@fitlab-ai/agent-infra 0.11.7 → 0.11.9

package/lib/platform/pull-requests.ts

@@ -1,6 +1,7 @@
 import { normalizePullRequest, type RemotePullRequest } from './github-data.ts';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 
 import { parseTypedTaskFrontmatter } from '../task/frontmatter.ts';
@@ -41,6 +42,8 @@ import {
 import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber, serializeResourceIdentity } from './resource-identity.ts';
 import type { ResourceIdentity } from './resource-identity.ts';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.ts';
+import { coordinatePlatformWrite } from './operation-coordinator.ts';
+import type { PlatformPullRequestIntent } from '../task/platform-operation-journal.ts';
 import type { ChangeRequestSnapshot as ProviderChangeRequestSnapshot, IssueSnapshot as ProviderIssueSnapshot } from './provider-contract.ts';
 
 type PullRequestSnapshot = PlatformChangeRequestSnapshot;
@@ -63,7 +66,7 @@ type PullRequestResult = PlatformResult & {
   }>;
 };
 type InspectionOptions = { cwd?: string; client?: PlatformClient; runtimeVersion?: string };
-type SharedOptions = { cwd?: string; client?: PlatformClient; runtimeVersion?: string };
+type SharedOptions = { cwd?: string; client?: PlatformClient; runtimeVersion?: string; skipQueue?: boolean };
 type CreateOptions = SharedOptions & {
   agent: string;
   base: string;
@@ -137,6 +140,30 @@ function withCreation(output: PullRequestResult, creation: CreationOutcome): Pul
   return { ...output, creation };
 }
 
+async function journalPullRequestOperation(
+  taskRef: string,
+  options: SharedOptions & { agent: string; dryRun?: boolean },
+  intent: PlatformPullRequestIntent,
+  target: string,
+  identityInput: unknown,
+  execute: () => Promise<PullRequestResult>
+): Promise<PullRequestResult> {
+  if (options.dryRun) return execute();
+  const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+  if (!resolved.ok) return execute();
+  const expectedDigest = createHash('sha256').update(JSON.stringify({ taskId: resolved.taskId, intent, identityInput })).digest('hex');
+  const operation = { kind: 'pull-request' as const, target: intent.action === 'sync' ? `bound-pr:${resolved.taskId}` : target, expectedDigest };
+  const dependency = intent.action === 'sync' ? 'deferred' : 'required';
+  if (options.skipQueue) return execute();
+  return coordinatePlatformWrite({
+    operation: { taskRef: resolved.taskId, cwd: resolved.repoRoot, ...operation, pullRequest: intent, dependency },
+    agent: options.agent,
+    execute,
+    block: (error) => result('blocked', resolved.taskId, null, null, { error }),
+    persistenceFailure: (error) => result('failed', resolved.taskId, null, null, { error })
+  });
+}
+
 const PRECONDITION_NOT_CREATED: CreationOutcome = {
   kind: 'not-created', reason: 'precondition-failed', createdByCurrentOperation: false
 };
@@ -851,7 +878,7 @@ function bindIdentity(
   }, { repoRoot: base.resolved.repoRoot, metadataProvider: () => metadata });
 }
 
-async function bindPlatformPullRequest(taskRef: string, options: BindOptions): Promise<PullRequestResult> {
+async function bindPlatformPullRequestImpl(taskRef: string, options: BindOptions): Promise<PullRequestResult> {
   const base = await resolvedContext(taskRef, options);
   if (!base.ok) return base.output;
   if (!base.fact) return result('failed', base.resolved.taskId, base.issueNumber, null, {
@@ -884,6 +911,12 @@ async function bindPlatformPullRequest(taskRef: string, options: BindOptions): P
   });
 }
 
+async function bindPlatformPullRequest(taskRef: string, options: BindOptions): Promise<PullRequestResult> {
+  const intent: PlatformPullRequestIntent = { action: 'bind', prToken: String(options.pr) };
+  return journalPullRequestOperation(taskRef, options, intent, `pr:${options.pr}`, { pr: String(options.pr) },
+    () => bindPlatformPullRequestImpl(taskRef, options));
+}
+
 function externalEvidenceNote(
   issueIdentity: ResourceIdentity | null,
   source: 'unique' | 'explicit',
@@ -1077,7 +1110,7 @@ async function resolveExternalPullRequest(taskRef: string, options: ResolveExter
   }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selectedPullRequest });
 }
 
