@fitlab-ai/agent-infra 0.7.3 → 0.7.4

package/lib/sandbox/commands/create.ts

@@ -840,7 +840,34 @@ export function ensureClaudeSettings(toolDir: string, hostHomeDir?: string): voi
   }
 }
 
-export function ensureCodexModelInheritance(toolDir: string, hostHomeDir?: string): void {
+function resolveHostCatalogPath(value: unknown, hostHomeDir: string): string | null {
+  if (typeof value !== 'string' || value === '') {
+    return null;
+  }
+  let resolved: string;
+  if (value === '~' || value.startsWith('~/') || value.startsWith('~\\')) {
+    resolved = path.join(hostHomeDir, value.slice(1).replace(/^[/\\]+/, ''));
+  } else if (path.isAbsolute(value)) {
+    resolved = value;
+  } else {
+    resolved = path.join(hostHomeDir, '.codex', value);
+  }
+  try {
+    if (!fs.statSync(resolved).isFile()) {
+      return null;
+    }
+    fs.accessSync(resolved, fs.constants.R_OK);
+    return resolved;
+  } catch {
+    return null;
+  }
+}
+
+export function ensureCodexModelInheritance(
+  toolDir: string,
+  hostHomeDir?: string,
+  containerCodexDir: string = '/home/devuser/.codex'
+): void {
   if (!hostHomeDir) {
     return;
   }
@@ -890,6 +917,22 @@ export function ensureCodexModelInheritance(toolDir: string, hostHomeDir?: strin
     changed = true;
   }
 
+  if (!Object.hasOwn(sandboxParsed, 'model_catalog_json')) {
+    const hostCatalogPath = resolveHostCatalogPath(hostParsed['model_catalog_json'], hostHomeDir);
+    if (hostCatalogPath) {
+      try {
+        const basename = path.basename(hostCatalogPath);
+        const destDir = path.join(toolDir, 'model-catalogs');
+        fs.mkdirSync(destDir, { recursive: true });
+        fs.copyFileSync(hostCatalogPath, path.join(destDir, basename));
+        sandboxParsed['model_catalog_json'] = path.posix.join(containerCodexDir, 'model-catalogs', basename);
+        changed = true;
+      } catch {
+        // Copy failed (e.g. permissions): skip catalog, keep scalar inheritance intact.
+      }
+    }
+  }
+
   if (changed) {
     fs.writeFileSync(sandboxConfigPath, `${toml.stringify(sandboxParsed)}\n`, 'utf8');
   }
@@ -1042,7 +1085,7 @@ function runEngineTaskCommand(engine: string, cmd: string, args: string[], opts:
 }
 
 export function buildImage(
-  config: SandboxCreateConfig,
+  config: Pick<SandboxCreateConfig, 'project' | 'imageName' | 'repoRoot'> & { engine?: string | null },
   tools: SandboxTool[],
   dockerfilePath: string,
   imageSignature: string,
@@ -1060,7 +1103,7 @@ export function buildImage(
     env?: NodeJS.ProcessEnv;
   } = {}
 ): void {
-  const selectedEngine = engine ?? detectEngine(config);
+  const selectedEngine = engine ?? detectEngine({ engine: config.engine });
   const { uid: hostUid, gid: hostGid } = resolveBuildUid({
     engine: selectedEngine,
     runFn,
@@ -1342,7 +1385,7 @@ export async function create(args: string[]): Promise<void> {
             }
             const codexEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'codex');
             if (codexEntry) {
-              ensureCodexModelInheritance(codexEntry.dir, effectiveConfig.home);
+              ensureCodexModelInheritance(codexEntry.dir, effectiveConfig.home, codexEntry.tool.containerMount);
               ensureCodexWorkspaceTrust(codexEntry.dir);
             }
             const geminiEntry = effectiveResolvedTools.find(({ tool }) => tool.id === 'gemini-cli');

package/lib/sandbox/commands/rm.ts

@@ -21,15 +21,27 @@ import { runOk, runSafe, runSafeEngine } from '../shell.ts';
 import { resolveTaskBranch } from '../task-resolver.ts';
 import { resolveTools, toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.ts';
 import type { SandboxTool } from '../tools.ts';
+import { fetchSandboxRows } from './list-running.ts';
+import { lookupShortIdByBranch } from '../../task/short-id.ts';
 
