@fitlab-ai/agent-infra 0.11.15 → 0.12.0

package/dist/lib/sandbox/workspace-identity.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { configuredShortIdLength, inspectShortIdRegistry, isRemovedHashShortIdInput, normalizeShortIdInput } from '../task/short-id.js';
+import { resolveProjectTaskWorkspaceRoot } from '../task/workspace-root.js';
 import { TASK_WORKSPACE_STATES, listTaskWorkspaces, resolveTaskWorkspace } from './task-resolver.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 const SHORT_ID_RE = /^\d+$/;
@@ -16,7 +17,7 @@ function taskBranch(taskMd, taskId) {
     return stripQuotes(value);
 }
 function activeRegistry(repoRoot) {
-    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', '.short-ids.json');
+    const registryPath = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', '.short-ids.json');
     if (!fs.existsSync(registryPath))
         return {};
     const value = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
@@ -29,7 +30,7 @@ function activeRegistry(repoRoot) {
     return Object.fromEntries(Object.entries(ids).filter((entry) => SHORT_ID_RE.test(entry[0]) && typeof entry[1] === 'string' && TASK_ID_RE.test(entry[1])));
 }
 function taskIdentity(repoRoot, taskId, registry) {
-    const taskMd = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
+    const taskMd = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', taskId, 'task.md');
     if (!fs.existsSync(taskMd))
         throw new Error(`Active task not found: ${taskId}`);
     const shortIds = Object.entries(registry).filter(([, id]) => id === taskId).map(([shortId]) => shortId);
@@ -81,13 +82,13 @@ export function resolveSandboxTarget(requestedRef, repoRoot) {
         if (!taskId)
             throw new Error(`Short id '${requestedRef}' not found in active task registry`);
         const workspace = taskIdentity(repoRoot, taskId, registry);
-        return { requestedRef, branch: taskBranch(path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md'), taskId), workspace };
+        return { requestedRef, branch: taskBranch(path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', taskId, 'task.md'), taskId), workspace };
     }
     if (TASK_ID_RE.test(requestedRef)) {
         const workspace = taskIdentity(repoRoot, requestedRef, registry);
-        return { requestedRef, branch: taskBranch(path.join(repoRoot, '.agents', 'workspace', 'active', requestedRef, 'task.md'), requestedRef), workspace };
+        return { requestedRef, branch: taskBranch(path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active', requestedRef, 'task.md'), requestedRef), workspace };
     }
-    const activeRoot = path.join(repoRoot, '.agents', 'workspace', 'active');
+    const activeRoot = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), 'active');
     const matches = fs.existsSync(activeRoot)
         ? fs.readdirSync(activeRoot, { withFileTypes: true }).flatMap((entry) => {
             if (!entry.isDirectory() || !TASK_ID_RE.test(entry.name))

