@fitlab-ai/agent-infra 0.11.4 → 0.11.6

package/lib/platform/release-notes.ts

@@ -7,6 +7,7 @@ import { resolvePlatformProviderContext } from './context.ts';
 import type { PlatformClient } from './context.ts';
 import { providerError, providerOperationContext, providerStatus, unsupportedProviderOperation } from './provider-bridge.ts';
 import { resourceIdentityNumber } from './resource-identity.ts';
+import type { ReleaseNoteAuthor } from './provider-contract.ts';
 import type { ResourceIdentity } from './resource-identity.ts';
 
 type ReleaseNoteOptions = {
@@ -15,10 +16,9 @@ type ReleaseNoteOptions = {
   client?: PlatformClient;
 };
 
-type ReleaseNoteActor = { id?: string; name?: string };
-type ReleaseNoteCommit = { oid: string; title: string; authors: ReleaseNoteActor[] };
-type ReleaseNoteIssue = { number: number; identity?: ResourceIdentity; title: string; url: string; labels: string[]; author: { login: string; bot: boolean } | null };
-type ReleaseNotePullRequest = { number: number; identity?: ResourceIdentity; title: string; body: string; url: string; mergedAt: string; labels: string[]; author: { login: string; bot: boolean } | null; closingIssues: ReleaseNoteIssue[] };
+type ReleaseNoteCommit = { oid: string; title: string; url: string | null; pullRequestNumbers: number[]; authors: ReleaseNoteAuthor[] };
+type ReleaseNoteIssue = { number: number; identity?: ResourceIdentity; title: string; url: string; author: ReleaseNoteAuthor | null };
+type ReleaseNotePullRequest = { number: number; identity?: ResourceIdentity; title: string; body: string; url: string; mergedAt: string; labels: string[]; author: ReleaseNoteAuthor | null; closingIssues: ReleaseNoteIssue[] };
 
 const unsupportedError = {
   code: 'PLATFORM_RELEASE_NOTES_UNSUPPORTED',
@@ -180,15 +180,15 @@ async function releaseNoteContext(
   if (!platform.ok) return { ...baseResult(platform.error.retryable ? 'blocked' : 'failed'), error: providerError(platform.error, 'PLATFORM_PROVIDER_OPERATION_FAILED') };
   const commits = commitFacts.map((commit) => {
     const seen = new Set<string>();
-    const authors = platform.value.history.filter((item) => item.sha === commit.oid).flatMap((item) => item.author ? [item.author] : [])
-      .concat(platform.value.actors)
+    const facts = platform.value.commits.find((item) => item.sha === commit.oid);
+    const authors = (facts?.authors || [])
       .filter((actor) => {
-      const key = actor.id || actor.name || '';
+      const key = actor.login || actor.name;
       if (seen.has(key)) return false;
       seen.add(key);
       return true;
       });
-    return { ...commit, authors };
+    return { ...commit, url: facts?.url || null, pullRequestNumbers: facts?.pullRequestNumbers || [], authors };
   });
   const pullRequests: ReleaseNotePullRequest[] = platform.value.mergedPullRequests
     .map((item) => ({
@@ -199,14 +199,13 @@ async function releaseNoteContext(
       url: item.displayUrl || '',
       mergedAt: item.mergedAt || '',
       labels: item.labels || [],
-      author: item.author ? { login: item.author.name || item.author.id || '', bot: false } : null,
-      closingIssues: platform.value.closingIssues.filter((issue) => issue.id === item.id).map((issue) => ({
+      author: item.author,
+      closingIssues: item.closingIssues.map((issue) => ({
         number: issue.number || resourceIdentityNumber(issue.identity) || 0,
         ...(issue.identity ? { identity: issue.identity } : {}),
         title: issue.title,
         url: issue.displayUrl || '',
-        labels: issue.labels || [],
-        author: issue.author ? { login: issue.author.name || issue.author.id || '', bot: false } : null
+        author: issue.author
       }))
     }))
     .sort((left, right) => left.number - right.number);

