@fitlab-ai/agent-infra 0.8.4 → 0.8.5

package/dist/lib/defaults.json

@@ -44,8 +44,16 @@
       ".gemini/commands/",
       ".git-hooks/check-version-format.sh",
       ".github/scripts/",
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml",
       ".opencode/commands/"
     ],
+    "guardedManaged": [
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml"
+    ],
     "merged": [
       "**/post-release.*",
       "**/release.*",

package/dist/lib/init.js

@@ -197,6 +197,8 @@ async function cmdInit() {
     // install skill
     copySkillDir(path.join(templateDir, '.agents', 'skills', 'update-agent-infra'), path.join('.agents', 'skills', 'update-agent-infra'), replacements, language, platformType);
     ok('Installed .agents/skills/update-agent-infra/');
+    renderFile(path.join(templateDir, '.agents', 'scripts', 'lib', 'agent-infra-package.js'), path.join('.agents', 'scripts', 'lib', 'agent-infra-package.js'), replacements);
+    ok('Installed .agents/scripts/lib/agent-infra-package.js');
     // install Claude command (only if enabled)
     if (enabledTUISet.has('claude-code')) {
         renderFile(path.join(templateDir, '.claude', 'commands', claudeSrc), path.join('.claude', 'commands', 'update-agent-infra.md'), replacements);
@@ -245,6 +247,9 @@ async function cmdInit() {
     console.log('');
     ok('Project initialized successfully!');
     console.log('');
+    console.log('  If this init used npx, install agent-infra persistently before update or validation:');
+    console.log('    npm install -g @fitlab-ai/agent-infra');
+    console.log('');
     if (enabledTUISet.size === 0) {
         console.log('  No built-in TUI selected.');
         console.log(`  Configure "customTUIs" in ${configPath} before running update-agent-infra.`);

package/dist/lib/sandbox/commands/create.js

@@ -47,13 +47,27 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
   as ${CONTAINER_HOME}/.bash_aliases inside the sandbox container (the host
   shell-config directory is bind-mounted at ${CONTAINER_SHELL_CONFIG_MOUNT} and
-  symlinked into $HOME).`;
+  symlinked into $HOME).
+
+Proxy:
+  --inherit-proxy, -P  Copy non-empty standard host proxy variables into the
+                       container environment through the private env file.`;
+const HOST_PROXY_ENV_KEYS = [
+    'http_proxy',
+    'HTTP_PROXY',
+    'https_proxy',
+    'HTTPS_PROXY',
+    'all_proxy',
+    'ALL_PROXY',
+    'no_proxy',
+    'NO_PROXY'
+];
 function resolveToolDirs(config, tools, branch) {
     return tools.map((tool) => {
         const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -425,9 +439,17 @@ function formatEnvFileEntry(key, value) {
     }
     return `${key}=${value}`;
 }
+export function collectHostProxyEntries(env) {
+    const entriesByExactKey = new Map(Object.entries(env));
+    return HOST_PROXY_ENV_KEYS.flatMap((key) => {
+        const value = entriesByExactKey.get(key);
+        return typeof value === 'string' && value !== '' ? [[key, value]] : [];
+    });
+}
 export function buildContainerEnvFile(resolvedTools, engine, runSafeEngineFn = runSafeEngine, options = {}) {
-    const { mkdtempFn = fs.mkdtempSync, writeFileFn = fs.writeFileSync, chmodFn = fs.chmodSync, rmFn = fs.rmSync, tmpDir = os.tmpdir(), runSafeFn = runSafe } = options;
+    const { additionalEntries = [], mkdtempFn = fs.mkdtempSync, writeFileFn = fs.writeFileSync, chmodFn = fs.chmodSync, rmFn = fs.rmSync, tmpDir = os.tmpdir(), runSafeFn = runSafe } = options;
     const entries = resolvedTools.flatMap(({ tool }) => Object.entries(tool.envVars ?? {}));
+    entries.push(...additionalEntries);
     let ghToken = runSafeEngineFn(engine, 'gh', ['auth', 'token']);
     if (!ghToken && engine === 'wsl2') {
         ghToken = runSafeFn('gh', ['auth', 'token']);
@@ -933,6 +955,7 @@ export async function create(args) {
             cpu: { type: 'string' },
             memory: { type: 'string' },
             'no-refresh': { type: 'boolean' },
+            'inherit-proxy': { type: 'boolean', short: 'P' },
             help: { type: 'boolean', short: 'h' }
         }
     });
@@ -1148,7 +1171,10 @@ export async function create(args) {
                     const cachedGpg = needsGpg
                         ? readGpgCache(effectiveConfig.home, effectiveConfig.project, undefined, signingKey)
                         : null;
-                    const envFile = buildContainerEnvFile(effectiveResolvedTools, engine);
+                    const proxyEntries = values['inherit-proxy'] ? collectHostProxyEntries(process.env) : [];
+                    const envFile = buildContainerEnvFile(effectiveResolvedTools, engine, undefined, {
+                        additionalEntries: proxyEntries
+                    });
                     let hostShellConfig;
                     let tmpfsSeedPlan = [];
                     try {

