@fitlab-ai/agent-infra 0.11.3 → 0.11.5

package/dist/lib/sandbox/control/server.js

@@ -1,4 +1,3 @@
-import { finalizationTerminalResponse } from './finalization-response.js';
 import { completedReentryView } from './completed-reentry.js';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -21,7 +20,7 @@ import { nextSandboxControlBackoff } from './timing.js';
 import { readTaskFinalizationReceipt } from '../../task/finalization.js';
 import { readCodexControllerRegistration } from './controller-registration.js';
 import { validateSandboxControlIdentity } from './identity-sentinel.js';
-import { mergeSandboxTaskView, taskViewAfterFinalization, taskViewForManifest } from './task-view.js';
+import { mergeSandboxTaskView, taskViewForManifest } from './task-view.js';
 import { taskCreateOutputUnavailableResult } from '../../task/create-service.js';
 function appendBrokerAudit(manifest, event, fields = {}) {
     appendDiagnosticAudit(manifest, event, { source: 'broker', ...fields });
@@ -125,48 +124,6 @@ export function writeSandboxControlResponse(manifest, response) {
     }
     return true;
 }
-function finalizationRecoveryResponse(manifest, requestId, exitCode) {
-    if (!manifest.taskId || exitCode !== 0)
-        return { status: 'not-applicable' };
-    let receipt;
-    try {
-        receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
-        if (!receipt || !receipt.controlBinding
-            || receipt.controlBinding.generation !== manifest.generation
-            || receipt.controlBinding.requestId !== requestId)
-            return { status: 'deferred' };
-        const resolved = resolveTaskRef(manifest.taskId, { repoRoot: manifest.repoRoot });
-        if (!resolved.ok || resolved.state !== 'completed' || receipt.lifecycle !== 'done')
-            return { status: 'deferred' };
-    }
-    catch {
-        return { status: 'deferred' };
-    }
-    return { status: 'matched', response: finalizationTerminalResponse(manifest.taskId, requestId, receipt) };
-}
-function publishFinalizationTaskView(manifest, broker, requestId, state, reasonCode, activeRequestId) {
-    let view;
-    try {
-        const resolved = resolveTaskRef(manifest.taskId ?? '', { repoRoot: manifest.repoRoot });
-        const receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId ?? '');
-        view = resolved.ok && resolved.state === 'completed'
-            ? taskViewAfterFinalization({
-                taskId: manifest.taskId ?? '', generation: manifest.generation, requestId, receipt
-            })
-            : {
-                state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
-                reasonCode: 'SANDBOX_TASK_VIEW_SOURCE_UNCONFIRMED'
-            };
-    }
-    catch {
-        view = {
-            state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
-            reasonCode: 'SANDBOX_TASK_VIEW_RECEIPT_INVALID'
-        };
-    }
-    writeSandboxControlStatus(manifest, broker, state, reasonCode, activeRequestId, Date.now(), view);
-    return view;
-}
 function payloadReference(payload) {
     return {
         version: payload.version,
@@ -329,12 +286,7 @@ export async function recoveryResponse(manifest, manifestPath, request, evidence
         if (JSON.stringify(payloadTerminal) !== JSON.stringify(terminalResult))
             return unknown(request.id);
     }
-    const finalization = request.family === 'task-finalization' ? finalizationRecoveryResponse(manifest, request.id, 0) : null;
-    if (evidence.exitCode === 0 && finalization?.status === 'deferred')
-        return null;
-    const recovery = finalization
-        ? { domain: { consistent: finalization.status === 'matched' } }
-        : await readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
+    const recovery = await readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
     const binding = operationRecoveryBinding(request.id, manifest.generation, manifest.taskId, request.family, operationName);
     const decision = classifySandboxControlRecovery({
         operation,
@@ -351,23 +303,9 @@ export async function recoveryResponse(manifest, manifestPath, request, evidence
         return notExecuted(request.id);
     if (decision.outcome !== 'success' && decision.outcome !== 'failure')
         return null;
-    if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-        if (finalization?.status !== 'matched')
