@fitlab-ai/agent-infra 0.11.9 → 0.11.10

package/dist/lib/task/commit-intent.js

@@ -1,11 +1,18 @@
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-function intentRoot(repoRoot) {
-    return path.join(repoRoot, '.agents', 'workspace', '.task-commit-intents');
+const MAX_INTENT_SIZE = 1024 * 1024;
+const TASK_ID_PATTERN = /^TASK-\d{8}-\d{6}$/;
+function intentPath(taskDir) {
+    return path.join(taskDir, '.checkpoint-intent.json');
 }
-function intentPath(repoRoot, taskId) {
-    return path.join(intentRoot(repoRoot), `${taskId}.json`);
+function assertTaskDirectory(taskDir, taskId) {
+    if (!TASK_ID_PATTERN.test(taskId) || path.basename(path.resolve(taskDir)) !== taskId) {
+        throw new Error('COMMIT_INTENT_INVALID: task directory does not match task ID');
+    }
+    const stat = fs.statSync(taskDir);
+    if (!stat.isDirectory())
+        throw new Error('COMMIT_INTENT_INVALID: task directory is not a directory');
 }
 function checkpointIntentDigest(identity) {
     return createHash('sha256').update(JSON.stringify({
@@ -23,8 +30,13 @@ function isIntent(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const intent = value;
+    const validState = ['prepared', 'committed', 'synced'].includes(String(intent.state));
+    const validHead = intent.committedHead === null
+        ? intent.state === 'prepared'
+        : typeof intent.committedHead === 'string' && /^[a-f0-9]{40,64}$/.test(intent.committedHead)
+            && intent.state !== 'prepared';
     return intent.version === 1
-        && typeof intent.taskId === 'string' && intent.taskId.length > 0
+        && typeof intent.taskId === 'string' && TASK_ID_PATTERN.test(intent.taskId)
         && typeof intent.branch === 'string' && intent.branch.length > 0
         && intent.mode === 'local'
         && typeof intent.expectedHead === 'string' && /^[a-f0-9]{40,64}$/.test(intent.expectedHead)
@@ -33,28 +45,57 @@ function isIntent(value) {
         && typeof intent.message === 'string' && intent.message.length > 0
         && Number.isSafeInteger(intent.round) && Number(intent.round) > 0
         && typeof intent.digest === 'string' && /^[a-f0-9]{64}$/.test(intent.digest)
-        && ['prepared', 'committed', 'synced'].includes(String(intent.state))
-        && (intent.committedHead === null || (typeof intent.committedHead === 'string' && /^[a-f0-9]{40,64}$/.test(intent.committedHead)))
+        && validState && validHead
         && typeof intent.createdAt === 'string' && intent.createdAt.length > 0
         && typeof intent.updatedAt === 'string' && intent.updatedAt.length > 0
         && intent.digest === checkpointIntentDigest(intent);
 }
-function readCheckpointIntent(repoRoot, taskId) {
-    const target = intentPath(repoRoot, taskId);
-    if (!fs.existsSync(target))
-        return null;
-    const value = JSON.parse(fs.readFileSync(target, 'utf8'));
-    if (!isIntent(value))
-        throw new Error('COMMIT_INTENT_INVALID: checkpoint intent schema is invalid');
-    return value;
+function invalidIntent() {
+    throw new Error('COMMIT_INTENT_INVALID: checkpoint intent schema is invalid');
+}
+function readCheckpointIntent(taskDir, taskId) {
+    assertTaskDirectory(taskDir, taskId);
+    const target = intentPath(taskDir);
+    let before;
+    try {
+        before = fs.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_INTENT_SIZE)
+        return invalidIntent();
+    let descriptor;
+    try {
+        const noFollow = typeof fs.constants.O_NOFOLLOW === 'number' ? fs.constants.O_NOFOLLOW : 0;
+        descriptor = fs.openSync(target, fs.constants.O_RDONLY | noFollow);
+        const opened = fs.fstatSync(descriptor);
+        if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino
+            || opened.size !== before.size || opened.size > MAX_INTENT_SIZE)
+            return invalidIntent();
+        const value = JSON.parse(fs.readFileSync(descriptor, 'utf8'));
+        if (!isIntent(value) || value.taskId !== taskId)
+            return invalidIntent();
+        return value;
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('COMMIT_INTENT_INVALID:'))
+            throw error;
+        return invalidIntent();
+    }
+    finally {
+        if (descriptor !== undefined)
+            fs.closeSync(descriptor);
+    }
 }
-function writeCheckpointIntent(repoRoot, value) {
+function writeCheckpointIntent(taskDir, value) {
+    assertTaskDirectory(taskDir, value.taskId);
     if (!isIntent(value))
-        throw new Error('COMMIT_INTENT_INVALID: checkpoint intent schema is invalid');
-    const directory = intentRoot(repoRoot);
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    const target = intentPath(repoRoot, value.taskId);
-    const temporary = `${target}.${process.pid}.${Date.now()}.tmp`;
+        return invalidIntent();
+    const target = intentPath(taskDir);
+    const temporary = `${target}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
     fs.writeFileSync(temporary, `${JSON.stringify(value)}\n`, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
     try {
         fs.renameSync(temporary, target);
@@ -75,10 +116,10 @@ function updateCheckpointIntent(value, patch) {
         throw new Error('COMMIT_INTENT_INVALID: committed intent requires a committed head');
     return next;
 }
-function removeCheckpointIntent(repoRoot, taskId) {
-    const target = intentPath(repoRoot, taskId);
+function removeCheckpointIntent(taskDir, taskId) {
+    assertTaskDirectory(taskDir, taskId);
     try {
-        fs.unlinkSync(target);
+        fs.unlinkSync(intentPath(taskDir));
     }
     catch (error) {
         if (error.code !== 'ENOENT')
@@ -96,5 +137,5 @@ function sameCheckpointIntent(left, right) {
         && left.round === right.round
         && JSON.stringify(left.paths) === JSON.stringify(right.paths);
 }
-export { checkpointIntentDigest, intentPath, intentRoot, isIntent, readCheckpointIntent, removeCheckpointIntent, sameCheckpointIntent, updateCheckpointIntent, writeCheckpointIntent };
+export { checkpointIntentDigest, intentPath, isIntent, readCheckpointIntent, removeCheckpointIntent, sameCheckpointIntent, updateCheckpointIntent, writeCheckpointIntent };
 //# sourceMappingURL=commit-intent.js.map

