@fitlab-ai/agent-infra 0.8.4 → 0.8.5

package/lib/sandbox/commands/create.ts

@@ -87,13 +87,27 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
   as ${CONTAINER_HOME}/.bash_aliases inside the sandbox container (the host
   shell-config directory is bind-mounted at ${CONTAINER_SHELL_CONFIG_MOUNT} and
-  symlinked into $HOME).`;
+  symlinked into $HOME).
+
+Proxy:
+  --inherit-proxy, -P  Copy non-empty standard host proxy variables into the
+                       container environment through the private env file.`;
+const HOST_PROXY_ENV_KEYS = [
+  'http_proxy',
+  'HTTP_PROXY',
+  'https_proxy',
+  'HTTPS_PROXY',
+  'all_proxy',
+  'ALL_PROXY',
+  'no_proxy',
+  'NO_PROXY'
+] as const;
 
 type SandboxCreateConfig = ReturnType<typeof loadConfig>;
 type PreparedDockerfile = ReturnType<typeof prepareDockerfile>;
@@ -626,11 +640,20 @@ function formatEnvFileEntry(key: string, value: string): string {
   return `${key}=${value}`;
 }
 
+export function collectHostProxyEntries(env: NodeJS.ProcessEnv): Array<[string, string]> {
+  const entriesByExactKey = new Map(Object.entries(env));
+  return HOST_PROXY_ENV_KEYS.flatMap((key) => {
+    const value = entriesByExactKey.get(key);
+    return typeof value === 'string' && value !== '' ? [[key, value]] : [];
+  });
+}
+
 export function buildContainerEnvFile(
   resolvedTools: ResolvedTool[],
   engine: string,
   runSafeEngineFn: EngineRunSafeFn = runSafeEngine,
   options: {
+    additionalEntries?: Array<[string, string]>;
     mkdtempFn?: typeof fs.mkdtempSync;
     writeFileFn?: typeof fs.writeFileSync;
     chmodFn?: typeof fs.chmodSync;
@@ -640,6 +663,7 @@ export function buildContainerEnvFile(
   } = {}
 ): { dockerArgs: string[]; cleanup: () => void } {
   const {
+    additionalEntries = [],
     mkdtempFn = fs.mkdtempSync,
     writeFileFn = fs.writeFileSync,
     chmodFn = fs.chmodSync,
@@ -649,6 +673,7 @@ export function buildContainerEnvFile(
   } = options;
 
   const entries: Array<[string, string]> = resolvedTools.flatMap(({ tool }) => Object.entries(tool.envVars ?? {}));
+  entries.push(...additionalEntries);
   let ghToken = runSafeEngineFn(engine, 'gh', ['auth', 'token']);
   if (!ghToken && engine === 'wsl2') {
     ghToken = runSafeFn('gh', ['auth', 'token']);
@@ -1246,6 +1271,7 @@ export async function create(args: string[]): Promise<void> {
       cpu: { type: 'string' },
       memory: { type: 'string' },
       'no-refresh': { type: 'boolean' },
+      'inherit-proxy': { type: 'boolean', short: 'P' },
       help: { type: 'boolean', short: 'h' }
     }
   });
@@ -1503,7 +1529,10 @@ export async function create(args: string[]): Promise<void> {
               signingKey
             )
             : null;
-          const envFile = buildContainerEnvFile(effectiveResolvedTools, engine);
+          const proxyEntries = values['inherit-proxy'] ? collectHostProxyEntries(process.env) : [];
+          const envFile = buildContainerEnvFile(effectiveResolvedTools, engine, undefined, {
+            additionalEntries: proxyEntries
+          });
           let hostShellConfig: HostShellConfig;
           let tmpfsSeedPlan: TmpfsSeedPlanEntry[] = [];
           try {

package/lib/sandbox/engine.ts

@@ -2,7 +2,7 @@ import { platform } from 'node:os';
 import { detectHostResources } from './constants.ts';
 import { ADAPTERS, enginesForPlatform, getAdapter } from './engines/index.ts';
 import type { EffectiveSandboxConfig, OnMessage, RunFns, SandboxAdapter, SandboxVmConfig } from './engines/index.ts';
-import { run, runOk, runSafe, runVerbose } from './shell.ts';
+import { run, runOk, runOkEngine, runSafe, runVerbose } from './shell.ts';
 