-            return null;
-        return finalization.response ?? null;
-    }
     return genericRecoveryResponse(request, evidence.exitCode, payload);
 }
-async function terminalMatchesEvidence(manifest, manifestPath, request, response, evidence, payload, payloadInvalid, terminalResult) {
-    if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-        if (!terminalResult)
-            return { valid: false, payloadReferenced: false };
-        const expected = await recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult);
-        return {
-            valid: expected !== null && JSON.stringify(response) === JSON.stringify(expected),
-            payloadReferenced: false
-        };
-    }
+async function terminalMatchesEvidence(manifest, request, response, evidence, payload, payloadInvalid, terminalResult) {
     if (response.version !== 2 || response.id !== request.id || response.phase !== 'completed'
         || response.exitCode !== evidence.exitCode || response.error !== null) {
         return { valid: false, payloadReferenced: false };
@@ -401,7 +339,7 @@ async function terminalMatchesEvidence(manifest, manifestPath, request, response
         payloadReferenced: false
     };
 }
-function publishExecutionResult(manifest, request, result, broker, brokerOwns) {
+function publishExecutionResult(manifest, request, result, brokerOwns) {
     const normalized = sanitizeSandboxControlResult(manifest, result);
     const terminalResult = writeSandboxControlTerminalResult(manifest, {
         id: request.id,
@@ -413,46 +351,29 @@ function publishExecutionResult(manifest, request, result, broker, brokerOwns) {
         criticalRequestPhase(manifest, request, 'evidence-written', normalized.exitCode === 0 ? 'success' : 'failure');
         criticalRequestPhase(manifest, request, 'publish-authorized', normalized.exitCode === 0 ? 'success' : 'failure');
     }
-    let terminal = null;
-    if (request.family === 'task-finalization') {
-        const finalization = finalizationRecoveryResponse(manifest, request.id, normalized.exitCode);
-        if (finalization.status === 'deferred')
-            return false;
-        terminal = finalization.response ?? null;
-    }
-    if (!terminal) {
-        const inline = {
-            version: 2, id: request.id, phase: 'completed', exitCode: normalized.exitCode,
-            stdout: normalized.stdout, stderr: normalized.stderr, error: null
-        };
-        if (sandboxControlEncodedJsonBytes(inline) <= SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
-            terminal = inline;
-        }
+    let terminal = {
+        version: 2, id: request.id, phase: 'completed', exitCode: normalized.exitCode,
+        stdout: normalized.stdout, stderr: normalized.stderr, error: null
+    };
+    if (sandboxControlEncodedJsonBytes(terminal) > SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
         let payload = null;
-        if (!terminal) {
-            try {
-                payload = createSandboxControlPayload(manifest, request.id, normalized);
-                const usage = sandboxControlGenerationUsage(manifest);
-                if (usage.bytes + sandboxControlEncodedJsonBytes(payload) <= SANDBOX_CONTROL_MAX_RESPONSE_BYTES) {
-                    writeSandboxControlPayload(manifest, request.id, normalized);
-                }
-                else {
-                    payload = null;
-                }
+        try {
+            payload = createSandboxControlPayload(manifest, request.id, normalized);
+            const usage = sandboxControlGenerationUsage(manifest);
+            if (usage.bytes + sandboxControlEncodedJsonBytes(payload) <= SANDBOX_CONTROL_MAX_RESPONSE_BYTES) {
+                writeSandboxControlPayload(manifest, request.id, normalized);
             }
-            catch {
+            else {
                 payload = null;
             }
-            terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
         }
+        catch {
+            payload = null;
+        }
+        terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
     }
     if (!brokerOwns())
         return false;
-    if (request.family === 'task-finalization' && normalized.exitCode === 0) {
-        const view = publishFinalizationTaskView(manifest, broker, request.id, 'healthy', null, null);
-        if (view.state === 'unknown')
-            return false;