package/lib/platform/verification-sync.ts

@@ -5,6 +5,8 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 
+import { resolveBranchWorktree } from "../git/branch-worktree.ts";
+
 import { resolvePlatformProviderContext } from "./context.ts";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.ts";
 import { requirementSectionAnchors } from "./issues.ts";
@@ -1054,7 +1056,10 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
     return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
   }
   const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
-  const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+  const gitCwd = branch ? resolveBranchWorktree(shared.repoRoot, branch) : taskDir;
+  if (!gitCwd) {
+    return { ok: false, type: "check_failed", message: `Task branch '${branch}' is not checked out in a usable worktree` };
+  }
   const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
   if (!changedFilesResult.ok) {
     return { ...changedFilesResult, type: "network_error" };
@@ -1082,25 +1087,6 @@ function computeExpectedInLabels(taskDir: any, repositoryLabels: string[], mappi
   return { ok: true, labels: planned.target, mode: "mapped" };
 }
 
-function worktreeForBranch(repositoryRoot: string, branch: string): string | null {
-  try {
-    const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
-      cwd: repositoryRoot,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    }).trim().split(/\r?\n\r?\n/);
-    const expectedRef = `refs/heads/${branch}`;
-    for (const record of records) {
-      const worktree = /^worktree (.+)$/m.exec(record)?.[1];
-      const branchRef = /^branch (.+)$/m.exec(record)?.[1];
-      if (worktree && branchRef === expectedRef) return worktree;
-    }
-  } catch {
-    // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
-  }
-  return null;
-}
-
 function loadInLabelMapping(shared: VerificationShared): any {
   const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
   if (!fs.existsSync(configPath)) {
@@ -1141,42 +1127,16 @@ function resolvePrHeadSha(context: any): any {
     return fallback();
   }
 
-  const worktreeList = gitText(["worktree", "list", "--porcelain"], context.taskDir);
-  if (!worktreeList.ok) {
-    return fallback();
-  }
-
-  const matchedWorktree = findWorktreeForBranch(worktreeList.value, branch);
+  const matchedWorktree = resolveBranchWorktree(context.taskDir, branch);
   if (!matchedWorktree) {
-    return fallback();
-  }
-
-  const headInWorktree = gitText(["rev-parse", "HEAD"], matchedWorktree);
-  if (!headInWorktree.ok) {
-    return fallback();
-  }
-
-  return headInWorktree;
-}
-
-function findWorktreeForBranch(porcelainOutput: any, branch: any): any {
-  let currentWorktree = "";
-  for (const rawLine of String(porcelainOutput || "").split("\n")) {
-    const line = rawLine.trimEnd();
-    if (line.startsWith("worktree ")) {
-      currentWorktree = line.slice("worktree ".length).trim();
-      continue;
-    }
-
-    if (line.startsWith("branch refs/heads/")) {
-      const usedBranch = line.slice("branch refs/heads/".length).trim();
-      if (usedBranch === branch && currentWorktree) {
-        return currentWorktree;
-      }
-    }
+    return {
+      ok: false,
+      type: "check_failed",
+      message: `Task branch '${branch}' is not checked out in a usable worktree`
+    };
   }
 
-  return null;
+  return gitText(["rev-parse", "HEAD"], matchedWorktree);
 }
 
 function interpolate(template: any, taskDir: any, artifactFile: any): any {

package/lib/sandbox/capture.ts

@@ -219,7 +219,7 @@ export async function runInSandbox(
       allowRecreate: request.recreate,
       recreate: async () => {
         const { create } = await import('./commands/create.ts');
-        await create([request.taskRef, '--no-refresh']);
+        await create([request.taskRef, '--no-refresh'], { runProjectInitCommand: false });
       }
     })).container;
   } else if (!found.running) {

package/lib/sandbox/commands/create.ts

@@ -79,6 +79,7 @@ import {
   recoverSandboxControlReplacement,
   readSandboxControlManifest
 } from '../control/lifecycle.ts';
+import { atomicWriteJson } from '../control/state.ts';
 import { inspectSandboxControlContainer } from '../control/container-identity.ts';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.ts';
 import { sandboxCoreBindMounts } from '../mounts.ts';
@@ -1008,7 +1009,27 @@ function readImageLabels(config: Pick<SandboxCreateConfig, 'imageName'> & Pick<S
   ]));
 }
 