package/dist/lib/sandbox/engine.js

@@ -1,7 +1,7 @@
 import { platform } from 'node:os';
 import { detectHostResources } from './constants.js';
 import { ADAPTERS, enginesForPlatform, getAdapter } from './engines/index.js';
-import { run, runOk, runSafe, runVerbose } from './shell.js';
+import { run, runOk, runOkEngine, runSafe, runVerbose } from './shell.js';
 export const ENGINES = Object.freeze({
     COLIMA: 'colima',
     ORBSTACK: 'orbstack',
@@ -27,6 +27,34 @@ function applyDockerContext(adapter) {
         process.env.DOCKER_CONTEXT = adapter.dockerContext;
     }
 }
+function buildKitError(engine) {
+    let repair;
+    switch (engine) {
+        case ENGINES.COLIMA:
+            repair = 'Install the Docker Buildx plugin with: brew install docker-buildx';
+            break;
+        case ENGINES.DOCKER_DESKTOP:
+        case ENGINES.WSL2:
+            repair = 'Upgrade or repair Docker Desktop so Docker Buildx and BuildKit are available.';
+            break;
+        case ENGINES.NATIVE:
+            repair = 'Install the Docker Buildx plugin for your Docker Engine installation.';
+            break;
+        default:
+            repair = `Upgrade or repair ${engineDisplayName(engine)} so Docker Buildx and BuildKit are available.`;
+    }
+    return new Error([
+        `Docker BuildKit is not available for ${engineDisplayName(engine)}.`,
+        repair,
+        'Verify the builder with: docker buildx inspect --bootstrap',
+        'Then retry the sandbox create or rebuild command.'
+    ].join('\n'));
+}
+function ensureBuildKit(engine, runOkEngineFn) {
+    if (!runOkEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap'])) {
+        throw buildKitError(engine);
+    }
+}
 export function validateSandboxEngine(engine, { platformFn = platform } = {}) {
     if (engine === null || engine === undefined) {
         return null;
@@ -90,9 +118,11 @@ export async function ensureDocker(config, onMessage, dependencies = {}) {
     const engine = detectEngine(config, dependencies);
     const adapter = getAdapter(engine);
     const effectiveConfig = effectiveConfigFor(adapter, config);
+    const fns = runFns(dependencies);
     applyDockerContext(adapter);
-    const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, runFns(dependencies));
-    adapter.syncResources(effectiveConfig, onMessage, runFns(dependencies), { vmJustStarted });
+    const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, fns);
+    ensureBuildKit(engine, dependencies.runOkEngineFn ?? runOkEngine);
+    adapter.syncResources(effectiveConfig, onMessage, fns, { vmJustStarted });
 }
 export function isVmManaged(config = {}, dependencies = {}) {
     try {

package/dist/lib/sandbox/engines/colima.js

@@ -28,8 +28,8 @@ export const colimaAdapter = {
     async ensure(config, onMessage, { runOk, runSafe, runVerbose }) {
         let started = false;
         if (!runOk('which', ['colima'])) {
-            onMessage?.('Installing colima + docker via Homebrew...');
-            runVerbose('brew', ['install', 'colima', 'docker']);
+            onMessage?.('Installing colima + docker + docker-buildx via Homebrew...');
+            runVerbose('brew', ['install', 'colima', 'docker', 'docker-buildx']);
         }
         if (!runOk('colima', ['status'])) {
             onMessage?.('Starting Colima VM...');