-async function createPlatformPullRequest(taskRef: string, options: CreateOptions): Promise<PullRequestResult> {
+async function createPlatformPullRequestImpl(taskRef: string, options: CreateOptions): Promise<PullRequestResult> {
   const base = await resolvedContext(taskRef, options);
   if (!base.ok) return withCreation(base.output, PRECONDITION_NOT_CREATED);
   if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) {
@@ -1112,6 +1145,66 @@ async function createPlatformPullRequest(taskRef: string, options: CreateOptions
   }
 }
 
+async function recoverCreatedPullRequest(
+  taskRef: string,
+  options: SharedOptions & { agent: string; base: string; head: string }
+): Promise<PullRequestResult> {
+  const base = await resolvedContext(taskRef, options);
+  if (!base.ok) return base.output;
+  if (!base.issueIdentity) return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    error: { code: 'PLATFORM_OPERATION_ISSUE_REQUIRED', message: 'Pull-request recovery requires a bound Issue identity', retryable: false }
+  });
+  const head = base.provider.changeRequests?.verifyHead
+    ? await base.provider.changeRequests.verifyHead({ context: providerOperationContext(base.loadedContext), head: options.head })
+    : unsupportedProviderOperation(base.provider, 'changeRequests.verifyHead');
+  if (!head.ok) return providerPullRequestError(base, head.error, base.prNumber);
+  if (base.prIdentity) {
+    const inspected = await inspectExternalPullRequest(base, base.prIdentity);
+    if (!inspected.pullRequest || inspected.status === 'failed' || inspected.status === 'blocked'
+      || inspected.pullRequest.base.repository !== base.context.platform.repository
+      || inspected.pullRequest.base.ref !== options.base || inspected.pullRequest.head.ref !== options.head
+      || inspected.pullRequest.head.sha !== head.value.sha) {
+      return result('blocked', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        error: inspected.error ?? { code: 'PLATFORM_OPERATION_PR_NOT_CONFIRMED', message: 'Bound pull request does not match the pending create intent', retryable: true }
+      });
+    }
+    return inspected;
+  }
+  const candidates = base.provider.changeRequests?.listClosing
+    ? await base.provider.changeRequests.listClosing({ context: providerOperationContext(base.loadedContext), issue: base.issueIdentity })
+    : unsupportedProviderOperation(base.provider, 'changeRequests.listClosing');
+  if (!candidates.ok) return providerPullRequestError(base, candidates.error, null);
+  const matches = candidates.value.map((candidate) => normalizeProviderPullRequest(candidate, base.context.platform.repository!, candidate.number || 0))
+    .filter((candidate) => candidate.base.repository === base.context.platform.repository
+      && candidate.base.ref === options.base
+      && candidate.head.repository === base.context.platform.repository
+      && candidate.head.ref === options.head
+      && candidate.head.sha === head.value.sha);
+  if (matches.length !== 1 || !matches[0]?.number) return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+    error: { code: matches.length > 1 ? 'PLATFORM_OPERATION_PR_AMBIGUOUS' : 'PLATFORM_OPERATION_PR_NOT_CONFIRMED',
+      message: 'Pending pull-request creation does not resolve to one exact repository/base/head identity', retryable: true }
+  });
+  const bound = await bindPlatformPullRequest(base.resolved.taskId, { agent: options.agent, cwd: base.resolved.repoRoot, pr: matches[0].number });
+  if (!bound.pullRequest || (bound.status !== 'applied' && bound.status !== 'no-op') || bound.error) return bound;
+  if (bound.pullRequest.base.repository !== base.context.platform.repository || bound.pullRequest.base.ref !== options.base
+    || bound.pullRequest.head.repository !== base.context.platform.repository || bound.pullRequest.head.ref !== options.head
+    || bound.pullRequest.head.sha !== head.value.sha) return result('blocked', base.resolved.taskId, base.issueNumber, bound.task.prNumber, {
+    error: { code: 'PLATFORM_OPERATION_PR_NOT_CONFIRMED', message: 'Bound pull request changed while recovering the create intent', retryable: true }
+  });
+  return bound;
+}
+
+async function createPlatformPullRequest(taskRef: string, options: CreateOptions): Promise<PullRequestResult> {
+  const intent: PlatformPullRequestIntent = { action: 'create', baseRef: options.base, headRef: options.head };
+  const identityInput = {
+    title: createHash('sha256').update(options.title).digest('hex'),
+    body: createHash('sha256').update(options.body).digest('hex'),
+    draft: options.draft === true
+  };
+  return journalPullRequestOperation(taskRef, options, intent, `head:${options.head}:base:${options.base}`, identityInput,
+    () => createPlatformPullRequestImpl(taskRef, options));
+}
+
 async function createExternalPullRequest(
   taskRef: string,
   options: CreateOptions,
@@ -1266,7 +1359,7 @@ async function createExternalPullRequest(
   }), { kind: 'created', createdByCurrentOperation: true });
 }
 