-export async function create(args: string[]): Promise<void> {
+function readProjectInitCommandDigest(controlRoot: string): string | null {
+  const markerPath = path.join(controlRoot, 'project-init.json');
+  if (!fs.existsSync(markerPath)) return null;
+  try {
+    const marker = JSON.parse(fs.readFileSync(markerPath, 'utf8')) as { version?: unknown; commandSha256?: unknown };
+    return marker.version === 1 && typeof marker.commandSha256 === 'string' && /^[a-f0-9]{64}$/.test(marker.commandSha256)
+      ? marker.commandSha256
+      : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeProjectInitCommandDigest(controlRoot: string, commandSha256: string): void {
+  atomicWriteJson(path.join(controlRoot, 'project-init.json'), { version: 1, commandSha256 });
+}
+
+export async function create(
+  args: string[],
+  { runProjectInitCommand = true }: { runProjectInitCommand?: boolean } = {}
+): Promise<void> {
   const { values, positionals } = parseArgs({
     args,
     allowPositionals: true,
@@ -1079,6 +1100,7 @@ export async function create(args: string[]): Promise<void> {
     identity: target.workspace
   });
   const worktree = worktreeCandidates.find((candidate) => fs.existsSync(candidate)) ?? worktreeCandidates[0] ?? '';
+  let worktreeCreated = false;
   const shareCommon = shareCommonDir(effectiveConfig);
   const shareBranch = shareBranchDir(effectiveConfig, branch);
   const preparedDockerfile = prepareDockerfile(effectiveConfig, capabilityPlan.image);
@@ -1203,6 +1225,7 @@ export async function create(args: string[]): Promise<void> {
               toEnginePath(engine, worktree),
               branch
             ]);
+            worktreeCreated = true;
           } else {
             message(`Creating branch '${branch}' from '${baseBranch}'...`);
             runEngineTaskCommand(engine, 'git', [
@@ -1215,6 +1238,7 @@ export async function create(args: string[]): Promise<void> {
               toEnginePath(engine, worktree),
               baseBranch
             ]);
+            worktreeCreated = true;
           }
 
           return `Worktree ready at ${worktree}`;
@@ -1272,6 +1296,7 @@ export async function create(args: string[]): Promise<void> {
           let replacementCutover: ReturnType<typeof beginSandboxControlReplacement> | null = null;
           try {
             const recoveryResult = await recoverSandboxControlReplacement(controlPaths.root, replacementLease);
+            const previousProjectInitCommandDigest = readProjectInitCommandDigest(controlPaths.root);
             const hadExistingControlRoot = hadControlRootBeforeAcquire || recoveryResult === 'restored';
             const previousManifest = fs.existsSync(controlPaths.manifestPath)
               ? readSandboxControlManifest(controlPaths.manifestPath)
@@ -1728,6 +1753,32 @@ export async function create(args: string[]): Promise<void> {
             );
           }
 
+          const initCommand = effectiveConfig.initCommand;
+          const initCommandDigest = initCommand === null ? null : createHash('sha256').update(initCommand).digest('hex');
+          const shouldRunProjectInitCommand = runProjectInitCommand
+            && initCommand !== null
+            && initCommandDigest !== null
+            && (worktreeCreated || previousProjectInitCommandDigest !== initCommandDigest);
+          let projectInitCompleted = !worktreeCreated
+            && initCommandDigest !== null
+            && previousProjectInitCommandDigest === initCommandDigest;
+
+          if (shouldRunProjectInitCommand && initCommand !== null) {
+            try {
+              runVerboseEngine(engine, 'docker', [
+                'exec', '--workdir', '/workspace', container, 'bash', '-lc', initCommand
+              ]);
+              projectInitCompleted = true;
+            } catch (error) {
+              throw new Error(
+                `Project initialization failed for '${branch}': ${error instanceof Error ? error.message : String(error)}`
+              );
+            }
+          }
+          if (projectInitCompleted && initCommandDigest !== null) {
+            writeProjectInitCommandDigest(controlPaths.root, initCommandDigest);
+          }
+
           replacementLease.release();
           replacementLeaseHeld = false;
           return 'Container started';

