@fitlab-ai/agent-infra 0.11.9 → 0.11.11

package/dist/lib/platform/provider-contract.js

@@ -37,10 +37,7 @@ function validatePlatformProvider(value, providerType) {
             ok: false,
             error: {
                 code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
-                message: 'Provider must expose matching type, contractVersion, and context.resolve',
-                retryable: false,
-                providerType,
-                phase: 'provider-validation'
+                message: 'Provider must expose matching type, contractVersion, and context.resolve'
             }
         };
     }
@@ -51,10 +48,7 @@ function validatePlatformProvider(value, providerType) {
                 ok: false,
                 error: {
                     code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
-                    message: 'Provider identity declaration is invalid',
-                    retryable: false,
-                    providerType,
-                    phase: 'provider-validation'
+                    message: 'Provider identity declaration is invalid'
                 }
             };
         }
@@ -68,10 +62,7 @@ function validatePlatformProvider(value, providerType) {
                 ok: false,
                 error: {
                     code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
-                    message: `Provider operation group ${groupName} is incomplete`,
-                    retryable: false,
-                    providerType,
-                    phase: 'provider-validation'
+                    message: `Provider operation group ${groupName} is incomplete`
                 }
             };
         }
@@ -84,9 +75,6 @@ function validatePlatformProvider(value, providerType) {
                         error: {
                             code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
                             message: `Provider operation group ${groupName} requires an identity declaration for ${resourceKind}`,
-                            retryable: false,
-                            providerType,
-                            phase: 'provider-validation'
                         }
                     };
                 }

package/dist/lib/platform/provider-validation.js

@@ -462,9 +462,11 @@ const PROVIDER_ERROR_CATALOG = {
     REMOTE_INVALID: { message: 'The platform remote is invalid', retryable: false },
     UPSTREAM_UNRESOLVED: { message: 'The platform upstream repository could not be resolved', retryable: false },
     RESOURCE_NOT_FOUND: { message: 'The platform resource was not found', retryable: false },
+    COMMENT_LIST_FAILED: { message: 'Comments could not be listed', retryable: true },
     PR_NOT_FOUND: { message: 'The pull request was not found', retryable: false },
     ISSUE_NOT_FOUND: { message: 'The issue was not found', retryable: false },
     REMOTE_BUSY: { message: 'Platform provider is temporarily busy', retryable: true },
+    IN_LABEL_SYNC_PARTIAL: { message: 'In-label synchronization is partial or unknown', retryable: true },
     NETWORK_TRANSIENT: { message: 'The platform request failed temporarily', retryable: true },
     NETWORK_RETRY: { message: 'The platform request failed temporarily', retryable: true },
     NETWORK_RETRY_EXHAUSTED: { message: 'The platform request retries were exhausted', retryable: true },
@@ -505,11 +507,14 @@ function safeProviderError(providerType, operation, value) {
     return {
         code: definition ? item.code : 'PLATFORM_PROVIDER_OPERATION_FAILED',
         message: definition?.message || PROVIDER_ERROR_CATALOG.PLATFORM_PROVIDER_OPERATION_FAILED.message,
-        retryable: definition?.retryable || false,
+        retryable: definition?.retryable ?? false,
         providerType,
         phase: operation
     };
 }
+function providerErrorRetryable(code) {
+    return PROVIDER_ERROR_CATALOG[code]?.retryable ?? false;
+}
 function validators(providerType, declaration) {
     return {
         'context.resolve': (value) => validateContext(value, providerType),
@@ -608,8 +613,8 @@ async function invokeProviderOperation(providerType, operation, call, validate)
             try {
                 exactKeys(envelope, Object.hasOwn(envelope, 'value') ? ['ok', 'error', 'value'] : ['ok', 'error'], `${operation} result`);
                 const error = envelope.error;