package/dist/lib/sandbox/runtimes/base.dockerfile

@@ -191,6 +191,10 @@ fi
 exec tmux new-session -s "$SESSION"
 SCRIPT
 
+RUN test -s /usr/local/bin/cc-token-status && test -x /usr/local/bin/cc-token-status && \
+    test -s /usr/local/bin/sandbox-dotfiles-link && test -x /usr/local/bin/sandbox-dotfiles-link && \
+    test -s /usr/local/bin/sandbox-tmux-entry && test -x /usr/local/bin/sandbox-tmux-entry
+
 ENV LANG=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 ENV TERM=xterm-256color

package/dist/lib/server/daemon.js

@@ -8,6 +8,7 @@ import { runAi } from './runner.js';
 import { streamCommand } from './streamer.js';
 import { markdownMessage, replyOutbound, textMessage } from './display.js';
 import { buildStatusModel, statusModelToDisplay } from '../task/commands/status.js';
+import { getProcessStartTime, removePidRecordIfMatches } from './process-state.js';
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -85,6 +86,7 @@ export async function runDaemon() {
     }
     const logger = createLogger(config.log);
     logger.info(`daemon starting agent-infra ${VERSION} pid=${process.pid}`);
+    const ownStartTime = getProcessStartTime(process.pid);
     const abortController = new AbortController();
     let resolveShutdown = () => { };
     const shutdown = new Promise((resolve) => {
@@ -106,6 +108,13 @@ export async function runDaemon() {
             await unloadAdapters(adapters);
             clearInterval(heartbeat);
             logger.close();
+            if (ownStartTime !== null) {
+                removePidRecordIfMatches(config.pidFile, {
+                    version: 1,
+                    pid: process.pid,
+                    startTime: ownStartTime
+                });
+            }
             resolveShutdown();
         })();
     };