-async function syncPlatformPullRequest(taskRef: string, options: SyncOptions): Promise<PullRequestResult> {
+async function syncPlatformPullRequestImpl(taskRef: string, options: SyncOptions): Promise<PullRequestResult> {
   const warningResult = warningResultForPrimary(options.primaryResult);
   const softenFailure = (output: PullRequestResult): PullRequestResult => {
     const authorityError = output.error?.code.startsWith('IN_LABEL_SYNC') || output.error?.code.startsWith('PR_IDENTITY');
@@ -1430,6 +1523,13 @@ async function syncPlatformPullRequest(taskRef: string, options: SyncOptions): P
   }
 }
 
+async function syncPlatformPullRequest(taskRef: string, options: SyncOptions): Promise<PullRequestResult> {
+  const intent: PlatformPullRequestIntent = { action: 'sync', metadata: options.metadata === true, closingIssue: options.closingIssue === true };
+  return journalPullRequestOperation(taskRef, options, intent, `bound-pr:${taskRef}`, {
+    metadata: options.metadata === true, closingIssue: options.closingIssue === true
+  }, () => syncPlatformPullRequestImpl(taskRef, options));
+}
+
 function readProjectPrFlow(repoRoot: string): 'required' | 'disabled' | undefined {
   try {
     const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8')) as { prFlow?: unknown };
@@ -1527,6 +1627,6 @@ async function skipPlatformPullRequestFact(taskRef: string, options: SkipFactOpt
   }
 }
 
-export { bindPlatformPullRequest, createPlatformPullRequest, inspectPlatformPullRequest, inspectPlatformPullRequestByNumber, resolveExternalPullRequest, skipPlatformPullRequestFact, selectExternalPullRequest, selectPullRequest, syncPlatformPullRequest, syncPlatformPullRequestInLabels };
+export { bindPlatformPullRequest, createPlatformPullRequest, inspectPlatformPullRequest, inspectPlatformPullRequestByNumber, recoverCreatedPullRequest, resolveExternalPullRequest, skipPlatformPullRequestFact, selectExternalPullRequest, selectPullRequest, syncPlatformPullRequest, syncPlatformPullRequestInLabels };
 export type { BindOptions, CreateOptions, ExternalPullRequestResult, ExternalPullRequestSelection, PullRequestPrimaryResult, PullRequestResult, PullRequestSnapshot, ResolveExternalOptions, SkipFactOptions, SyncOptions };
 export { warningResultForPrimary };

package/lib/sandbox/commands/create.ts

@@ -83,6 +83,7 @@ import { atomicWriteJson } from '../control/state.ts';
 import { inspectSandboxControlContainer } from '../control/container-identity.ts';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.ts';
 import { sandboxCoreBindMounts } from '../mounts.ts';
+import { materializeSandboxGitMetadata } from '../git-metadata.ts';
 import {
   assertSandboxTaskSource,
   finalizeSandboxControlManifest,
@@ -950,9 +951,10 @@ function runSandboxAuthoritySafeCommand(
 