-                exactKeys(error, ['code', 'message', 'retryable'], `${operation} error`);
-                if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message || typeof error.retryable !== 'boolean')
+                exactKeys(error, ['code', 'message'], `${operation} error`);
+                if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message)
                     throw new Error('invalid provider error');
                 return {
                     ok: false,
@@ -648,5 +653,5 @@ function wrapProviderOperations(provider) {
     }
     return wrapped;
 }
-export { invokeProviderOperation, validationError, wrapProviderOperations };
+export { invokeProviderOperation, providerErrorRetryable, validationError, wrapProviderOperations };
 //# sourceMappingURL=provider-validation.js.map

package/dist/lib/platform/pull-requests.js

@@ -9,6 +9,7 @@ import { extractSection } from '../task/sections.js';
 import { captureTaskWriteMetadata, writeTask } from '../task/write.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { inspectPlatformIssue } from './issues.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { planPullRequestMetadata } from './pull-request-metadata.js';
 import { planInLabelUpdate, validateInLabelMapping } from './in-label-sync.js';
 import { platformResult } from './types.js';
@@ -316,6 +317,21 @@ function normalizeProviderPullRequest(remote, repository, fallbackNumber, fallba
     Object.defineProperty(snapshot, 'identity', { value: identity, enumerable: false, configurable: true });
     return snapshot;
 }
+function inspectedPullRequestIdentityError(remote, requested) {
+    if (!remote.identity)
+        return {
+            code: 'PR_IDENTITY_MISSING',
+            message: 'Provider pull-request inspection did not return a canonical identity',
+            retryable: false
+        };
+    if (!resourceIdentityEquals(remote.identity, requested))
+        return {
+            code: 'PR_IDENTITY_MISMATCH',
+            message: 'Provider returned a different pull request identity than requested',
+            retryable: false
+        };
+    return null;
+}
 function pullRequestIdentity(pullRequest) {
     return pullRequest.identity || { kind: 'number', value: pullRequest.number };
 }
@@ -338,6 +354,9 @@ async function inspectExternalPullRequest(base, prIdentity) {
         : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
     if (!inspected.ok)
         return providerPullRequestError(base, inspected.error, prNumber);
+    const identityError = inspectedPullRequestIdentityError(inspected.value, prIdentity);
+    if (identityError)
+        return providerPullRequestError(base, identityError, prNumber);
     const pullRequest = normalizeProviderPullRequest(inspected.value, base.context.platform.repository, prNumber || 0, fallback);
     return result('no-op', base.resolved.taskId, base.issueNumber, prNumber, {
         platform: base.context.platform,
@@ -391,6 +410,12 @@ async function inspectPlatformPullRequestByNumber(prNumber, options = {}) {
                 platform: context.platform, capabilities: context.capabilities,
                 resource: { kind: 'pull-request', number, identity }, error: providerError(inspected.error, 'PLATFORM_PROVIDER_OPERATION_FAILED')
             });
+        const identityError = inspectedPullRequestIdentityError(inspected.value, identity);
+        if (identityError)
+            return result('failed', null, null, number, {
+                platform: context.platform, capabilities: context.capabilities,
+                resource: { kind: 'pull-request', number, identity }, error: identityError
+            });
         return result('no-op', null, null, number, {
             platform: context.platform, capabilities: context.capabilities,
             resource: { kind: 'pull-request', number, identity },
@@ -447,27 +472,38 @@ function resourceIdentityLabel(identity) {
     const number = resourceIdentityNumber(identity);
     return number === null ? `${identity.kind} ${identity.value}` : `#${number}`;
 }
-function inLabelResource(kind, identity, before, expected, after, effect) {
-    return { kind, number: resourceIdentityNumber(identity), identity, before: [...before].sort(), expected: [...expected].sort(), after: after ? [...after].sort() : null, effect };
+function inLabelResource(kind, identity, before, expected, after, effect, displayNumber = resourceIdentityNumber(identity)) {