package/lib/sandbox/commands/enter.ts

@@ -169,7 +169,7 @@ export async function enter(args: string[]): Promise<number> {
     allowRecreate: parsed.recreate,
     recreate: async () => {
       const { create } = await import('./create.ts');
-      await create([target.requestedRef, '--no-refresh']);
+      await create([target.requestedRef, '--no-refresh'], { runProjectInitCommand: false });
     }
   });
   const container = ready.container;

package/lib/sandbox/commands/start.ts

@@ -86,7 +86,7 @@ export async function start(args: string[]): Promise<void> {
     forceRecreate: parsed.recreate,
     recreate: async () => {
       const { create } = await import('./create.ts');
-      await create([target.requestedRef, '--no-refresh']);
+      await create([target.requestedRef, '--no-refresh'], { runProjectInitCommand: false });
     }
   });
   const message = ready.path === 'healthy'

package/lib/sandbox/config.ts

@@ -18,6 +18,7 @@ const DEFAULTS = Object.freeze({
   tools: ['agent-infra'],
   refreshIntervalDays: 7,
   dockerfile: null,
+  initCommand: null,
   vm: {
     cpu: null,
     memory: null,
@@ -35,6 +36,7 @@ type SandboxConfigInput = {
   customTools?: unknown;
   refreshIntervalDays?: unknown;
   dockerfile?: string | null;
+  initCommand?: unknown;
   vm?: Record<string, unknown>;
 };
 
@@ -66,6 +68,7 @@ export type SandboxConfig = {
   delivery?: { remote: string; baseRef: string };
   refreshIntervalDays: number;
   dockerfile: string | null;
+  initCommand: string | null;
   vm: SandboxVmConfig;
 };
 
@@ -103,6 +106,7 @@ function cloneDefaults(): SandboxConfigInput & { vm: SandboxVmConfig; runtimes:
     tools: [...DEFAULTS.tools],
     refreshIntervalDays: DEFAULTS.refreshIntervalDays,
     dockerfile: DEFAULTS.dockerfile,
+    initCommand: DEFAULTS.initCommand,
     vm: { ...DEFAULTS.vm }
   };
 }
@@ -149,6 +153,13 @@ export function loadConfig({
     ? [...sandbox.runtimes]
     : defaults.runtimes;
   const dockerfile = typeof sandbox.dockerfile === 'string' ? sandbox.dockerfile : defaults.dockerfile ?? null;
+  if (sandbox.initCommand !== undefined &&
+      (typeof sandbox.initCommand !== 'string' || sandbox.initCommand.trim().length === 0)) {
+    throw new Error('sandbox.initCommand must be a non-empty string when configured');
+  }
+  const initCommand = typeof sandbox.initCommand === 'string'
+    ? sandbox.initCommand
+    : null;
 
   if (!dockerfile) {
     let enginesNode: string | undefined;
@@ -200,6 +211,7 @@ export function loadConfig({
       defaults.refreshIntervalDays
     ),
     dockerfile,
+    initCommand,
     vm: {
       cpu: asPositiveNumberOrNull(sandbox.vm?.cpu) ?? defaults.vm.cpu,
       memory: asPositiveNumberOrNull(sandbox.vm?.memory) ?? defaults.vm.memory,

package/lib/sandbox/control/client.ts

@@ -393,6 +393,7 @@ export function requestSandboxControl(params: Readonly<{
 
 export function requestSandboxTaskFinalization(params: Readonly<{
   agent: string;
+  prepareHandoff?: (binding: Readonly<{ generation: string; requestId: string }>) => string;
   channelDir?: string;
   statusDir?: string;
   token?: string;
@@ -403,15 +404,18 @@ export function requestSandboxTaskFinalization(params: Readonly<{
   if (!agent) clientError('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization agent is invalid', false);
   const auth = authority(params);
   const issuedAt = Date.now();
+  const id = randomUUID();
+  const handoffSha256 = (params.prepareHandoff ?? (() => '0'.repeat(64)))({ generation: auth.generation, requestId: id });
   const request: SandboxTaskFinalizationRequest = {
     version: 3,
-    id: randomUUID(),
+    id,
     ...auth,
     issuedAt,
     expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
     family: 'task-finalization',
     operation: 'complete',
     agent,
+    handoffSha256,
     args: [],
     controllerProcess: null,
     controllerProof: null