 // `docker run` args for mounting a tool's containerMount as an in-container
 // tmpfs. containerMount is an in-container path, so it is NOT engine-converted.
-export function buildTmpfsRunArgs(containerMount: string, tmpfs: { size?: string }): string[] {
+export function buildTmpfsRunArgs(containerMount: string, tmpfs: { size?: string; exec?: boolean }): string[] {
   const size = tmpfs.size ?? '512m';
-  return ['--tmpfs', `${containerMount}:rw,size=${size}`];
+  const options = ['rw', ...(tmpfs.exec ? ['exec'] : []), `size=${size}`];
+  return ['--tmpfs', `${containerMount}:${options.join(',')}`];
 }
 
 export function buildImage(
@@ -1459,6 +1461,7 @@ export async function create(
               engine,
               replacementLease,
             });
+            const gitMetadata = materializeSandboxGitMetadata(worktree, control.channelDir);
             hostShellConfig = prepareHostShellConfig({
               home: effectiveConfig.home,
               project: effectiveConfig.project,
@@ -1466,6 +1469,8 @@ export async function create(
               repoRoot: effectiveConfig.repoRoot
             });
             const coreVolumes = sandboxCoreBindMounts(effectiveConfig, branch, {
+              gitCommonDir: gitMetadata.commonDir,
+              worktreeGitFile: gitMetadata.worktreeGitFile,
               worktree,
               shellConfigHostDir: hostShellConfig.hostDir,
               workspaceViewRoot: workspaceView.root,
@@ -1572,12 +1577,6 @@ export async function create(
               `${sandboxRuntimeCapabilityLabel(effectiveConfig)}=${capabilityPlan.runtimeSignature}`,
               ...coreVolumes,
               ...buildClipboardVolumeArgs(engine, effectiveConfig.home),
-              '-v',
-              volumeArg(
-                engine,
-                path.join(effectiveConfig.repoRoot, '.git'),
-                `${toEnginePath(engine, effectiveConfig.repoRoot)}/.git`
-              ),
               ...dotfilesMount,
               ...toolVolumes,
               ...tmpfsArgs,

package/lib/sandbox/commands/ls.ts

@@ -22,8 +22,9 @@ display-only row number; the 'SHORT' column shows the active task short
 id bound to each container's branch (via
 .agents/workspace/active/.short-ids.json), or '-' if no active task is
 bound. Pass the SHORT value to "ai sandbox exec" (e.g. 'ai sandbox exec 11').
-A '-' means no active task is bound to that branch, so the sandbox is free
-to remove with "ai sandbox rm <branch>".
+A SHORT value of '-' means this container has no active task short id and may
+be eligible for "ai sandbox rm --unbound" cleanup. Use a full TASK-id to
+remove a specific task-bound sandbox.
 
 Use "ai sandbox show <ref>" for a single sandbox's worktree and per-tool
 state paths.`;
@@ -97,7 +98,7 @@ export function ls(args: string[] = []): void {
     }
     if (tableRows.some((r) => r.shortId === '-')) {
       process.stdout.write(
-        `  SHORT '-' = no active task bound; that sandbox is free to remove with 'ai sandbox rm <branch>'.\n`
+        `  SHORT '-' = no active task short id is displayed; --unbound may clean this sandbox if its branch is not tied to an active task.\n`
       );
     }
   }

package/lib/sandbox/commands/rm.ts

@@ -14,7 +14,7 @@ import { rmOne, rmPurge, rmUnbound } from '../removal.ts';
 
 const USAGE = `Usage:
   ai sandbox rm <branch | TASK-id | short id> Remove one sandbox; use a full TASK-id for a task-bound sandbox and a branch for branch-only sandboxes
-  ai sandbox rm --unbound [--dry-run] [--yes] Remove discovered task-bound and branch-only sandboxes
+  ai sandbox rm --unbound [--dry-run] [--yes] Remove sandboxes not bound to an active task short id
   ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;
 
 function resolveMissingTaskSandboxBranch(taskId: string, config: ReturnType<typeof loadConfig>): string | null {

package/lib/sandbox/config.ts

@@ -32,7 +32,7 @@ type WriteStderr = (chunk: string) => unknown;
 type SandboxConfigInput = {
   engine?: SandboxEngineInput;
   runtimes?: string[];
-  tools?: string[];
+  tools?: unknown;
   customTools?: unknown;
   refreshIntervalDays?: unknown;
   dockerfile?: string | null;
@@ -115,10 +115,22 @@ function resolveSandboxToolIds(
   sandbox: SandboxConfigInput,
   defaults: readonly string[]
 ): string[] {
-  if (Array.isArray(sandbox.tools)) {
-    return sandbox.tools.filter((tool): tool is string => typeof tool === 'string');
+  if (sandbox.tools === undefined) {
+    return [...defaults];
   }
-  return [...defaults];
+  if (typeof sandbox.tools !== 'object' || sandbox.tools === null || Array.isArray(sandbox.tools)) {
+    throw new Error('sandbox.tools must be an object when configured');
+  }
+  const tools = sandbox.tools as Record<string, unknown>;
+  if (!Array.isArray(tools.ids)) {
+    throw new Error('sandbox.tools.ids must be an array');
+  }
+  return tools.ids.map((id, index) => {
+    if (typeof id !== 'string') {
+      throw new Error(`sandbox.tools.ids[${index}] must be a string`);
+    }
+    return id;
+  });
 }
 
