@fitlab-ai/agent-infra 0.9.1 → 0.9.2

package/dist/lib/platform/pr-checks.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
+import { inspectPlatformRequiredChecks, registerPlatformCapabilities } from './adapters.js';
 import { resolvePlatformContext } from './context.js';
 import { createGitHubClient } from './github-client.js';
 import { inspectPlatformPullRequest } from './pull-requests.js';
@@ -87,6 +88,18 @@ function normalizeChecks(value) {
             }] : [];
     });
 }
+registerPlatformCapabilities('github', {
+    inspectRequiredChecks({ client, repository, number, cwd }) {
+        const github = client || createGitHubClient();
+        const inspected = github.json([
+            'pr', 'checks', String(number), '--repo', repository, '--required',
+            '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
+        ], { cwd });
+        return inspected.ok
+            ? { ok: true, value: normalizeChecks(inspected.value) }
+            : { ok: false, error: inspected.error };
+    }
+});
 function resolvedTask(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok)
@@ -110,18 +123,26 @@ function inspectRequiredChecks(taskRef, options = {}) {
     if (!base.ok)
         return base.output;
     const repository = base.context.platform.repository;
-    const inspected = base.client.json([
-        'pr', 'checks', String(base.prNumber), '--repo', repository, '--required',
-        '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
-    ], { cwd: base.resolved.repoRoot });
-    if (!inspected.ok) {
-        return checksResult(inspected.error.retryable ? 'blocked' : 'failed', {
+    const inspected = inspectPlatformRequiredChecks(base.context.platform.type, {
+        cwd: base.resolved.repoRoot,
+        repository,
+        number: base.prNumber,
+        headSha: base.pullRequest.head.sha,
+        client: options.client || base.client
+    });
+    if (!inspected.ok || !inspected.value) {
+        const error = inspected.error || {
+            code: 'REQUIRED_CHECKS_INSPECTION_INVALID',
+            message: 'Platform adapter returned no required-checks snapshot',
+            retryable: false
+        };
+        return checksResult(error.retryable ? 'blocked' : 'failed', {
             platform: base.context.platform, capabilities: base.context.capabilities,
             resource: { kind: 'pull-request', number: base.prNumber },
-            pullRequest: base.pullRequest, error: inspected.error
+            pullRequest: base.pullRequest, error
         });
     }
-    const classified = classifyRequiredChecks(normalizeChecks(inspected.value));
+    const classified = classifyRequiredChecks(inspected.value);
     const status = classified.state === 'passed' || classified.state === 'no-required'
         ? 'no-op'
         : classified.state === 'failed' || classified.state === 'cancelled' ? 'failed' : 'blocked';
@@ -194,6 +215,13 @@ function resolvePlatformCheckRun(taskRef, options) {
         error: resolution.status === 'resolved' ? null : { code: resolution.status === 'ambiguous' ? 'CHECK_RUN_AMBIGUOUS' : 'CHECK_RUN_NOT_FOUND', message: `Check run is ${resolution.status}`, retryable: false }
     });
 }
+function fetchCheckLogText(client, args, cwd) {
+    const fetched = client.text(args, { cwd });
+    if (fetched.ok || args[0] !== 'api' || !/response contains terminal escape sequences/i.test(fetched.error.message)) {
+        return fetched;
+    }
+    return client.text([...args, '--allow-escape-sequences'], { cwd });
+}
 function fetchPlatformCheckLogs(taskRef, options) {
     const base = resolvedTask(taskRef, options);
     if (!base.ok)
@@ -201,7 +229,7 @@ function fetchPlatformCheckLogs(taskRef, options) {
     const args = options.job
         ? ['api', `repos/${base.context.platform.repository}/actions/jobs/${options.job}/logs`]
         : ['run', 'view', String(options.run), '--repo', base.context.platform.repository, '--log-failed'];
-    const fetched = base.client.text(args, { cwd: base.resolved.repoRoot });
+    const fetched = fetchCheckLogText(base.client, args, base.resolved.repoRoot);
     if (!fetched.ok)
         return checksResult(fetched.error.retryable ? 'blocked' : 'failed', { platform: base.context.platform, capabilities: base.context.capabilities, error: fetched.error });
     if (!fetched.value)
@@ -212,5 +240,5 @@ function fetchPlatformCheckLogs(taskRef, options) {
         logs: { runId: options.run, ...(options.job ? { jobId: options.job } : {}), text: fetched.value }, error: null
     });
 }
-export { classifyRequiredChecks, fetchPlatformCheckLogs, inspectRequiredChecks, parseRunJobIdentity, resolvePlatformCheckRun, resolveRunCandidate, watchPlatformChecks, watchRequiredChecks };
+export { classifyRequiredChecks, fetchCheckLogText, fetchPlatformCheckLogs, inspectRequiredChecks, parseRunJobIdentity, resolvePlatformCheckRun, resolveRunCandidate, watchPlatformChecks, watchRequiredChecks };
 //# sourceMappingURL=pr-checks.js.map