package/dist/lib/server/process-control.js

@@ -1,66 +1,44 @@
 import fs from 'node:fs';
-import path from 'node:path';
 import { spawn, execFileSync } from 'node:child_process';
 import { loadServerConfig } from './config.js';
 import { runDaemon } from './daemon.js';
+import { getProcessStartTime, isProcessAlive, processIdentityMatches, readProcessState, removePidFileIfMatches, writePidRecord } from './process-state.js';
+export { isProcessAlive } from './process-state.js';
 export function buildStopCommand(pid, platform) {
     if (platform === 'win32') {
         return { kind: 'exec', command: 'taskkill', args: ['/PID', String(pid), '/T', '/F'] };
     }
     return { kind: 'signal', signal: 'SIGTERM' };
 }
-// Liveness check that treats an exited-but-unreaped daemon as dead.
-//
-// The daemon is spawned detached and re-parented to init when `ai server start`
-// exits. After it terminates, `process.kill(pid, 0)` still succeeds until init
-// reaps the zombie. On Linux we therefore also check /proc state so status/stop
-// /start don't treat an already-exited daemon as running. macOS reaps orphans
-// via launchd and Windows has no zombies, so the kill(pid, 0) result is enough.
-export function isProcessAlive(pid) {
-    try {
-        process.kill(pid, 0);
-    }
-    catch (error) {
-        // EPERM means the process exists but we may not signal it → still alive.
-        return error.code === 'EPERM';
-    }
-    if (process.platform === 'linux') {
-        try {
-            const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
-            // The process state is the first token after the parenthesised comm.
-            const state = stat.slice(stat.lastIndexOf(')') + 1).trim().charAt(0);
-            if (state === 'Z')
-                return false;
-        }
-        catch {
-            return false; // /proc entry vanished → not alive
-        }
-    }
-    return true;
+function delay(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
 }
-function readPid(pidFile) {
-    try {
-        const raw = fs.readFileSync(pidFile, 'utf8').trim();
-        const pid = Number.parseInt(raw, 10);
-        return Number.isInteger(pid) && pid > 0 ? pid : null;
-    }
-    catch {
-        return null;
-    }
+async function waitForProcessIdentity(pid, timeoutMs = 2000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const startTime = getProcessStartTime(pid);
+        if (startTime !== null)
+            return { version: 1, pid, startTime };
+        await delay(25);
+    }
+    return null;
 }
-function removePidFile(pidFile) {
+function terminateIfMatching(record) {
+    if (!processIdentityMatches(record))
+        return;
+    const command = buildStopCommand(record.pid, process.platform);
     try {
-        fs.unlinkSync(pidFile);
+        if (command.kind === 'exec')
+            execFileSync(command.command, command.args);
+        else
+            process.kill(record.pid, command.signal);
     }
     catch {
-        // Already gone.
+        // Best effort cleanup for a daemon whose PID record could not be published.
     }
 }
-function delay(ms) {
-    return new Promise((resolve) => {
-        setTimeout(resolve, ms);
-    });
-}
 function enabledAdapterNames(config) {
     return Object.entries(config.adapters)
         .filter(([, adapter]) => adapter?.enabled === true)
@@ -69,15 +47,13 @@ function enabledAdapterNames(config) {
 export async function start({ foreground = false } = {}) {
     const config = loadServerConfig();
     const pidPath = config.pidFile;
-    // Zombie PID cleanup: a stale PID file from a crashed daemon must not block a
-    // fresh start.
-    const existing = readPid(pidPath);
-    if (existing !== null && isProcessAlive(existing)) {
-        process.stdout.write(`server already running (pid ${existing})\n`);
+    const existing = readProcessState(pidPath);
+    if (existing.kind === 'running') {
+        process.stdout.write(`server already running (pid ${existing.record.pid})\n`);
         return;
     }
-    if (existing !== null) {
-        removePidFile(pidPath);
+    if (existing.kind !== 'missing') {
+        removePidFileIfMatches(pidPath, existing.snapshot);
     }
     if (foreground) {
         await runDaemon();
@@ -98,47 +74,64 @@ export async function start({ foreground = false } = {}) {
     if (typeof child.pid !== 'number') {
         throw new Error('server: failed to spawn daemon process');
     }
-    fs.mkdirSync(path.dirname(pidPath), { recursive: true });
-    fs.writeFileSync(pidPath, `${child.pid}\n`);
-    process.stdout.write(`server started (pid ${child.pid})\n`);
+    // The initial check, spawn, and record publication are not a mutually
+    // exclusive transaction. Atomic publication keeps the record complete, but
+    // a separate locking design is required to serialize concurrent starts.
+    const record = await waitForProcessIdentity(child.pid);
+    if (record === null || !processIdentityMatches(record)) {
+        throw new Error('server: unable to verify spawned daemon process identity');
+    }
+    try {
+        writePidRecord(pidPath, record);
+    }
+    catch (error) {
+        terminateIfMatching(record);
+        throw error;
+    }
+    process.stdout.write(`server started (pid ${record.pid})\n`);
 }
 export async function stop() {
     const config = loadServerConfig();
-    const pid = readPid(config.pidFile);
-    if (pid === null) {
+    const state = readProcessState(config.pidFile);
+    if (state.kind === 'missing') {
         process.stdout.write('server is not running (no pid file)\n');
         return;
     }
-    if (!isProcessAlive(pid)) {
-        removePidFile(config.pidFile);
+    if (state.kind !== 'running') {
+        removePidFileIfMatches(config.pidFile, state.snapshot);
         process.stdout.write('server is not running (removed stale pid file)\n');
         return;
     }
-    const command = buildStopCommand(pid, process.platform);
+    const { record } = state;
+    if (!processIdentityMatches(record)) {
+        removePidFileIfMatches(config.pidFile, state.snapshot);
+        process.stdout.write('server is not running (removed stale pid file)\n');
+        return;
+    }
+    const command = buildStopCommand(record.pid, process.platform);
     if (command.kind === 'exec') {
         execFileSync(command.command, command.args);
     }
     else {
-        process.kill(pid, command.signal);
+        process.kill(record.pid, command.signal);
         const deadline = Date.now() + 5000;
-        while (isProcessAlive(pid) && Date.now() < deadline) {
+        while (isProcessAlive(record.pid) && Date.now() < deadline) {
             await delay(100);
         }
-        if (isProcessAlive(pid)) {
-            process.kill(pid, 'SIGKILL');
+        if (isProcessAlive(record.pid) && processIdentityMatches(record)) {
+            process.kill(record.pid, 'SIGKILL');
         }
     }
-    removePidFile(config.pidFile);
-    process.stdout.write(`server stopped (pid ${pid})\n`);
+    removePidFileIfMatches(config.pidFile, state.snapshot);
+    process.stdout.write(`server stopped (pid ${record.pid})\n`);
 }
 export function status() {
     const config = loadServerConfig();
-    const pid = readPid(config.pidFile);
-    if (pid === null || !isProcessAlive(pid)) {
+    const state = readProcessState(config.pidFile);
+    if (state.kind !== 'running') {
+        if (state.kind !== 'missing')
+            removePidFileIfMatches(config.pidFile, state.snapshot);
         process.stdout.write('server: stopped\n');
-        if (pid !== null) {
-            process.stdout.write(`  (stale pid file references pid ${pid})\n`);
-        }
         return;
     }
     let startedAt = 'unknown';
@@ -150,7 +143,7 @@ export function status() {
     }
     const adapters = enabledAdapterNames(config);
     process.stdout.write(`server: running\n` +
-        `  pid: ${pid}\n` +
+        `  pid: ${state.record.pid}\n` +
         `  started: ${startedAt}\n` +
         `  adapters: ${adapters.length > 0 ? adapters.join(', ') : '(none)'}\n` +
         `  pid file: ${config.pidFile}\n` +