 export const ENGINES = Object.freeze({
   COLIMA: 'colima',
@@ -26,6 +26,7 @@ type EngineDependencies = {
   platformFn?: typeof platform;
   runFn?: RunFns['run'];
   runOkFn?: RunFns['runOk'];
+  runOkEngineFn?: typeof runOkEngine;
   runSafeFn?: RunFns['runSafe'];
   runVerboseFn?: RunFns['runVerbose'];
 };
@@ -50,6 +51,37 @@ function applyDockerContext(adapter: SandboxAdapter): void {
   }
 }
 
+function buildKitError(engine: string): Error {
+  let repair: string;
+  switch (engine) {
+    case ENGINES.COLIMA:
+      repair = 'Install the Docker Buildx plugin with: brew install docker-buildx';
+      break;
+    case ENGINES.DOCKER_DESKTOP:
+    case ENGINES.WSL2:
+      repair = 'Upgrade or repair Docker Desktop so Docker Buildx and BuildKit are available.';
+      break;
+    case ENGINES.NATIVE:
+      repair = 'Install the Docker Buildx plugin for your Docker Engine installation.';
+      break;
+    default:
+      repair = `Upgrade or repair ${engineDisplayName(engine)} so Docker Buildx and BuildKit are available.`;
+  }
+
+  return new Error([
+    `Docker BuildKit is not available for ${engineDisplayName(engine)}.`,
+    repair,
+    'Verify the builder with: docker buildx inspect --bootstrap',
+    'Then retry the sandbox create or rebuild command.'
+  ].join('\n'));
+}
+
+function ensureBuildKit(engine: string, runOkEngineFn: typeof runOkEngine): void {
+  if (!runOkEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap'])) {
+    throw buildKitError(engine);
+  }
+}
+
 export function validateSandboxEngine(
   engine: string | null | undefined,
   { platformFn = platform }: Pick<EngineDependencies, 'platformFn'> = {}
@@ -144,10 +176,12 @@ export async function ensureDocker(
   const engine = detectEngine(config, dependencies);
   const adapter = getAdapter(engine);
   const effectiveConfig = effectiveConfigFor(adapter, config);
+  const fns = runFns(dependencies);
 
   applyDockerContext(adapter);
-  const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, runFns(dependencies));
-  adapter.syncResources(effectiveConfig, onMessage, runFns(dependencies), { vmJustStarted });
+  const vmJustStarted = await adapter.ensure(effectiveConfig, onMessage, fns);
+  ensureBuildKit(engine, dependencies.runOkEngineFn ?? runOkEngine);
+  adapter.syncResources(effectiveConfig, onMessage, fns, { vmJustStarted });
 }
 
 export function isVmManaged(config: EngineConfig = {}, dependencies: EngineDependencies = {}): boolean {

package/lib/sandbox/engines/colima.ts

@@ -35,8 +35,8 @@ export const colimaAdapter: SandboxAdapter = {
     let started = false;
 
     if (!runOk('which', ['colima'])) {
-      onMessage?.('Installing colima + docker via Homebrew...');
-      runVerbose('brew', ['install', 'colima', 'docker']);
+      onMessage?.('Installing colima + docker + docker-buildx via Homebrew...');
+      runVerbose('brew', ['install', 'colima', 'docker', 'docker-buildx']);
     }
 
     if (!runOk('colima', ['status'])) {

package/lib/sandbox/runtimes/base.dockerfile

@@ -191,6 +191,10 @@ fi
 exec tmux new-session -s "$SESSION"
 SCRIPT
 
+RUN test -s /usr/local/bin/cc-token-status && test -x /usr/local/bin/cc-token-status && \
+    test -s /usr/local/bin/sandbox-dotfiles-link && test -x /usr/local/bin/sandbox-dotfiles-link && \
+    test -s /usr/local/bin/sandbox-tmux-entry && test -x /usr/local/bin/sandbox-tmux-entry
+
 ENV LANG=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 ENV TERM=xterm-256color