 export function loadConfig({
@@ -180,7 +192,13 @@ export function loadConfig({
     }
   }
 
-  const customTools = parseCustomTools(sandbox.customTools, { home });
+  const toolsConfig = sandbox.tools && typeof sandbox.tools === 'object' && !Array.isArray(sandbox.tools)
+    ? sandbox.tools as Record<string, unknown>
+    : undefined;
+  if (sandbox.customTools !== undefined) {
+    throw new Error('sandbox.customTools is no longer supported; use sandbox.tools.definitions');
+  }
+  const customTools = parseCustomTools(toolsConfig?.definitions, { home });
   const tools = resolveSandboxToolIds(sandbox, defaults.tools);
 
   return {

package/lib/sandbox/git-metadata.ts

@@ -0,0 +1,66 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+export const SANDBOX_GIT_COMMON_DIR = '/run/agent-infra/git';
+
+export type SandboxGitMetadata = Readonly<{
+  commonDir: string;
+  worktreeGitFile: string;
+  worktreeGitFileContent: string;
+}>;
+
+function gitText(worktreeRoot: string, args: string[]): string {
+  const env = { ...process.env };
+  for (const key of [
+    'GIT_DIR',
+    'GIT_COMMON_DIR',
+    'GIT_WORK_TREE',
+    'GIT_INDEX_FILE',
+    'GIT_PREFIX',
+    'GIT_NAMESPACE',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_CEILING_DIRECTORIES',
+    'GIT_DISCOVERY_ACROSS_FILESYSTEM'
+  ]) {
+    delete env[key];
+  }
+  return execFileSync('git', ['-C', worktreeRoot, ...args], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    env
+  }).trim();
+}
+
+export function resolveSandboxGitMetadata(
+  worktreeRoot: string,
+  controlDir: string
+): SandboxGitMetadata {
+  const commonDir = fs.realpathSync.native(gitText(worktreeRoot, [
+    'rev-parse', '--path-format=absolute', '--git-common-dir'
+  ]));
+  const gitDir = fs.realpathSync.native(gitText(worktreeRoot, ['rev-parse', '--absolute-git-dir']));
+  const relativeGitDir = path.relative(commonDir, gitDir);
+  if (path.isAbsolute(relativeGitDir) || relativeGitDir.startsWith(`..${path.sep}`) || relativeGitDir === '..') {
+    throw new Error('SANDBOX_GIT_METADATA_INVALID: worktree git directory is outside its common directory');
+  }
+
+  const containerGitDir = relativeGitDir === '.'
+    ? SANDBOX_GIT_COMMON_DIR
+    : path.posix.join(SANDBOX_GIT_COMMON_DIR, ...relativeGitDir.split(path.sep));
+  return {
+    commonDir,
+    worktreeGitFile: path.join(controlDir, 'workspace.git'),
+    worktreeGitFileContent: `gitdir: ${containerGitDir}\n`
+  };
+}
+
+export function materializeSandboxGitMetadata(
+  worktreeRoot: string,
+  controlDir: string
+): SandboxGitMetadata {
+  const metadata = resolveSandboxGitMetadata(worktreeRoot, controlDir);
+  fs.mkdirSync(controlDir, { recursive: true });
+  fs.writeFileSync(metadata.worktreeGitFile, metadata.worktreeGitFileContent, 'utf8');
+  return metadata;
+}

package/lib/sandbox/index.ts

@@ -20,7 +20,7 @@ Commands:
   rm <branch | TASK-id> | --unbound | --purge
                                Remove one sandbox; use a full TASK-id for task-bound
                                cleanup and a branch for branch-only cleanup. --unbound
-                               removes discovered task-bound and branch-only sandboxes.
+                               removes sandboxes not bound to an active task short id.
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure

package/lib/sandbox/mounts.ts

@@ -7,6 +7,7 @@ import {
 } from './constants.ts';
 import type { SandboxConfig } from './config.ts';
 import { sandboxWorkspaceViewStatePaths } from './workspace-view.ts';
+import { SANDBOX_GIT_COMMON_DIR } from './git-metadata.ts';
 
 export type SandboxBindMountDeclaration = {
   hostPaths: string[];
@@ -26,6 +27,8 @@ export function sandboxCoreBindMounts(
     workspaceViewRoot: string;
     controlDir: string;
     controlStatusDir: string;
+    gitCommonDir?: string;
+    worktreeGitFile?: string;
     runtimeDir?: string;
     taskSources?: string[];
     taskId?: string;
@@ -46,7 +49,17 @@ export function sandboxCoreBindMounts(
           readOnly: true
         }
   );
+  if (Boolean(overrides.gitCommonDir) !== Boolean(overrides.worktreeGitFile)) {
+    throw new Error('SANDBOX_GIT_METADATA_INCOMPLETE');
+  }
+  const gitCommonMount = overrides.gitCommonDir
+    ? { hostPaths: [overrides.gitCommonDir], containerPath: SANDBOX_GIT_COMMON_DIR, readOnly: false }
+    : null;
+  const worktreeGitFileMount = overrides.worktreeGitFile
+    ? { hostPaths: [overrides.worktreeGitFile], containerPath: '/workspace/.git', readOnly: true }
+    : null;
   const mounts: SandboxBindMountDeclaration[] = [
+    ...(gitCommonMount ? [gitCommonMount] : []),
     {
       hostPaths: overrides.worktree
         ? [overrides.worktree]
@@ -54,6 +67,7 @@ export function sandboxCoreBindMounts(
       containerPath: '/workspace',
       readOnly: false
     },
+    ...(worktreeGitFileMount ? [worktreeGitFileMount] : []),
     ...workspaceMounts,
   ];
   if (taskBound) {

