@fitlab-ai/agent-infra 0.12.0 → 0.12.2

package/lib/sandbox/control/server.ts

@@ -36,7 +36,6 @@ import {
   writeSandboxControlReservation,
   writeSandboxControlResultEvidence,
   writeSandboxControlTerminalResult,
-  appendSandboxControlAudit,
   terminateSandboxControlExecution,
   writeSandboxControlStatus,
   readSandboxControlStatus
@@ -65,7 +64,6 @@ import { loadShortIdByTaskId } from '../../task/short-id.ts';
 import { inspectSandboxControlContainer, type ContainerObservation } from './container-identity.ts';
 import {
   acquireSandboxControlBrokerStartup,
-  garbageCollectSandboxControlRoot,
   isSandboxControlRootQuiescing,
   readSandboxControlManifest
 } from './lifecycle.ts';
@@ -76,7 +74,6 @@ import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   mergeSandboxTaskView,
   taskViewForManifest,
-  type SandboxTaskView
 } from './task-view.ts';
 import { taskCreateOutputUnavailableResult } from '../../task/create-service.ts';
 
@@ -287,7 +284,6 @@ function taskCreateDomainEvidence(
 
 async function readRecoveryDomain(
   manifest: SandboxControlManifest,
-  manifestPath: string,
   request: SandboxControlRequest,
   operation: ReturnType<typeof findSandboxControlRecoveryOperation>,
   terminalResult: ReturnType<typeof readSandboxControlTerminalResult>,
@@ -301,9 +297,6 @@ async function readRecoveryDomain(
   }
 
   if (operation.family === 'task-lifecycle') {
-    if (operation.intent === 'recover-started') {
-      return { domain: null };
-    }
     if (!taskRef || !terminalResult.targetState) return { domain: null };
     const journal = readLifecycleJournalEvidence(manifest.repoRoot, taskRef);
     try {
@@ -340,7 +333,6 @@ function readCommittedCriticalPhases(manifest: SandboxControlManifest, requestId
 
 export async function recoveryResponse(
   manifest: SandboxControlManifest,
-  manifestPath: string,
   request: SandboxControlRequest,
   evidence: ReturnType<typeof readSandboxControlResultEvidence>,
   payload: ReturnType<typeof readSandboxControlPayload> | null,
@@ -355,7 +347,7 @@ export async function recoveryResponse(
     }, payload.stdout);
     if (JSON.stringify(payloadTerminal) !== JSON.stringify(terminalResult)) return unknown(request.id);
   }
-  const recovery = await readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
+  const recovery = await readRecoveryDomain(manifest, request, operation, terminalResult, payload?.stdout ?? null);
   const binding = operationRecoveryBinding(request.id, manifest.generation, manifest.taskId, request.family, operationName!);
   const decision = classifySandboxControlRecovery({
     operation,
@@ -373,13 +365,11 @@ export async function recoveryResponse(
 }
 
 async function terminalMatchesEvidence(
-  manifest: SandboxControlManifest,
   request: SandboxControlRequest,
   response: SandboxControlResponse,
   evidence: ReturnType<typeof readSandboxControlResultEvidence>,
   payload: ReturnType<typeof readSandboxControlPayload> | null,
-  payloadInvalid: boolean,
-  terminalResult: ReturnType<typeof readSandboxControlTerminalResult> | null
+  payloadInvalid: boolean
 ): Promise<{ valid: boolean; payloadReferenced: boolean }> {
   if (response.version !== 2 || response.id !== request.id || response.phase !== 'completed'
     || response.exitCode !== evidence.exitCode || response.error !== null) {
@@ -422,7 +412,7 @@ function publishExecutionResult(
   brokerOwns: () => boolean
 ): boolean {
   const normalized = sanitizeSandboxControlResult(manifest, result);
-  const terminalResult = writeSandboxControlTerminalResult(manifest, {
+  writeSandboxControlTerminalResult(manifest, {
     id: request.id,
     family: request.family,
     operation: operationKey(request)
@@ -535,7 +525,7 @@ function assertCurrentSandboxControlIdentity(manifest: SandboxControlManifest, m
   }
 }
 