package/dist/lib/platform/pull-requests.js

@@ -1,9 +1,11 @@
 import fs from 'node:fs';
+import { execFileSync } from 'node:child_process';
 import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { extractSection } from '../task/sections.js';
 import { captureTaskWriteMetadata, writeTask } from '../task/write.js';
-import { resolvePlatformContext } from './context.js';
+import { inspectPlatformChangeRequest, registerPlatformCapabilities } from './adapters.js';
+import { parseGitHubRemote, resolvePlatformContext } from './context.js';
 import { createGitHubClient } from './github-client.js';
 import { inspectPlatformIssue } from './issues.js';
 import { planPullRequestMetadata } from './pull-request-metadata.js';
@@ -90,6 +92,97 @@ function inspectGitHubPullRequest(client, repository, number, cwd) {
         ? { ok: true, value: pullRequest }
         : { ok: false, error: { code: 'PR_IDENTITY_INVALID', message: 'Remote resource is not a valid pull request', retryable: false } };
 }
+function configuredGitRemotes(cwd) {
+    try {
+        return execFileSync('git', ['remote'], {
+            cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
+        }).split(/\r?\n/).filter(Boolean).flatMap((name) => {
+            try {
+                const url = execFileSync('git', ['config', '--get', `remote.${name}.url`], {
+                    cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
+                }).trim();
+                const repository = parseGitHubRemote(url);
+                return repository ? [{ name, url, repository }] : [];
+            }
+            catch {
+                return [];
+            }
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function rewriteGitHubRemote(remote, repository) {
+    const match = remote.trim().match(/^(https?:\/\/github\.com\/|ssh:\/\/(?:git@)?github\.com\/|git@github\.com:)[^/\s]+\/[^/\s]+(?:\.git)?$/i);
+    return match ? `${match[1]}${repository}.git` : null;
+}
+function resolveGitHubChangeRequestGitEvidence({ cwd, repository, pullRequest }) {
+    if (pullRequest.repository !== repository ||
+        pullRequest.base.repository !== repository ||
+        pullRequest.number <= 0) {
+        return {
+            ok: false,
+            error: {
+                code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
+                message: 'Pull request repository identity is inconsistent',
+                retryable: false
+            }
+        };
+    }
+    const reviewedHeadRef = `refs/pull/${pullRequest.number}/head`;
+    const targetHeadRef = `refs/heads/${pullRequest.base.ref}`;
+    const refValid = (ref) => {
+        try {
+            execFileSync('git', ['check-ref-format', ref], {
+                cwd, encoding: 'utf8', stdio: ['ignore', 'ignore', 'ignore']
+            });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    if (!refValid(reviewedHeadRef) || !refValid(targetHeadRef)) {
+        return {
+            ok: false,
+            error: {
+                code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
+                message: 'Pull request Git refs are invalid',
+                retryable: false
+            }
+        };
+    }
+    const remotes = configuredGitRemotes(cwd);
+    const exact = remotes
+        .filter((remote) => remote.repository === repository)
+        .sort((left, right) => Number(right.name === 'origin') - Number(left.name === 'origin') ||
+        left.name.localeCompare(right.name))[0];
+    const origin = remotes.find((remote) => remote.name === 'origin');
+    const remoteUrl = exact?.url || (origin ? rewriteGitHubRemote(origin.url, repository) : null);
+    if (!remoteUrl) {
+        return {
+            ok: false,
+            error: {
+                code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
+                message: `No GitHub remote can provide evidence for ${repository}`,
+                retryable: false
+            }
+        };
+    }
+    return {
+        ok: true,
+        value: { remoteUrl, reviewedHeadRef, targetHeadRef }
+    };
+}
+registerPlatformCapabilities('github', {
+    inspectChangeRequest({ client, repository, number, cwd }) {
+        return inspectGitHubPullRequest(client || createGitHubClient(), repository, number, cwd);
+    },
+    resolveChangeRequestGitEvidence(context) {
+        return resolveGitHubChangeRequestGitEvidence(context);
+    }
+});
 function locatePullRequest(base, head, target) {
     const repository = base.context.platform.repository;
     const listed = base.client.json([
@@ -115,12 +208,23 @@ function inspectPlatformPullRequest(taskRef, options = {}) {
             platform: base.context.platform, capabilities: base.context.capabilities,
             error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false }
         });
-    const fetched = inspectGitHubPullRequest(base.client, base.context.platform.repository, base.prNumber, base.resolved.repoRoot);
-    if (!fetched.ok)
-        return result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+    const fetched = inspectPlatformChangeRequest(base.context.platform.type, {
+        cwd: base.resolved.repoRoot,
+        repository: base.context.platform.repository,
+        number: base.prNumber,
+        client: options.client || base.client
+    });
+    if (!fetched.ok || !fetched.value) {
+        const error = fetched.error || {
+            code: 'PR_INSPECTION_INVALID',
+            message: 'Platform adapter returned no change-request snapshot',
+            retryable: false
+        };
+        return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform, capabilities: base.context.capabilities,
-            resource: { kind: 'pull-request', number: base.prNumber }, error: fetched.error
+            resource: { kind: 'pull-request', number: base.prNumber }, error
         });
+    }
     return result('no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
         platform: base.context.platform, capabilities: base.context.capabilities,
         resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value, error: null
@@ -336,5 +440,5 @@ function syncPlatformPullRequest(taskRef, options) {
         operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation), error: null
     });
 }
-export { bindPlatformPullRequest, createPlatformPullRequest, inspectGitHubPullRequest, inspectPlatformPullRequest, normalizePullRequest, selectPullRequest, syncPlatformPullRequest };
+export { bindPlatformPullRequest, createPlatformPullRequest, inspectGitHubPullRequest, inspectPlatformPullRequest, normalizePullRequest, resolveGitHubChangeRequestGitEvidence, selectPullRequest, syncPlatformPullRequest };
 //# sourceMappingURL=pull-requests.js.map