-const USAGE = `Usage: ai sandbox rm <branch> [--all]`;
+const USAGE = `Usage:
+  ai sandbox rm <branch>                    Remove one sandbox (branch | TASK-id | short id)
+  ai sandbox rm --all [--dry-run] [--yes]   Remove every sandbox not bound to an active task
+  ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;
 export { assertManagedPath } from '../managed-fs.ts';
 
 function projectToolDirs(config: SandboxConfig, tools: SandboxTool[]): string[] {
   return tools.flatMap((tool) => toolProjectDirCandidates(tool, config.project));
 }
 
-async function rmOne(config: SandboxConfig, tools: SandboxTool[], branch: string): Promise<void> {
+type RmOneOptions = { assumeYes?: boolean; quiet?: boolean };
+
+async function rmOne(
+  config: SandboxConfig,
+  tools: SandboxTool[],
+  branch: string,
+  options: RmOneOptions = {}
+): Promise<void> {
   assertValidBranchName(branch);
   const engine = detectEngine(config);
   let effectiveBranch = branch;
@@ -39,7 +51,9 @@ async function rmOne(config: SandboxConfig, tools: SandboxTool[], branch: string
     candidates: toolConfigDirCandidates(tool, config.project, branch)
   }));
 
-  p.intro(pc.cyan(`Removing sandbox for ${branch}`));
+  if (!options.quiet) {
+    p.intro(pc.cyan(`Removing sandbox for ${branch}`));
+  }
 
   const existing = runSafeEngine(engine, 'docker', ['ps', '-a', '--format', '{{.Names}}']).split('\n').filter(Boolean);
   const matchedContainers = containerNameCandidates(config, branch)
@@ -74,10 +88,12 @@ async function rmOne(config: SandboxConfig, tools: SandboxTool[], branch: string
 
   const existingWorktrees = worktreeCandidates.filter((candidate) => fs.existsSync(candidate));
   if (existingWorktrees.length > 0) {
-    const shouldRemoveWorktree = await p.confirm({
-      message: `Remove worktree(s): ${existingWorktrees.join(', ')}?`,
-      initialValue: true
-    });
+    const shouldRemoveWorktree = options.assumeYes
+      ? true
+      : await p.confirm({
+          message: `Remove worktree(s): ${existingWorktrees.join(', ')}?`,
+          initialValue: true
+        });
 
     if (p.isCancel(shouldRemoveWorktree)) {
       p.outro('Cancelled');
@@ -89,10 +105,12 @@ async function rmOne(config: SandboxConfig, tools: SandboxTool[], branch: string
         removeWorktreeDir(config.repoRoot, config.worktreeBase, worktree);
       }
 
-      const shouldDeleteBranch = await p.confirm({
-        message: `Also delete local branch '${effectiveBranch}'?`,
-        initialValue: true
-      });
+      const shouldDeleteBranch = options.assumeYes
+        ? true
+        : await p.confirm({
+            message: `Also delete local branch '${effectiveBranch}'?`,
+            initialValue: true
+          });
 
       if (!p.isCancel(shouldDeleteBranch) && shouldDeleteBranch) {
         if (!runOk('git', ['-C', config.repoRoot, 'branch', '-D', effectiveBranch])) {
@@ -116,20 +134,24 @@ async function rmOne(config: SandboxConfig, tools: SandboxTool[], branch: string
 
   const shareBranch = shareBranchDir(config, effectiveBranch);
   if (fs.existsSync(shareBranch)) {
-    const shouldRemoveShare = await p.confirm({
-      message: `Remove share dir for branch '${effectiveBranch}' (${shareBranch})?`,
-      initialValue: true
-    });
+    const shouldRemoveShare = options.assumeYes
+      ? true
+      : await p.confirm({
+          message: `Remove share dir for branch '${effectiveBranch}' (${shareBranch})?`,
+          initialValue: true
+        });
     if (!p.isCancel(shouldRemoveShare) && shouldRemoveShare) {
       removeManagedDir(config.shareBase, shareBranch);
       p.log.success(`Share dir removed: ${shareBranch}`);
     }
   }
 