+    return { kind, number: displayNumber, identity, before: [...before].sort(), expected: [...expected].sort(), after: after ? [...after].sort() : null, effect };
 }
-async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
+async function syncPlatformPullRequestInLabels(prToken, options = {}) {
     const cwd = path.resolve(options.cwd || process.cwd());
+    const token = String(prToken);
     const loaded = await resolvePlatformProviderContext({ cwd, client: options.client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
     const usable = (context.status === 'no-op' || context.status === 'degraded') && context.platform.repository;
     if (!loaded.ok || !usable)
-        return result(context.status, null, null, prNumber, {
+        return result(context.status, null, null, null, {
             platform: context.platform, capabilities: context.capabilities, operations: context.operations, error: context.error
         });
-    if (!Number.isSafeInteger(prNumber) || prNumber <= 0)
-        return result('failed', null, null, prNumber, {
+    if (!token || token.trim() !== token)
+        return result('failed', null, null, null, {
             platform: context.platform, capabilities: context.capabilities,
-            error: { code: 'PR_NUMBER_INVALID', message: 'PR number must be positive', retryable: false }
+            error: { code: 'PR_IDENTITY_INVALID', message: 'PR identity token must be non-empty and trimmed', retryable: false }
         });
     const provider = loaded.value.provider;
     const operationContext = providerOperationContext(loaded.value);
     const repository = context.platform.repository;
-    const pullRequestIdentity = providerResourceToken(provider, 'pull-request', String(prNumber));
+    let pullRequestIdentity;
+    try {
+        pullRequestIdentity = providerResourceToken(provider, 'pull-request', token);
+    }
+    catch (error) {
+        return result('failed', null, null, null, {
+            platform: context.platform, capabilities: context.capabilities,
+            error: { code: 'PR_IDENTITY_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        });
+    }
+    let prNumber = resourceIdentityNumber(pullRequestIdentity);
     const providerFailure = (error) => result(error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED' ? 'degraded' : providerStatus(error), null, null, prNumber, {
         platform: context.platform,
         capabilities: context.capabilities,
@@ -479,7 +515,13 @@ async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
         : unsupportedProviderOperation(provider, 'changeRequests.inspect');
     if (!inspected.ok)
         return providerFailure(inspected.error);
-    const fetched = normalizeProviderPullRequest(inspected.value, repository, prNumber);
+    const identityError = inspectedPullRequestIdentityError(inspected.value, pullRequestIdentity);
+    if (identityError)
+        return providerFailure(identityError);
+    if (Number.isSafeInteger(inspected.value.number) && inspected.value.number > 0) {
+        prNumber = inspected.value.number;
+    }
+    const fetched = normalizeProviderPullRequest(inspected.value, repository, prNumber ?? 0);
     const files = provider.changeRequests?.listFiles
         ? await provider.changeRequests.listFiles({ context: operationContext, target: pullRequestIdentity })
         : unsupportedProviderOperation(provider, 'changeRequests.listFiles');
@@ -548,7 +590,7 @@ async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
         }))
     ];
     const willWrite = context.capabilities.triage && !options.dryRun;
-    const resourcesState = plans.map((item) => inLabelResource(item.kind, item.identity, item.snapshot.labels, item.plan.target, item.plan.changed && willWrite ? null : item.snapshot.labels, item.plan.changed && willWrite ? 'unknown' : 'no-op'));
+    const resourcesState = plans.map((item) => inLabelResource(item.kind, item.identity, item.snapshot.labels, item.plan.target, item.plan.changed && willWrite ? null : item.snapshot.labels, item.plan.changed && willWrite ? 'unknown' : 'no-op', item.number));
     if (options.dryRun || !context.capabilities.triage)
         return result(!context.capabilities.triage || association.value.length !== 1 ? 'degraded' : plans.some((item) => item.plan.changed) ? 'planned' : 'no-op', null, issueNumber, prNumber, {