package/lib/sandbox/recovery.ts

@@ -8,12 +8,10 @@ import {
   containerNameCandidates,
   sandboxBranchLabel,
   sandboxLabel,
-  sandboxRuntimeCapabilityLabel,
   sandboxTaskIdLabel,
   sandboxWorkspaceModeLabel,
   worktreeDirCandidates
 } from './constants.ts';
-import { isAgentClientId } from '../agent-clients/types.ts';
 import {
   createSandboxCapabilityPlan
 } from './agent-client-reconciler.ts';
@@ -24,6 +22,7 @@ import type {
 import type { SandboxConfig } from './config.ts';
 import { toEnginePath } from './engines/wsl2-paths.ts';
 import { sandboxCoreBindMounts } from './mounts.ts';
+import { resolveSandboxGitMetadata } from './git-metadata.ts';
 import {
   assertSandboxTaskSource,
   sandboxControlPaths,
@@ -99,8 +98,6 @@ export type SandboxRecoverySnapshot = {
   workspaceTopology?: 'legacy-parent' | 'per-state' | 'unknown';
   taskView?: { path: string; readable: boolean };
   runtimeStoreOk?: boolean;
-  runtimeCapabilityOk?: boolean;
-  unexpectedCapabilityMounts?: string[];
   mounts: Array<{
     path: string;
     expectedType: string;
@@ -451,12 +448,6 @@ export function classifySandboxRecovery(snapshot: SandboxRecoverySnapshot): Sand
         : `Container identity ${actualIdentity} on branch ${snapshot.actualBranch ?? 'unknown'} does not match requested ${expectedIdentity} on branch ${snapshot.expectedBranch}.`
     });
   }
-  if (snapshot.runtimeCapabilityOk === false) {
-    findings.push({
-      repairKind: 'hard-failure',
-      message: 'Container runtime capability signature does not match the current sandbox plan.'
-    });
-  }
   if (snapshot.workspaceTopology === 'legacy-parent') {
     findings.push({
       repairKind: 'hard-failure',
@@ -481,14 +472,6 @@ export function classifySandboxRecovery(snapshot: SandboxRecoverySnapshot): Sand
       path: '/run/agent-infra/runtime'
     });
   }
-  for (const mountPath of snapshot.unexpectedCapabilityMounts ?? []) {
-    findings.push({
-      repairKind: 'hard-failure',
-      message: `Disabled Agent Client capability remains mounted at ${mountPath}.`,
-      path: mountPath
-    });
-  }
-
   for (const mount of snapshot.mounts) {
     if (
       snapshot.workspaceTopology === 'legacy-parent'
@@ -764,7 +747,19 @@ function expectedMounts(params: {
     ? recoveryTaskSources(config.repoRoot, params.workspace.taskId)
     : null;
   const taskId = params.workspace.mode === 'task-bound' ? params.workspace.taskId : null;
+  const worktrees = worktreeDirCandidates(config, branch).filter((candidate) =>
+    fs.existsSync(path.join(candidate, '.git'))
+  );
+  const gitMetadata = worktrees.length === 1
+    ? resolveSandboxGitMetadata(worktrees[0]!, control.channelDir)
+    : null;
   const core = sandboxCoreBindMounts(config, branch, {
+    ...(gitMetadata === null
+      ? {}
+      : {
+        gitCommonDir: gitMetadata.commonDir,
+        worktreeGitFile: gitMetadata.worktreeGitFile
+      }),
     workspaceViewRoot: view.root,
     controlDir: control.channelDir,
     controlStatusDir: control.statusDir,
@@ -951,11 +946,6 @@ export function collectSandboxRecoverySnapshot(params: {
     mode: sandboxWorkspaceModeLabel(params.config),
     taskId: sandboxTaskIdLabel(params.config)
   });
-  const selectedToolIds = new Set(tools.map((tool) => tool.id));
-  const unexpectedCapabilityMounts = capabilityPlan.cleanupInventory
-    .filter((tool) => isAgentClientId(tool.id) && !selectedToolIds.has(tool.id))
-    .map((tool) => tool.containerMount)
-    .filter((mountPath) => mountsByDestination.has(mountPath));
   const mountSnapshots = expectedMounts({
     config: params.config,
     branch: params.branch,
@@ -1022,8 +1012,6 @@ export function collectSandboxRecoverySnapshot(params: {
     identityOk: typeof inspection.Id === 'string' && inspection.Id.length > 0
       && branchLabel === params.branch
       && sameSandboxWorkspaceIdentity(containerWorkspace, workspace),
-    runtimeCapabilityOk: labels[sandboxRuntimeCapabilityLabel(params.config)] === capabilityPlan.runtimeSignature,
-    unexpectedCapabilityMounts,
     mounts: mountSnapshots,
     tmpfs,
     seeds,

package/lib/sandbox/removal.ts

@@ -22,6 +22,7 @@ import { run, runEngine, runOk, runOkEngine, runSafe, runSafeEngine } from './sh
 import {
   parseSandboxWorkspaceIdentity,
   resolveSandboxCleanupTarget,
+  resolveSandboxTarget,
   sameSandboxWorkspaceIdentity,
   type SandboxCleanupTarget,
   type SandboxWorkspaceKey
@@ -1112,7 +1113,10 @@ async function rmUnbound(
   tools: SandboxTool[],
   options: { dryRun: boolean; assumeYes: boolean }
 ): Promise<void> {
-  return rmUnboundCore(config, tools, options);
+  return withRepositoryMutationLock(
+    config.repoRoot,
+    () => rmUnboundCore(config, tools, options)
+  );
 }
 