package/dist/lib/sandbox/workspace-view.js

@@ -1,6 +1,8 @@
 import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
+import { resolveProjectTaskWorkspaceRoot } from '../task/workspace-root.js';
 import { resolveTaskWorkspace } from './task-resolver.js';
 import { createSandboxControlIdentitySentinel, writeSandboxControlIdentitySentinel } from './control/identity-sentinel.js';
 export const SANDBOX_WORKSPACE_VIEW_STATES = Object.freeze([
@@ -101,7 +103,8 @@ function assertSafeMountTargetPath(target, worktreeRoot, canonicalWorktreeRoot)
 export function assertSandboxTaskSource(repoRoot, taskId) {
     if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
         throw new Error('SANDBOX_TASK_SOURCE_INVALID');
-    const activeSource = path.join(repoRoot, '.agents', 'workspace', 'active', taskId);
+    const workspaceRootPath = resolveProjectTaskWorkspaceRoot(repoRoot);
+    const activeSource = path.join(workspaceRootPath, 'active', taskId);
     try {
         const stat = fs.lstatSync(activeSource);
         if (!stat.isDirectory() || stat.isSymbolicLink()) {
@@ -109,7 +112,7 @@ export function assertSandboxTaskSource(repoRoot, taskId) {
         }
         const canonical = fs.realpathSync.native(activeSource);
         const activeRoot = fs.realpathSync.native(path.dirname(activeSource));
-        const workspaceRoot = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace'));
+        const workspaceRoot = fs.realpathSync.native(workspaceRootPath);
         const relative = path.relative(workspaceRoot, canonical);
         if (path.dirname(canonical) !== activeRoot || relative.startsWith('..') || path.isAbsolute(relative)) {
             throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${activeSource} escapes the task workspace`);
@@ -129,39 +132,46 @@ export function assertSandboxTaskSource(repoRoot, taskId) {
         throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${source} must be a real directory`);
     }
     const canonical = fs.realpathSync.native(source);
-    const workspaceRoot = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace'));
+    const workspaceRoot = fs.realpathSync.native(workspaceRootPath);
     const relative = path.relative(workspaceRoot, canonical);
     if (path.basename(canonical) !== taskId || relative.startsWith('..') || path.isAbsolute(relative)) {
         throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${source} escapes the task workspace`);
     }
     return canonical;
 }
-export function prepareSandboxWorkspaceMountTargets(worktreeRoot, taskId) {
-    const resolvedWorktreeRoot = path.resolve(worktreeRoot);
-    const canonicalWorktreeRoot = fs.realpathSync.native(resolvedWorktreeRoot);
-    const workspaceRoot = path.resolve(resolvedWorktreeRoot, '.agents', 'workspace');
+export function prepareSandboxWorkspaceMountTargets(repoRoot) {
+    const resolvedHome = path.resolve(process.env.HOME || os.homedir());
+    const canonicalHome = fs.realpathSync.native(resolvedHome);
+    const workspaceRoot = path.resolve(resolveProjectTaskWorkspaceRoot(repoRoot));
+    const relativeRoot = path.relative(resolvedHome, workspaceRoot);
+    if (relativeRoot.startsWith('..') || path.isAbsolute(relativeRoot)) {
+        throw new Error(`Sandbox workspace mount target escapes the host home: ${workspaceRoot}`);
+    }
     const statePaths = sandboxWorkspaceViewStatePaths(workspaceRoot);
     const registryTarget = path.join(workspaceRoot, 'active', '.short-ids.json');
-    const completedTaskTarget = taskId ? path.join(workspaceRoot, 'completed', taskId) : null;
-    if (taskId && !/^TASK-\d{8}-\d{6}$/.test(taskId))
-        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
-    for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget, ...(completedTaskTarget ? [completedTaskTarget] : [])]) {
-        assertSafeMountTargetPath(target, resolvedWorktreeRoot, canonicalWorktreeRoot);
+    for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget]) {
+        assertSafeMountTargetPath(target, resolvedHome, canonicalHome);
     }
     fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 });
     for (const { hostPath } of statePaths) {
         fs.mkdirSync(hostPath, { recursive: true, mode: 0o700 });
         fs.chmodSync(hostPath, 0o700);
     }
-    if (completedTaskTarget)
-        fs.mkdirSync(completedTaskTarget, { recursive: true, mode: 0o700 });
     fs.chmodSync(workspaceRoot, 0o700);
-    fs.closeSync(fs.openSync(registryTarget, 'a', 0o600));
+    const registryFd = fs.openSync(registryTarget, 'a', 0o600);
+    try {
+        if (fs.fstatSync(registryFd).size === 0) {
+            fs.writeFileSync(registryFd, `${JSON.stringify({ version: 1, ids: {} })}\n`);
+        }
+    }
+    finally {
+        fs.closeSync(registryFd);
+    }
 }
 export function prepareSandboxCompletedTaskMountSource(repoRoot, taskId) {
     if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
         throw new Error('SANDBOX_TASK_SOURCE_INVALID');
-    const workspaceRoot = path.resolve(repoRoot, '.agents', 'workspace');
+    const workspaceRoot = resolveProjectTaskWorkspaceRoot(repoRoot);
     fs.mkdirSync(path.join(workspaceRoot, 'completed'), { recursive: true, mode: 0o700 });
     const completedRoot = path.join(workspaceRoot, 'completed');
     const completedStat = fs.lstatSync(completedRoot);
@@ -184,17 +194,14 @@ export function prepareSandboxCompletedTaskMountSource(repoRoot, taskId) {
 export function sandboxCompletedTaskMountSource(repoRoot, taskId) {
     if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
         throw new Error('SANDBOX_TASK_SOURCE_INVALID');
-    const source = path.resolve(repoRoot, '.agents', 'workspace', 'completed', taskId);
+    const source = path.resolve(resolveProjectTaskWorkspaceRoot(repoRoot), 'completed', taskId);
     const stat = fs.lstatSync(source);
     if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error('SANDBOX_TASK_SOURCE_INVALID');
-    const canonicalWorkspace = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace'));
+    const canonicalWorkspace = fs.realpathSync.native(resolveProjectTaskWorkspaceRoot(repoRoot));
     const canonicalSource = fs.realpathSync.native(source);
-    const canonicalRepoRoot = fs.realpathSync.native(repoRoot);
-    const workspaceRelative = path.relative(canonicalRepoRoot, canonicalWorkspace);
     const relative = path.relative(canonicalWorkspace, canonicalSource);
-    if (workspaceRelative.startsWith('..') || path.isAbsolute(workspaceRelative)
-        || path.dirname(canonicalSource) !== fs.realpathSync.native(path.dirname(source))
+    if (path.dirname(canonicalSource) !== fs.realpathSync.native(path.dirname(source))
         || relative.startsWith('..') || path.isAbsolute(relative))
         throw new Error('SANDBOX_TASK_SOURCE_INVALID');
     return canonicalSource;