package/lib/sandbox/control/executor.ts

@@ -2,6 +2,7 @@ import { spawn, type ChildProcess } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
 import { getProcessStartTime } from '../../server/process-state.ts';
 import {
   createTask,
@@ -41,6 +42,11 @@ import {
   openCodexControllerRegistration,
   resolveCodexControllerBinding
 } from './controller-registration.ts';
+import { shareBranchDir } from '../constants.ts';
+
+function handoffDirectory(manifest: SandboxControlManifest): string {
+  return shareBranchDir({ shareBase: path.join(homedir(), '.agent-infra', 'share', manifest.project) }, manifest.branch);
+}
 
 export type SandboxControlExecutionResult = {
   exitCode: number;
@@ -373,10 +379,11 @@ async function executeRequestInner(
     }
   }
   if (request.family === 'task-finalization') {
-    const operation = parseTaskControlOperation(
+    const parsed = parseTaskControlOperation(
       'task-finalization', [manifest.taskId!, 'complete', '--agent', request.agent]
     );
-    if (operation.family !== 'task-finalization') throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+    if (parsed.family !== 'task-finalization') throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+    const operation = { ...parsed, request: { ...parsed.request, handoffSha256: request.handoffSha256 } };
     const result = dispatchTaskControlOperation(
       createSandboxExecutorExecutionContext({
         repoRoot: manifest.repoRoot,
@@ -385,7 +392,8 @@ async function executeRequestInner(
         taskId: manifest.taskId!,
         generation: manifest.generation,
         manifestPath,
-        requestId: request.id
+        requestId: request.id,
+        handoffDirectory: handoffDirectory(manifest)
       }),
       operation
     );
@@ -407,7 +415,8 @@ async function executeRequestInner(
     taskId: manifest.taskId!,
     generation: manifest.generation,
     manifestPath,
-    requestId: request.id
+    requestId: request.id,
+    handoffDirectory: handoffDirectory(manifest)
   });
   const format = (value: unknown): SandboxControlExecutionResult => {
     const result = value as { status?: string };

package/lib/sandbox/control/lifecycle.ts

@@ -1298,6 +1298,10 @@ export async function quiesceSandboxControlRoot(
     timeoutMs?: number;
     timing?: SandboxControlTimingPolicy;
     identityProbe?: ProcessIdentityProbe;
+    executionProcessControl?: Readonly<{
+      isAlive: (execution: SandboxControlExecution) => boolean;
+      terminate: (execution: SandboxControlExecution, phase: 'graceful' | 'force') => boolean;
+    }>;
   } = {}
 ): Promise<'missing' | 'stale' | 'stopped'> {
   const resolvedRoot = path.resolve(root);
@@ -1338,58 +1342,63 @@ export async function quiesceSandboxControlRoot(
   if (!manifest && brokerLive) throw new Error('SANDBOX_CONTROL_OWNER_MISMATCH');
 
   const platform = options.platform ?? process.platform;
+  const processControl = options.executionProcessControl ?? {
+    isAlive: (execution: SandboxControlExecution) => executionAlive(execution, platform, identityProbe),
+    terminate: (execution: SandboxControlExecution, phase: 'graceful' | 'force') => phase === 'graceful'
+      ? terminateSandboxControlExecution(execution, { platform, timeoutMs: 0, allowForce: false, identityProbe })
+      : terminateSandboxControlExecution(execution, {
+        platform, timeoutMs: Math.max(0, deadlineAt - Date.now()), deadlineAt, forceAt: Date.now(), identityProbe
+      })
+  };
   let executions = manifest ? readExecutions(manifest) : [];
   const owner: OwnerIdentity | null = brokerLive ? broker : statusLive ? statusOwner : null;
   if (!owner) {
     if (manifest && !broker && !status) throw new Error('SANDBOX_CONTROL_OWNER_EVIDENCE_MISSING');
     for (const execution of executions) {
-      terminateSandboxControlExecution(execution, { platform, timeoutMs: 0, allowForce: false, identityProbe });
+      processControl.terminate(execution, 'graceful');
     }
     const softDeadlineAt = Math.min(forceAt, Date.now() + Math.floor(Math.max(0, forceAt - Date.now()) / 2));
     while (Date.now() < softDeadlineAt) {
-      if (!executions.some((execution) => executionAlive(execution, platform, identityProbe))) break;
+      if (!executions.some((execution) => processControl.isAlive(execution))) break;
       await new Promise((resolve) => setTimeout(resolve, 25));
     }
     if (manifest) executions = mergeExecutions(executions, readExecutions(manifest));
     if (Date.now() >= deadlineAt) throw new Error('SANDBOX_CONTROL_QUIESCE_DEADLINE_EXCEEDED');
     for (const execution of executions) {
-      if (!terminateSandboxControlExecution(execution, {
-        platform, timeoutMs: Math.max(0, deadlineAt - Date.now()), deadlineAt, forceAt: Date.now(), identityProbe
-      })) {
+      if (!processControl.terminate(execution, 'force')) {
         throw new Error(`SANDBOX_CONTROL_EXECUTION_STILL_RUNNING: ${execution.requestId}`);
       }
     }
-    if (executions.some((execution) => executionAlive(execution, platform, identityProbe))) {
+    if (executions.some((execution) => processControl.isAlive(execution))) {
       throw new Error('SANDBOX_CONTROL_EXECUTION_STILL_RUNNING');
     }
     return broker || status ? 'stale' : 'missing';
   }
 