-  p.outro(pc.green('Sandbox removed'));
+  if (!options.quiet) {
+    p.outro(pc.green('Sandbox removed'));
+  }
 }
 
-async function rmAll(config: SandboxConfig, tools: SandboxTool[]): Promise<void> {
+async function rmPurge(config: SandboxConfig, tools: SandboxTool[]): Promise<void> {
   const engine = detectEngine(config);
   p.intro(pc.cyan(`Removing all sandboxes for ${config.project}`));
 
@@ -231,6 +253,70 @@ async function rmAll(config: SandboxConfig, tools: SandboxTool[]): Promise<void>
   p.outro(pc.green('All project sandboxes removed'));
 }
 
+async function rmUnbound(
+  config: SandboxConfig,
+  tools: SandboxTool[],
+  options: { dryRun: boolean; assumeYes: boolean }
+): Promise<void> {
+  const engine = detectEngine(config);
+  const { running, nonRunning } = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
+  const removable = [...running, ...nonRunning].filter(
+    (row) => row.branch && lookupShortIdByBranch(row.branch, config.repoRoot) === null
+  );
+
+  p.intro(pc.cyan(`Removing sandboxes not bound to an active task for ${config.project}`));
+
+  if (removable.length === 0) {
+    p.outro('No removable sandboxes: every container is bound to an active task (or none exist)');
+    return;
+  }
+
+  for (const row of removable) {
+    p.log.message(`${row.name}  ${row.branch}`);
+  }
+
+  if (options.dryRun) {
+    p.outro(`Dry run: ${removable.length} sandbox(es) would be removed, nothing deleted`);
+    return;
+  }
+
+  if (!options.assumeYes) {
+    if (!process.stdin.isTTY) {
+      throw new Error(
+        'Refusing to remove sandboxes without confirmation in a non-interactive shell; pass --yes to proceed.'
+      );
+    }
+    const confirmed = await p.confirm({
+      message: `Remove these ${removable.length} sandbox(es)?`,
+      initialValue: false
+    });
+    if (p.isCancel(confirmed) || !confirmed) {
+      p.outro('Cancelled');
+      return;
+    }
+  }
+
+  const failures: { branch: string; message: string }[] = [];
+  for (const row of removable) {
+    try {
+      await rmOne(config, tools, row.branch, { assumeYes: true, quiet: true });
+    } catch (error) {
+      failures.push({ branch: row.branch, message: error instanceof Error ? error.message : String(error) });
+    }
+  }
+
+  if (failures.length > 0) {
+    for (const failure of failures) {
+      p.log.error(`Failed to remove '${failure.branch}': ${failure.message}`);
+    }
+    throw new Error(
+      `Removed ${removable.length - failures.length}/${removable.length} sandbox(es); ${failures.length} failed`
+    );
+  }
+
+  p.outro(pc.green(`Removed ${removable.length} sandbox(es)`));
+}
+
 export async function rm(args: string[]): Promise<void> {
   const { values, positionals } = parseArgs({
     args,
@@ -238,6 +324,9 @@ export async function rm(args: string[]): Promise<void> {
     strict: true,
     options: {
       all: { type: 'boolean' },
+      purge: { type: 'boolean' },
+      'dry-run': { type: 'boolean' },
+      yes: { type: 'boolean', short: 'y' },
       help: { type: 'boolean', short: 'h' }
     }
   });
@@ -247,15 +336,35 @@ export async function rm(args: string[]): Promise<void> {
     return;
   }
 
-  if (!values.all && positionals.length !== 1) {
+  if (values.all && values.purge) {
+    throw new Error('--all and --purge are mutually exclusive');
+  }
+
+  if ((values['dry-run'] || values.yes) && !values.all) {
+    throw new Error('--dry-run and --yes only apply to --all');
+  }
+
+  if ((values.all || values.purge) && positionals.length > 0) {
+    throw new Error(`${values.all ? '--all' : '--purge'} does not take a branch argument`);
+  }
+
+  if (!values.all && !values.purge && positionals.length !== 1) {
     throw new Error(USAGE);
   }
 
   const config = loadConfig();
   const tools = resolveTools(config);
 