package/dist/lib/task/activity-intent.js

@@ -4,7 +4,6 @@ import { resolveTaskRef } from './resolve-ref.js';
 import { locateActivityLog, appendActivityEntry } from './activity-log.js';
 import { assertWritableInventory, buildArtifactLinkSection, inspectTaskArtifacts } from './artifact-lifecycle.js';
 import { parseArtifactName } from './artifact-name.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
 const HEAD_RE = /^[0-9a-f]{40}$/;
 const REVIEW_ACTION_RE = /^Review PR \(Round ([1-9]\d*)\)( \[started\])?$/;
@@ -192,7 +191,7 @@ function terminalNote(intent) {
     }
     return `Outcome: ${outcomeLabel(intent.outcome)}, reason: ${intent.reason} → ${intent.artifact}`;
 }
-function applyLocked(intent, normalizedAgent, options) {
+function applyActivityIntent(intent, normalizedAgent, options) {
     const state = readSnapshot(intent.taskRef, options.repoRoot);
     if (!state.ok)
         return failed(intent, state.code, state.message, state.taskId);
@@ -297,15 +296,6 @@ export function applyPrReviewActivityIntent(intent, options = {}) {
     if (resolved.state !== 'active') {
         return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     }
-    if (options.lockAlreadyHeld)
-        return applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot });
-    try {
-        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-activity:${intent.kind}`, () => applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot }), options.lockOptions);
-    }
-    catch (error) {
-        if (error instanceof TaskExecutionLockError)
-            return failed(intent, error.code, error.message, resolved.taskId);
-        return failed(intent, 'ACTIVITY_LOCK_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
-    }
+    return applyActivityIntent(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot });
 }
 //# sourceMappingURL=activity-intent.js.map