package/dist/lib/platform/releases.js

@@ -18,7 +18,7 @@ function inspectPlatformRelease(tag, options = {}) {
         return { ...platformResult(result.error.retryable ? 'blocked' : 'failed'), platform: context.platform, release: null, workflows: [], error: result.error };
     }
     const release = { tag: String(result.value.tagName || tag), published: !Boolean(result.value.isDraft), draft: Boolean(result.value.isDraft), url: result.value.url ? String(result.value.url) : null };
-    const runs = client.json(['run', 'list', '--repo', context.platform.repository, '--limit', '100', '--json', 'name,headBranch,status,conclusion,url'], { cwd: options.cwd });
+    const runs = client.json(['run', 'list', '--repo', context.platform.repository, '--limit', '100', '--json', 'name,workflowName,displayTitle,event,headBranch,headSha,status,conclusion,createdAt,databaseId,attempt,url'], { cwd: options.cwd });
     return { ...platformResult(runs.ok ? 'no-op' : runs.error.retryable ? 'blocked' : 'degraded'), platform: context.platform, release, workflows: runs.ok ? runs.value : [], error: runs.ok ? null : runs.error };
 }
 function upsertPlatformRelease(input, options = {}) {

package/dist/lib/platform/verification-required.js

@@ -1,10 +1,10 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { hasPlatformCapability } from "./adapters.js";
 import { inspectRequiredChecks } from "./pr-checks.js";
 import { resolvePlatformContext } from "./context.js";
 import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.js";
-import { loadPostReviewConfig, resolvePostReviewGlobs } from "../task/review-fingerprint.js";
 const CHECK_TYPE = "required-checks";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 function validPrNumber(value) {
@@ -50,10 +50,9 @@ export function evaluateRequiredChecks(context, shared) {
     const relation = context.relation || (context.gitRoot && inspection.pullRequest?.head
         ? resolveReviewedHeadRelation({
             gitRoot: context.gitRoot,
-            localHead,
+            comparisonHead: localHead,
             lastReviewedCommit: reviewedHead,
-            pullRequest: inspection.pullRequest,
-            pathspecs: context.pathspecs || [":/"]
+            pullRequest: inspection.pullRequest
         })
         : localHead === reviewedHead && localHead === prHead
             ? { status: "strict" }
@@ -78,14 +77,14 @@ export function check({ taskDir }, shared) {
     const task = shared.loadTask(taskDir);
     if (!task.ok)
         return shared.failResult(CHECK_TYPE, task.message);
-    const platform = resolvePlatformContext({ cwd: shared.repoRoot });
-    if (platform.platform.type !== "github") {
-        return shared.passResult(CHECK_TYPE, "Skipped: this code platform does not provide required checks");
-    }
     const prFlow = readPrFlow(shared.repoRoot);
     if (prFlow === "disabled" || task.metadata.pr_status === "skipped" || !validPrNumber(task.metadata.pr_number)) {
         return evaluateRequiredChecks({ metadata: task.metadata, localHead: null, inspection: null, prFlow }, shared);
     }
+    const platform = resolvePlatformContext({ cwd: shared.repoRoot });
+    if (!hasPlatformCapability(platform.platform.type, "required-checks")) {
+        return shared.blockedResult(CHECK_TYPE, `Platform '${platform.platform.type || "none"}' does not provide required-checks inspection`, "dependency_error");