package/lib/server/daemon.ts

@@ -12,6 +12,7 @@ import type { RunnerOptions, RunnerResult } from './runner.ts';
 import { streamCommand } from './streamer.ts';
 import { markdownMessage, replyOutbound, textMessage } from './display.ts';
 import { buildStatusModel, statusModelToDisplay, type StatusModel } from '../task/commands/status.ts';
+import { getProcessStartTime, removePidRecordIfMatches } from './process-state.ts';
 
 function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
@@ -110,6 +111,7 @@ export async function runDaemon(): Promise<void> {
 
   const logger = createLogger(config.log);
   logger.info(`daemon starting agent-infra ${VERSION} pid=${process.pid}`);
+  const ownStartTime = getProcessStartTime(process.pid);
 
   const abortController = new AbortController();
   let resolveShutdown: () => void = () => {};
@@ -135,6 +137,13 @@ export async function runDaemon(): Promise<void> {
       await unloadAdapters(adapters);
       clearInterval(heartbeat);
       logger.close();
+      if (ownStartTime !== null) {
+        removePidRecordIfMatches(config.pidFile, {
+          version: 1,
+          pid: process.pid,
+          startTime: ownStartTime
+        });
+      }
       resolveShutdown();
     })();
   };

package/lib/server/process-control.ts

@@ -1,9 +1,19 @@
 import fs from 'node:fs';
-import path from 'node:path';
 import { spawn, execFileSync } from 'node:child_process';
 import { loadServerConfig } from './config.ts';
 import type { ServerConfig } from './config.ts';
 import { runDaemon } from './daemon.ts';
+import {
+  getProcessStartTime,
+  isProcessAlive,
+  processIdentityMatches,
+  readProcessState,
+  removePidFileIfMatches,
+  writePidRecord
+} from './process-state.ts';
+import type { PidRecord } from './process-state.ts';
+
+export { isProcessAlive } from './process-state.ts';
 
 export type StartOptions = { foreground?: boolean };
 export type LogsOptions = { follow?: boolean };
@@ -20,59 +30,33 @@ export function buildStopCommand(pid: number, platform: NodeJS.Platform): StopCo
   }
   return { kind: 'signal', signal: 'SIGTERM' };
 }
-
-
-// Liveness check that treats an exited-but-unreaped daemon as dead.
-//
-// The daemon is spawned detached and re-parented to init when `ai server start`
-// exits. After it terminates, `process.kill(pid, 0)` still succeeds until init
-// reaps the zombie. On Linux we therefore also check /proc state so status/stop
-// /start don't treat an already-exited daemon as running. macOS reaps orphans
-// via launchd and Windows has no zombies, so the kill(pid, 0) result is enough.
-export function isProcessAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-  } catch (error) {
-    // EPERM means the process exists but we may not signal it → still alive.
-    return (error as NodeJS.ErrnoException).code === 'EPERM';
-  }
-  if (process.platform === 'linux') {
-    try {
-      const stat = fs.readFileSync(`/proc/${pid}/stat`, 'utf8');
-      // The process state is the first token after the parenthesised comm.
-      const state = stat.slice(stat.lastIndexOf(')') + 1).trim().charAt(0);
-      if (state === 'Z') return false;
-    } catch {
-      return false; // /proc entry vanished → not alive
-    }
-  }
-  return true;
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
 }
 
-function readPid(pidFile: string): number | null {
-  try {
-    const raw = fs.readFileSync(pidFile, 'utf8').trim();
-    const pid = Number.parseInt(raw, 10);
-    return Number.isInteger(pid) && pid > 0 ? pid : null;
-  } catch {
-    return null;
+async function waitForProcessIdentity(pid: number, timeoutMs = 2000): Promise<PidRecord | null> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const startTime = getProcessStartTime(pid);
+    if (startTime !== null) return { version: 1, pid, startTime };
+    await delay(25);
   }
+  return null;
 }
 
-function removePidFile(pidFile: string): void {
+function terminateIfMatching(record: PidRecord): void {
+  if (!processIdentityMatches(record)) return;
+  const command = buildStopCommand(record.pid, process.platform);
   try {
-    fs.unlinkSync(pidFile);
+    if (command.kind === 'exec') execFileSync(command.command, command.args);
+    else process.kill(record.pid, command.signal);
   } catch {
-    // Already gone.
+    // Best effort cleanup for a daemon whose PID record could not be published.
   }
 }
 