             platform: context.platform, capabilities: context.capabilities, pullRequest: fetched,
@@ -582,9 +624,10 @@ async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
                 : unsupportedProviderOperation(provider, 'changeRequests.update');
         if (!synced.ok) {
             const state = resourcesState.find((resource) => resource.kind === item.kind && resourceIdentityEquals(resource.identity, item.identity));
-            state.effect = synced.error.retryable ? 'unknown' : 'no-op';
+            const retryable = synced.error.retryable || providerErrorRetryable(synced.error.code);
+            state.effect = retryable ? 'unknown' : 'no-op';
             state.after = state.effect === 'unknown' ? null : item.snapshot.labels;
-            const partial = successfulWrites > 0 || synced.error.retryable;
+            const partial = successfulWrites > 0 || retryable;
             const error = partial
                 ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
                 : synced.error;
@@ -609,6 +652,16 @@ async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
                 evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: closingIssueIdentities },
                 error: { ...providerError(reread.error, 'PLATFORM_PROVIDER_OPERATION_FAILED'), code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${reread.error.message}` }
             });
+        if (item.kind === 'pull-request') {
+            const identityError = inspectedPullRequestIdentityError(reread.value, item.identity);
+            if (identityError)
+                return result('blocked', null, issueNumber, prNumber, {
+                    changed: true, platform: context.platform, capabilities: context.capabilities,
+                    pullRequest: currentPullRequest, resource: { kind: 'pull-request', number: prNumber, identity: pullRequestIdentity }, operations, resources: resourcesState,
+                    evidence: { kind: 'pull-request-files', pullRequestFiles: files.value, closingIssues: closingIssueIdentities },
+                    error: { ...identityError, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${identityError.message}` }
+                });
+        }
         const after = reread.value.labels || [];
         const state = resourcesState.find((resource) => resource.kind === item.kind && resourceIdentityEquals(resource.identity, item.identity));
         state.after = after;
@@ -621,7 +674,7 @@ async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
                 error: { code: 'IN_LABEL_SYNC_PARTIAL', message: `${item.kind} ${resourceIdentityLabel(item.identity)} did not converge to the expected in: labels`, retryable: true }
             });
         if (item.kind === 'pull-request')
-            currentPullRequest = normalizeProviderPullRequest(reread.value, repository, prNumber, currentPullRequest);
+            currentPullRequest = normalizeProviderPullRequest(reread.value, repository, prNumber ?? currentPullRequest.number, currentPullRequest);
     }
     return result(association.value.length !== 1 ? 'degraded' : successfulWrites > 0 ? 'applied' : 'no-op', null, issueNumber, prNumber, {
         changed: successfulWrites > 0, platform: context.platform, capabilities: context.capabilities,
@@ -854,9 +907,13 @@ async function resolveExternalPullRequest(taskRef, options) {
         ? await base.provider.changeRequests.inspect({
             context: providerOperationContext(base.loadedContext),
             target: pullRequestIdentity(selected.selected)
-        }).then((response) => response.ok
-            ? { ok: true, value: normalizeProviderPullRequest(response.value, base.context.platform.repository, selected.selected.number, selected.selected) }
-            : response)
+        }).then((response) => {
+            if (!response.ok)
+                return response;
+            const identityError = inspectedPullRequestIdentityError(response.value, pullRequestIdentity(selected.selected));
+            return identityError ? { ok: false, error: identityError }
+                : { ok: true, value: normalizeProviderPullRequest(response.value, base.context.platform.repository, selected.selected.number, selected.selected) };
+        })
         : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
     if (!rechecked.ok || !rechecked.value)
         return externalResult(result(rechecked.ok ? 'failed' : rechecked.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