-  const remaining = (): number => Math.max(0, deadlineAt - Date.now());
   signalOwner(owner, platform, false);
   for (const execution of executions) {
-    terminateSandboxControlExecution(execution, { platform, timeoutMs: 0, allowForce: false, identityProbe });
+    processControl.terminate(execution, 'graceful');
   }
   const softDeadlineAt = Math.min(forceAt, Date.now() + Math.floor(Math.max(0, forceAt - Date.now()) / 2));
   while (Date.now() < softDeadlineAt) {
-    if (!ownerLive(owner, identityProbe) && !executions.some((execution) => executionAlive(execution, platform, identityProbe))) break;
+    if (!ownerLive(owner, identityProbe) && !executions.some((execution) => processControl.isAlive(execution))) break;
     await new Promise((resolve) => setTimeout(resolve, 25));
   }
-  if (!ownerLive(owner, identityProbe) && !executions.some((execution) => executionAlive(execution, platform, identityProbe))) {
+  if (!ownerLive(owner, identityProbe) && !executions.some((execution) => processControl.isAlive(execution))) {
     return 'stopped';
   }
   if (manifest) executions = mergeExecutions(executions, readExecutions(manifest));
   if (Date.now() >= deadlineAt) throw new Error('SANDBOX_CONTROL_QUIESCE_DEADLINE_EXCEEDED');
   for (const execution of executions) {
-    terminateSandboxControlExecution(execution, { platform, timeoutMs: 0, deadlineAt, forceAt: Date.now(), identityProbe });
+    processControl.terminate(execution, 'force');
   }
   signalOwner(owner, platform, true);
   while (Date.now() < deadlineAt) {
-    if (!ownerLive(owner, identityProbe) && !executions.some((execution) => executionAlive(execution, platform, identityProbe))) return 'stopped';
+    if (!ownerLive(owner, identityProbe) && !executions.some((execution) => processControl.isAlive(execution))) return 'stopped';
     await new Promise((resolve) => setTimeout(resolve, 25));
   }
   if (ownerLive(owner, identityProbe)) throw new Error('SANDBOX_CONTROL_BROKER_STILL_RUNNING');
-  if (executions.some((execution) => executionAlive(execution, platform, identityProbe))) throw new Error('SANDBOX_CONTROL_EXECUTION_STILL_RUNNING');
+  if (executions.some((execution) => processControl.isAlive(execution))) throw new Error('SANDBOX_CONTROL_EXECUTION_STILL_RUNNING');
   return 'stopped';
 }
 