+  if (values.purge) {
+    await rmPurge(config, tools);
+    return;
+  }
+
   if (values.all) {
-    await rmAll(config, tools);
+    await rmUnbound(config, tools, {
+      dryRun: Boolean(values['dry-run']),
+      assumeYes: Boolean(values.yes)
+    });
     return;
   }
 

package/lib/sandbox/index.ts

@@ -16,7 +16,9 @@ Commands:
   rebuild [--quiet] [--refresh]
                                Rebuild the sandbox image (--refresh pulls base + tools)
   refresh                      Sync host Claude Code credentials to all sandbox copies
-  rm <branch> [--all]          Remove a sandbox or all sandboxes
+  rm <branch> | --all | --purge
+                               Remove one sandbox, all sandboxes not bound to an
+                               active task (--all), or tear down everything (--purge)
   vm status|start|stop         Manage the sandbox VM (macOS) or check the backend (Windows)
 
 Run 'ai sandbox <command> --help' for details.`;

package/lib/sandbox/readme-scaffold.ts

@@ -18,7 +18,7 @@ symlink under \`$HOME\` (e.g. \`.tmux.conf\` -> \`/home/devuser/.tmux.conf\`),
 overriding image defaults so your editor, shell, and tool preferences follow
 you across \`ai sandbox destroy + create\`.
 
-See: https://github.com/fitlab-ai/agent-infra/blob/main/README.md#user-level-dotfiles-channel
+See: https://github.com/fitlab-ai/agent-infra/blob/main/docs/en/sandbox.md#user-level-dotfiles-channel
 
 Common usage - drop files or symlinks here:
 
@@ -46,7 +46,7 @@ only writes \`README.md\` when it is missing, never when it already exists.
 （例如 \`.tmux.conf -> /home/devuser/.tmux.conf\`），覆盖镜像默认值，让你的编辑器、
 shell、工具偏好跨 \`ai sandbox destroy + create\` 持久存在。
 
-参考：https://github.com/fitlab-ai/agent-infra/blob/main/README.zh-CN.md#用户级-dotfiles-通道
+参考：https://github.com/fitlab-ai/agent-infra/blob/main/docs/zh-CN/sandbox.md#用户级-dotfiles-通道
 
 常见用法：把文件或符号链接放进来：
 
@@ -72,7 +72,7 @@ This directory is mounted **read-write** into every sandbox container of this
 project at \`/share/common\`, regardless of branch. Drop files here to share
 between host and any sandbox without polluting the git worktree.
 
-See: https://github.com/fitlab-ai/agent-infra/blob/main/README.md#host-sandbox-file-exchange
+See: https://github.com/fitlab-ai/agent-infra/blob/main/docs/en/sandbox.md#host-sandbox-file-exchange
 
 This file is safe to delete; the next \`ai sandbox create\` will re-create it.
 
@@ -83,7 +83,7 @@ This file is safe to delete; the next \`ai sandbox create\` will re-create it.
 该目录被以**读写**方式挂载到本项目所有 sandbox 容器的 \`/share/common\`，
 跨分支可见。可用来在宿主和任意 sandbox 之间传文件，无需弄脏 git worktree。
 
-参考：https://github.com/fitlab-ai/agent-infra/blob/main/README.zh-CN.md#宿主-沙箱文件交换
+参考：https://github.com/fitlab-ai/agent-infra/blob/main/docs/zh-CN/sandbox.md#宿主-沙箱文件交换
 
 该文件可以安全删除；下一次 \`ai sandbox create\` 会重新生成。
 `;
@@ -94,7 +94,7 @@ This directory is mounted **read-write** into the sandbox container of this
 project's current branch at \`/share/branch\`. Files here are exclusive to this
 branch's sandbox and do not leak across branches.
 
-See: https://github.com/fitlab-ai/agent-infra/blob/main/README.md#host-sandbox-file-exchange
+See: https://github.com/fitlab-ai/agent-infra/blob/main/docs/en/sandbox.md#host-sandbox-file-exchange
 
 This file is safe to delete; the next \`ai sandbox create\` will re-create it.
 