package/dist/lib/server/process-state.js

@@ -0,0 +1,168 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+export function parseLinuxProcessStat(raw) {
+    const closeParen = raw.lastIndexOf(')');
+    if (closeParen < 0)
+        return null;
+    const fields = raw.slice(closeParen + 1).trim().split(/\s+/);
+    const state = fields[0];
+    const startTime = fields[19];
+    if (typeof state !== 'string' || state.length !== 1 || !/^\d+$/.test(startTime ?? '')) {
+        return null;
+    }
+    return { state, startTime: startTime };
+}
+export function buildProcessStartTimeQuery(pid, platform) {
+    if (platform === 'darwin') {
+        return { command: 'ps', args: ['-p', String(pid), '-o', 'lstart='] };
+    }
+    if (platform === 'win32') {
+        const script = `$process = Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}'; ` +
+            `if ($null -ne $process) { $process.CreationDate.ToUniversalTime().ToString('o') }`;
+        return {
+            command: 'powershell.exe',
+            args: ['-NoProfile', '-NonInteractive', '-Command', script]
+        };
+    }
+    return null;
+}
+export function isProcessAlive(pid, platform = process.platform) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return false;
+    if (platform === 'linux') {
+        try {
+            const stat = parseLinuxProcessStat(fs.readFileSync(`/proc/${pid}/stat`, 'utf8'));
+            return stat !== null && stat.state !== 'Z';
+        }
+        catch {
+            return false;
+        }
+    }
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+export function getProcessStartTime(pid, platform = process.platform) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        return null;
+    if (platform === 'linux') {
+        try {
+            const stat = parseLinuxProcessStat(fs.readFileSync(`/proc/${pid}/stat`, 'utf8'));
+            return stat !== null && stat.state !== 'Z' ? stat.startTime : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!isProcessAlive(pid, platform))
+        return null;
+    const query = buildProcessStartTimeQuery(pid, platform);
+    if (query === null)
+        return null;
+    try {
+        const output = execFileSync(query.command, query.args, { encoding: 'utf8' }).trim();
+        if (output.length === 0)
+            return null;
+        if (platform === 'win32') {
+            const timestamp = new Date(output);
+            return Number.isNaN(timestamp.getTime()) ? null : timestamp.toISOString();
+        }
+        return output;
+    }
+    catch {
+        return null;
+    }
+}
+function parsePidRecord(raw) {
+    const trimmed = raw.trim();
+    if (/^[1-9]\d*$/.test(trimmed)) {
+        const pid = Number(trimmed);
+        return Number.isSafeInteger(pid) ? { kind: 'legacy', pid } : { kind: 'invalid' };
+    }
+    try {
+        const value = JSON.parse(trimmed);
+        if (value !== null &&
+            value.version === 1 &&
+            Number.isSafeInteger(value.pid) &&
+            (value.pid ?? 0) > 0 &&
+            typeof value.startTime === 'string' &&
+            value.startTime.length > 0) {
+            return {
+                kind: 'record',
+                record: { version: 1, pid: value.pid, startTime: value.startTime }
+            };
+        }
+    }
+    catch {
+        // Invalid JSON is an invalid PID record.
+    }
+    return { kind: 'invalid' };
+}
+export function readProcessState(pidFile) {
+    let snapshot;
+    try {
+        snapshot = fs.readFileSync(pidFile, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { kind: 'missing', snapshot: null };
+        return { kind: 'invalid', snapshot: '' };
+    }
+    const parsed = parsePidRecord(snapshot);
+    if (parsed.kind === 'invalid')
+        return { kind: 'invalid', snapshot };
+    if (parsed.kind === 'legacy')
+        return { kind: 'legacy', snapshot, pid: parsed.pid };
+    const currentStartTime = getProcessStartTime(parsed.record.pid);
+    if (currentStartTime === null || currentStartTime !== parsed.record.startTime) {
+        return { kind: 'stale', snapshot, record: parsed.record };
+    }
+    return { kind: 'running', snapshot, record: parsed.record };
+}
+export function writePidRecord(pidFile, record) {
+    fs.mkdirSync(path.dirname(pidFile), { recursive: true });
+    const temporary = `${pidFile}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+    try {
+        fs.writeFileSync(temporary, `${JSON.stringify(record)}\n`);
+        fs.renameSync(temporary, pidFile);
+    }
+    catch (error) {
+        try {
+            fs.unlinkSync(temporary);
+        }
+        catch {
+            // The temporary file was never created or was already renamed.
+        }
+        throw error;
+    }
+}
+export function removePidFileIfMatches(pidFile, expectedSnapshot) {
+    if (expectedSnapshot === null)
+        return false;
+    try {
+        if (fs.readFileSync(pidFile, 'utf8') !== expectedSnapshot)
+            return false;
+        fs.unlinkSync(pidFile);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function removePidRecordIfMatches(pidFile, expected) {
+    const state = readProcessState(pidFile);
+    if (state.kind !== 'running')
+        return false;
+    if (state.record.pid !== expected.pid || state.record.startTime !== expected.startTime)
+        return false;
+    return removePidFileIfMatches(pidFile, state.snapshot);
+}
+export function processIdentityMatches(record) {
+    return getProcessStartTime(record.pid) === record.startTime;
+}
+//# sourceMappingURL=process-state.js.map