package/lib/sandbox/control/protocol.ts

@@ -65,7 +65,7 @@ export type SandboxTaskCommandRequest = RequestBase & Readonly<{
   family: 'task-lifecycle'; args: string[];
 }>;
 export type SandboxTaskFinalizationRequest = RequestBase & Readonly<{
-  family: 'task-finalization'; operation: 'complete'; agent: string; args: [];
+  family: 'task-finalization'; operation: 'complete'; agent: string; handoffSha256: string; args: [];
 }>;
 export type SandboxTaskCreateRequest = RequestBase & Readonly<{
   family: 'task-create'; candidate: TaskCreateCandidateV1;
@@ -279,11 +279,12 @@ export function validateSandboxControlRequest(
     return request as SandboxCodexControllerRequest;
   }
   if (request.family === 'task-finalization') {
-    const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+    const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'handoffSha256', 'id', 'issuedAt', 'operation', 'token', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
       || request.operation !== 'complete'
       || !Array.isArray(request.args) || request.args.length !== 0
       || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
+      || typeof request.handoffSha256 !== 'string' || !/^[a-f0-9]{64}$/u.test(request.handoffSha256)
       || request.controllerProcess !== null || request.controllerProof !== null) {
       fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
     }

package/lib/sandbox/removal.ts

@@ -47,6 +47,7 @@ import { toolConfigDirCandidates, toolProjectDirCandidates } from './tools.ts';
 import type { SandboxTool } from './tools.ts';
 import { getProcessStartTime } from '../server/process-state.ts';
 import { releaseStaleShortIdRegistry } from '../task/short-id.ts';
+import { withRepositoryMutationLock } from '../task/task-execution-lock.ts';
 import { fetchSandboxRows, type SandboxRow } from './commands/list-running.ts';
 import {
   formatIntermediateCleanupReport,
@@ -959,7 +960,10 @@ async function rmOne(
   branch: string,
   options: RmOneOptions = {}
 ): Promise<void> {
-  await runRmOneUnderRepositoryLock(config, tools, branch, options);
+  await withRepositoryMutationLock(
+    config.repoRoot,
+    () => runRmOneUnderRepositoryLock(config, tools, branch, options)
+  );
 }
 
 async function removeUncheckedSandbox(
@@ -998,7 +1002,16 @@ async function removeUncheckedSandbox(
     return null;
   }
 
+  const worktreePermits = options.permits ?? await authorizeWorktrees(
+    existingWorktrees,
+    { allowDirtyDiscard: true, assumeYes: Boolean(options.assumeYes) },
+    { ...options.prompt, interactive: options.interactive }
+  );
+
   for (const container of matchedContainers) runSafeEngine(engine, 'docker', ['rm', '-f', container]);
+  if (!sandboxContainersRemoved(engine, matchedContainers)) {
+    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+  }
   for (const root of controlRoots) {
     fs.rmSync(root, { recursive: true, force: true });
     removeEmptyManagedParent(path.join(config.controlBase, config.project), root);
@@ -1011,12 +1024,15 @@ async function removeUncheckedSandbox(
   for (const shell of shellConfigDirCandidates(config, effectiveBranch)) fs.rmSync(shell, { recursive: true, force: true });
   if (shouldRemoveShare) fs.rmSync(sharePath, { recursive: true, force: true });
   if (shouldRemoveWorktree) {
-    for (const worktree of existingWorktrees) fs.rmSync(worktree, { recursive: true, force: true });
-    runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
+    for (const worktree of existingWorktrees) {
+      const permit = worktreePermits.get(path.resolve(worktree));
+      if (!permit) throw new Error(`SANDBOX_WORKTREE_REMOVAL_PERMIT_MISSING: ${worktree}`);
+      removeWorktreeDir(config.repoRoot, config.worktreeBase, worktree, permit);
+    }
   }
-  if (shouldDeleteBranch) runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
-  if (!sandboxContainersRemoved(engine, matchedContainers)) {
-    throw new Error(`SANDBOX_REMOVAL_CONTAINER_STILL_PRESENT: ${matchedContainers.join(', ')}`);
+  if (shouldDeleteBranch) {
+    assertBranchRemovalIdentity(config, effectiveBranch, worktreePermits);
+    runSafe('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch]);
   }
   if (target.workspace.mode === 'task-bound') {
     releaseStaleShortIdRegistry(config.repoRoot, target.workspace.taskId);
@@ -1045,7 +1061,7 @@ async function rmPurge(
   tools: SandboxTool[],
   prompt: PromptDependencies = {}
 ): Promise<void> {
-  return rmPurgeCore(config, tools, prompt);
+  return withRepositoryMutationLock(config.repoRoot, () => rmPurgeCore(config, tools, prompt));
 }
 
 async function rmPurgeCore(