package/dist/lib/task/artifact-lifecycle.js

@@ -79,11 +79,11 @@ function failure(requestRef, family, error, extra = {}) {
 function diagnostic(code, family, name, message) {
     return { code, family, name, message };
 }
-function inspectTaskArtifacts(taskRef, family, options = {}) {
+function inspectTaskArtifacts(taskRef, family, options = {}, resolvedTask) {
     const spec = familySpec(family);
     if (!spec)
         return failure(taskRef, family, { code: 'ARTIFACT_FAMILY_UNKNOWN', message: `unknown artifact family '${family}'` });
-    const resolved = resolveTaskRef(taskRef, { repoRoot: options.repoRoot });
+    const resolved = resolvedTask ?? resolveTaskRef(taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failure(taskRef, family, { code: resolved.code, message: resolved.message }, { taskId: resolved.taskId });
     return inspectArtifactDirectory(resolved.taskDir, spec.family, {
@@ -399,8 +399,8 @@ function attachArtifactSelection(context, pathState, options) {
         return fail('ARTIFACT_SELECTION_INDETERMINATE', error instanceof Error ? error.message : String(error));
     }
 }
-function resolveArtifactContext(taskRef, family, options = {}) {
-    const inventory = inspectTaskArtifacts(taskRef, family, options);
+function resolveArtifactContextFromTask(taskRef, family, options, resolvedTask) {
+    const inventory = inspectTaskArtifacts(taskRef, family, options, resolvedTask);
     if (inventory.status === 'failed')
         return { ...inventory, inputs: [], codeMode: null };
     const writableError = assertWritableInventory(inventory);
@@ -411,7 +411,7 @@ function resolveArtifactContext(taskRef, family, options = {}) {
         return contextFailure(inventory, 'LIFECYCLE_PATH_INVALID', pathState.message);
     }
     if (inventory.family === 'code') {
-        const code = resolveCodeContext(inventory, options);
+        const code = resolveCodeContext(inventory, options, resolvedTask);
         const selected = attachArtifactSelection(code, pathState, options);
         if (selected.status !== 'ready' || !selected.selection)
             return selected;
@@ -447,7 +447,7 @@ function resolveArtifactContext(taskRef, family, options = {}) {
     const required = REQUIRED_INPUT[inventory.family];
     const inputs = [];
     if (required) {
-        const input = inspectTaskArtifacts(taskRef, required, options);
+        const input = inspectTaskArtifacts(taskRef, required, options, resolvedTask);
         if (input.status === 'failed' || !input.latest) {
             return { ...inventory, status: 'failed', inputs, codeMode: null, error: { code: 'ARTIFACT_INPUT_MISSING', message: `latest ${required} artifact is required` } };
         }
@@ -456,7 +456,7 @@ function resolveArtifactContext(taskRef, family, options = {}) {
     const optional = OPTIONAL_CONTEXT[inventory.family];
     if (optional) {
         for (const family of optional) {
-            const context = inspectTaskArtifacts(taskRef, family, options);
+            const context = inspectTaskArtifacts(taskRef, family, options, resolvedTask);
             if (context.status === 'ready' && context.latest)
                 inputs.push(context.latest);
         }
@@ -466,16 +466,22 @@ function resolveArtifactContext(taskRef, family, options = {}) {
     }
     return attachArtifactSelection({ ...inventory, inputs, codeMode: null }, pathState, options);
 }
-function resolveCodeContext(inventory, options) {
+function resolveArtifactContext(taskRef, family, options = {}) {
+    return resolveArtifactContextFromTask(taskRef, family, options);
+}
+export function resolveArtifactContextForResolvedTask(resolvedTask, family, options = {}) {
+    return resolveArtifactContextFromTask(resolvedTask.taskId, family, options, resolvedTask);
+}
+function resolveCodeContext(inventory, options, resolvedTask) {
     const taskRef = inventory.requestRef;
     const pathState = lifecyclePathState(inventory.taskDir);
     if (pathState.status !== 'valid')
         return contextFailure(inventory, 'LIFECYCLE_PATH_INVALID', pathState.message);
     const inputFamily = pathState.decision.path === 'streamlined' ? 'analysis' : 'plan';
-    const source = inspectTaskArtifacts(taskRef, inputFamily, options);
+    const source = inspectTaskArtifacts(taskRef, inputFamily, options, resolvedTask);
     if (source.status === 'failed' || !source.latest)
         return contextFailure(inventory, 'ARTIFACT_INPUT_MISSING', `latest ${inputFamily} artifact is required`);
-    const reviewCode = inspectTaskArtifacts(taskRef, 'review-code', options);
+    const reviewCode = inspectTaskArtifacts(taskRef, 'review-code', options, resolvedTask);
     try {
         const taskContent = fs.readFileSync(path.join(inventory.taskDir, 'task.md'), 'utf8');
         const hasPendingImplementation = parseImplementationInputs(taskContent).rows.some((input) => input.needsImplementation && input.status === 'pending');
@@ -492,7 +498,7 @@ function resolveCodeContext(inventory, options) {
     const reviewMax = reviewCode.latest?.round ?? 0;
     const inputs = [source.latest];
     const sourceReviewFamily = inputFamily === 'analysis' ? 'review-analysis' : 'review-plan';
-    const sourceReview = inspectTaskArtifacts(taskRef, sourceReviewFamily, options);
+    const sourceReview = inspectTaskArtifacts(taskRef, sourceReviewFamily, options, resolvedTask);
     if (sourceReview.status === 'ready' && sourceReview.latest && sourceReview.reviewedInput?.name === source.latest.name)
         inputs.push(sourceReview.latest);
     if (inventory.openRounds.length > 0) {