-function delay(ms: number): Promise<void> {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
-
 function enabledAdapterNames(config: ServerConfig): string[] {
   return Object.entries(config.adapters)
     .filter(([, adapter]) => adapter?.enabled === true)
@@ -83,15 +67,13 @@ export async function start({ foreground = false }: StartOptions = {}): Promise<
   const config = loadServerConfig();
   const pidPath = config.pidFile;
 
-  // Zombie PID cleanup: a stale PID file from a crashed daemon must not block a
-  // fresh start.
-  const existing = readPid(pidPath);
-  if (existing !== null && isProcessAlive(existing)) {
-    process.stdout.write(`server already running (pid ${existing})\n`);
+  const existing = readProcessState(pidPath);
+  if (existing.kind === 'running') {
+    process.stdout.write(`server already running (pid ${existing.record.pid})\n`);
     return;
   }
-  if (existing !== null) {
-    removePidFile(pidPath);
+  if (existing.kind !== 'missing') {
+    removePidFileIfMatches(pidPath, existing.snapshot);
   }
 
   if (foreground) {
@@ -116,52 +98,69 @@ export async function start({ foreground = false }: StartOptions = {}): Promise<
   if (typeof child.pid !== 'number') {
     throw new Error('server: failed to spawn daemon process');
   }
-  fs.mkdirSync(path.dirname(pidPath), { recursive: true });
-  fs.writeFileSync(pidPath, `${child.pid}\n`);
-  process.stdout.write(`server started (pid ${child.pid})\n`);
+
+  // The initial check, spawn, and record publication are not a mutually
+  // exclusive transaction. Atomic publication keeps the record complete, but
+  // a separate locking design is required to serialize concurrent starts.
+  const record = await waitForProcessIdentity(child.pid);
+  if (record === null || !processIdentityMatches(record)) {
+    throw new Error('server: unable to verify spawned daemon process identity');
+  }
+  try {
+    writePidRecord(pidPath, record);
+  } catch (error) {
+    terminateIfMatching(record);
+    throw error;
+  }
+  process.stdout.write(`server started (pid ${record.pid})\n`);
 }
 
 export async function stop(): Promise<void> {
   const config = loadServerConfig();
-  const pid = readPid(config.pidFile);
+  const state = readProcessState(config.pidFile);
 
-  if (pid === null) {
+  if (state.kind === 'missing') {
     process.stdout.write('server is not running (no pid file)\n');
     return;
   }
-  if (!isProcessAlive(pid)) {
-    removePidFile(config.pidFile);
+  if (state.kind !== 'running') {
+    removePidFileIfMatches(config.pidFile, state.snapshot);
     process.stdout.write('server is not running (removed stale pid file)\n');
     return;
   }
 
-  const command = buildStopCommand(pid, process.platform);
+  const { record } = state;
+  if (!processIdentityMatches(record)) {
+    removePidFileIfMatches(config.pidFile, state.snapshot);
+    process.stdout.write('server is not running (removed stale pid file)\n');
+    return;
+  }
+
+  const command = buildStopCommand(record.pid, process.platform);
   if (command.kind === 'exec') {
     execFileSync(command.command, command.args);
   } else {
-    process.kill(pid, command.signal);
+    process.kill(record.pid, command.signal);
     const deadline = Date.now() + 5000;
-    while (isProcessAlive(pid) && Date.now() < deadline) {
+    while (isProcessAlive(record.pid) && Date.now() < deadline) {
       await delay(100);
     }
-    if (isProcessAlive(pid)) {
-      process.kill(pid, 'SIGKILL');
+    if (isProcessAlive(record.pid) && processIdentityMatches(record)) {
+      process.kill(record.pid, 'SIGKILL');
     }
   }
 
-  removePidFile(config.pidFile);
-  process.stdout.write(`server stopped (pid ${pid})\n`);
+  removePidFileIfMatches(config.pidFile, state.snapshot);
+  process.stdout.write(`server stopped (pid ${record.pid})\n`);
 }
 
 export function status(): void {
   const config = loadServerConfig();
-  const pid = readPid(config.pidFile);
+  const state = readProcessState(config.pidFile);
 