package/dist/lib/update.js

@@ -145,6 +145,8 @@ async function cmdUpdate() {
     // update skill
     copySkillDir(path.join(templateDir, '.agents', 'skills', 'update-agent-infra'), path.join('.agents', 'skills', 'update-agent-infra'), replacements, language, platformType);
     ok('Updated .agents/skills/update-agent-infra/');
+    renderFile(path.join(templateDir, '.agents', 'scripts', 'lib', 'agent-infra-package.js'), path.join('.agents', 'scripts', 'lib', 'agent-infra-package.js'), replacements);
+    ok('Updated .agents/scripts/lib/agent-infra-package.js');
     try {
         fs.unlinkSync(path.join('.agents', 'skills', 'update-agent-infra', 'scripts', 'sync-templates.cjs'));
     }

package/lib/defaults.json

@@ -44,8 +44,16 @@
       ".gemini/commands/",
       ".git-hooks/check-version-format.sh",
       ".github/scripts/",
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml",
       ".opencode/commands/"
     ],
+    "guardedManaged": [
+      ".github/workflows/metadata-sync.yml",
+      ".github/workflows/pr-label.yml",
+      ".github/workflows/status-label.yml"
+    ],
     "merged": [
       "**/post-release.*",
       "**/release.*",

package/lib/init.ts

@@ -278,6 +278,12 @@ async function cmdInit(): Promise<void> {
     platformType
   );
   ok('Installed .agents/skills/update-agent-infra/');
+  renderFile(
+    path.join(templateDir, '.agents', 'scripts', 'lib', 'agent-infra-package.js'),
+    path.join('.agents', 'scripts', 'lib', 'agent-infra-package.js'),
+    replacements
+  );
+  ok('Installed .agents/scripts/lib/agent-infra-package.js');
 
   // install Claude command (only if enabled)
   if (enabledTUISet.has('claude-code')) {
@@ -347,6 +353,9 @@ async function cmdInit(): Promise<void> {
   console.log('');
   ok('Project initialized successfully!');
   console.log('');
+  console.log('  If this init used npx, install agent-infra persistently before update or validation:');
+  console.log('    npm install -g @fitlab-ai/agent-infra');
+  console.log('');
   if (enabledTUISet.size === 0) {
     console.log('  No built-in TUI selected.');
     console.log(`  Configure "customTUIs" in ${configPath} before running update-agent-infra.`);