package/dist/lib/task/artifact-operations.js

@@ -5,7 +5,6 @@ import { readStableFileSync } from './secure-fs.js';
 import { parseArtifactName } from './artifact-name.js';
 import { scanVisibleMarkdown } from './markdown.js';
 import { getArtifactSchema, renderArtifactSkeleton } from './artifact-schema.js';
-import { withTaskExecutionLock } from './task-execution-lock.js';
 function sha256Content(content) {
     return createHash('sha256').update(content, 'utf8').digest('hex');
 }
@@ -239,57 +238,50 @@ function initializeArtifactSkeleton(request) {
     if (path.dirname(path.resolve(target)) !== path.resolve(request.taskDir))
         return resultFailure('ARTIFACT_INIT_TARGET_INVALID', 'artifact must be inside the current task directory');
     try {
-        return withTaskExecutionLock(request.repoRoot, request.taskId, 'task-artifact.init', () => {
-            try {
-                const existing = fs.lstatSync(target);
-                if (existing.isSymbolicLink() || !existing.isFile())
-                    return resultFailure('ARTIFACT_INIT_TARGET_INVALID', 'artifact target is not a regular file');
-                return resultNoOp(readStableFileSync(target, { maxBytes: 1024 * 1024 }).bytes.toString('utf8'));
-            }
-            catch (error) {
-                if (error.code !== 'ENOENT')
-                    return resultFailure('ARTIFACT_INIT_TARGET_INVALID', String(error));
-            }
-            const skeleton = renderArtifactSkeleton({
-                taskId: request.taskId,
-                family: request.family,
-                artifact: request.artifact,
-                ...(request.locale ? { locale: request.locale } : {})
-            });
-            const content = skeleton.trimEnd();
-            const tempPath = path.join(request.taskDir, `.${request.artifact}.init-${process.pid}-${Date.now()}.tmp`);
-            try {
-                fs.writeFileSync(tempPath, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
-                try {
-                    fs.lstatSync(target);
-                    fs.unlinkSync(tempPath);
-                    return resultFailure('ARTIFACT_INIT_TARGET_EXISTS', 'artifact was created concurrently');
-                }
-                catch (error) {
-                    if (error.code !== 'ENOENT')
-                        throw error;
-                }
-                fs.renameSync(tempPath, target);
-            }
-            catch (error) {
-                try {
-                    fs.unlinkSync(tempPath);
-                }
-                catch { /* preserve primary error */ }
-                return resultFailure('ARTIFACT_INIT_WRITE_FAILED', String(error));
-            }
-            return {
-                status: 'applied',
-                changed: true,
-                artifactSha256: sha256Content(content),
-                semanticDigest: canonicalSemanticDigest(content),
-                error: null
-            };
-        });
+        const existing = fs.lstatSync(target);
+        if (existing.isSymbolicLink() || !existing.isFile())
+            return resultFailure('ARTIFACT_INIT_TARGET_INVALID', 'artifact target is not a regular file');
+        return resultNoOp(readStableFileSync(target, { maxBytes: 1024 * 1024 }).bytes.toString('utf8'));
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            return resultFailure('ARTIFACT_INIT_TARGET_INVALID', String(error));
+    }
+    const skeleton = renderArtifactSkeleton({
+        taskId: request.taskId,
+        family: request.family,
+        artifact: request.artifact,
+        ...(request.locale ? { locale: request.locale } : {})
+    });
+    const content = skeleton.trimEnd();
+    const tempPath = path.join(request.taskDir, `.${request.artifact}.init-${process.pid}-${Date.now()}.tmp`);
+    try {
+        fs.writeFileSync(tempPath, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+        try {
+            fs.lstatSync(target);
+            fs.unlinkSync(tempPath);
+            return resultFailure('ARTIFACT_INIT_TARGET_EXISTS', 'artifact was created concurrently');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        fs.renameSync(tempPath, target);
     }
     catch (error) {
-        return resultFailure('ARTIFACT_INIT_LOCK_FAILED', String(error));
+        try {
+            fs.unlinkSync(tempPath);
+        }
+        catch { /* preserve primary error */ }
+        return resultFailure('ARTIFACT_INIT_WRITE_FAILED', String(error));
     }
+    return {
+        status: 'applied',
+        changed: true,
+        artifactSha256: sha256Content(content),
+        semanticDigest: canonicalSemanticDigest(content),
+        error: null
+    };
 }
 export { canonicalSemanticDigest, initializeArtifactSkeleton, inspectArtifactContract, inspectArtifactPatterns, inspectArtifactStructure, sha256Content };
 //# sourceMappingURL=artifact-operations.js.map