+    }
     const localHead = readHead(shared.repoRoot);
     if (!localHead)
         return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection: null, prFlow }, shared);
@@ -95,8 +94,7 @@ export function check({ taskDir }, shared) {
         localHead,
         inspection,
         prFlow,
-        gitRoot: shared.repoRoot,
-        pathspecs: resolvePostReviewGlobs({}, loadPostReviewConfig(shared.repoRoot))
+        gitRoot: shared.repoRoot
     }, shared);
 }
 //# sourceMappingURL=verification-required.js.map

package/dist/lib/prompt.js

@@ -74,18 +74,30 @@ async function select(question, choices, defaultValue) {
     }
     return trimmed;
 }
-async function multiSelect(question, choices) {
+async function multiSelect(question, choices, defaultIds = choices.map((choice) => choice.id)) {
+    const choiceIds = new Set(choices.map((choice) => choice.id));
+    if (defaultIds.some((id) => !choiceIds.has(id))) {
+        throw new Error('Default selection contains an unknown id');
+    }
+    const normalizedDefaults = choices
+        .map((choice) => choice.id)
+        .filter((id) => defaultIds.includes(id));
     process.stdout.write(`  ${question}:\n`);
     const idWidth = Math.max(...choices.map((c) => c.id.length));
     choices.forEach((c, i) => {
         process.stdout.write(`      ${i + 1}) ${c.id.padEnd(idWidth)}  (${c.label})\n`);
     });
-    ask('Enter comma-separated numbers or ids to keep, or "none" to select nothing [default: all]: ');
+    const defaultLabel = normalizedDefaults.length === choices.length
+        ? 'all'
+        : normalizedDefaults.length === 0
+            ? 'none'
+            : normalizedDefaults.join(',');
+    ask(`Enter comma-separated numbers or ids to keep, or "none" to select nothing [default: ${defaultLabel}]: `);
     setupInterface();
     const line = await nextLine();
     // Strictly distinguish bare Enter (null/empty string) from whitespace input.
     if (line === null || line === '')
-        return choices.map((c) => c.id);
+        return normalizedDefaults;
     // Explicit empty selection: "none" means deliberately zero built-in choices.
     if (line.trim().toLowerCase() === 'none')
         return [];

package/dist/lib/release/channels.js

@@ -21,7 +21,10 @@ async function inspectHomebrewChannel(url, version, fetcher = fetch) {
             return { status: 'blocked', published: null, version, error: { code: 'HOMEBREW_UNAVAILABLE', message: `formula endpoint returned ${response.status}` } };
         const formula = await response.text();
         const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        return { status: 'no-op', published: new RegExp(`(?:version\\s+["']${escaped}["']|/v?${escaped}\\.)`).test(formula), version, error: null };
+        const formulaUrl = /^\s*url\s+["']([^"']+)["']\s*$/m.exec(formula)?.[1] ?? '';
+        const npmTarball = new RegExp(`^https://registry\\.npmjs\\.org/.+/-/[^/]+-${escaped}\\.tgz$`).test(formulaUrl);
+        const bottle = /^\s*bottle do\s*$/m.test(formula);
+        return { status: 'no-op', published: npmTarball && bottle, version, error: null };
     }
     catch (error) {
         return { status: 'blocked', published: null, version, error: { code: 'HOMEBREW_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };

package/dist/lib/release/workflow.js

@@ -1,5 +1,5 @@
 function deriveReleasePhase(facts) {
-    if (!facts.localTag)
+    if (!facts.localTag && !facts.localTagAncestor)
         return 'unprepared';
     if (!facts.remoteBranch && !facts.remoteTag)
         return 'prepared';
@@ -18,8 +18,10 @@ async function runReleaseAction(input) {
     const before = releaseSnapshot(input.version, await input.inspect());
     if (input.action === 'inspect')
         return { status: 'no-op', changed: false, before, snapshot: before, error: null };
+    if (before.facts.localTagConflict)
+        return { status: 'failed', changed: false, before, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag ${before.tag} is not reachable from HEAD` } };
     const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
-        : input.action === 'publish' ? ['prepared', 'partially-published'].includes(before.phase)
+        : input.action === 'publish' ? before.facts.localTag && ['prepared', 'partially-published'].includes(before.phase)
             : ['published', 'post-pending'].includes(before.phase);
     if (!allowed)
         return { status: before.phase === 'complete' ? 'no-op' : 'failed', changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };

package/dist/lib/remove-dir.js

@@ -0,0 +1,25 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export function removeDirRecursive(dir) {
+    if (!fs.existsSync(dir)) {
+        return;
+    }
+    const pending = [dir];
+    const directories = [];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        const stat = fs.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            fs.unlinkSync(current);
+            continue;
+        }
+        directories.push(current);
+        for (const entry of fs.readdirSync(current)) {
+            pending.push(path.join(current, entry));
+        }
+    }
+    for (const directory of directories.reverse()) {
+        fs.rmdirSync(directory);
+    }
+}
+//# sourceMappingURL=remove-dir.js.map

package/dist/lib/run/tui.js

@@ -1,3 +1,5 @@
+import { renderAgentClientInvocation } from '../agent-clients/invocation.js';
+import { getAgentClientAdapter } from '../agent-clients/registry.js';
 const TUI_NAMES = new Set(['claude', 'codex', 'gemini', 'opencode']);
 function isTuiName(value) {
     return typeof value === 'string' && TUI_NAMES.has(value);
@@ -17,8 +19,12 @@ export function selectTui(skill, options) {
 }
 export function renderPrompt(params) {
     const suffix = [params.skill, ...params.args].join(' ').trim();
-    if (params.tui === 'codex')
-        return `$${suffix}`;
+    if (params.tui === 'codex') {
+        return renderAgentClientInvocation(getAgentClientAdapter('codex').invocation, {
+            skillName: params.skill,
+            args: params.args
+        });
+    }
     if (params.tui === 'gemini')
         return `/agent-infra:${suffix}`;
     return `/${suffix}`;