@@ -105,7 +105,7 @@ This file is safe to delete; the next \`ai sandbox create\` will re-create it.
 该目录被以**读写**方式挂载到本项目当前分支 sandbox 容器的 \`/share/branch\`，
 仅当前分支可见，不会跨分支泄漏。
 
-参考：https://github.com/fitlab-ai/agent-infra/blob/main/README.zh-CN.md#宿主-沙箱文件交换
+参考：https://github.com/fitlab-ai/agent-infra/blob/main/docs/zh-CN/sandbox.md#宿主-沙箱文件交换
 
 该文件可以安全删除；下一次 \`ai sandbox create\` 会重新生成。
 `;

package/lib/task/artifacts.ts

@@ -0,0 +1,72 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+type Artifact = {
+  index: number;
+  name: string;
+  path: string;
+  size: number;
+  mtimeMs: number;
+};
+
+/**
+ * Enumerate a task directory's artifacts ordered by modification time, oldest
+ * first, so the listing reads like the task's timeline. Filename ascending is a
+ * deterministic tiebreak when two files share the same mtime (e.g. written in
+ * the same millisecond).
+ *
+ * Only top-level regular files are included; subdirectories and dotfiles are
+ * skipped so every entry is something `cat` can print. The returned 1-based
+ * `index` is the source of truth shared by `files` and `cat`.
+ */
+function enumerateArtifacts(taskDir: string): Artifact[] {
+  const entries = fs
+    .readdirSync(taskDir, { withFileTypes: true })
+    .filter((dirent) => dirent.isFile() && !dirent.name.startsWith('.'))
+    .map((dirent) => {
+      const abs = path.join(taskDir, dirent.name);
+      const stat = fs.statSync(abs);
+      return { name: dirent.name, path: abs, size: stat.size, mtimeMs: stat.mtimeMs };
+    });
+
+  entries.sort((a, b) => {
+    if (a.mtimeMs !== b.mtimeMs) return a.mtimeMs - b.mtimeMs;
+    return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+  });
+
+  return entries.map((entry, i) => ({ index: i + 1, ...entry }));
+}
+
+/**
+ * Resolve an artifact selector to an absolute path within `taskDir`. The
+ * selector is either a 1-based index `N` (as listed by `files`) or a filename
+ * (with or without the `.md` suffix). Throws with a clear message on failure.
+ */
+function resolveArtifact(taskDir: string, artifactOrN: string): string {
+  if (path.basename(artifactOrN) !== artifactOrN) {
+    throw new Error('artifact name must not contain path separators');
+  }
+
+  if (/^\d+$/.test(artifactOrN)) {
+    const n = Number(artifactOrN);
+    const match = enumerateArtifacts(taskDir).find((a) => a.index === n);
+    if (!match) {
+      throw new Error(`invalid artifact index ${n} (run 'ai task files <ref>' to list)`);
+    }
+    return match.path;
+  }
+
+  const candidates = artifactOrN.endsWith('.md')
+    ? [artifactOrN]
+    : [artifactOrN, `${artifactOrN}.md`];
+  for (const candidate of candidates) {
+    const abs = path.join(taskDir, candidate);
+    if (fs.existsSync(abs) && fs.statSync(abs).isFile()) {
+      return abs;
+    }
+  }
+  throw new Error(`artifact '${artifactOrN}' not found in task directory`);
+}
+
+export { enumerateArtifacts, resolveArtifact };
+export type { Artifact };