@@ -1150,6 +1207,9 @@ async function createExternalPullRequest(taskRef, options, base) {
         : unsupportedProviderOperation(base.provider, 'changeRequests.inspect');
     if (!inspected.ok)
         return withCreation(providerPullRequestError(base, inspected.error, number), { kind: 'created', createdByCurrentOperation: true });
+    const identityError = inspectedPullRequestIdentityError(inspected.value, createdIdentity);
+    if (identityError)
+        return withCreation(providerPullRequestError(base, identityError, number), { kind: 'created', createdByCurrentOperation: true });
     const pullRequest = normalizeProviderPullRequest(inspected.value, base.context.platform.repository, inspected.value.number ?? fallback.number, fallback);
     if (!pullRequest.nodeId || !isUsableResourceIdentity(pullRequestIdentity(pullRequest)))
         return withCreation(result('failed', base.resolved.taskId, base.issueNumber, null, {
@@ -1352,6 +1412,13 @@ async function syncPlatformPullRequestImpl(taskRef, options) {
                     code: 'IN_LABEL_SYNC_PARTIAL',
                     message: `In-label synchronization is partial or unknown: ${reread.error.message}`
                 }, base.prNumber));
+            const identityError = inspectedPullRequestIdentityError(reread.value, base.prIdentity);
+            if (identityError)
+                return softenFailure(providerPullRequestError(base, {
+                    ...identityError,
+                    code: 'IN_LABEL_SYNC_PARTIAL',
+                    message: `Pull-request metadata synchronization is partial or unknown: ${identityError.message}`
+                }, base.prNumber));
             finalPullRequest = normalizeProviderPullRequest(reread.value, base.context.platform.repository, base.prNumber || 0, inspected.pullRequest);
             const expected = ((planned.find((operation) => operation.name === 'labels')?.value || [])
                 .filter((label) => label.startsWith('in:') || label.startsWith('type:'))).sort();

package/dist/lib/platform/verification-sync.js

@@ -457,7 +457,7 @@ function checkTaskCommentContent(context, remoteData, shared) {
     return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage("task", context.issueNumber, expectedBody, commentBody), "check_failed");
 }
 function checkPrTypeLabel(context, remoteData, shared) {
-    if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+    if (!context.audit.enabled || !context.hasTriage || !context.prIdentity || remoteData.prLabels === undefined || remoteData.prLabels === null) {
         return infoResult('PR type-label audit is not applicable because the required PR metadata or capability is unavailable');
     }
     const expectedLabel = mapTaskTypeToLabel(context.task.metadata.type);
@@ -465,12 +465,12 @@ function checkPrTypeLabel(context, remoteData, shared) {
         return infoResult('PR type-label audit is not applicable because the task type has no label mapping');
     }
     if (remoteData.prLabels.includes(expectedLabel)) {
-        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has expected type label '${expectedLabel}'`);
+        return shared.passResult(CHECK_TYPE, `${pullRequestLabel(context)} has expected type label '${expectedLabel}'`);
     }
-    return shared.failResult(CHECK_TYPE, `Expected type label '${expectedLabel}' not found on PR #${context.prNumber}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Expected type label '${expectedLabel}' not found on ${pullRequestLabel(context)}`, "check_failed");
 }
 function checkInLabelsMatchPr(context, remoteData, shared) {
-    if (!context.audit.enabled || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
+    if (!context.audit.enabled || !context.hasTriage || !context.prIdentity || remoteData.prLabels === undefined || remoteData.prLabels === null) {
         return infoResult('PR in: label audit is not applicable because the required PR metadata or capability is unavailable');
     }
     const issueInLabels = extractLabelNames(remoteData.issue.labels)
@@ -480,9 +480,12 @@ function checkInLabelsMatchPr(context, remoteData, shared) {
         .filter((label) => label.startsWith("in:"))
         .sort();
     if (arraysEqual(issueInLabels, prInLabels)) {
-        return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} in: labels match Issue #${context.issueNumber}`);