package/dist/lib/task/commit-operation.js

@@ -206,7 +206,7 @@ function executeUnlocked(input, task, mode) {
         ? (() => {
             const identity = checkpointIdentity(input, task, delivery);
             try {
-                pendingIntent = readCheckpointIntent(task.repoRoot, task.taskId);
+                pendingIntent = readCheckpointIntent(task.taskDir, task.taskId);
             }
             catch (error) {
                 return {
@@ -215,6 +215,11 @@ function executeUnlocked(input, task, mode) {
                 };
             }
             if (pendingIntent && !sameCheckpointIntent(pendingIntent, identity)) {
+                if (pendingIntent.state !== 'prepared')
+                    return {
+                        status: 'failed', changed: false, snapshot: inspected.snapshot, operations: [],
+                        error: { code: 'COMMIT_INTENT_INVALID', message: 'A committed checkpoint intent must be recovered with its original request' }
+                    };
                 const timestamp = checkpointTimestamp();
                 pendingIntent = {
                     version: 1, ...identity,
@@ -222,7 +227,7 @@ function executeUnlocked(input, task, mode) {
                     state: 'prepared', committedHead: null, createdAt: timestamp, updatedAt: timestamp
                 };
                 try {
-                    writeCheckpointIntent(task.repoRoot, pendingIntent);
+                    writeCheckpointIntent(task.taskDir, pendingIntent);
                 }
                 catch (error) {
                     return {
@@ -231,6 +236,12 @@ function executeUnlocked(input, task, mode) {
                     };
                 }
             }
+            if (pendingIntent && pendingIntent.state !== 'prepared'
+                && !checkpointCommitMatches(task.repoRoot, pendingIntent, pendingIntent.committedHead))
+                return {
+                    status: 'failed', changed: false, snapshot: inspected.snapshot, operations: [],
+                    error: { code: 'COMMIT_INTENT_INVALID', message: 'Committed checkpoint intent does not match its Git commit' }
+                };
             if (!pendingIntent) {
                 const timestamp = checkpointTimestamp();
                 pendingIntent = {
@@ -238,7 +249,7 @@ function executeUnlocked(input, task, mode) {
                     committedHead: null, createdAt: timestamp, updatedAt: timestamp
                 };
                 try {
-                    writeCheckpointIntent(task.repoRoot, pendingIntent);
+                    writeCheckpointIntent(task.taskDir, pendingIntent);
                 }
                 catch (error) {
                     return {
@@ -264,7 +275,7 @@ function executeUnlocked(input, task, mode) {
                 pendingIntent = updateCheckpointIntent(pendingIntent, {
                     state: 'committed', committedHead: checkpointCommittedHead, updatedAt: checkpointTimestamp()
                 });
-                writeCheckpointIntent(task.repoRoot, pendingIntent);
+                writeCheckpointIntent(task.taskDir, pendingIntent);
                 return {
                     status: 'no-op', changed: false, snapshot: inspected.snapshot,
                     operations: [{ name: 'commit', status: 'no-op' }], error: null
@@ -284,10 +295,10 @@ function executeUnlocked(input, task, mode) {
                 pendingIntent = updateCheckpointIntent(pendingIntent, {
                     state: 'committed', committedHead: checkpointCommittedHead, updatedAt: checkpointTimestamp()
                 });
-                writeCheckpointIntent(task.repoRoot, pendingIntent);
+                writeCheckpointIntent(task.taskDir, pendingIntent);
             }
             else if (created.status === 'no-op') {
-                removeCheckpointIntent(task.repoRoot, task.taskId);
+                removeCheckpointIntent(task.taskDir, task.taskId);