package/dist/lib/sandbox/agent-client-reconciler.js

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { isAgentClientId } from '../agent-clients/types.js';
+import { listAgentClientAdapters, listInstalledAgentClientAdapters } from '../agent-clients/registry.js';
+import { hostJoin } from './engines/wsl2-paths.js';
+const DEFAULT_SANDBOX_HOOK_TIMEOUT_MS = 30_000;
+function agentInfraTool(home) {
+    return {
+        id: 'agent-infra',
+        name: 'agent-infra CLI',
+        install: { type: 'npm', cmd: '@fitlab-ai/agent-infra@latest' },
+        sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'agent-infra'),
+        containerMount: '/home/devuser/.agent-infra-cli',
+        versionCmd: 'ai version --raw',
+        setupHint: 'Provides the ai and agent-infra CLI commands inside the sandbox.'
+    };
+}
+function compatAgentClientState(tools) {
+    return Object.fromEntries(listAgentClientAdapters().map((adapter) => [
+        adapter.id,
+        {
+            enabled: true,
+            installInSandbox: tools.includes(adapter.id)
+        }
+    ]));
+}
+function stableValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(stableValue);
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, nested]) => [key, stableValue(nested)]));
+    }
+    return value;
+}
+function runtimeToolProjection(tool) {
+    return stableValue({
+        id: tool.id,
+        install: tool.install,
+        containerMount: tool.containerMount,
+        versionCmd: tool.versionCmd,
+        envVars: tool.envVars ?? {},
+        hostPreSeedFiles: (tool.hostPreSeedFiles ?? []).map(({ sandboxName }) => ({ sandboxName })),
+        hostPreSeedDirs: (tool.hostPreSeedDirs ?? []).map(({ sandboxSubdir }) => ({ sandboxSubdir })),
+        pathRewriteFiles: tool.pathRewriteFiles ?? [],
+        hostLiveMounts: (tool.hostLiveMounts ?? []).map(({ containerSubpath }) => ({ containerSubpath })),
+        postSetupCmds: tool.postSetupCmds ?? [],
+        tmpfs: tool.tmpfs ?? null
+    });
+}
+function hash(value) {
+    return createHash('sha256').update(JSON.stringify(stableValue(value))).digest('hex');
+}
+function assertUniqueTools(tools) {
+    const seen = new Set();
+    for (const tool of tools) {
+        if (seen.has(tool.id)) {
+            throw new Error(`Duplicate sandbox tool id "${tool.id}"`);
+        }
+        seen.add(tool.id);
+    }
+}
+function hooksByPhase(adapters) {
+    const phases = [
+        'prepare',
+        'before-container-create',
+        'after-container-start',
+        'before-enter'
+    ];
+    return Object.freeze(Object.fromEntries(phases.map((phase) => [
+        phase,
+        Object.freeze(adapters.flatMap((adapter) => adapter.sandbox.hooks.filter((hook) => hook.phase === phase)))
+    ])));
+}
+function createSandboxCapabilityPlan(config) {
+    const state = config.agentClientState ?? compatAgentClientState(config.tools);
+    const selectedAgentClients = listInstalledAgentClientAdapters(state);
+    const context = { home: config.home, project: config.project };
+    const selectedTools = selectedAgentClients.map((adapter) => adapter.sandbox.createTool(context));
+    const allClientTools = listAgentClientAdapters().map((adapter) => adapter.sandbox.createTool(context));
+    const customById = new Map((config.customTools ?? []).map((tool) => [tool.id, tool]));
+    if (customById.size !== (config.customTools ?? []).length) {
+        throw new Error('Duplicate sandbox tool id in customTools');
+    }
+    for (const id of customById.keys()) {
+        if (id === 'agent-infra' || isAgentClientId(id)) {
+            throw new Error(`Custom sandbox tool id "${id}" collides with a built-in tool`);
+        }
+    }
+    const nonClientTools = [];
+    const selectedCustomTools = [];
+    for (const id of config.tools) {
+        if (isAgentClientId(id))
+            continue;
+        if (id === 'agent-infra') {
+            if (!nonClientTools.some((tool) => tool.id === id)) {
+                nonClientTools.push(agentInfraTool(config.home));
+            }
+            continue;
+        }
+        const custom = customById.get(id);
+        if (!custom) {
+            throw new Error(`Unknown sandbox tool: ${id}`);
+        }
+        selectedCustomTools.push(custom);
+    }
+    const tools = Object.freeze([...nonClientTools, ...selectedTools, ...selectedCustomTools]);
+    assertUniqueTools(tools);
+    const phaseHooks = hooksByPhase(selectedAgentClients);
+    const hookProjection = selectedAgentClients.flatMap((adapter) => adapter.sandbox.hooks.map((hook) => ({
+        adapterId: adapter.id,
+        id: hook.id,
+        phase: hook.phase,
+        timeoutMs: hook.timeoutMs ?? DEFAULT_SANDBOX_HOOK_TIMEOUT_MS
+    })));
+    const recoveryChecks = Object.freeze(selectedAgentClients.flatMap((adapter) => (adapter.sandbox.recoveryChecks ?? []).map((check) => Object.freeze({
+        adapterId: adapter.id,
+        check
+    }))));
