@fitlab-ai/agent-infra 0.11.7 → 0.11.9

package/dist/lib/sandbox/removal.js

@@ -8,7 +8,7 @@ import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedV
 import { pruneSandboxDanglingImages } from './image-prune.js';
 import { assertManagedPath, removeManagedDir, removeWorktreeDir } from './managed-fs.js';
 import { run, runEngine, runOk, runOkEngine, runSafe, runSafeEngine } from './shell.js';
-import { parseSandboxWorkspaceIdentity, resolveSandboxCleanupTarget, sameSandboxWorkspaceIdentity } from './workspace-identity.js';
+import { parseSandboxWorkspaceIdentity, resolveSandboxCleanupTarget, resolveSandboxTarget, sameSandboxWorkspaceIdentity } from './workspace-identity.js';
 import { sandboxControlPaths, sandboxWorkspaceViewPaths } from './workspace-view.js';
 import { advanceSandboxRemovalJournalToPhase, advanceSandboxRemovalJournalPhase, claimSandboxRemovalJournal, clearSandboxRemovalJournalRecord, isDefaultSandboxRemovalJournal, listSandboxRemovalJournals, removeSandboxControlRoot, readSandboxControlManifest, sandboxRemovalPhaseIndex } from './control/lifecycle.js';
 import { inspectSandboxControlContainer } from './control/container-identity.js';
@@ -792,38 +792,76 @@ async function rmPurgeCore(config, tools, prompt = {}) {
     p.outro(pc.green('All project sandboxes removed'));
 }
 async function rmUnbound(config, tools, options) {
-    return rmUnboundCore(config, tools, options);
+    return withRepositoryMutationLock(config.repoRoot, () => rmUnboundCore(config, tools, options));
 }
 async function rmUnboundCore(config, tools, options) {
     const engine = detectEngine(config);
     const listed = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config), { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) });
-    const rows = [...listed.running, ...listed.nonRunning];
+    const discovered = [...listed.running, ...listed.nonRunning];
+    const branchMismatches = [];
+    const classified = discovered.map((row) => {
+        if (!row.branch)
+            return { row, protected: true, cleanupTarget: null };
+        if (row.workspaceMode === 'task-bound' && row.taskId) {
+            try {
+                resolveSandboxTarget(row.taskId, config.repoRoot);
+                return { row, protected: true, cleanupTarget: null };
+            }
+            catch {
+                try {
+                    const cleanupTarget = resolveSandboxCleanupTarget(row.taskId, config.repoRoot, { allowProtected: true });
+                    if (cleanupTarget.taskState === 'blocked'
+                        || cleanupTarget.taskState === 'completed'
+                        || cleanupTarget.taskState === 'archive') {
+                        if (row.branch !== cleanupTarget.branch) {
+                            branchMismatches.push({ container: row.name, labelBranch: row.branch, taskBranch: cleanupTarget.branch });
+                            return { row, protected: true, cleanupTarget: null };
+                        }
+                        const activeBranchTarget = resolveSandboxTarget(cleanupTarget.branch, config.repoRoot);
+                        if (activeBranchTarget.workspace.mode === 'branch-only') {
+                            return { row, protected: false, cleanupTarget };
+                        }
+                    }
+                }
+                catch {
+                    // An unresolved task identity has no active short-id evidence, so keep it out of bulk cleanup.
+                }
+                return { row, protected: true, cleanupTarget: null };
+            }
+        }
+        if (row.workspaceMode !== 'branch-only')
+            return { row, protected: true, cleanupTarget: null };
+        const cleanupTarget = resolveSandboxCleanupTarget(row.branch, config.repoRoot);
+        return cleanupTarget.workspace.mode === 'branch-only'
+            ? { row, protected: false, cleanupTarget }
+            : { row, protected: true, cleanupTarget: null };
+    });
+    const protectedBranches = new Set(classified
+        .filter((entry) => entry.protected)
+        .map(({ row }) => row.branch));
+    const targets = classified
+        .filter((entry) => !entry.protected && !protectedBranches.has(entry.row.branch) && entry.cleanupTarget)
+        .map(({ row, cleanupTarget }) => ({
+        row,
+        cleanupTarget: cleanupTarget,
+        target: resolveRmTarget(config, tools, cleanupTarget, { discoveredContainers: [row.name] })
+    }));
     p.intro(pc.cyan(`Removing sandboxes for ${config.project}`));
+    for (const mismatch of branchMismatches) {
+        p.log.warn(`Skipping task-bound sandbox '${mismatch.container}': container branch '${mismatch.labelBranch}' differs from task record branch '${mismatch.taskBranch}'. Inspect the task record and container labels before retrying cleanup.`);
+    }
     if (options.dryRun) {
-        p.outro(`Dry run: ${rows.length} sandbox(es) found, nothing deleted`);
+        p.outro(`Dry run: ${targets.length} sandbox(es) found, nothing deleted`);
         return;
     }
-    for (const row of rows) {
-        if (!row.branch) {
-            runSafeEngine(engine, 'docker', ['rm', '-f', row.name]);
-            continue;
-        }
-        const cleanupTarget = {
-            requestedRef: row.branch,
-            branch: row.branch,
-            workspace: row.workspaceMode === 'task-bound' && row.taskId
-                ? { mode: 'task-bound', taskId: row.taskId }
-                : { mode: 'branch-only' },
-            taskState: 'branch-only'
-        };
-        const target = resolveRmTarget(config, tools, cleanupTarget, { discoveredContainers: [row.name] });
-        await rmOne(config, tools, cleanupTarget.branch, {
+    for (const { row, cleanupTarget, target } of targets) {
+        await runRmOneUnderRepositoryLock(config, tools, cleanupTarget.branch, {
             assumeYes: options.assumeYes,
             target,
             cleanupTarget
         });
     }
-    p.outro(pc.green(`Removed ${rows.length} sandbox(es)`));
+    p.outro(pc.green(`Removed ${targets.length} sandbox(es)`));
 }
 export { authorizeWorktrees, rmOne, rmPurge, rmUnbound };
 //# sourceMappingURL=removal.js.map