                 pendingIntent = null;
             }
             return created;
@@ -377,8 +388,8 @@ function executeUnlocked(input, task, mode) {
             const synced = updateCheckpointIntent(pendingIntent, {
                 state: 'synced', committedHead: checkpointCommittedHead, updatedAt: checkpointTimestamp()
             });
-            writeCheckpointIntent(task.repoRoot, synced);
-            removeCheckpointIntent(task.repoRoot, task.taskId);
+            writeCheckpointIntent(task.taskDir, synced);
+            removeCheckpointIntent(task.taskDir, task.taskId);
         }
     }
     return {

package/dist/lib/task/completion-facts.js

@@ -1,6 +1,6 @@
 import fs from 'node:fs';
 import { canonicalSemanticDigest } from './artifact-operations.js';
-import { inspectActivityLog } from './activity-log.js';
+import { inspectActivityLog, pairEntries } from './activity-log.js';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
 import { parseArtifactName } from './artifact-name.js';
 import { sha256File } from './artifact-receipts.js';
@@ -39,18 +39,40 @@ export function hasArtifactCompletionFact(taskContent, artifactPath, event) {
     }
 }
 export function hasArtifactCompletionLog(taskContent, artifact, event) {
+    return artifactCompletionOrder(taskContent, artifact, event) !== null;
+}
+/** Returns the stable Activity Log position of a paired completion row. */
+export function artifactCompletionOrder(taskContent, artifact, event) {
     const identity = parseArtifactName(artifact);
     if (!identity)
-        return false;
-    const action = event === 'review-code.completed' ? 'Review Code'
-        : event === 'review-plan.completed' ? 'Review Plan'
-            : event === 'review-analysis.completed' ? 'Review Analysis' : null;
-    if (!action)
-        return false;
+        return null;
+    const family = event === 'analysis.completed' || event === 'analyze.completed' ? 'analysis'
+        : event === 'review-analysis.completed' ? 'review-analysis'
+            : event === 'plan.completed' ? 'plan'
+                : event === 'review-plan.completed' ? 'review-plan'
+                    : event === 'code.completed' ? 'code'
+                        : event === 'review-code.completed' ? 'review-code' : null;
+    if (!family || family !== identity.family)
+        return null;
+    const action = family === 'analysis' ? 'Analyze Task'
+        : family === 'review-analysis' ? 'Review Analysis'
+            : family === 'plan' ? 'Plan Task'
+                : family === 'review-plan' ? 'Review Plan'
+                    : family === 'code' ? 'Code Task' : 'Review Code';
     const { section, invalidEntries } = inspectActivityLog(taskContent);
     if (!section || invalidEntries.length > 0)
-        return false;
-    const expected = `${action} (Round ${identity.round})`;
-    return section.entries.some((entry) => entry.step === expected && entry.note.includes(`→ ${artifact}`));
+        return null;
+    const ordered = section.entries.map((entry, sourceOrder) => ({ entry, sourceOrder }))
+        .sort((left, right) => Date.parse(left.entry.time.replace(' ', 'T')) - Date.parse(right.entry.time.replace(' ', 'T')) || left.sourceOrder - right.sourceOrder);
+    const entries = ordered.map(({ entry }) => entry);
+    const roundPattern = new RegExp(`^${action} \\(Round ${identity.round}(?:, [^)]+)?\\)$`);
+    const row = pairEntries(entries).find((candidate) => candidate.started !== ''
+        && candidate.done !== '' && roundPattern.test(candidate.step)
+        && candidate.note.includes(`→ ${artifact}`));
+    if (!row)
+        return null;
+    const doneIndex = ordered.findIndex(({ entry }) => entry.time === row.done
+        && entry.step === row.step && entry.note === row.note);
+    return doneIndex < 0 ? null : doneIndex;
 }
 //# sourceMappingURL=completion-facts.js.map

