@fitlab-ai/agent-infra 0.8.5 → 0.9.1

package/lib/sandbox/runtimes/ai-tools.dockerfile

@@ -5,20 +5,41 @@ ENV NPM_CONFIG_PREFIX=/home/devuser/.npm-global
 ENV PATH="/home/devuser/.npm-global/bin:${PATH}"
 
 ARG AI_TOOL_PACKAGES=
-RUN set -e && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    set -e && \
     for pkg in ${AI_TOOL_PACKAGES}; do \
       npm install -g "$pkg"; \
     done
 
 ARG AI_TOOLS_SHELL_INSTALL_B64=
-RUN if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
       set -e && \
       echo "${AI_TOOLS_SHELL_INSTALL_B64}" | base64 -d > /tmp/ai-tools-install.sh && \
       bash /tmp/ai-tools-install.sh && \
       rm /tmp/ai-tools-install.sh; \
     fi
 
-RUN npm install -g pyright
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    npm install -g pyright
 
 RUN mkdir -p /home/devuser/.local/share /home/devuser/.local/state
 

package/lib/sandbox/runtimes/base.dockerfile

@@ -19,7 +19,14 @@ RUN if [ "${HOST_UID}" = "0" ]; then \
         useradd -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     fi
 
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     curl wget git vim file jq \
     build-essential ca-certificates gnupg lsb-release \
     libevent-core-2.1-7 libncursesw6 libtinfo6 \

package/lib/sandbox/runtimes/java17.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-17-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/java21.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-21-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/node20.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/node22.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/lib/sandbox/runtimes/python3.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     python3 python3-pip python3-venv \
     && rm -rf /var/lib/apt/lists/*

package/lib/sandbox/shell.ts

@@ -12,6 +12,7 @@ type CommandOptions = {
   stdio?: StdioOptions;
   timeout?: number;
   shell?: boolean;
+  env?: NodeJS.ProcessEnv;
 };
 
 type RunProbeOptions = CommandOptions & {
@@ -23,7 +24,8 @@ function normalizeOptions(opts: CommandOptions = {}, stdio: StdioOptions): Comma
     cwd: opts.cwd,
     encoding: opts.encoding,
     stdio,
-    timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS
+    timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+    env: opts.env
   };
 }
 

package/lib/sandbox/task-resolver.ts

@@ -1,9 +1,10 @@
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { isRemovedHashShortIdInput } from '../task/short-id.ts';
 
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
-const SHORT_ID_RE = /^#?\d+$/;
+const SHORT_ID_RE = /^\d+$/;
 const WORKSPACE_DIRS = ['active', 'completed', 'blocked', 'archive'];
 
 function resolveShortIdStrict(arg: string, repoRoot: string): string {
@@ -51,6 +52,9 @@ function resolveBranchFromTaskContent(content: string, taskId: string): string {
 }
 
 export function resolveTaskBranch(arg: string, repoRoot: string): string {
+  if (isRemovedHashShortIdInput(arg)) {
+    throw new Error(`Invalid task short id '${arg}': task short ids must use bare digits`);
+  }
   if (SHORT_ID_RE.test(arg)) {
     const taskId = resolveShortIdStrict(arg, repoRoot);
     const content = readTaskContent(repoRoot, taskId);

package/lib/sandbox/tools.ts

@@ -1,3 +1,4 @@
+import path from 'node:path';
 import { safeNameCandidates, sanitizeBranchName } from './constants.ts';
 import { hostJoin } from './engines/wsl2-paths.ts';
 
@@ -28,6 +29,36 @@ export type SandboxTool = {
   tmpfs?: { size?: string; seed?: string[] };
 };
 
+export type TmpfsSeedEntry = {
+  toolId: string;
+  containerMount: string;
+  stagingPath: string;
+  targetPath: string;
+};
+
+export function tmpfsSeedStagingPath(toolId: string, index: number): string {
+  return `/run/agent-infra/tmpfs-seeds/${toolId}/${index}`;
+}
+
+export function tmpfsSeedTargetPath(containerMount: string, entry: string): string {
+  const normalized = path.posix.normalize(entry);
+  if (path.posix.isAbsolute(entry) || normalized === '..' || normalized.startsWith('../')) {
+    throw new Error(`tmpfs seed entry must stay within ${containerMount}: ${entry}`);
+  }
+  return path.posix.join(containerMount, normalized);
+}
+
+export function declaredTmpfsSeedEntries(tools: SandboxTool[]): TmpfsSeedEntry[] {
+  return tools.flatMap((tool) =>
+    (tool.tmpfs?.seed ?? []).map((entry, index) => ({
+      toolId: tool.id,
+      containerMount: tool.containerMount,
+      stagingPath: tmpfsSeedStagingPath(tool.id, index),
+      targetPath: tmpfsSeedTargetPath(tool.containerMount, entry)
+    }))
+  );
+}
+
 type ToolsConfig = {
   home: string;
   project: string;