-    }
     const committed = writeSandboxControlResponse(manifest, terminal);
     if (committed && fs.existsSync(path.join(manifest.processingDir, request.id, 'transitions'))) {
         criticalRequestPhase(manifest, request, 'published-committed', normalized.exitCode === 0 ? 'success' : 'failure');
@@ -652,16 +573,11 @@ async function recoverProcessing(manifest, manifestPath, broker, brokerOwns) {
             if (terminal && request && resultEvidence) {
                 if (!terminalResult && request.family !== 'task-create')
                     continue;
-                const reconciliation = await terminalMatchesEvidence(manifest, manifestPath, request, existingTerminalResponse, resultEvidence, payload, payloadInvalid, terminalResult);
+                const reconciliation = await terminalMatchesEvidence(manifest, request, existingTerminalResponse, resultEvidence, payload, payloadInvalid, terminalResult);
                 if (!reconciliation.valid)
                     continue;
                 terminalReconciled = true;
                 payloadReferenced = reconciliation.payloadReferenced;
-                if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
-                    const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
-                    if (view.state === 'unknown')
-                        continue;
-                }
             }
             if (!terminalResult && !terminalReconciled) {
                 if (terminal)
@@ -688,11 +604,6 @@ async function recoverProcessing(manifest, manifestPath, broker, brokerOwns) {
                 const recovered = await recoveryResponse(manifest, manifestPath, request, resultEvidence, payload, terminalResult);
                 if (!recovered)
                     continue;
-                if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
-                    const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
-                    if (view.state === 'unknown')
-                        continue;
-                }
                 writeSandboxControlResponse(manifest, recovered);
                 const preserveRecoveryEvidence = recovered.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN';
                 if (transitionProtocolActive && !preserveRecoveryEvidence) {
@@ -700,7 +611,7 @@ async function recoverProcessing(manifest, manifestPath, broker, brokerOwns) {
                 }
                 if (preserveRecoveryEvidence)
                     continue;
-                payloadReferenced = Boolean(payload) && request.family !== 'task-finalization';
+                payloadReferenced = Boolean(payload);
             }
         }
         else {
@@ -794,14 +705,10 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
             startupReceipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
         }
         catch {
-            // Preserve malformed receipt evidence as unknown rather than treating it as no receipt.
             startupReceipt = {};
         }
     }
-    let taskView = taskViewForManifest({
-        ...manifest,
-        receipt: startupReceipt
-    });
+    let taskView = taskViewForManifest({ ...manifest, receipt: startupReceipt });
     try {
         const previous = readSandboxControlStatus(manifest.publicStatusDir);
         if (previous.generation === manifest.generation)
@@ -983,17 +890,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                     break;
                 let terminalCommitted = false;
                 if (settledExecution.result && settledExecution.resultEvidenceWritten) {
-                    terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, broker, brokerOwns);
-                    if (terminalCommitted && settledExecution.request.family === 'task-finalization') {
-                        try {
-                            const published = readSandboxControlStatus(manifest.publicStatusDir);
-                            if (published.generation === manifest.generation)
-                                taskView = published.taskView;
-                        }
-                        catch {
-                            taskView = { state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null, reasonCode: 'SANDBOX_TASK_VIEW_STATUS_INVALID' };
-                        }
-                    }
+                    terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, brokerOwns);
