@fitlab-ai/agent-infra 0.8.5 → 0.9.1

package/lib/platform/verification.ts

@@ -0,0 +1,11 @@
+import { inspectRequiredChecks } from './pr-checks.ts';
+
+type VerificationStatus = 'pass' | 'fail' | 'blocked';
+type VerificationCheck = { type: string; status: VerificationStatus; message: string; fail_type?: string };
+
+function verificationCheck(type: string, status: VerificationStatus, message: string, failType?: string): VerificationCheck {
+  return { type, status, message, ...(failType ? { fail_type: failType } : {}) };
+}
+
+export { inspectRequiredChecks, verificationCheck };
+export type { VerificationCheck, VerificationStatus };

package/lib/release/channels.ts

@@ -0,0 +1,30 @@
+type FetchResponse = { ok: boolean; status: number; json(): Promise<unknown>; text(): Promise<string> };
+type Fetcher = (url: string) => Promise<FetchResponse>;
+
+async function inspectNpmChannel(name: string, version: string, fetcher: Fetcher = fetch as unknown as Fetcher) {
+  try {
+    const response = await fetcher(`https://registry.npmjs.org/${encodeURIComponent(name)}/${encodeURIComponent(version)}`);
+    if (response.status === 404) return { status: 'no-op' as const, published: false, version, error: null };
+    if (!response.ok) return { status: 'blocked' as const, published: null, version, error: { code: 'NPM_REGISTRY_UNAVAILABLE', message: `npm registry returned ${response.status}` } };
+    const body = await response.json() as Record<string, unknown>;
+    return { status: 'no-op' as const, published: body.version === version, version, error: null };
+  } catch (error) {
+    return { status: 'blocked' as const, published: null, version, error: { code: 'NPM_REGISTRY_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };
+  }
+}
+
+async function inspectHomebrewChannel(url: string, version: string, fetcher: Fetcher = fetch as unknown as Fetcher) {
+  try {
+    const response = await fetcher(url);
+    if (response.status === 404) return { status: 'no-op' as const, published: false, version, error: null };
+    if (!response.ok) return { status: 'blocked' as const, published: null, version, error: { code: 'HOMEBREW_UNAVAILABLE', message: `formula endpoint returned ${response.status}` } };
+    const formula = await response.text();
+    const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return { status: 'no-op' as const, published: new RegExp(`(?:version\\s+["']${escaped}["']|/v?${escaped}\\.)`).test(formula), version, error: null };
+  } catch (error) {
+    return { status: 'blocked' as const, published: null, version, error: { code: 'HOMEBREW_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };
+  }
+}
+
+export { inspectHomebrewChannel, inspectNpmChannel };
+export type { Fetcher, FetchResponse };

package/lib/release/workflow.ts

@@ -0,0 +1,31 @@
+type ReleasePhase = 'unprepared' | 'prepared' | 'partially-published' | 'published' | 'post-pending' | 'complete';
+type ReleaseFacts = { localTag: boolean; localTagConflict?: boolean; remoteBranch: boolean; remoteTag: boolean; githubRelease: boolean | null; npm: boolean | null; homebrew: boolean | null; smoke: 'success' | 'pending' | 'failed' | null; postCommit: boolean };
+
+function deriveReleasePhase(facts: ReleaseFacts): ReleasePhase {
+  if (!facts.localTag) return 'unprepared';
+  if (!facts.remoteBranch && !facts.remoteTag) return 'prepared';
+  if (!facts.remoteBranch || !facts.remoteTag) return 'partially-published';
+  if (facts.githubRelease !== true || facts.npm !== true || facts.homebrew !== true) return 'published';
+  if (facts.smoke !== 'success' || !facts.postCommit) return 'post-pending';
+  return 'complete';
+}
+
+function releaseSnapshot(version: string, facts: ReleaseFacts) {
+  return { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+}
+
+async function runReleaseAction(input: { version: string; action: 'inspect' | 'prepare' | 'publish' | 'post'; inspect: () => Promise<ReleaseFacts>; prepare?: () => Promise<void>; publish?: () => Promise<void>; post?: () => Promise<void> }) {
+  const before = releaseSnapshot(input.version, await input.inspect());
+  if (input.action === 'inspect') return { status: 'no-op' as const, changed: false, before, snapshot: before, error: null };
+  const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
+    : input.action === 'publish' ? ['prepared', 'partially-published'].includes(before.phase)
+      : ['published', 'post-pending'].includes(before.phase);
+  if (!allowed) return { status: before.phase === 'complete' ? 'no-op' as const : 'failed' as const, changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };
+  await input[input.action]?.();
+  const snapshot = releaseSnapshot(input.version, await input.inspect());
+  const progressed = snapshot.phase !== before.phase;
+  return { status: progressed ? 'applied' as const : 'blocked' as const, changed: progressed, before, snapshot, error: progressed ? null : { code: 'RELEASE_PROGRESS_PENDING', message: `${input.action} has not reached the next observable phase` } };
+}
+
+export { deriveReleasePhase, releaseSnapshot, runReleaseAction };
+export type { ReleaseFacts, ReleasePhase };