package/dist/lib/task/capabilities.js

@@ -275,7 +275,7 @@ function recommendNext(facts) {
     }
     return { action: null, reasonCode: 'LIFECYCLE_REVIEWED', evidence: ['latest code review is approved'] };
 }
-function buildLifecycleFacts(taskDir, content, taskState = 'active', executionBusy = false) {
+function buildLifecycleFacts(taskDir, content, taskState = 'active', executionBusy = false, repositoryRoot) {
     try {
         const metadata = parseTypedTaskFrontmatter(content);
         const rework = parseReworkIntentDocument(content);
@@ -387,7 +387,7 @@ function buildLifecycleFacts(taskDir, content, taskState = 'active', executionBu
                 && artifactHashes[input] === receipt.inputSha256)
                 reviewedInputs[family] = input;
             if (family === 'review-code') {
-                const identity = inspectReviewIdentity(taskDir, reviewContent);
+                const identity = inspectReviewIdentity(taskDir, reviewContent, repositoryRoot);
                 reviewCodeIdentityValid = identity.status === 'matched'
                     && hasArtifactCompletionFact(content, path.join(taskDir, latest), 'review-code.completed')
                     && hasArtifactCompletionLog(content, latest, 'review-code.completed');

package/dist/lib/task/commands/ls.js

@@ -4,9 +4,10 @@ import { execFileSync } from 'node:child_process';
 import { formatTable } from '../../table.js';
 import { parseTaskFrontmatter, extractTitle } from '../frontmatter.js';
 import { loadShortIdByTaskId } from '../short-id.js';
+import { resolveProjectTaskWorkspaceRoot } from '../workspace-root.js';
 const USAGE = `Usage: ai task ls [--all | --blocked | --completed]
 
-Lists tasks under .agents/workspace/. Defaults to active tasks only.
+Lists tasks under the project task workspace. Defaults to active tasks only.
   --all         Include active + blocked + completed (excludes archive)
   --blocked     Only blocked tasks
   --completed   Only completed tasks
@@ -55,7 +56,7 @@ function parseSelection(args) {
     }
 }
 function collectTasks(repoRoot, state) {
-    const dir = path.join(repoRoot, '.agents', 'workspace', state);
+    const dir = path.join(resolveProjectTaskWorkspaceRoot(repoRoot), state);
     if (!fs.existsSync(dir))
         return [];
     const shortIdByTaskId = state === 'active' || state === 'completed'
@@ -101,7 +102,7 @@ function ls(args = []) {
         rows.push(...collectTasks(repoRoot, state));
     }
     if (rows.length === 0) {
-        process.stdout.write(`No tasks under .agents/workspace/${selection.join('|')}\n`);
+        process.stdout.write(`No tasks under project task workspace state ${selection.join('|')}\n`);
         return;
     }
     const tableRows = rows.map((r, i) => [

package/dist/lib/task/commands/status.js

@@ -388,7 +388,7 @@ function buildFromResolved(input) {
     const run = input.run ?? makeRunner(input.repoRoot);
     const artifacts = enumerateArtifacts(input.taskDir);
     const workflow = collectWorkflow(content, input.now);
-    const facts = buildLifecycleFacts(input.taskDir, content, fm.status ?? 'active');
+    const facts = buildLifecycleFacts(input.taskDir, content, fm.status ?? 'active', false, input.repoRoot);
     const next = facts.ok ? recommendNext(facts.facts) : null;
     const recommendation = next?.action ?? DASH;
     return {