                 }
                 else {
                     terminalCommitted = writeSandboxControlResponse(manifest, unknown(settledExecution.request.id));
@@ -1255,7 +1152,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 }
             }
             if (owned && active.result && active.resultEvidenceWritten) {
-                if (publishExecutionResult(manifest, active.request, active.result, broker, brokerOwns)) {
+                if (publishExecutionResult(manifest, active.request, active.result, brokerOwns)) {
                     if (brokerOwns()) {
                         removeAcceptedResponse(manifest, active.request.id);
                         fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
@@ -1264,22 +1161,8 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 }
             }
             if (active) {
-                const terminationConfirmed = active.prepared.terminate(owned);
-                if (owned && brokerOwns() && active.request.family === 'task-finalization') {
-                    const recovered = finalizationRecoveryResponse(manifest, active.request.id, 0);
-                    const view = recovered.status === 'matched'
-                        ? publishFinalizationTaskView(manifest, broker, active.request.id, 'healthy', null, null)
-                        : null;
-                    if (view?.state !== 'unknown' && recovered.status === 'matched' && recovered.response
-                        && writeSandboxControlResponse(manifest, recovered.response)) {
-                        if (terminationConfirmed && brokerOwns()) {
-                            removeAcceptedResponse(manifest, active.request.id);
-                            fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
-                            active = null;
-                        }
-                    }
-                }
-                if (owned && brokerOwns() && active && active.request.family !== 'task-finalization' && !active.resultEvidenceWritten) {
+                active.prepared.terminate(owned);
+                if (owned && brokerOwns() && active && !active.resultEvidenceWritten) {
                     writeSandboxControlResponse(manifest, unknown(active.request.id));
                 }
             }

package/dist/lib/sandbox/removal.js

@@ -17,6 +17,7 @@ import { acquireSandboxResourceLock } from './control/native-file-lock.js';
 import { toolConfigDirCandidates, toolProjectDirCandidates } from './tools.js';
 import { getProcessStartTime } from '../server/process-state.js';
 import { releaseStaleShortIdRegistry } from '../task/short-id.js';
+import { withRepositoryMutationLock } from '../task/task-execution-lock.js';
 import { fetchSandboxRows } from './commands/list-running.js';
 import { formatIntermediateCleanupReport, cleanupIntermediateUnderRemovalCoordinator, protectIntermediateCleanupReport, mergeIntermediateCleanupReports, scanIntermediateCleanup } from '../task/intermediate-cleanup.js';
 import { createSandboxControlBindingEvidence } from './task-cleanup.js';
@@ -670,7 +671,7 @@ async function runRmOneUnderRepositoryLock(config, tools, branch, options = {})
     return rmOneCore(config, tools, branch, { ...options, target });
 }
 async function rmOne(config, tools, branch, options = {}) {
-    await runRmOneUnderRepositoryLock(config, tools, branch, options);
+    await withRepositoryMutationLock(config.repoRoot, () => runRmOneUnderRepositoryLock(config, tools, branch, options));
 }
 async function removeUncheckedSandbox(config, target, options) {
     const confirm = options.prompt?.confirm ?? p.confirm;
@@ -703,8 +704,12 @@ async function removeUncheckedSandbox(config, target, options) {
             p.outro('Cancelled');
         return null;
     }
+    const worktreePermits = options.permits ?? await authorizeWorktrees(existingWorktrees, { allowDirtyDiscard: true, assumeYes: Boolean(options.assumeYes) }, { ...options.prompt, interactive: options.interactive });
     for (const container of matchedContainers)
         runSafeEngine(engine, 'docker', ['rm', '-f', container]);
+    if (!sandboxContainersRemoved(engine, matchedContainers)) {
+        throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+    }
     for (const root of controlRoots) {
         fs.rmSync(root, { recursive: true, force: true });
         removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
@@ -720,14 +725,16 @@ async function removeUncheckedSandbox(config, target, options) {
     if (shouldRemoveShare)
         fs.rmSync(sharePath, { recursive: true, force: true });
     if (shouldRemoveWorktree) {
-        for (const worktree of existingWorktrees)
-            fs.rmSync(worktree, { recursive: true, force: true });
-        runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
+        for (const worktree of existingWorktrees) {
+            const permit = worktreePermits.get(path.resolve(worktree));
+            if (!permit)
+                throw new Error(`SANDBOX_WORKTREE_REMOVAL_PERMIT_MISSING: ${worktree}`);
+            removeWorktreeDir(config.repoRoot, config.worktreeBase, worktree, permit);
+        }
     }
-    if (shouldDeleteBranch)
+    if (shouldDeleteBranch) {
+        assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
         runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
-    if (!sandboxContainersRemoved(engine, matchedContainers)) {
-        throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
     }
     if (target.workspace.mode === 'task-bound') {
         releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
@@ -741,7 +748,7 @@ async function rmOneCore(config, tools, branch, options = {}) {
     return removeUncheckedSandbox(config, target, options);
 }
 async function rmPurge(config, tools, prompt = {}) {
-    return rmPurgeCore(config, tools, prompt);
+    return withRepositoryMutationLock(config.repoRoot, () => rmPurgeCore(config, tools, prompt));
 }
 async function rmPurgeCore(config, tools, prompt = {}) {
     const engine = detectEngine(config);

package/dist/lib/sandbox/task-cleanup.js

@@ -8,7 +8,6 @@ import { enumerateAllTaskDirs } from '../task/resolve-ref.js';
 import { resolveSandboxCleanupTarget } from './workspace-identity.js';
 import { readSandboxControlManifest } from './control/lifecycle.js';
 import { readJsonFile, readSandboxControlStatus } from './control/state.js';
-import { finalizationTerminalResponse } from './control/finalization-response.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 function matchingControlManifest(repoRoot, controlRoot, taskId, binding) {
     if (!controlRootIdentity(controlRoot))
@@ -77,11 +76,9 @@ function canonicalPath(input) {
         return path.resolve(input);
     }
 }
-function taskFinalizationReceiptComplete(receipt, taskId, binding) {
+function taskFinalizationReceiptComplete(receipt, taskId) {
     return receipt.taskId === taskId
-        && taskFinalizationReceiptState(receipt) === 'complete'
-        && receipt.controlBinding?.generation === binding.generation
-        && receipt.controlBinding.requestId === binding.requestId;
+        && taskFinalizationReceiptState(receipt) === 'complete';
 }
 function terminalControlBindingEvidence(repoRootInput, controlRootInput, taskId, binding) {
     const repoRoot = canonicalPath(repoRootInput);
@@ -105,26 +102,22 @@ function terminalControlBindingEvidence(repoRootInput, controlRootInput, taskId,
                 return false;
         }
         const receipt = readTaskFinalizationReceipt(repoRoot, taskId);
-        if (!receipt || !taskFinalizationReceiptComplete(receipt, taskId, binding)) {
+        if (!receipt || !taskFinalizationReceiptComplete(receipt, taskId)) {
             return false;
         }
-        const status = readSandboxControlStatus(manifest.publicStatusDir);
-        const viewReceipt = status.taskView.receipt;
-        const terminalTaskView = (status.taskView.state === 'current' && status.taskView.observedSource === 'completed')
-            || (status.taskView.state === 'finalized-stale' && status.taskView.observedSource === 'active');
-        if (status.generation !== binding.generation || status.state !== 'healthy'
-            || status.activeRequestId !== null || !terminalTaskView || status.taskView.taskId !== taskId
-            || !viewReceipt || viewReceipt.generation !== binding.generation
-            || viewReceipt.requestId !== binding.requestId
-            || viewReceipt.receiptId !== receipt.receiptId
-            || viewReceipt.revision !== receipt.revision)
-            return false;
         const responsePath = path.join(manifest.channelDir, 'responses', `${binding.requestId}.json`);
         if (!inspectOwnedPath(path.join(controlRoot, 'channel'), responsePath, 'file'))