package/lib/server/protocol.ts

@@ -31,16 +31,16 @@ export function commandHelp(): string {
     '/sandbox ls',
     '/sandbox show {ref}',
     '/sandbox vm status',
-    '/task decisions {ref}',
-    '/task log {ref}',
+    '/task decisions [--task {ref}] [--item {selector}]',
+    '/task log [--task {ref}]',
     '/task ls',
-    '/task show {ref}',
-    '/task status {ref}',
+    '/task show [--task {ref}]',
+    '/task status [--task {ref}]',
     'Write:',
     '/sandbox create {ref}',
     '/sandbox start {ref}',
     'Exec:',
-    '/decide {task-ref} {HD-id} {decision}',
+    '/decide [--task {ref}] --item {ordinal|ledger-id} [--needs-implementation true|false] {decision}',
     '/run create-task {description}',
     '/run {skill} {task-ref}'
   ].join('\n');

package/lib/task/activity-log.ts

@@ -0,0 +1,62 @@
+const HEADING_RE = /^##\s+(活动日志|Activity Log)\s*$/;
+const NEXT_H2_RE = /^##\s/;
+const ENTRY_RE = /^- (\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2}) — \*\*(.+?)\*\* by (.+?) — (.*)$/;
+const STARTED_SUFFIX_RE = /\s*\[started\]\s*$/;
+
+type LogEntry = { time: string; step: string; agent: string; note: string };
+type StepRow = { step: string; agent: string; started: string; done: string; note: string };
+type ActivityLogSection = { heading: string; body: string; entries: LogEntry[] };
+
+function parseActivityLog(content: string): { sectionFound: boolean; entries: LogEntry[] } {
+  const section = locateActivityLog(content);
+  return section ? { sectionFound: true, entries: section.entries } : { sectionFound: false, entries: [] };
+}
+
+function locateActivityLog(content: string): ActivityLogSection | null {
+  const lines = content.split('\n');
+  const headings = lines.map((line, index) => HEADING_RE.test(line) ? index : -1).filter((index) => index >= 0);
+  if (headings.length !== 1) return null;
+  const i = headings[0]!;
+  let end = lines.length;
+  for (let j = i + 1; j < lines.length; j += 1) {
+    if (NEXT_H2_RE.test(lines[j]!)) { end = j; break; }
+  }
+  const bodyLines = lines.slice(i + 1, end);
+  const parsed: { entry: LogEntry; epoch: number; order: number }[] = [];
+  for (const line of bodyLines) {
+    const m = ENTRY_RE.exec(line);
+    if (!m) continue;
+    parsed.push({ entry: { time: m[1]!, step: m[2]!, agent: m[3]!, note: m[4]! }, epoch: Date.parse(m[1]!.replace(' ', 'T')), order: parsed.length });
+  }
+  parsed.sort((a, b) => a.epoch - b.epoch || a.order - b.order);
+  return { heading: HEADING_RE.exec(lines[i]!)![1]!, body: bodyLines.join('\n').replace(/^\n+|\n+$/g, ''), entries: parsed.map((item) => item.entry) };
+}
+
+function appendActivityEntry(section: ActivityLogSection, entry: LogEntry): string {
+  const line = `- ${entry.time} — **${entry.step}** by ${entry.agent} — ${entry.note}`;
+  return section.body ? `${section.body}\n${line}` : line;
+}
+
+function pairEntries(entries: LogEntry[]): StepRow[] {
+  const rows: StepRow[] = [];
+  const open = new Map<string, StepRow[]>();
+  for (const entry of entries) {
+    const started = STARTED_SUFFIX_RE.test(entry.step);
+    const base = entry.step.replace(STARTED_SUFFIX_RE, '');
+    if (started) {
+      const row = { step: base, agent: entry.agent, started: entry.time, done: '', note: entry.note };
+      rows.push(row);
+      const queue = open.get(base) ?? [];
+      queue.push(row);
+      open.set(base, queue);
+    } else {
+      const pending = open.get(base)?.shift();
+      if (pending) Object.assign(pending, { done: entry.time, agent: entry.agent, note: entry.note });
+      else rows.push({ step: base, agent: entry.agent, started: '', done: entry.time, note: entry.note });
+    }
+  }
+  return rows;
+}
+
+export { parseActivityLog, locateActivityLog, appendActivityEntry, pairEntries };
+export type { LogEntry, StepRow, ActivityLogSection };