+        return shared.passResult(CHECK_TYPE, `${pullRequestLabel(context)} in: labels match Issue #${context.issueNumber}`);
     }
-    return shared.failResult(CHECK_TYPE, `in: labels mismatch — PR #${context.prNumber} has [${formatLabelList(prInLabels)}], Issue #${context.issueNumber} has [${formatLabelList(issueInLabels)}]`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `in: labels mismatch — ${pullRequestLabel(context)} has [${formatLabelList(prInLabels)}], Issue #${context.issueNumber} has [${formatLabelList(issueInLabels)}]`, "check_failed");
+}
+function pullRequestLabel(context) {
+    return context.prNumber ? `PR #${context.prNumber}` : 'Pull request';
 }
 function checkInLabelsComputed(context, remoteData, shared) {
     if (!context.audit.enabled || !context.hasTriage) {
@@ -574,13 +577,13 @@ function checkIssueFields(context, remoteData, shared) {
     return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} fields match task metadata`);
 }
 function checkPrAssignee(context, remoteData, shared) {
-    if (!context.audit.enabled || !context.hasPush || !context.prNumber) {
+    if (!context.audit.enabled || !context.hasPush || !context.prIdentity || remoteData.prAssignees === undefined || remoteData.prAssignees === null) {
         return infoResult('PR assignee audit is not applicable because it is disabled or required PR metadata/capability is unavailable');
     }
-    if (!remoteData.prAssignees || remoteData.prAssignees.length === 0) {
-        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no assignee`, "check_failed");
+    if (remoteData.prAssignees.length === 0) {
+        return shared.failResult(CHECK_TYPE, `${pullRequestLabel(context)} has no assignee`, "check_failed");
     }
-    return shared.passResult(CHECK_TYPE, `PR #${context.prNumber} has an assignee`);
+    return shared.passResult(CHECK_TYPE, `${pullRequestLabel(context)} has an assignee`);
 }
 function checkMilestone(context, remoteData, shared) {
     if (!context.hasTriage) {
@@ -589,16 +592,16 @@ function checkMilestone(context, remoteData, shared) {
     if (!remoteData.issue?.milestone?.title) {
         return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no milestone set`, "check_failed");
     }
-    if (context.prNumber && remoteData.prMilestone !== undefined && !remoteData.prMilestone?.title) {
-        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no milestone set`, "check_failed");
+    if (context.prIdentity && remoteData.prMilestone !== undefined && !remoteData.prMilestone?.title) {
+        return shared.failResult(CHECK_TYPE, `${pullRequestLabel(context)} has no milestone set`, "check_failed");
     }
     if (context.audit.requireSpecificMilestone) {
         const issueTitle = remoteData.issue.milestone.title;
         if (VERSION_LINE_REGEX.test(issueTitle)) {
             return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone '${issueTitle}' is a release line; narrow to a specific version (e.g. ${issueTitle.replace(/\.x$/, ".N")}) before continuing`, "check_failed");
         }
-        if (context.prNumber && remoteData.prMilestone?.title && VERSION_LINE_REGEX.test(remoteData.prMilestone.title)) {
-            return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} milestone '${remoteData.prMilestone.title}' is a release line; narrow to a specific version before continuing`, "check_failed");
+        if (context.prIdentity && remoteData.prMilestone?.title && VERSION_LINE_REGEX.test(remoteData.prMilestone.title)) {
+            return shared.failResult(CHECK_TYPE, `${pullRequestLabel(context)} milestone '${remoteData.prMilestone.title}' is a release line; narrow to a specific version before continuing`, "check_failed");
         }
     }
     return shared.passResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone satisfies the configured policy`);

package/dist/lib/sandbox/commands/create.js

@@ -672,7 +672,7 @@ function readProjectInitCommandDigest(controlRoot) {
 function writeProjectInitCommandDigest(controlRoot, commandSha256) {
     atomicWriteJson(path.join(controlRoot, 'project-init.json'), { version: 1, commandSha256 });
 }
-export async function create(args, { runProjectInitCommand = true } = {}) {
+export async function create(args, { runProjectInitCommand = true, workspace: workspaceOverride } = {}) {
     const { values, positionals } = parseArgs({
         args,
         allowPositionals: true,