             return false;
         const actual = readJsonFile(responsePath);
-        const expected = finalizationTerminalResponse(taskId, binding.requestId, receipt);
-        return JSON.stringify(actual) === JSON.stringify(expected);
+        const response = actual;
+        if (response.version !== 2 || response.id !== binding.requestId || response.phase !== 'completed'
+            || response.exitCode !== 0 || typeof response.stdout !== 'string')
+            return false;
+        const envelope = JSON.parse(response.stdout);
+        const result = envelope.result;
+        return envelope.status === 'completed' && envelope.accepted === true
+            && result !== null && typeof result === 'object'
+            && result.status === 'completed' && result.taskId === taskId;
     }
     catch {
         return false;
@@ -153,7 +146,7 @@ function removedControlBindingEvidence(repoRootInput, journal, taskId, binding)
         return false;
     try {
         const receipt = readTaskFinalizationReceipt(repoRoot, taskId);
-        return receipt !== null && taskFinalizationReceiptComplete(receipt, taskId, binding);
+        return receipt !== null && taskFinalizationReceiptComplete(receipt, taskId);
     }
     catch {
         return false;

package/dist/lib/task/activity-intent.js

@@ -6,7 +6,6 @@ import { assertWritableInventory, buildArtifactLinkSection, inspectTaskArtifacts
 import { parseArtifactName } from './artifact-name.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
-import { allowsManualOverride } from './guard-override.js';
 const HEAD_RE = /^[0-9a-f]{40}$/;
 const REVIEW_ACTION_RE = /^Review PR \(Round ([1-9]\d*)\)( \[started\])?$/;
 const VERDICTS = new Set(['approved', 'changes-requested', 'commented']);
@@ -294,7 +293,7 @@ export function applyPrReviewActivityIntent(intent, options = {}) {
     const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(intent, resolved.code, resolved.message, resolved.taskId);
-    if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'activity-intent', 'TASK_STATE_MISMATCH')) {
+    if (resolved.state !== 'active') {
         return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     }
     if (options.lockAlreadyHeld)

package/dist/lib/task/artifact-command.js

@@ -13,7 +13,7 @@ export function parseArtifactCommand(args) {
     }
     const fields = {};
     const allowed = {
-        inspect: ['--family'],
+        inspect: ['--family', '--source-finding', '--source-artifact', '--source-sha256'],
         init: ['--family', '--artifact', '--locale'],
         'preflight': ['--family', '--artifact'],
         'finalize-local': ['--family', '--artifact']
@@ -37,8 +37,10 @@ export function parseArtifactCommand(args) {
     if (locale !== undefined && locale !== 'zh-CN' && locale !== 'en')
         throw new Error("option '--locale' must be 'zh-CN' or 'en'");
     return {
-        taskRef, operation: operation, family: fields['--family'],
-        artifact: fields['--artifact'] ?? '', locale
+        taskRef, operation: operation, family: fields['--family'] ?? '',
+        artifact: fields['--artifact'] ?? '', locale,
+        sourceFinding: fields['--source-finding'], sourceArtifact: fields['--source-artifact'],
+        sourceSha256: fields['--source-sha256']
     };
 }
 /** Resolve authoritative task metadata separately from a trusted candidate directory. */
@@ -46,7 +48,12 @@ export function executeArtifactCommand(command, options = {}) {
     const { taskRef, operation, family, artifact, locale } = command;
     const fail = (code, message) => ({ status: 'failed', changed: false, error: { code, message } });
     if (operation === 'inspect') {
-        const result = resolveArtifactContext(taskRef, family, { repoRoot: options.repoRoot });
+        const result = resolveArtifactContext(taskRef, family, {
+            repoRoot: options.repoRoot,
+            sourceFinding: command.sourceFinding,
+            sourceArtifact: command.sourceArtifact,
+            sourceSha256: command.sourceSha256
+        });
         return family === 'code' && result.codeMode ? {
             ...result, mode: result.codeMode.mode, code_max: result.codeMode.codeMax, rev_max: result.codeMode.reviewMax,
             verdict: result.codeMode.verdict, next_round: result.next?.round ?? null, next_artifact: result.next?.name ?? null,