-async function recoverProcessing(manifest: SandboxControlManifest, manifestPath: string, broker: BrokerOwner, brokerOwns: () => boolean): Promise<boolean> {
+async function recoverProcessing(manifest: SandboxControlManifest, brokerOwns: () => boolean): Promise<boolean> {
   for (const entry of fs.readdirSync(manifest.processingDir, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^[a-f0-9-]{16,64}$/.test(entry.name)) continue;
     if (!brokerOwns()) return false;
@@ -641,13 +631,11 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
       if (terminal && request && resultEvidence) {
         if (!terminalResult && request.family !== 'task-create') continue;
         const reconciliation = await terminalMatchesEvidence(
-          manifest,
           request,
           existingTerminalResponse!,
           resultEvidence,
           payload,
-          payloadInvalid,
-          terminalResult
+          payloadInvalid
         );
         if (!reconciliation.valid) continue;
         terminalReconciled = true;
@@ -669,7 +657,7 @@ async function recoverProcessing(manifest: SandboxControlManifest, manifestPath:
       if (!terminal) {
         if (!brokerOwns()) return false;
         if (!resultEvidence || !request || payloadInvalid) continue;
-        const recovered = await recoveryResponse(manifest, manifestPath, request, resultEvidence, payload, terminalResult!);
+        const recovered = await recoveryResponse(manifest, request, resultEvidence, payload, terminalResult!);
         if (!recovered) continue;
         writeSandboxControlResponse(manifest, recovered);
         const preserveRecoveryEvidence = recovered.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN';
@@ -814,7 +802,7 @@ export async function serveSandboxControl(
       pid: broker.pid,
       brokerId: broker.brokerId
     });
-    if (!await recoverProcessing(manifest, manifestPath, broker, brokerOwns)) return;
+    if (!await recoverProcessing(manifest, brokerOwns)) return;
     try {
       const published = readSandboxControlStatus(manifest.publicStatusDir);
       if (published.generation === manifest.generation) taskView = published.taskView;
@@ -856,29 +844,15 @@ export async function serveSandboxControl(
           containerReasonCode = null;
           containerBackoffMs = timing.parkedBindingInitialMs;
           nextContainerHeartbeatAt = Date.now() + timing.containerHeartbeatMs;
-        } else if (observation.state === 'unknown') {
-          containerReasonCode = 'SANDBOX_CONTROL_CONTAINER_UNKNOWN';
-          appendDiagnosticAudit(manifest, 'container-heartbeat-unknown', { reason: observation.reason });
+        } else {
+          const missing = observation.state === 'absent';
+          containerReasonCode = missing ? 'SANDBOX_CONTROL_CONTAINER_ABSENT' : 'SANDBOX_CONTROL_CONTAINER_UNKNOWN';
+          appendDiagnosticAudit(manifest, missing ? 'container-heartbeat-absent' : 'container-heartbeat-unknown', {
+            reason: observation.state === 'unknown' ? observation.reason : 'recorded container was not found'
+          });
           const backoff = nextSandboxControlBackoff(containerBackoffMs, timing.slowCheckMs);
           nextContainerHeartbeatAt = Date.now() + backoff.delayMs;
           containerBackoffMs = backoff.nextDelayMs;
-        } else {
-          try {
-            await garbageCollectSandboxControlRoot(root, {
-              timeoutMs: timing.quiesceDeadlineMs,
-              inspectContainer: (timeoutMs) => inspectContainer(manifest),
-              selfOwner: broker
-            });
-            active = null;
-            return;
-          } catch (error) {
-            if (!brokerOwns()) break;
-            containerReasonCode = 'SANDBOX_CONTROL_CONTAINER_ABSENT_GC_FAILED';
-            appendDiagnosticAudit(manifest, 'container-gc-failed', { reason: controlError(error).code });
-            const backoff = nextSandboxControlBackoff(containerBackoffMs, timing.slowCheckMs);
-            nextContainerHeartbeatAt = Date.now() + backoff.delayMs;
-            containerBackoffMs = backoff.nextDelayMs;
-          }
         }
       }
 

package/lib/sandbox/control/state.ts

@@ -1,4 +1,3 @@
-import { isCompletionEvidence, type CleanCompletionEvidence } from '../../task/orchestration.ts';
 import { parseControlOutput } from '../../task/control-recovery.ts';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
@@ -112,7 +111,6 @@ export type SandboxControlTerminalResult = Readonly<{
   targetState: string | null;
   status: string;
   changed: boolean | null;
-  completionEvidence: CleanCompletionEvidence | null;
 }>;
 
