@fitlab-ai/agent-infra 0.8.5 → 0.9.1

package/dist/lib/sandbox/commands/list-running.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { runSafeEngine, runVerboseEngine } from '../shell.js';
 import { resolveTaskBranch } from '../task-resolver.js';
+import { isRemovedHashShortIdInput } from '../../task/short-id.js';
 export function containerListFormat() {
     return '{{.Names}}\t{{.Status}}\t{{.Labels}}';
 }
@@ -70,13 +71,13 @@ export function fetchSandboxRows(engine, label, branchKey) {
 }
 /**
  * Returns true iff `arg` is a syntactically valid task short reference.
- * Accepts both bare numeric ('11') and '#'-prefixed ('#11') forms.
+ * Accepts bare numeric ('11') task short ids.
  * Zero IO. Callers MUST use this as the gate before constructing any context
  * for resolveTaskShortRef — that way non-matching arguments (e.g. '#abc',
  * '#1.5', '#') never trigger sandbox list IO.
  */
 export function isTaskShortRef(arg) {
-    return /^#?\d+$/.test(arg);
+    return /^\d+$/.test(arg);
 }
 /**
  * Try to resolve a short ref against the global task-short-id registry.
@@ -91,9 +92,7 @@ function tryResolveFromRegistry(arg, repoRoot) {
     const scriptPath = path.join(repoRoot, '.agents', 'scripts', 'task-short-id.js');
     if (!fs.existsSync(scriptPath))
         return { status: 'miss' };
-    // Strip leading '#' when forwarding bare-numeric input through the script's CLI.
-    // (Script accepts both forms, but this avoids shell quoting confusion in error
-    // messages echoed back to the user.)
+    // Forward the bare-numeric short ref to the registry script for ID resolution.
     const result = spawnSync('node', [scriptPath, 'resolve', arg], { encoding: 'utf8', cwd: repoRoot });
     if (result.status !== 0)
         return { status: 'miss' };
@@ -120,7 +119,7 @@ function tryResolveFromRegistry(arg, repoRoot) {
 }
 /**
 /**
- * Resolve a task short reference (bare 'N' or '#N') to a branch name for the
+ * Resolve a bare task short reference to a branch name for the
  * sandbox entrypoint.
  *
  * Resolution: registry-only. Look up the short id in the global task-short-id
@@ -137,11 +136,11 @@ export function resolveTaskShortRef(arg, ctx) {
     if (lookup.status === 'hit')
         return lookup.branch;
     throw new Error(`short ref '${arg}' is not in the active task registry. ` +
-        `'#N' and bare N resolve only via the registry (not by row position in 'ai sandbox ls'); ` +
+        `bare N resolves only via the registry (not by row position in 'ai sandbox ls'); ` +
         `use a task short id (e.g. 'ai sandbox exec 11'), a TASK-id, or a branch name.`);
 }
 /**
- * Resolve a sandbox command argument (`<branch | TASK-id | N | '#N'>`) to a
+ * Resolve a sandbox command argument (`<branch | TASK-id | N>`) to a
  * branch name, mirroring `ai sandbox exec` so that `start` and `exec` share one
  * input contract. Short refs go through the registry-only resolver (which throws
  * an actionable error on a miss); everything else flows through resolveTaskBranch
@@ -149,6 +148,9 @@ export function resolveTaskShortRef(arg, ctx) {
  * Callers still run assertValidBranchName on the result.
  */
 export function resolveBranchArg(arg, ctx) {
+    if (isRemovedHashShortIdInput(arg)) {
+        throw new Error(`Invalid task short id '${arg}': task short ids must use bare digits`);
+    }
     return isTaskShortRef(arg)
         ? resolveTaskShortRef(arg, ctx)
         : resolveTaskBranch(arg, ctx.repoRoot);