-  if (pid === null || !isProcessAlive(pid)) {
+  if (state.kind !== 'running') {
+    if (state.kind !== 'missing') removePidFileIfMatches(config.pidFile, state.snapshot);
     process.stdout.write('server: stopped\n');
-    if (pid !== null) {
-      process.stdout.write(`  (stale pid file references pid ${pid})\n`);
-    }
     return;
   }
 
@@ -174,7 +173,7 @@ export function status(): void {
   const adapters = enabledAdapterNames(config);
   process.stdout.write(
     `server: running\n` +
-      `  pid: ${pid}\n` +
+      `  pid: ${state.record.pid}\n` +
       `  started: ${startedAt}\n` +
       `  adapters: ${adapters.length > 0 ? adapters.join(', ') : '(none)'}\n` +
       `  pid file: ${config.pidFile}\n` +

package/lib/server/process-state.ts

@@ -0,0 +1,183 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+export type PidRecord = {
+  version: 1;
+  pid: number;
+  startTime: string;
+};
+
+export type ProcessStartTimeQuery = { command: string; args: string[] };
+
+export type ProcessState =
+  | { kind: 'missing'; snapshot: null }
+  | { kind: 'invalid'; snapshot: string }
+  | { kind: 'legacy'; snapshot: string; pid: number }
+  | { kind: 'stale'; snapshot: string; record: PidRecord }
+  | { kind: 'running'; snapshot: string; record: PidRecord };
+
+export type LinuxProcessStat = { state: string; startTime: string };
+
+export function parseLinuxProcessStat(raw: string): LinuxProcessStat | null {
+  const closeParen = raw.lastIndexOf(')');
+  if (closeParen < 0) return null;
+  const fields = raw.slice(closeParen + 1).trim().split(/\s+/);
+  const state = fields[0];
+  const startTime = fields[19];
+  if (typeof state !== 'string' || state.length !== 1 || !/^\d+$/.test(startTime ?? '')) {
+    return null;
+  }
+  return { state, startTime: startTime! };
+}
+
+export function buildProcessStartTimeQuery(
+  pid: number,
+  platform: NodeJS.Platform
+): ProcessStartTimeQuery | null {
+  if (platform === 'darwin') {
+    return { command: 'ps', args: ['-p', String(pid), '-o', 'lstart='] };
+  }
+  if (platform === 'win32') {
+    const script =
+      `$process = Get-CimInstance Win32_Process -Filter 'ProcessId = ${pid}'; ` +
+      `if ($null -ne $process) { $process.CreationDate.ToUniversalTime().ToString('o') }`;
+    return {
+      command: 'powershell.exe',
+      args: ['-NoProfile', '-NonInteractive', '-Command', script]
+    };
+  }
+  return null;
+}
+
+export function isProcessAlive(pid: number, platform: NodeJS.Platform = process.platform): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  if (platform === 'linux') {
+    try {
+      const stat = parseLinuxProcessStat(fs.readFileSync(`/proc/${pid}/stat`, 'utf8'));
+      return stat !== null && stat.state !== 'Z';
+    } catch {
+      return false;
+    }
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === 'EPERM';
+  }
+}
+
+export function getProcessStartTime(
+  pid: number,
+  platform: NodeJS.Platform = process.platform
+): string | null {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (platform === 'linux') {
+    try {
+      const stat = parseLinuxProcessStat(fs.readFileSync(`/proc/${pid}/stat`, 'utf8'));
+      return stat !== null && stat.state !== 'Z' ? stat.startTime : null;
+    } catch {
+      return null;
+    }
+  }
+  if (!isProcessAlive(pid, platform)) return null;
+  const query = buildProcessStartTimeQuery(pid, platform);
+  if (query === null) return null;
+  try {
+    const output = execFileSync(query.command, query.args, { encoding: 'utf8' }).trim();
+    if (output.length === 0) return null;
+    if (platform === 'win32') {
+      const timestamp = new Date(output);
+      return Number.isNaN(timestamp.getTime()) ? null : timestamp.toISOString();
+    }
+    return output;
+  } catch {
+    return null;
+  }
+}
+
+function parsePidRecord(raw: string): { kind: 'invalid' } | { kind: 'legacy'; pid: number } | { kind: 'record'; record: PidRecord } {