 export function terminalResultPath(manifest: SandboxControlManifest, requestId: string): string {
@@ -126,9 +124,6 @@ export function createSandboxControlTerminalResult(
   output: string
 ): SandboxControlTerminalResult {
   const nested = parseControlOutput(output) ?? {};
-  const run = nested.run && typeof nested.run === 'object' && !Array.isArray(nested.run)
-    ? nested.run as Record<string, unknown> : null;
-  const rawCompletion = nested.completionEvidence ?? run?.completionEvidence;
   const operation = request.operation ?? (typeof nested.intent === 'string' ? nested.intent : null) ?? '';
   return {
     version: 1,
@@ -138,8 +133,7 @@ export function createSandboxControlTerminalResult(
     intentDigest: createHash('sha256').update(`${request.family}\0${operation}`, 'utf8').digest('hex'),
     targetState: typeof nested.targetState === 'string' ? nested.targetState : null,
     status: typeof nested.status === 'string' ? nested.status : 'completed',
-    changed: typeof nested.changed === 'boolean' ? nested.changed : null,
-    completionEvidence: isCompletionEvidence(rawCompletion) ? rawCompletion : null
+    changed: typeof nested.changed === 'boolean' ? nested.changed : null
   };
 }
 
@@ -170,9 +164,6 @@ export function readSandboxControlTerminalResult(filePath: string): SandboxContr
     || (value.changed !== null && typeof value.changed !== 'boolean')) {
     throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
   }
-  if (value.completionEvidence !== null && !isCompletionEvidence(value.completionEvidence)) {
-    throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
-  }
   if (value.changed === undefined) {
     throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
   }

package/lib/sandbox/dockerfile.ts

@@ -143,14 +143,3 @@ export function prepareDockerfile(
     }
   };
 }
-
-export function composeDockerfile(
-  config: DockerfileConfig,
-  image: DockerfileImageContribution = EMPTY_IMAGE_CONTRIBUTION
-): string {
-  const content = dockerfileContent(config, image);
-
-  const tempPath = path.join(os.tmpdir(), `${config.project}-sandbox.Dockerfile`);
-  fs.writeFileSync(tempPath, content, 'utf8');
-  return tempPath;
-}

package/lib/sandbox/engine.ts

@@ -195,23 +195,6 @@ export async function ensureDocker(
   adapter.syncResources(effectiveConfig, onMessage, fns, { vmJustStarted });
 }
 
-export function isVmManaged(config: EngineConfig = {}, dependencies: EngineDependencies = {}): boolean {
-  try {
-    const engine = detectEngine(config, dependencies);
-    return isManagedEngine(engine);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : '';
-    if (
-      message.startsWith('sandbox: platform "')
-      || / is not supported on [^.]+\. Supported engines on [^:]+: none\./.test(message)
-    ) {
-      return false;
-    }
-
-    throw error;
-  }
-}
-
 export function isManagedEngine(engine: string): boolean {
   try {
     return getAdapter(engine).managed;

package/lib/sandbox/engines/docker-exact-discovery.ts

@@ -1,6 +1,5 @@
 import type { SpawnSyncReturns } from 'node:child_process';
 import { commandForEngine, runProbe } from '../shell.ts';
-import { commandForSandboxAuthority, type SandboxAuthorityEvidenceV1 } from './authority.ts';
 
 type ProbeResult = SpawnSyncReturns<string | Buffer>;
 type Probe = (cmd: string, args: string[], options?: { timeout?: number }) => ProbeResult;
@@ -20,7 +19,6 @@ export type ExactContainerDiscovery =
 export type ExactContainerDiscoveryOptions = Readonly<{
   probe?: Probe;
   timeoutMs?: number;
-  authority?: SandboxAuthorityEvidenceV1;
 }>;
 
 const FULL_CONTAINER_ID = /^[a-f0-9]{64}$/u;
@@ -47,9 +45,7 @@ function runDockerProbe(
   args: string[],
   options: ExactContainerDiscoveryOptions
 ): ProbeResult {
-  const command = options.authority
-    ? commandForSandboxAuthority(options.authority, 'docker', args)
-    : commandForEngine(engine, 'docker', args);
+  const command = commandForEngine(engine, 'docker', args);
   return (options.probe ?? runProbe)(
     command.cmd,
     command.args,

package/lib/sandbox/engines/wsl2-paths.ts

@@ -8,10 +8,6 @@ export function hostJoin(basePath: string, ...segments: string[]): string {
   return basePath.startsWith('/') ? path.posix.join(basePath, ...segments) : path.join(basePath, ...segments);
 }
 