package/dist/lib/sandbox/commands/rebuild.js

@@ -9,15 +9,17 @@ import { runEngine, runOkEngine, runSafeEngine, runVerboseEngine } from '../shel
 import { pruneSandboxDanglingImages } from '../image-prune.js';
 import { resolveTools } from '../tools.js';
 import { buildImageSignature, buildSandboxImageArgs, parseImageLabels, parseRefreshTimestamp } from '../image-build.js';
-const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh]`;
-export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+import { assertBuildProxyCompatibility, buildProxyFailureHint, prepareBuildProxy, redactBuildProxyValues } from '../build-proxy.js';
+const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh] [--inherit-build-proxy|-B]`;
+export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh, buildProxyArgs = [] } = {}) {
     return buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
         engine: engine ?? detectEngine(config),
         runFn,
         runSafeFn,
         env,
         refresh,
-        lastRefresh
+        lastRefresh,
+        buildProxyArgs
     });
 }
 function readExistingLastRefresh(config, engine) {
@@ -41,6 +43,7 @@ export async function rebuild(args) {
         options: {
             refresh: { type: 'boolean' },
             quiet: { type: 'boolean', short: 'q' },
+            'inherit-build-proxy': { type: 'boolean', short: 'B' },
             help: { type: 'boolean', short: 'h' }
         }
     });
@@ -56,6 +59,12 @@ export async function rebuild(args) {
     const refresh = values.refresh ?? false;
     const engine = detectEngine(config);
     await ensureDocker(config, undefined);
+    if (values['inherit-build-proxy'] && config.dockerfile) {
+        throw new Error('Build proxy inheritance is unavailable with a custom sandbox Dockerfile.');
+    }
+    const buildProxy = prepareBuildProxy(values['inherit-build-proxy'] ?? false, process.env, engine);
+    if (values['inherit-build-proxy'])
+        assertBuildProxyCompatibility(engine);
     const lastRefresh = refresh ? Date.now() : readExistingLastRefresh(config, engine);
     p.intro(pc.cyan('Rebuilding sandbox image'));
     try {
@@ -65,9 +74,11 @@ export async function rebuild(args) {
             runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
                 engine,
                 refresh,
-                lastRefresh
+                lastRefresh,
+                buildProxyArgs: buildProxy.args
             }), {
-                cwd: config.repoRoot
+                cwd: config.repoRoot,
+                env: buildProxy.env
             });
             spinner.stop(pc.green('Sandbox image rebuilt'));
         }
@@ -76,12 +87,18 @@ export async function rebuild(args) {
             runVerboseEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
                 engine,
                 refresh,
-                lastRefresh
-            }), { cwd: config.repoRoot });
+                lastRefresh,
+                buildProxyArgs: buildProxy.args
+            }), { cwd: config.repoRoot, env: buildProxy.env });
             p.log.success(pc.green('Sandbox image rebuilt'));
         }
         pruneSandboxDanglingImages(config, engine);
     }
+    catch (error) {
+        const message = redactBuildProxyValues(error instanceof Error ? error.message : String(error), buildProxy.redactionValues);
+        const hint = values['inherit-build-proxy'] ? `\n${buildProxyFailureHint(engine)}` : '';
+        throw new Error(`${message}${hint}`);
+    }
     finally {
         preparedDockerfile.cleanup();
     }

package/dist/lib/sandbox/commands/show.js

@@ -5,12 +5,12 @@ import { loadConfig } from '../config.js';
 import { assertValidBranchName, worktreeDirCandidates } from '../constants.js';
 import { resolveBranchArg } from './list-running.js';
 import { resolveTools, toolConfigDirCandidates } from '../tools.js';
-const USAGE = `Usage: ai sandbox show <branch | TASK-id | N | '#N'>
+const USAGE = `Usage: ai sandbox show <branch | TASK-id | N>
 
 Shows one sandbox's worktree path and per-tool state paths (Claude Code,
 Codex, Gemini CLI, OpenCode). The argument follows the same contract as
 'ai sandbox exec' and 'ai sandbox start': N (bare) is the recommended form
-for task short ids (e.g. 'ai sandbox show 11'); '#N', a TASK-id, or a plain
+for task short ids (e.g. 'ai sandbox show 11'); a TASK-id or a plain
 branch name are also accepted. Use 'ai sandbox ls' for the container list.`;
 function existingDirs(candidates) {
     const seen = new Set();

package/dist/lib/sandbox/commands/start.js

@@ -1,36 +1,74 @@
 import { loadConfig } from '../config.js';
 import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
 import { detectEngine } from '../engine.js';
-import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, startSandboxContainer } from './list-running.js';
-const USAGE = `Usage: ai sandbox start <branch | TASK-id | N | '#N'>
+import { ensureSandboxReady } from '../recovery.js';
+import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, } from './list-running.js';
+const USAGE = `Usage: ai sandbox start [--recreate] <branch | TASK-id | N>
 