@@ -696,7 +696,13 @@ export async function create(args, { runProjectInitCommand = true } = {}) {
     validateSelinuxDisableEnv();
     const config = loadConfig();
     const [branchOrTaskId = '', base] = positionals;
-    const target = resolveSandboxTarget(branchOrTaskId, config.repoRoot);
+    const resolvedTarget = resolveSandboxTarget(branchOrTaskId, config.repoRoot);
+    const workspace = workspaceOverride?.mode === 'task-bound'
+        && resolvedTarget.workspace.mode === 'task-bound'
+        && workspaceOverride.taskId === resolvedTarget.workspace.taskId
+        ? resolvedTarget.workspace
+        : workspaceOverride ?? resolvedTarget.workspace;
+    const target = { ...resolvedTarget, workspace };
     const branch = target.branch;
     assertValidBranchName(branch);
     const effectiveConfig = {
@@ -866,6 +872,9 @@ export async function create(args, { runProjectInitCommand = true } = {}) {
                 task: async () => {
                     for (const { tool, dir } of effectiveResolvedTools) {
                         fs.mkdirSync(dir, { recursive: true });
+                        for (const { hostSubdir } of tool.hostStateMounts ?? []) {
+                            fs.mkdirSync(path.join(dir, hostSubdir), { recursive: true });
+                        }
                         for (const { hostPath, sandboxName } of tool.hostPreSeedFiles ?? []) {
                             const destination = path.join(dir, sandboxName);
                             if (fs.existsSync(hostPath) && !fs.existsSync(destination)) {
@@ -1105,6 +1114,10 @@ export async function create(args, { runProjectInitCommand = true } = {}) {
                                 '-v',
                                 volumeArg(engine, hostPath, path.posix.join(tool.containerMount, containerSubpath))
                             ]));
+                            const hostStateMountVolumes = effectiveResolvedTools.flatMap(({ tool, dir }) => (tool.hostStateMounts ?? []).flatMap(({ hostSubdir, containerSubpath }) => [
+                                '-v',
+                                volumeArg(engine, path.join(dir, hostSubdir), path.posix.join(tool.containerMount, containerSubpath))
+                            ]));
                             fs.mkdirSync(shareCommon, { recursive: true });
                             fs.mkdirSync(shareBranch, { recursive: true });
                             fs.mkdirSync(clipboardHostDir(effectiveConfig.home), { recursive: true, mode: 0o700 });
@@ -1133,6 +1146,8 @@ export async function create(args, { runProjectInitCommand = true } = {}) {
                                     `${sandboxBranchLabel(effectiveConfig)}=${branch}`,
                                     '--label',
                                     `${sandboxWorkspaceModeLabel(effectiveConfig)}=${target.workspace.mode}`,
+                                    '-e',
+                                    'AGENT_INFRA_SANDBOX=1',
                                     ...(target.workspace.mode === 'task-bound'
                                         ? [
                                             '--label',
@@ -1163,6 +1178,7 @@ export async function create(args, { runProjectInitCommand = true } = {}) {
                                     ...tmpfsArgs,
                                     ...tmpfsSeedPlan.flatMap(({ volumeArgs }) => volumeArgs),
                                     ...liveMountVolumes,
+                                    ...hostStateMountVolumes,
                                     ...envFile.dockerArgs,
                                     ...tzFlags,
                                     '-w',

package/dist/lib/sandbox/commands/enter.js

@@ -8,15 +8,16 @@ import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
 import { redactCommandError } from '../redaction.js';
 import { runInteractiveWithClipboardBridge } from '../clipboard/bridge.js';
 import { detectHostTimezone } from '../host-timezone.js';
-import { fetchSandboxRows, selectSandboxContainer, } from './list-running.js';
-import { resolveSandboxReentryContext, resolveSandboxTarget } from '../workspace-identity.js';
+import { fetchSandboxRows, selectSandboxContainer, startSandboxContainer, } from './list-running.js';
+import { resolveSandboxTarget } from '../workspace-identity.js';
 const USAGE = `Usage: ai sandbox exec [--recreate] <branch | TASK-id | N> [cmd...]