-export function isWindowsDrivePath(value: unknown): boolean {
-  return typeof value === 'string' && WINDOWS_DRIVE_PATH_PATTERN.test(value);
-}
-
 export function isUncPath(value: unknown): boolean {
   return typeof value === 'string' && UNC_PATH_PATTERN.test(value);
 }

package/lib/sandbox/recovery.ts

@@ -5,6 +5,7 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { nodeEntryArgs } from './control/executor.ts';
 import {
+  containerName,
   containerNameCandidates,
   sandboxBranchLabel,
   sandboxLabel,
@@ -55,7 +56,6 @@ import {
 import { getProcessIdentityState, getProcessStartTime, removePidFileIfMatches } from '../server/process-state.ts';
 import {
   acquireSandboxControlBrokerStartup,
-  garbageCollectSandboxControlRoot,
   isSandboxControlRootQuiescing,
   readSandboxControlManifest,
   type BrokerOwner
@@ -178,7 +178,7 @@ type EnsureSandboxReadyParams = {
   branch: string;
   workspace?: SandboxWorkspaceReference;
   reentry?: 'standard' | 'completed';
-  row: SandboxRow;
+  row: SandboxRow | null;
   allowRecreate?: boolean;
   forceRecreate?: boolean;
   recreate?: (branch: string) => Promise<void>;
@@ -365,9 +365,6 @@ async function ensureSandboxControlBroker(params: {
     throw new Error(`SANDBOX_CONTROL_CONTAINER_UNKNOWN: ${containerObservation.reason}`);
   }
   if (containerObservation.state === 'absent') {
-    await garbageCollectSandboxControlRoot(control.root, {
-      inspectContainer: (timeoutMs) => inspectSandboxControlContainer(validatedManifest, { timeoutMs })
-    });
     throw new Error('SANDBOX_CONTROL_CONTAINER_ABSENT: recreate the sandbox container before broker recovery');
   }
   const brokerPath = path.join(control.root, 'broker.json');
@@ -1285,6 +1282,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
   const deps = params.deps;
   const startFn = deps?.start ?? startSandboxContainer;
   const warnings: string[] = [];
+  const container = params.row?.name ?? containerName(params.config, params.branch);
   let failure: Error | null = null;
   try {
     if (deps?.ensureControlBroker) {
@@ -1292,11 +1290,11 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
     } else {
       await ensureSandboxControlBroker({
         config: params.config,
-        container: params.row.name,
+        container: container,
         workspace: params.workspace ?? { mode: 'branch-only' }
       });
     }
-    if (params.forceRecreate || (params.reentry === 'completed' && params.allowRecreate)) {
+    if (!params.row || params.forceRecreate || (params.reentry === 'completed' && params.allowRecreate)) {
       throw new Error('Explicit container recreation requested.');
     }
     if (!params.row.running) {
@@ -1304,7 +1302,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
       if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
         const control = sandboxControlPaths({
           base: params.config.controlBase, project: params.config.project,
-          container: params.row.name, identity: params.workspace
+          container: container, identity: params.workspace
         });
         const manifest = readSandboxControlManifest(control.manifestPath);
         if (manifest.taskId !== params.workspace.taskId || manifest.branch !== params.branch) {
@@ -1314,19 +1312,19 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
         startCompletedSandboxContainer({
           config: params.config,
           engine: params.engine,
-          container: params.row.name,
+          container: container,
           taskId: params.workspace.taskId,
           start: startFn
         });
       } else {
-        startFn(params.engine, params.row.name);
+        startFn(params.engine, container);
       }
       const initial = assess({
         config: params.config,
         engine: params.engine,
         branch: params.branch,
         workspace: params.workspace,
-        container: params.row.name,
+        container: container,
         deps
       });
       if (initial.findings.some((finding) => finding.repairKind === 'hard-failure')) {
@@ -1337,13 +1335,13 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
       const tools = resolveTools(params.config);
       prepareTmpfsMounts({
         engine: params.engine,
-        container: params.row.name,
+        container: container,
         mountPaths: tools.filter((tool) => tool.tmpfs).map((tool) => tool.containerMount),
         deps
       });
       hydrateTmpfsSeedEntries({
         engine: params.engine,
-        container: params.row.name,
+        container: container,
         entries: mountedSeeds(initial.snapshot),
         replace: true,
         deps
@@ -1353,13 +1351,13 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
         engine: params.engine,
         branch: params.branch,
         workspace: params.workspace,
-        container: params.row.name,
+        container: container,
         deps
       });
       if (!final.findings.some((finding) => finding.repairKind === 'hard-failure')) {
         repairFindings({
           engine: params.engine,
-          container: params.row.name,
+          container: container,
           findings: final.findings,
           deps
         });
@@ -1368,7 +1366,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
           engine: params.engine,
           branch: params.branch,
           workspace: params.workspace,
-          container: params.row.name,
+          container: container,
           deps
         });
       }
@@ -1384,7 +1382,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
         publishCompletedReentry(manifest, evidence);
         await waitForCompletedReentry(manifest, evidence);
       }
-      return { container: params.row.name, path: 'recovered', warnings };
+      return { container: container, path: 'recovered', warnings };
     }
 