 Start an existing sandbox container that has stopped (for example after the
 Docker daemon was restarted or replaced). The container must already exist:
 if none is found, run 'ai sandbox create <branch>' first. A container that is
-already running is left untouched.`;
+already running is checked without modifying healthy runtime state. --recreate
+allows container-only replacement after in-place recovery fails.`;
+export function parseStartArgs(args) {
+    let recreate = false;
+    let help = false;
+    const positionals = [];
+    for (const arg of args) {
+        if (arg === '--recreate') {
+            recreate = true;
+        }
+        else if (arg === '--help' || arg === '-h') {
+            help = true;
+        }
+        else if (arg.startsWith('-')) {
+            throw new Error(`Unknown option: ${arg}\n${USAGE}`);
+        }
+        else {
+            positionals.push(arg);
+        }
+    }
+    if (!help && positionals.length !== 1) {
+        throw new Error(USAGE);
+    }
+    return { target: positionals[0] ?? '', recreate, help };
+}
 export async function start(args) {
-    if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
+    if (args.length === 0) {
+        process.stdout.write(`${USAGE}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    const parsed = parseStartArgs(args);
+    if (parsed.help) {
         process.stdout.write(`${USAGE}\n`);
-        if (args.length === 0) {
-            process.exitCode = 1;
-        }
         return;
     }
-    const [firstArg = ''] = args;
     const config = loadConfig();
     const engine = detectEngine(config);
-    const branch = resolveBranchArg(firstArg, { repoRoot: config.repoRoot });
+    const branch = resolveBranchArg(parsed.target, { repoRoot: config.repoRoot });
     assertValidBranchName(branch);
     const { running, nonRunning } = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
     const found = selectSandboxContainer([...running, ...nonRunning], containerNameCandidates(config, branch));
     if (!found) {
         throw new Error(`No sandbox container for branch '${branch}'. Run 'ai sandbox create ${branch}' to create one.`);
     }
-    if (found.running) {
-        process.stdout.write(`Sandbox '${found.name}' is already running.\n`);
-        return;
-    }
-    startSandboxContainer(engine, found.name);
-    process.stdout.write(`Started sandbox '${found.name}'.\n`);
+    const ready = await ensureSandboxReady({
+        config,
+        engine,
+        branch,
+        row: found,
+        allowRecreate: parsed.recreate,
+        recreate: async (targetBranch) => {
+            const { create } = await import('./create.js');
+            await create([targetBranch, '--no-refresh']);
+        }
+    });
+    const message = ready.path === 'healthy'
+        ? `Sandbox '${ready.container}' is already running and healthy.`
+        : ready.path === 'recreated'
+            ? `Recreated sandbox '${ready.container}' and verified readiness.`
+            : `Recovered sandbox '${ready.container}' and verified readiness.`;
+    process.stdout.write(`${message}\n`);
 }
 //# sourceMappingURL=start.js.map

package/dist/lib/sandbox/image-build.js

@@ -14,7 +14,7 @@ export function buildImageSignature(preparedDockerfile, tools) {
         .digest('hex')
         .slice(0, 12);
 }
-export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh, buildProxyArgs = [] } = {}) {
     const selectedEngine = engine ?? detectEngine({ engine: config.engine });
     const { uid: hostUid, gid: hostGid } = resolveBuildUid({
         engine: selectedEngine,
@@ -39,6 +39,7 @@ export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignat
         '--label',
         `${sandboxImageConfigLabel(config)}=${imageSignature}`
     ];
+    args.push(...buildProxyArgs);
     if (lastRefresh !== undefined) {
         args.push('--label', `${sandboxImageRefreshLabel(config)}=${lastRefresh}`);
     }

package/dist/lib/sandbox/index.js

@@ -2,14 +2,14 @@ const USAGE = `Usage: ai sandbox <command> [options]
 
 Commands:
   create <branch> [base]       Create a sandbox (VM + image + worktree + container)
-  exec <branch | TASK-id | N | '#N'> [cmd...]
+  exec [--recreate] <branch | TASK-id | N> [cmd...]
                                Enter sandbox or run a command. N (bare) is the
                                recommended form for task short ids (e.g.
-                               'ai sandbox exec 11'); '#N' is also accepted.
+                               'ai sandbox exec 11').
   ls                           List sandboxes for the current project (the '#'
                                column is a display-only row number; the 'SHORT'
                                column shows the active task short id, '-' if none)
-  show <branch | TASK-id | N | '#N'>
+  show <branch | TASK-id | N>
                                Show one sandbox's worktree and per-tool state paths
   prune [--dry-run]            Remove orphaned per-branch state dirs
   rebuild [--quiet] [--refresh]
@@ -18,9 +18,9 @@ Commands:
   rm <branch> | --all | --purge
                                Remove one sandbox, all sandboxes not bound to an
                                active task (--all), or tear down everything (--purge)
-  start <branch | TASK-id | N | '#N'>
-                               Start an existing stopped sandbox container
-                               (e.g. after the Docker daemon restarted)
+  start [--recreate] <branch | TASK-id | N>
+                               Verify or recover an existing sandbox container;
+                               optionally replace only the container on failure
   vm status|start|stop         Manage the sandbox VM (macOS) or check the backend (Windows)
 
 Run 'ai sandbox <command> --help' for details.`;

package/dist/lib/sandbox/mounts.js

@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
+export function sandboxCoreBindMounts(config, branch, overrides = {}) {
+    return [
+        {
+            hostPaths: overrides.worktree
+                ? [overrides.worktree]
+                : worktreeDirCandidates(config, branch),
+            containerPath: '/workspace',
+            readOnly: false
+        },
+        {
+            hostPaths: [path.join(config.repoRoot, '.agents', 'workspace')],
+            containerPath: '/workspace/.agents/workspace',
+            readOnly: false
+        },
+        {
+            hostPaths: [shareCommonDir(config)],
+            containerPath: '/share/common',
+            readOnly: false
+        },
+        {
+            hostPaths: [shareBranchDir(config, branch)],
+            containerPath: '/share/branch',
+            readOnly: false
+        },
+        {
+            hostPaths: overrides.shellConfigHostDir
+                ? [overrides.shellConfigHostDir]
+                : shellConfigDirCandidates(config, branch),
+            containerPath: '/home/devuser/.host-shell-config',
+            readOnly: true
+        }
+    ];
+}
+//# sourceMappingURL=mounts.js.map