package/lib/render.ts

@@ -1,8 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 
-// Add a new identifier here only after shipping matching .{platform}. template variants.
-const KNOWN_PLATFORMS = new Set(['github']);
+// Built-in platform strategies. "none" deliberately selects generic templates
+// and the no-op runtime adapter instead of requiring .none.* variants.
+const KNOWN_PLATFORMS = new Set(['github', 'none']);
 const KNOWN_LANGUAGES = new Set(['en', 'zh-CN']);
 
 type Replacements = {

package/lib/run/index.ts

@@ -13,6 +13,7 @@ export type ParsedRunArgs = {
   taskRef: string | null;
   args: string[];
   tui: string | null;
+  recreate?: true;
 };
 
 export type SandboxRunRequest = {
@@ -20,6 +21,7 @@ export type SandboxRunRequest = {
   branch: string;
   command: string[];
   runId?: string;
+  recreate?: boolean;
 };
 
 export type SandboxRunResult = RunProcessResult & {
@@ -35,14 +37,15 @@ export type RunSkillOptions = {
   writeStderr?: (chunk: string) => void;
 };
 
-const USAGE = `Usage: ai run <skill> [task-ref] [args...] [--tui <name>]
+const USAGE = `Usage: ai run <skill> [task-ref] [args...] [--tui <name>] [--recreate]
 
 Task skills are scheduled inside the sandbox tmux session; ai run returns once
-the tmux window is created.
+the tmux window is created. --recreate authorizes container-only replacement
+when in-place sandbox recovery fails; it is not included in the TUI prompt.
 
 Examples:
   ai run create-task "describe the task" --tui codex
-  ai run code-task #7 --tui codex`;
+  ai run code-task #7 --tui codex --recreate`;
 
 function extractTui(args: string[]): { rest: string[]; tui: string | null } {
   const rest: string[] = [];
@@ -65,17 +68,26 @@ export function parseRunArgs(args: string[]): ParsedRunArgs {
   if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
     throw new Error(USAGE);
   }
-  const { rest, tui } = extractTui(args);
+  const { rest: withRecoveryFlags, tui } = extractTui(args);
+  const recreate = withRecoveryFlags.includes('--recreate');
+  const rest = withRecoveryFlags.filter((arg) => arg !== '--recreate');
   const [skill = '', maybeTaskRef, ...remaining] = rest;
   const spec = getSkillRunSpec(skill);
   if (!spec) throw new Error(`Unknown skill '${skill}'`);
   if (spec.kind === 'create') {
+    if (recreate) throw new Error('--recreate is only valid for sandbox task runs');
     const createArgs = rest.slice(1);
     if (createArgs.length === 0) throw new Error('create-task requires a description');
     return { skill, taskRef: null, args: createArgs, tui };
   }
   if (!maybeTaskRef) throw new Error(`${skill} requires a task-ref`);
-  return { skill, taskRef: maybeTaskRef, args: remaining, tui };
+  return {
+    skill,
+    taskRef: maybeTaskRef,
+    args: remaining,
+    tui,
+    ...(recreate ? { recreate: true as const } : {})
+  };
 }
 