+  const trimmed = raw.trim();
+  if (/^[1-9]\d*$/.test(trimmed)) {
+    const pid = Number(trimmed);
+    return Number.isSafeInteger(pid) ? { kind: 'legacy', pid } : { kind: 'invalid' };
+  }
+  try {
+    const value = JSON.parse(trimmed) as Partial<PidRecord> | null;
+    if (
+      value !== null &&
+      value.version === 1 &&
+      Number.isSafeInteger(value.pid) &&
+      (value.pid ?? 0) > 0 &&
+      typeof value.startTime === 'string' &&
+      value.startTime.length > 0
+    ) {
+      return {
+        kind: 'record',
+        record: { version: 1, pid: value.pid!, startTime: value.startTime }
+      };
+    }
+  } catch {
+    // Invalid JSON is an invalid PID record.
+  }
+  return { kind: 'invalid' };
+}
+
+export function readProcessState(pidFile: string): ProcessState {
+  let snapshot: string;
+  try {
+    snapshot = fs.readFileSync(pidFile, 'utf8');
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return { kind: 'missing', snapshot: null };
+    return { kind: 'invalid', snapshot: '' };
+  }
+
+  const parsed = parsePidRecord(snapshot);
+  if (parsed.kind === 'invalid') return { kind: 'invalid', snapshot };
+  if (parsed.kind === 'legacy') return { kind: 'legacy', snapshot, pid: parsed.pid };
+
+  const currentStartTime = getProcessStartTime(parsed.record.pid);
+  if (currentStartTime === null || currentStartTime !== parsed.record.startTime) {
+    return { kind: 'stale', snapshot, record: parsed.record };
+  }
+  return { kind: 'running', snapshot, record: parsed.record };
+}
+
+export function writePidRecord(pidFile: string, record: PidRecord): void {
+  fs.mkdirSync(path.dirname(pidFile), { recursive: true });
+  const temporary = `${pidFile}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`;
+  try {
+    fs.writeFileSync(temporary, `${JSON.stringify(record)}\n`);
+    fs.renameSync(temporary, pidFile);
+  } catch (error) {
+    try {
+      fs.unlinkSync(temporary);
+    } catch {
+      // The temporary file was never created or was already renamed.
+    }
+    throw error;
+  }
+}
+
+export function removePidFileIfMatches(pidFile: string, expectedSnapshot: string | null): boolean {
+  if (expectedSnapshot === null) return false;
+  try {
+    if (fs.readFileSync(pidFile, 'utf8') !== expectedSnapshot) return false;
+    fs.unlinkSync(pidFile);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function removePidRecordIfMatches(pidFile: string, expected: PidRecord): boolean {
+  const state = readProcessState(pidFile);
+  if (state.kind !== 'running') return false;
+  if (state.record.pid !== expected.pid || state.record.startTime !== expected.startTime) return false;
+  return removePidFileIfMatches(pidFile, state.snapshot);
+}
+
+export function processIdentityMatches(record: PidRecord): boolean {
+  return getProcessStartTime(record.pid) === record.startTime;
+}

package/lib/update.ts

@@ -194,6 +194,12 @@ async function cmdUpdate(): Promise<void> {
     platformType
   );
   ok('Updated .agents/skills/update-agent-infra/');
+  renderFile(
+    path.join(templateDir, '.agents', 'scripts', 'lib', 'agent-infra-package.js'),
+    path.join('.agents', 'scripts', 'lib', 'agent-infra-package.js'),
+    replacements
+  );
+  ok('Updated .agents/scripts/lib/agent-infra-package.js');
   try {
     fs.unlinkSync(path.join('.agents', 'skills', 'update-agent-infra', 'scripts', 'sync-templates.cjs'));
   } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fitlab-ai/agent-infra",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Bootstrap tool for AI multi-tool collaboration infrastructure — works with Claude Code, Codex, Gemini CLI, and OpenCode",
   "license": "MIT",
   "type": "module",
@@ -26,6 +26,7 @@
     "!dist/**/*.map",
     "bin/cli.ts",
     "lib/",
+    "runtime/",
     "templates/"
   ],
   "engines": {