package/dist/lib/sandbox/tools.js

@@ -56,6 +56,15 @@ function asOptionalNonEmptyString(value, field, context) {
     }
     return value;
 }
+function asOptionalBoolean(value, field, context) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== 'boolean') {
+        throw new Error(`${context}: field "${field}" must be a boolean when provided`);
+    }
+    return value;
+}
 function asStringRecord(value, field, context) {
     if (value === undefined) {
         return undefined;
@@ -158,13 +167,14 @@ function parseTmpfs(value, context) {
     if (!isPlainObject(value)) {
         throw new Error(`${context}: field "tmpfs" must be an object when provided`);
     }
+    const exec = asOptionalBoolean(value.exec, 'tmpfs.exec', context);
     return {
         size: asOptionalNonEmptyString(value.size, 'tmpfs.size', context),
-        seed: asStringArray(value.seed, 'tmpfs.seed', context)
+        seed: asStringArray(value.seed, 'tmpfs.seed', context),
+        ...(exec === undefined ? {} : { exec })
     };
 }
-export function parseCustomTool(entry, index, options) {
-    const context = `customTools[${index}]`;
+export function parseCustomTool(entry, index, options, context = `customTools[${index}]`) {
     if (!isPlainObject(entry)) {
         throw new Error(`${context} must be an object`);
     }
@@ -177,6 +187,7 @@ export function parseCustomTool(entry, index, options) {
     if (!containerMount.startsWith('/')) {
         throw new Error(`${context}: field "containerMount" must be an absolute path`);
     }
+    const invoke = asOptionalNonEmptyString(entry.invoke, 'invoke', context);
     const tool = {
         id,
         name: asOptionalNonEmptyString(entry.name, 'name', context) ?? id,
@@ -186,6 +197,7 @@ export function parseCustomTool(entry, index, options) {
         versionCmd: asOptionalNonEmptyString(entry.versionCmd, 'versionCmd', context) ?? `which ${id}`,
         setupHint: asOptionalNonEmptyString(entry.setupHint, 'setupHint', context)
             ?? `Run \`${id}\` inside the container to set up.`,
+        ...(invoke === undefined ? {} : { invoke }),
         envVars: asStringRecord(entry.envVars, 'envVars', context),
         hostPreSeedFiles: parseHostPreSeedFiles(entry.hostPreSeedFiles, context),
         hostPreSeedDirs: parseHostPreSeedDirs(entry.hostPreSeedDirs, context),
@@ -198,13 +210,25 @@ export function parseCustomTool(entry, index, options) {
     return tool;
 }
 export function parseCustomTools(value, options) {
-    if (value === undefined || value === null) {
+    if (value === undefined) {
         return [];
     }
-    if (!Array.isArray(value)) {
-        throw new Error('sandbox: "customTools" must be an array');
+    if (!isPlainObject(value)) {
+        throw new Error('sandbox.tools.definitions must be an object');
     }
-    return value.map((entry, index) => parseCustomTool(entry, index, options));
+    return Object.entries(value).map(([id, definition], index) => {
+        const context = `sandbox.tools.definitions.${id}`;
+        if (!TOOL_ID_PATTERN.test(id)) {
+            throw new Error(`${context}: tool id must match ${TOOL_ID_PATTERN.source}`);
+        }
+        if (!isPlainObject(definition)) {
+            throw new Error(`${context} must be an object`);
+        }
+        if (Object.hasOwn(definition, 'id')) {
+            throw new Error(`${context}.id is not allowed; the definition key is the tool id`);
+        }
+        return parseCustomTool({ ...definition, id }, index, options, context);
+    });
 }
 export function resolveTools(config) {
     return [...createSandboxCapabilityPlan(config).tools];