 async function rmUnboundCore(
@@ -1127,32 +1131,66 @@ async function rmUnboundCore(
     sandboxBranchLabel(config),
     { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) }
   );
-  const rows = [...listed.running, ...listed.nonRunning];
+  const discovered = [...listed.running, ...listed.nonRunning];
+  const branchMismatches: Array<{ container: string; labelBranch: string; taskBranch: string }> = [];
+  const classified = discovered.map((row) => {
+    if (!row.branch) return { row, protected: true, cleanupTarget: null };
+    if (row.workspaceMode === 'task-bound' && row.taskId) {
+      try {
+        resolveSandboxTarget(row.taskId, config.repoRoot);
+        return { row, protected: true, cleanupTarget: null };
+      } catch {
+        try {
+          const cleanupTarget = resolveSandboxCleanupTarget(row.taskId, config.repoRoot, { allowProtected: true });
+          if (cleanupTarget.taskState === 'blocked'
+            || cleanupTarget.taskState === 'completed'
+            || cleanupTarget.taskState === 'archive') {
+            if (row.branch !== cleanupTarget.branch) {
+              branchMismatches.push({ container: row.name, labelBranch: row.branch, taskBranch: cleanupTarget.branch });
+              return { row, protected: true, cleanupTarget: null };
+            }
+            const activeBranchTarget = resolveSandboxTarget(cleanupTarget.branch, config.repoRoot);
+            if (activeBranchTarget.workspace.mode === 'branch-only') {
+              return { row, protected: false, cleanupTarget };
+            }
+          }
+        } catch {
+          // An unresolved task identity has no active short-id evidence, so keep it out of bulk cleanup.
+        }
+        return { row, protected: true, cleanupTarget: null };
+      }
+    }
+    if (row.workspaceMode !== 'branch-only') return { row, protected: true, cleanupTarget: null };
+    const cleanupTarget = resolveSandboxCleanupTarget(row.branch, config.repoRoot);
+    return cleanupTarget.workspace.mode === 'branch-only'
+      ? { row, protected: false, cleanupTarget }
+      : { row, protected: true, cleanupTarget: null };
+  });
+  const protectedBranches = new Set(classified
+    .filter((entry) => entry.protected)
+    .map(({ row }) => row.branch));
+  const targets = classified
+    .filter((entry) => !entry.protected && !protectedBranches.has(entry.row.branch) && entry.cleanupTarget)
+    .map(({ row, cleanupTarget }) => ({
+      row,
+      cleanupTarget: cleanupTarget!,
+      target: resolveRmTarget(config, tools, cleanupTarget!, { discoveredContainers: [row.name] })
+    }));
   p.intro(pc.cyan(`Removing sandboxes for ${config.project}`));
+  for (const mismatch of branchMismatches) {
+    p.log.warn(`Skipping task-bound sandbox '${mismatch.container}': container branch '${mismatch.labelBranch}' differs from task record branch '${mismatch.taskBranch}'. Inspect the task record and container labels before retrying cleanup.`);
+  }
   if (options.dryRun) {
-    p.outro(`Dry run: ${rows.length} sandbox(es) found, nothing deleted`);
+    p.outro(`Dry run: ${targets.length} sandbox(es) found, nothing deleted`);
     return;
   }
-  for (const row of rows) {
-    if (!row.branch) {
-      runSafeEngine(engine, 'docker', ['rm', '-f', row.name]);
-      continue;
-    }
-    const cleanupTarget: SandboxCleanupTarget = {
-      requestedRef: row.branch,
-      branch: row.branch,
-      workspace: row.workspaceMode === 'task-bound' && row.taskId
-        ? { mode: 'task-bound', taskId: row.taskId }
-        : { mode: 'branch-only' },
-      taskState: 'branch-only'
-    };
-    const target = resolveRmTarget(config, tools, cleanupTarget, { discoveredContainers: [row.name] });
-    await rmOne(config, tools, cleanupTarget.branch, {
+  for (const { row, cleanupTarget, target } of targets) {
+    await runRmOneUnderRepositoryLock(config, tools, cleanupTarget.branch, {
       assumeYes: options.assumeYes,
       target,
       cleanupTarget
     });
   }
-  p.outro(pc.green(`Removed ${rows.length} sandbox(es)`));
+  p.outro(pc.green(`Removed ${targets.length} sandbox(es)`));
 }
 export { authorizeWorktrees, rmOne, rmPurge, rmUnbound };

package/lib/sandbox/tool-types.ts

@@ -10,13 +10,14 @@ type SandboxTool = {
   containerMount: string;
   versionCmd: string;
   setupHint: string;
+  invoke?: string;
   envVars?: Record<string, string>;
   hostPreSeedFiles?: Array<{ hostPath: string; sandboxName: string }>;
   hostPreSeedDirs?: Array<{ hostDir: string; sandboxSubdir: string }>;
   pathRewriteFiles?: string[];
   hostLiveMounts?: Array<{ hostPath: string; containerSubpath: string }>;
   postSetupCmds?: string[];
-  tmpfs?: { size?: string; seed?: string[] };
+  tmpfs?: { size?: string; seed?: string[]; exec?: boolean };
 };
 
 type SandboxAlias = Readonly<{