package/dist/lib/task/commit-operation.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { commitExplicitPaths, inspectGitWorkflow, pushGitRefs } from '../git/workflow.js';
 import { parseTaskFrontmatter } from './frontmatter.js';
@@ -6,7 +7,6 @@ import { checkpointCommitMatches } from './commit-identity.js';
 import { resolveTaskContext, resolveTaskRef } from './resolve-ref.js';
 import { commitPushDecision } from './commit-policy.js';
 import { mergeOperationWarnings } from './operation-outcome.js';
-import { TaskExecutionLockError, withRepositoryMutationLock, withTaskExecutionLock } from './task-execution-lock.js';
 import { appendActivityEntry, locateActivityLog } from './activity-log.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
 import { checkpointIntentDigest, readCheckpointIntent, removeCheckpointIntent, sameCheckpointIntent, updateCheckpointIntent, writeCheckpointIntent } from './commit-intent.js';
@@ -58,6 +58,8 @@ function resolveBoundTask(input) {
             };
         return boundTask(input, resolved.taskId, resolved.taskDir, resolved.taskMdPath, resolved.repoRoot, resolved.state);
     }
+    if (!fs.existsSync(path.join(input.cwd, '.agents', '.airc.json')))
+        return { kind: 'none' };
     const context = resolveTaskContext(undefined, { repoRoot: input.cwd });
     if (context.ok)
         return boundTask(input, context.taskId, context.taskDir, context.taskMdPath, context.repoRoot, context.state);
@@ -181,7 +183,7 @@ function checkpointIdentity(input, task, delivery) {
 function checkpointTimestamp() {
     return new Date().toISOString();
 }
-function executeUnlocked(input, task, mode) {
+function executeCommitOperationCore(input, task, mode) {
     const inspected = inspectGitWorkflow(input.cwd);
     if (!inspected.snapshot)
         return failure(input, mode, task?.taskId ?? null, 'GIT_INSPECT_FAILED', 'Unable to inspect Git repository');
@@ -432,12 +434,10 @@ function executeCommitOperation(input) {
     if (mode === 'orchestrated' && !task)
         return failure(normalizedInput, mode, null, 'ORCHESTRATION_TASK_REQUIRED', 'orchestrated commit requires a task context', 'blocked');
     try {
-        return task
-            ? withRepositoryMutationLock(normalizedInput.cwd, () => withTaskExecutionLock(normalizedInput.cwd, task.taskId, 'commit-operation', () => executeUnlocked(normalizedInput, task, mode)))
-            : withRepositoryMutationLock(normalizedInput.cwd, () => executeUnlocked(normalizedInput, null, mode));
+        return executeCommitOperationCore(normalizedInput, task, mode);
     }
     catch (error) {
-        const code = error instanceof TaskExecutionLockError ? error.code : 'COMMIT_OPERATION_FAILED';
+        const code = 'COMMIT_OPERATION_FAILED';
         return failure(normalizedInput, mode, task?.taskId ?? null, code, error instanceof Error ? error.message : String(error), 'blocked');
     }
 }