 function assertAllowedByConfig(skill: string, commandConfig: Record<string, unknown>): void {
@@ -129,7 +141,7 @@ function resolveActiveTaskIdentity(taskRef: string, repoRoot: string): ActiveTas
     const normalized = normalizeShortIdInput(taskRef, { shortIdLength: readShortIdLength(repoRoot) });
     if (normalized.kind !== 'shortId') return null;
     resolvedTaskRef = normalized.value;
-    taskId = readActiveShortIdRegistry(repoRoot)[normalized.value.slice(1)] ?? null;
+    taskId = readActiveShortIdRegistry(repoRoot)[normalized.value] ?? null;
   }
 
   if (!taskId) return null;
@@ -207,7 +219,13 @@ export async function runSkill(args: string[], options: RunSkillOptions = {}): P
   const runSandbox =
     options.runSandbox ??
     ((request: SandboxRunRequest) => runInSandbox(request));
-  const result = await runSandbox({ taskRef: parsed.taskRef, branch, command, runId });
+  const result = await runSandbox({
+    taskRef: parsed.taskRef,
+    branch,
+    command,
+    runId,
+    recreate: parsed.recreate
+  });
   if (result.stdout) {
     writeStdout(result.stdout);
   }

package/lib/sandbox/build-proxy.ts

@@ -0,0 +1,94 @@
+import semver from 'semver';
+import { engineDisplayName } from './engine.ts';
+import { runSafeEngine } from './shell.ts';
+
+export const BUILD_PROXY_ENV_KEYS = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY'] as const;
+export const MIN_BUILD_PROXY_DOCKER_VERSION = '20.10.0';
+export const MIN_BUILD_PROXY_BUILDKIT_VERSION = '0.9.0';
+
+export type BuildProxyPlan = {
+  args: string[];
+  env: NodeJS.ProcessEnv;
+  redactionValues: string[];
+};
+
+type EngineRunSafeFn = (engine: string, cmd: string, args: string[]) => string;
+
+export function prepareBuildProxy(
+  enabled: boolean,
+  hostEnv: NodeJS.ProcessEnv,
+  engine: string
+): BuildProxyPlan {
+  const env = { ...hostEnv };
+  if (!enabled) {
+    return { args: [], env, redactionValues: [] };
+  }
+
+  const entries = BUILD_PROXY_ENV_KEYS.flatMap((key) => {
+    const value = hostEnv[key]?.trim();
+    return value ? [[key, value] as const] : [];
+  });
+  if (entries.length === 0) {
+    throw new Error(
+      `No non-empty build proxy variables are set. Configure one of: ${BUILD_PROXY_ENV_KEYS.join(', ')}.`
+    );
+  }
+
+  for (const [key, value] of entries) env[key] = value;
+  if (engine === 'wsl2') {
+    const existing = (env.WSLENV ?? '').split(':').filter(Boolean);
+    env.WSLENV = [...new Set([...existing, ...entries.map(([key]) => key)])].join(':');
+  }
+
+  return {
+    args: entries.flatMap(([key]) => ['--secret', `id=${key},env=${key}`]),
+    env,
+    redactionValues: entries.map(([, value]) => value)
+  };
+}
+
+function parsedVersion(raw: string): string | null {
+  return semver.coerce(raw.trim())?.version ?? null;
+}
+
+export function assertBuildProxyCompatibility(
+  engine: string,
+  runSafeEngineFn: EngineRunSafeFn = runSafeEngine
+): void {
+  const dockerRaw = runSafeEngineFn(engine, 'docker', ['version', '--format', '{{.Server.Version}}']);
+  const dockerVersion = parsedVersion(dockerRaw);
+  if (!dockerVersion || !semver.gte(dockerVersion, MIN_BUILD_PROXY_DOCKER_VERSION)) {
+    throw new Error(
+      `Build proxy requires Docker Engine ${MIN_BUILD_PROXY_DOCKER_VERSION} or newer; `
+      + `observed ${dockerVersion ?? 'an unparseable version'}.`
+    );
+  }
+
+  const buildxRaw = runSafeEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap']);
+  const versions = [...buildxRaw.matchAll(/BuildKit(?:\s+version)?:\s*v?(\d+\.\d+\.\d+(?:[-+][^\s]+)?)/gi)]
+    .map((match) => parsedVersion(match[1] ?? ''))
+    .filter((version): version is string => version !== null);
+  if (versions.length === 0) {
+    throw new Error(
+      `Build proxy requires BuildKit ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer, `
+      + 'but the active builder version could not be determined.'
+    );
+  }
+  const oldVersion = versions.find((version) => !semver.gte(version, MIN_BUILD_PROXY_BUILDKIT_VERSION));
+  if (oldVersion) {
+    throw new Error(
+      `Build proxy observed BuildKit ${oldVersion}; version ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer is required.`
+    );
+  }
+}
+
+export function redactBuildProxyValues(text: string, values: readonly string[]): string {
+  return [...new Set(values.filter(Boolean))]
+    .sort((left, right) => right.length - left.length)
+    .reduce((result, value) => result.replaceAll(value, '[REDACTED_BUILD_PROXY]'), text);
+}
+
+export function buildProxyFailureHint(engine: string): string {
+  return `Build-step proxy inheritance is enabled for ${engineDisplayName(engine)}. `
+    + 'Image pulls and Dockerfile FROM resolution use the Docker daemon or builder proxy configuration.';
+}