package/dist/lib/task/activity-intent.js

@@ -11,6 +11,7 @@ const REVIEW_ACTION_RE = /^Review PR \(Round ([1-9]\d*)\)( \[started\])?$/;
 const VERDICTS = new Set(['approved', 'changes-requested', 'commented']);
 const OUTCOMES = new Set(['aborted', 'superseded']);
 const SUCCESS_STATUSES = new Set(['applied', 'no-op']);
+const LOCAL_COMPLETION_STATUSES = new Set(['applied', 'no-op', 'blocked', 'failed']);
 const ARTIFACT_STATUSES = new Set([
     'pending', 'applied', 'no-op', 'blocked', 'failed', 'aborted', 'superseded'
 ]);
@@ -102,7 +103,7 @@ function readSnapshot(taskRef, repoRoot) {
         }
         if (terminal.length === 1) {
             const note = terminal[0].note;
-            const terminalMatchesStatus = (note.startsWith('Verdict: ') && SUCCESS_STATUSES.has(parsed.status))
+            const terminalMatchesStatus = (note.startsWith('Verdict: ') && LOCAL_COMPLETION_STATUSES.has(parsed.status))
                 || (note.startsWith('Outcome: Aborted, ') && parsed.status === 'aborted')
                 || (note.startsWith('Outcome: Superseded, ') && parsed.status === 'superseded')
                 || (note.startsWith('receipt ') && SUCCESS_STATUSES.has(parsed.status));
@@ -233,8 +234,8 @@ function applyLocked(intent, normalizedAgent, options) {
         if (roundState.startedAgent === null) {
             return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${base} has no matching started row`, state.taskId);
         }
-        if (intent.kind === 'pr-review-complete' && !SUCCESS_STATUSES.has(roundState.status)) {
-            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${intent.artifact} must be applied or no-op before completion`, state.taskId);
+        if (intent.kind === 'pr-review-complete' && !LOCAL_COMPLETION_STATUSES.has(roundState.status)) {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${intent.artifact} must record a publication outcome before completion`, state.taskId);
         }
         if (intent.kind === 'pr-review-terminate' && roundState.status !== intent.outcome) {
             return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${intent.artifact} status must match outcome ${intent.outcome}`, state.taskId);