package/dist/lib/task/control-authority.js

@@ -1,3 +1,4 @@
+import fs from 'node:fs';
 import path from 'node:path';
 import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { isAgentClientId } from '../agent-clients/types.js';
@@ -5,10 +6,10 @@ import { sandboxControlPaths } from '../sandbox/workspace-view.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
 import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, awaitOrchestrationDelegationActivation, beginOrResumeOrchestration, dispatchOrchestrationDelegation, OrchestrationStateError, pauseOrchestration, prepareOrchestrationDelegation, recoverPreparedOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from './orchestration.js';
 import { applyTaskFinalization } from './finalization.js';
-import { applyTaskLifecycle, applyTaskLifecycleWithinTaskLock, taskLifecycleFailure } from './lifecycle.js';
+import { applyTaskLifecycle } from './lifecycle.js';
 import { resolveTaskContext, resolveTaskRef, TASK_ID_RE } from './resolve-ref.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { verifyTaskEvent } from './verification.js';
+import { releaseStaleShortIdRegistry } from './short-id.js';
 export function taskControlOperationKey(operation) {
     if (operation.family === 'task-finalization')
         return 'complete';
@@ -112,7 +113,7 @@ function lifecycleTaskId(request, repoRoot) {
 async function applyLifecycleWithAuthority(context, request) {
     const taskId = lifecycleTaskId(request, context.repoRoot);
     const controlRoot = taskId ? controlRootForTask(context, taskId) : undefined;
-    const execute = async (underTaskLock = false) => {
+    const execute = async () => {
         if (request.intent === 'recover-started') {
             const adapter = isAgentClientId(request.agent)
                 ? getAgentClientAdapter(request.agent).orchestrationAdapter
@@ -126,36 +127,13 @@ async function applyLifecycleWithAuthority(context, request) {
             }
             return adapter.recoverStarted(request, { repoRoot: context.repoRoot });
         }
-        return underTaskLock
-            ? applyTaskLifecycleWithinTaskLock(request, {
-                repoRoot: context.repoRoot,
-                ...(controlRoot ? { controlRoot } : {}),
-                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
-            }, taskId)
-            : applyTaskLifecycle(request, {
-                repoRoot: context.repoRoot,
-                ...(controlRoot ? { controlRoot } : {}),
-                ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
-            });
+        return applyTaskLifecycle(request, {
+            repoRoot: context.repoRoot,
+            ...(controlRoot ? { controlRoot } : {}),
+            ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {})
+        });
     };
-    if (!taskId)
-        return await execute();
-    try {
-        return await withTaskExecutionLock(context.repoRoot, taskId, `task-lifecycle.${request.intent}`, () => execute(true));
-    }
-    catch (error) {
-        if (!(error instanceof TaskExecutionLockError))
-            throw error;
-        if (request.intent === 'recover-started') {
-            return {
-                status: 'owner-unknown', changed: false, targetState: 'active',
-                requestRef: request.taskRef, intent: 'recover-started', taskId,
-                receiptId: null, childId: null,
-                error: { code: error.code, message: error.message }
-            };
-        }
-        return taskLifecycleFailure(request, { code: error.code, message: error.message }, taskId);
-    }
+    return await execute();
 }
 function controlRootForTask(context, taskId) {
     if (context.source === 'sandbox-executor')
@@ -251,6 +229,28 @@ export function dispatchTaskControlOperation(context, operation) {
             ...(controlRoot ? { controlRoot } : {}),
             ...(context.source === 'direct-host' && context.project ? { controlProject: context.project } : {}),
             preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)
+        }).then((result) => {
+            if (context.source !== 'direct-host' || !controlRoot || result.status !== 'completed' || !result.taskId)
+                return result;
+            try {
+                if (fs.lstatSync(controlRoot, { throwIfNoEntry: false }) === undefined) {
+                    const released = releaseStaleShortIdRegistry(context.repoRoot, result.taskId);
+                    return { ...result, changed: result.changed || released.changed };
+                }
+                return result;
+            }
+            catch (error) {
+                return {
+                    ...result,
+                    status: 'blocked',
+                    result: 'blocked',
+                    error: {
+                        code: 'TASK_FINALIZATION_SHORT_ID_RELEASE_FAILED',
+                        message: error instanceof Error ? error.message : String(error),
+                        retryable: true
+                    }
+                };
+            }
         });
     }
     try {

package/dist/lib/task/create-service.js

@@ -3,7 +3,6 @@ import { createPlatformIssue, syncPlatformIssue } from '../platform/issues.js';
 import { VERSION } from '../version.js';
 import { applyWorkflowWarningIntent } from './workflow-warning-intents.js';
 import { createLocalTask } from './create.js';
-import { TaskExecutionLockError } from './task-execution-lock.js';
 import { verifyTaskEvent } from './verification.js';
 const DEFAULT_DEPENDENCIES = {
     createIssue: createPlatformIssue,
@@ -152,9 +151,8 @@ async function createTask(value, options) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        const lockBusy = error instanceof TaskExecutionLockError && error.code === 'ORCHESTRATION_LOCK_BUSY';
-        const code = lockBusy ? error.code : /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_FAILED';
-        return taskCreateFailure({ code, message, retryable: lockBusy || code === 'TASK_CREATE_LOCK_TIMEOUT' });
+        const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_FAILED';
+        return taskCreateFailure({ code, message, retryable: false });
     }
     const operations = [{
             name: 'task:local', status: local.status, reasonCode: null