package/lib/sandbox/capture.ts

@@ -3,6 +3,7 @@ import { loadConfig } from './config.ts';
 import { containerNameCandidates, sandboxBranchLabel, sandboxLabel } from './constants.ts';
 import { detectEngine } from './engine.ts';
 import { commandForEngine } from './shell.ts';
+import { ensureSandboxReady, type SandboxReadyResult } from './recovery.ts';
 import { hostTimezoneEnvFlags, terminalEnvFlags } from './commands/enter.ts';
 import {
   fetchSandboxRows,
@@ -16,6 +17,7 @@ export type SandboxCaptureRequest = {
   branch: string;
   command: string[];
   timeoutMs?: number;
+  recreate?: boolean;
 };
 
 export type SandboxCaptureResult = {
@@ -40,6 +42,11 @@ export type SandboxCaptureOptions = {
   containerCandidates?: string[];
   rows?: SandboxRow[];
   startContainer?: (name: string) => void;
+  ensureReady?: (params: {
+    branch: string;
+    row: SandboxRow;
+    allowRecreate: boolean;
+  }) => Promise<SandboxReadyResult>;
   spawn?: (file: string, args: string[]) => Promise<SandboxCaptureResult>;
 };
 
@@ -189,7 +196,26 @@ export async function runInSandbox(
       `Sandbox for ${request.branch} not found. Create it first with ai sandbox create ${request.taskRef}.`
     );
   }
-  if (!found.running) {
+  let container = found.name;
+  if (options.ensureReady) {
+    container = (await options.ensureReady({
+      branch: request.branch,
+      row: found,
+      allowRecreate: request.recreate ?? false
+    })).container;
+  } else if (config) {
+    container = (await ensureSandboxReady({
+      config,
+      engine,
+      branch: request.branch,
+      row: found,
+      allowRecreate: request.recreate,
+      recreate: async (targetBranch) => {
+        const { create } = await import('./commands/create.ts');
+        await create([targetBranch, '--no-refresh']);
+      }
+    })).container;
+  } else if (!found.running) {
     (options.startContainer ?? ((name: string) => startSandboxContainer(engine, name)))(found.name);
   }
   const runId = options.runId ?? createRunId();
@@ -198,7 +224,7 @@ export async function runInSandbox(
     'exec',
     ...terminalEnvFlags(),
     ...hostTimezoneEnvFlags(),
-    found.name,
+    container,
     'bash',
     '-lc',
     buildTmuxLauncher({ request, runId })
@@ -210,7 +236,7 @@ export async function runInSandbox(
     run: {
       runId,
       engine,
-      container: found.name,
+      container,
       runDir
     }
   };