package/dist/lib/task/create-service.js

@@ -3,6 +3,7 @@ import { createPlatformIssue, syncPlatformIssue } from '../platform/issues.js';
 import { VERSION } from '../version.js';
 import { applyWorkflowWarningIntent } from './workflow-warning-intents.js';
 import { createLocalTask } from './create.js';
+import { TaskExecutionLockError } from './task-execution-lock.js';
 import { verifyTaskEvent } from './verification.js';
 const DEFAULT_DEPENDENCIES = {
     createIssue: createPlatformIssue,
@@ -151,8 +152,9 @@ async function createTask(value, options) {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_FAILED';
-        return taskCreateFailure({ code, message, retryable: code === 'TASK_CREATE_LOCK_TIMEOUT' });
+        const lockBusy = error instanceof TaskExecutionLockError && error.code === 'ORCHESTRATION_LOCK_BUSY';
+        const code = lockBusy ? error.code : /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_FAILED';
+        return taskCreateFailure({ code, message, retryable: lockBusy || code === 'TASK_CREATE_LOCK_TIMEOUT' });
     }
     const operations = [{
             name: 'task:local', status: local.status, reasonCode: null
@@ -203,7 +205,7 @@ async function createTask(value, options) {
                 task: local.task, issue, operations, warnings: [], error: verified.error
             };
         return {
-            status: platformFailure.status === 'blocked' ? 'blocked' : 'degraded',
+            status: 'degraded',
             changed: local.changed,
             task: local.task,
             issue,

package/dist/lib/task/create.js

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { isValidAgentInfraVersion, VERSION } from '../version.js';
 import { loadShortIdByTaskId, mutateShortIdRegistry } from './short-id.js';
-import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
+import { TaskExecutionLockError, withRepositoryMutationLock, withTaskExecutionLock } from './task-execution-lock.js';
 import { readDeliveryDefaults, validateBaseRef, validateRemote } from './delivery-target.js';
 import { buildUnboundFact, encodePrDeliveryFact } from './pr-delivery-fact.js';
 import { CANDIDATE_COLUMNS, CONSTRAINT_COLUMNS, parseTaskQualification } from './qualification-audit.js';
@@ -375,7 +375,7 @@ function createLocalTask(value, options) {
     const canonical = canonicalTaskCreateCandidate(candidate);
     const candidateDigest = sha256(canonical);
     const keyDigest = sha256(candidate.idempotencyKey);
-    return withCreateLock(repoRoot, projectConfig.project, () => {
+    function createUnderRepositoryLock() {
         const recovered = recoverPublishedTask(repoRoot, keyDigest, candidateDigest);
         if (recovered) {
             return { status: 'no-op', changed: false, task: { id: recovered.taskId, shortId: recovered.shortId, state: recovered.state } };
@@ -402,12 +402,29 @@ function createLocalTask(value, options) {
         fs.writeFileSync(path.join(temporary, 'task.md'), rendered, { flag: 'wx', mode: 0o600 });
         const destination = path.join(activeRoot, taskId);
         fs.renameSync(temporary, destination);
-        let shortId;
         const allocated = mutateShortIdRegistry(repoRoot, taskId, 'alloc');
         if (!allocated.shortId)
             throw new Error('TASK_CREATE_SHORT_ID_FAILED');
-        shortId = allocated.shortId;
-        return { status: 'applied', changed: true, task: { id: taskId, shortId, state: 'active' } };
+        return { status: 'applied', changed: true, task: { id: taskId, shortId: allocated.shortId, state: 'active' } };
+    }
+    return withCreateLock(repoRoot, projectConfig.project, () => {
+        let callbackError;
+        try {
+            return withRepositoryMutationLock(repoRoot, () => {
+                try {
+                    return createUnderRepositoryLock();
+                }
+                catch (error) {
+                    callbackError = error;
+                    throw error;
+                }
+            });
+        }
+        catch (error) {
+            if (callbackError !== undefined)
+                throw callbackError;
+            throw error;
+        }
     });
 }
 export { canonicalTaskCreateCandidate, createLocalTask, validateTaskCreateCandidate };

package/dist/lib/task/finalization-artifacts.js

@@ -5,7 +5,10 @@ const COMPLETION_BACKFILL_FAMILIES = [
     'plan',
     'review-plan',
     'code',
-    'review-code'
+    'review-code',
+    'manual-validation',
+    'validation-run',
+    'pr-review'
 ];
 function inspectCompletionArtifacts(taskRef, options = {}) {
     const artifacts = [];