+    const recoveryCheckProjection = Object.freeze(recoveryChecks.map(({ adapterId, check }) => Object.freeze({
+        adapterId,
+        id: check.id,
+        ...(check.when === undefined ? {} : { when: check.when }),
+        probe: check.probe,
+        finding: Object.freeze({
+            repairKind: check.finding.repairKind,
+            ...(check.finding.path === undefined ? {} : { path: check.finding.path })
+        }),
+        ...(check.repair === undefined ? {} : { repair: check.repair })
+    })));
+    const runtimeProjection = Object.freeze({
+        tools: Object.freeze(tools.map(runtimeToolProjection)),
+        selectedAgentClients: Object.freeze(selectedAgentClients.map((adapter) => adapter.id)),
+        hooks: Object.freeze(hookProjection),
+        recoveryChecks: recoveryCheckProjection
+    });
+    const cleanupInventory = Object.freeze([
+        agentInfraTool(config.home),
+        ...allClientTools,
+        ...customById.values()
+    ]);
+    assertUniqueTools(cleanupInventory);
+    return Object.freeze({
+        tools,
+        selectedAgentClients,
+        hooksByPhase: phaseHooks,
+        recoveryChecks,
+        aliases: Object.freeze(listAgentClientAdapters().flatMap((adapter) => adapter.sandbox.aliases)),
+        imageSignature: hash(tools.map(({ id, install }) => ({ id, install }))),
+        runtimeSignature: hash(runtimeProjection),
+        runtimeProjection,
+        cleanupInventory
+    });
+}
+function timeoutStatus(phase) {
+    if (phase === 'before-enter')
+        return 'warning';
+    return 'fatal';
+}
+async function runSandboxHooks({ hooks, phase, context, runCommand = async () => {
+    throw new Error('Sandbox hook command runner is unavailable');
+}, scheduleTimeout = (callback, timeoutMs) => setTimeout(callback, timeoutMs), clearScheduledTimeout = (handle) => clearTimeout(handle) }) {
+    const results = [];
+    for (const hook of hooks) {
+        if (hook.phase !== phase)
+            continue;
+        const timeoutMs = hook.timeoutMs ?? DEFAULT_SANDBOX_HOOK_TIMEOUT_MS;
+        const controller = new AbortController();
+        let timedOut = false;
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = scheduleTimeout(() => {
+                timedOut = true;
+                controller.abort();
+                resolve({
+                    status: timeoutStatus(phase),
+                    message: `Sandbox hook '${hook.id}' timed out after ${timeoutMs}ms.`
+                });
+            }, timeoutMs);
+        });
+        let result;
+        try {
+            const execution = Promise.resolve().then(() => hook.run({
+                ...context,
+                signal: controller.signal,
+                runCommand: (command) => runCommand(command, {
+                    signal: controller.signal,
+                    timeoutMs
+                })
+            }));
+            result = await Promise.race([execution, timeout]);
+        }
+        catch (error) {
+            result = {
+                status: timeoutStatus(phase),
+                message: error instanceof Error ? error.message : String(error)
+            };
+        }
+        finally {
+            clearScheduledTimeout(timer);
+        }
+        results.push({
+            hookId: hook.id,
+            phase,
+            status: result.status,
+            ...(result.message ? { message: result.message } : {})
+        });
+        if (timedOut || result.status === 'fatal' || result.status === 'hard-failure') {
+            break;
+        }
+    }
+    return results;
+}
+function runBoundedSandboxHookCommand(command, options) {
+    return new Promise((resolve, reject) => {
+        execFile(command.command, [...(command.args ?? [])], {
+            cwd: command.cwd,
+            env: command.env,
+            encoding: 'utf8',
+            signal: options.signal,
+            timeout: options.timeoutMs
+        }, (error, stdout) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve({ stdout: stdout.trim() });
+        });
+    });
+}
+export { DEFAULT_SANDBOX_HOOK_TIMEOUT_MS, createSandboxCapabilityPlan, runBoundedSandboxHookCommand, runSandboxHooks };
+//# sourceMappingURL=agent-client-reconciler.js.map

package/dist/lib/sandbox/clipboard/linux.js

@@ -2,10 +2,11 @@ import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { removeDirRecursive } from '../../remove-dir.js';
 const PROBE_TIMEOUT_MS = 2_000;
 const READ_IMAGE_TIMEOUT_MS = 5_000;
 const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
-export function createLinuxClipboardAdapter({ env = process.env, execFn = execFileSync, execToFileFn = execToFile, mkdtempFn = fs.mkdtempSync, readFileFn = fs.readFileSync, rmFn = fs.rmSync } = {}) {
+export function createLinuxClipboardAdapter({ env = process.env, execFn = execFileSync, execToFileFn = execToFile, mkdtempFn = fs.mkdtempSync, readFileFn = fs.readFileSync, rmFn = removeDirRecursive } = {}) {
     return {
         available() {
             const backend = selectBackend(env);