package/lib/task/commands/cat.ts

@@ -0,0 +1,39 @@
+import fs from 'node:fs';
+import { resolveTaskRef } from '../resolve-ref.ts';
+import { resolveArtifact } from '../artifacts.ts';
+
+const USAGE = `Usage: ai task cat <N | #N | TASK-id> <artifact | N>
+
+Prints a task artifact's raw content to stdout.
+  <ref>            Bare numeric / '#N' short id, or a full TASK-YYYYMMDD-HHMMSS id.
+  <artifact | N>   Artifact filename (with or without '.md'), or the number from 'ai task files'.
+`;
+
+function cat(args: string[] = []): void {
+  if (args[0] === '--help' || args[0] === '-h') {
+    process.stdout.write(USAGE);
+    return;
+  }
+  if (args.length < 2) {
+    process.stdout.write(USAGE);
+    process.exitCode = 1;
+    return;
+  }
+  const resolved = resolveTaskRef(args[0]!);
+  if (!resolved.ok) {
+    process.stderr.write(`ai task cat: ${resolved.message}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  let artifactPath: string;
+  try {
+    artifactPath = resolveArtifact(resolved.taskDir, args[1]!);
+  } catch (e) {
+    process.stderr.write(`ai task cat: ${(e as Error).message}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(fs.readFileSync(artifactPath, 'utf8'));
+}
+
+export { cat };

package/lib/task/commands/files.ts

@@ -0,0 +1,53 @@
+import { formatTable } from '../../table.ts';
+import { resolveTaskRef } from '../resolve-ref.ts';
+import { enumerateArtifacts } from '../artifacts.ts';
+
+const USAGE = `Usage: ai task files <N | #N | TASK-id>
+
+Lists the artifacts in a task directory with stable numbers.
+  <ref>   Bare numeric / '#N' short id, or a full TASK-YYYYMMDD-HHMMSS id.
+
+Columns: # (artifact number, usable with 'ai task cat') / NAME / SIZE (bytes) / MTIME
+`;
+
+const TABLE_HEADERS = ['#', 'NAME', 'SIZE', 'MTIME'] as const;
+
+function pad2(n: number): string {
+  return String(n).padStart(2, '0');
+}
+
+function formatMtime(mtimeMs: number): string {
+  const d = new Date(mtimeMs);
+  return (
+    `${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ` +
+    `${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`
+  );
+}
+
+function files(args: string[] = []): void {
+  if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
+    process.stdout.write(USAGE);
+    if (args.length === 0) process.exitCode = 1;
+    return;
+  }
+  const resolved = resolveTaskRef(args[0]!);
+  if (!resolved.ok) {
+    process.stderr.write(`ai task files: ${resolved.message}\n`);
+    process.exitCode = 1;
+    return;
+  }
+  const artifacts = enumerateArtifacts(resolved.taskDir);
+  // Show the name without the `.md` suffix so the NAME column is exactly what
+  // `ai task cat <ref> <name>` accepts (the resolver re-adds `.md`).
+  const rows = artifacts.map((a) => [
+    String(a.index),
+    a.name.replace(/\.md$/, ''),
+    String(a.size),
+    formatMtime(a.mtimeMs)
+  ]);
+  for (const line of formatTable(TABLE_HEADERS, rows, { zebra: Boolean(process.stdout.isTTY) })) {
+    process.stdout.write(`${line}\n`);
+  }
+}
+
+export { files };