 
 N references an active task short id from
 .agents/workspace/active/.short-ids.json. They resolve only via that
 registry — they do not reference a container's row position in
-'ai sandbox ls' output. --recreate is a host recovery flag only before the
-target; the same token after the target is passed to the container command.`;
+'ai sandbox ls' output. --recreate rebuilds the matched container while
+preserving its task or branch identity. The same token after the target is
+passed to the container command.`;
 const TMUX_ENTRY_PATH = '/usr/local/bin/sandbox-tmux-entry';
 // Terminal-detection variables that interactive TUIs (e.g. claude-code)
 // inspect to enable progressive enhancements such as the kitty keyboard
@@ -78,41 +79,54 @@ export async function enter(args) {
     const config = loadConfig();
     const engine = detectEngine(config);
     const parsed = parseEnterArgs(args);
-    const target = resolveSandboxTarget(parsed.target, config.repoRoot);
-    const branch = target.branch;
-    assertValidBranchName(branch);
+    const fullTaskId = /^TASK-\d{8}-\d{6}$/.test(parsed.target);
+    const target = fullTaskId ? null : resolveSandboxTarget(parsed.target, config.repoRoot);
+    const branch = target?.branch ?? '';
+    if (branch)
+        assertValidBranchName(branch);
     const { running, nonRunning } = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config), {
         mode: sandboxWorkspaceModeLabel(config),
         taskId: sandboxTaskIdLabel(config)
     });
-    const found = selectSandboxContainer([...running, ...nonRunning], containerNameCandidates(config, branch));
-    if (!found) {
-        throw new Error(`No sandbox found for branch '${branch}'. Run 'ai sandbox create ${branch}' to create one.`);
+    const rows = [...running, ...nonRunning];
+    const found = fullTaskId
+        ? rows.find((row) => row.taskId === parsed.target)
+        : rows.find((row) => row.branch === branch)
+            ?? selectSandboxContainer(rows, containerNameCandidates(config, branch));
+    if (!found)
+        throw new Error(`No sandbox found for '${parsed.target}'.`);
+    const sandboxBranch = found.branch || branch;
+    if (sandboxBranch)
+        assertValidBranchName(sandboxBranch);
+    if (target?.workspace.mode === 'task-bound' && found.taskId !== target.workspace.taskId) {
+        throw new Error(`Sandbox task mismatch for short id '${parsed.target}'.`);
     }
-    const containerWorkspace = found.workspaceMode === 'task-bound' && found.taskId
+    const workspace = found.workspaceMode === 'task-bound' && found.taskId
         ? { mode: 'task-bound', taskId: found.taskId }
-        : found.workspaceMode === 'branch-only'
-            ? { mode: 'branch-only' }
-            : { mode: 'legacy-invalid' };
-    const reentry = resolveSandboxReentryContext({
-        target,
-        containerWorkspace,
-        repoRoot: config.repoRoot
-    });
-    const ready = await ensureSandboxReady({
-        config,
-        engine,
-        branch,
-        workspace: reentry.workspace,
-        reentry: reentry.reentry,
-        row: found,
-        allowRecreate: parsed.recreate,
-        recreate: async () => {
-            const { create } = await import('./create.js');
-            await create([target.requestedRef, '--no-refresh'], { runProjectInitCommand: false });
-        }
-    });
-    const container = ready.container;
+        : { mode: 'branch-only' };
+    let container = found.name;
+    if (parsed.recreate) {
+        const ready = await ensureSandboxReady({
+            config,
+            engine,
+            branch: sandboxBranch,
+            workspace,
+            row: found,
+            allowRecreate: true,
+            forceRecreate: true,
+            recreate: async () => {
+                const { create } = await import('./create.js');
+                await create([sandboxBranch, '--no-refresh'], {
+                    runProjectInitCommand: false,
+                    workspace
+                });
+            }
+        });
+        container = ready.container;
+    }
+    else if (!found.running) {
+        startSandboxContainer(engine, found.name);
+    }
     const cmd = parsed.command;
     const capabilityPlan = createSandboxCapabilityPlan(config);
     const enterHookResults = await runSandboxHooks({