     const initial = assess({
@@ -1392,11 +1390,11 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
       engine: params.engine,
       branch: params.branch,
       workspace: params.workspace,
-      container: params.row.name,
+      container: container,
       deps
     });
     if (initial.findings.length === 0) {
-      return { container: params.row.name, path: 'healthy', warnings };
+      return { container: container, path: 'healthy', warnings };
     }
     if (initial.findings.some((finding) => finding.repairKind === 'hard-failure')) {
       throw new Error(describeFindings(initial.findings));
@@ -1408,7 +1406,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
     if (permissionFindings.length > 0) {
       repairFindings({
         engine: params.engine,
-        container: params.row.name,
+        container: container,
         findings: permissionFindings,
         deps
       });
@@ -1417,7 +1415,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
         engine: params.engine,
         branch: params.branch,
         workspace: params.workspace,
-        container: params.row.name,
+        container: container,
         deps
       });
       if (current.findings.some(
@@ -1429,7 +1427,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
     }
     repairFindings({
       engine: params.engine,
-      container: params.row.name,
+      container: container,
       findings: current.findings,
       deps
     });
@@ -1438,13 +1436,13 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
       engine: params.engine,
       branch: params.branch,
       workspace: params.workspace,
-      container: params.row.name,
+      container: container,
       deps
     });
     if (final.findings.length > 0) {
       throw new Error(describeFindings(final.findings));
     }
-    return { container: params.row.name, path: 'recovered', warnings };
+    return { container: container, path: 'recovered', warnings };
   } catch (error) {
     failure = error instanceof Error ? error : new Error(String(error));
   }
@@ -1455,7 +1453,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
     }
     const taskId = params.workspace.taskId;
     const commandChain = [
-      `docker exec -it ${params.row.name} bash /usr/local/bin/sandbox-tmux-entry`,
+      `docker exec -it ${container} bash /usr/local/bin/sandbox-tmux-entry`,
       `ai sandbox rm ${taskId}`,
       `ai sandbox create ${params.branch}`
     ];
@@ -1467,7 +1465,7 @@ export async function ensureSandboxReady(params: EnsureSandboxReadyParams): Prom
       : 'Completed sandbox recovery failed; the existing container was not replaced.';
     throw new Error([
       `${code}: ${lead}`,
-      `Task: ${taskId}; container: ${params.row.name}; branch: ${params.branch}.`,
+      `Task: ${taskId}; container: ${container}; branch: ${params.branch}.`,
       'To preserve the current container state, enter it manually with:',
       `  ${commandChain[0]}`,
       'If you intentionally want a replacement, the following is the full interactive sandbox cleanup, not a container-only delete.',