package/dist/lib/task/control-authority.js

@@ -4,7 +4,7 @@ import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { isAgentClientId } from '../agent-clients/types.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
 import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, awaitOrchestrationDelegationActivation, beginOrResumeOrchestration, dispatchOrchestrationDelegation, OrchestrationStateError, pauseOrchestration, prepareOrchestrationDelegation, recoverPreparedOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from './orchestration.js';
-import { applyTaskFinalization, commitPreparedTaskFinalization } from './finalization.js';
+import { applyTaskFinalization } from './finalization.js';
 import { applyTaskLifecycle, taskLifecycleFailure } from './lifecycle.js';
 import { resolveTaskRef, TASK_ID_RE } from './resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
@@ -434,12 +434,10 @@ export function dispatchTaskControlOperation(context, operation) {
     }
     if (operation.family === 'task-finalization') {
         operationTaskId(context, operation.request.taskRef);
-        const finalize = context.source === 'sandbox-executor' ? commitPreparedTaskFinalization : applyTaskFinalization;
-        return finalize(operation.request, {
+        return applyTaskFinalization(operation.request, {
             repoRoot: context.repoRoot,
             ...(context.source === 'sandbox-executor' ? {
                 controlBinding: { generation: context.generation, requestId: context.requestId },
-                handoffDirectory: context.handoffDirectory,
                 manifestPath: context.manifestPath
             } : {}),
             preflight: (request, options) => verifyTaskEvent({ ...request, event: 'complete-task.hard-preflight' }, options)

package/dist/lib/task/current-contract.js

@@ -1,7 +1,6 @@
 import { isValidAgentInfraVersion } from '../version.js';
 import { parseTypedTaskFrontmatter } from './frontmatter.js';
 import { LEDGER_SECTION_MISSING_CODE, LEDGER_SECTION_MISSING_MESSAGE, parseLedgerDocument, validateLedgerRows } from './ledger.js';
-import { parseInvalidationDocument } from './invalidation.js';
 function validateCurrentTaskContract(content) {
     let metadata;
     try {
@@ -30,10 +29,7 @@ function validateCurrentTaskContract(content) {
     const invalid = validateLedgerRows(ledger.rows);
     if (invalid)
         return { ok: false, code: 'TASK_CURRENT_CONTRACT_INVALID', message: `${invalid.code}: ${invalid.message}` };
-    const invalidation = parseInvalidationDocument(content);
-    if (!invalidation.ok)
-        return { ok: false, code: 'TASK_CURRENT_CONTRACT_INVALID', message: `${invalidation.code}: ${invalidation.message}` };
-    return { ok: true, metadata, ledger, invalidation: invalidation.document };
+    return { ok: true, metadata, ledger };
 }
 export { validateCurrentTaskContract };
 //# sourceMappingURL=current-contract.js.map