       && (sentinel.taskId !== env.AGENT_INFRA_TASK_ID || !runtime)) {
       return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
     }
-    if (sentinel.mode === 'branch-only' && (taskBound || runtime)) {
+    if (sentinel.mode === 'branch-only' && (taskBound || runtime || Boolean(env.AGENT_INFRA_CONTROL_ROOT_DIR))) {
       return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
     }
     return { kind: options.localWorkflow ? 'sandbox-local' : 'broker-client', reasonCode: null };