package/lib/task/commands/grep.ts

@@ -0,0 +1,147 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveTaskRef, detectRepoRoot, enumerateTaskDirs } from '../resolve-ref.ts';
+import { enumerateArtifacts, resolveArtifact } from '../artifacts.ts';
+import { loadShortIdByTaskId } from '../short-id.ts';
+
+const USAGE = `Usage: ai task grep <pattern> [ref] [artifact | N]
+
+Literal (non-regex) line search across task artifacts.
+  <pattern>          Literal substring to match (NOT a regex). Case-sensitive by default.
+  [ref]              Bare numeric / '#N' short id, or a full TASK-YYYYMMDD-HHMMSS id.
+                     Omit to scan every task under active / blocked / completed
+                     (archive is skipped). With a ref, narrows to that single task
+                     (a TASK-id ref can also resolve an archived task).
+  [artifact | N]     Only valid with <ref>. Artifact filename (with or without '.md')
+                     or the number from 'ai task files'. Narrows to a single artifact.
+
+Options:
+  -i, --ignore-case  Case-insensitive matching.
+  --                 Treat the rest as positional (use for patterns starting with '-').
+
+Output: '{taskId} [#short] {fileStem}:{line}: {matched-line}' (short id only for active tasks).
+Exits 1 with no output when nothing matches.
+`;
+
+function makeMatcher(pattern: string, ignoreCase: boolean): (line: string) => boolean {
+  if (ignoreCase) {
+    const needle = pattern.toLowerCase();
+    return (line) => line.toLowerCase().includes(needle);
+  }
+  return (line) => line.includes(pattern);
+}
+
+// Split content into lines with grep-like semantics: a trailing newline does
+// not yield a phantom final empty line, but genuine interior blank lines stay.
+function splitLines(content: string): string[] {
+  const lines = content.split(/\r?\n/);
+  if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();
+  return lines;
+}
+
+function scanArtifact(
+  taskId: string,
+  shortToken: string | undefined,
+  artifactPath: string,
+  matcher: (line: string) => boolean,
+  emit: (line: string) => void
+): number {
+  const content = fs.readFileSync(artifactPath, 'utf8');
+  const stem = path.basename(artifactPath).replace(/\.md$/, '');
+  const prefix = shortToken ? `${taskId} ${shortToken}` : taskId;
+  let count = 0;
+  splitLines(content).forEach((line, i) => {
+    if (matcher(line)) {
+      emit(`${prefix} ${stem}:${i + 1}: ${line}\n`);
+      count++;
+    }
+  });
+  return count;
+}
+
+function grep(args: string[] = []): void {
+  const positional: string[] = [];
+  let ignoreCase = false;
+  let optsEnded = false;
+  for (const a of args) {
+    if (!optsEnded && a === '--') { optsEnded = true; continue; }
+    if (!optsEnded && (a === '-h' || a === '--help')) {
+      process.stdout.write(USAGE);
+      return;
+    }
+    if (!optsEnded && (a === '-i' || a === '--ignore-case')) { ignoreCase = true; continue; }
+    if (!optsEnded && a.startsWith('-') && a !== '-') {
+      process.stderr.write(`ai task grep: unknown flag: ${a}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    positional.push(a);
+  }
+
+  if (positional.length === 0) {
+    process.stdout.write(USAGE);
+    process.exitCode = 1;
+    return;
+  }
+  if (positional.length > 3) {
+    process.stderr.write('ai task grep: too many arguments\n');
+    process.exitCode = 1;
+    return;
+  }
+
+  const [pattern, ref, artifactOrN] = positional;
+  const matcher = makeMatcher(pattern!, ignoreCase);
+  const chunks: string[] = [];
+  const emit = (line: string) => chunks.push(line);
+  let total = 0;
+
+  if (ref === undefined) {
+    // No ref: full scan across active / blocked / completed (no archive).
+    let repoRoot: string;
+    try {
+      repoRoot = detectRepoRoot();
+    } catch (e) {
+      process.stderr.write(`ai task grep: ${(e as Error).message}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const shortMap = loadShortIdByTaskId(repoRoot);
+    for (const { taskId, taskDir } of enumerateTaskDirs(repoRoot)) {
+      const shortToken = shortMap.get(taskId);
+      for (const a of enumerateArtifacts(taskDir)) {
+        total += scanArtifact(taskId, shortToken, a.path, matcher, emit);
+      }
+    }
+  } else {
+    const resolved = resolveTaskRef(ref);
+    if (!resolved.ok) {
+      process.stderr.write(`ai task grep: ${resolved.message}\n`);
+      process.exitCode = 1;
+      return;
+    }
+    const shortToken = loadShortIdByTaskId(resolved.repoRoot).get(resolved.taskId);
+    if (artifactOrN !== undefined) {
+      let artifactPath: string;
+      try {
+        artifactPath = resolveArtifact(resolved.taskDir, artifactOrN);
+      } catch (e) {
+        process.stderr.write(`ai task grep: ${(e as Error).message}\n`);
+        process.exitCode = 1;
+        return;
+      }
+      total += scanArtifact(resolved.taskId, shortToken, artifactPath, matcher, emit);
+    } else {
+      for (const a of enumerateArtifacts(resolved.taskDir)) {
+        total += scanArtifact(resolved.taskId, shortToken, a.path, matcher, emit);
+      }
+    }
+  }
+
+  if (total === 0) {
+    process.exitCode = 1;
+    return;
+  }
+  process.stdout.write(chunks.join(''));
+}
+
+export { grep };