@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/process-data/index.js

@@ -9,6 +9,7 @@ import { readAppliedOverlays, repairSnapshot } from './repair.js';
 import { collectGitHubBoundary, resolveGitHubRepository } from './sources.js';
 import { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshotV2, verifySnapshot } from './store.js';
 import { createGitHubClient } from '../platform/github-client.js';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from '../internal/cli-route-inventory.js';
 const USAGE = `Usage: ai data <command> [options]
 
 Commands:
@@ -18,6 +19,7 @@ Commands:
   repair <snapshot-id> [--root <dir>] [--apply]
   export <snapshot-id> [--root <dir>] [--repairs none|applied] [--as-of <ISO>] [--output <file|->]
 `;
+const DATA_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS.data;
 function parseArgs(args, valueOptions, booleanOptions) {
     const positionals = [];
     const options = new Map();
@@ -286,6 +288,11 @@ async function cmdData(args) {
         return command ? 0 : 1;
     }
     try {
+        if (!DATA_OPERATIONS.includes(command)) {
+            process.stderr.write(`Unknown data command: ${command}\n`);
+            process.stdout.write(USAGE);
+            return 1;
+        }
         switch (command) {
             case 'capture': return capture(rest);
             case 'verify': return verify(rest);

package/dist/lib/run/index.js

@@ -7,57 +7,103 @@ import { loadShortIdByTaskId, normalizeShortIdInput } from '../task/short-id.js'
 import { buildTuiCommand, renderPrompt, selectTui } from './tui.js';
 import { getSkillRunSpec } from './skills.js';
 import { runHostCommand } from './host.js';
-const USAGE = `Usage: ai run <skill> [task-ref] [args...] [--tui <name>] [--recreate]
+import { PUBLIC_CLI_ROUTE_SELECTORS } from '../internal/cli-route-inventory.js';
+const USAGE = `Usage: ai run --skill <skill> [--task <task-ref>] [--tui <name>] [--recreate] [-- <skill-args...>]
 
 Task skills are scheduled inside the sandbox tmux session; ai run returns once
 the tmux window is created. --recreate authorizes container-only replacement
 when in-place sandbox recovery fails; it is not included in the TUI prompt.
 
 Examples:
-  ai run create-task "describe the task" --tui codex
-  ai run code-task #7 --tui codex --recreate`;
-function extractTui(args) {
-    const rest = [];
+  ai run --skill create-task "describe the task" --tui codex
+  ai run --skill code-task --task 7 --tui codex --recreate`;
+function optionValue(args, index, option) {
+    const value = args[index + 1];
+    if (!value || value.startsWith('--'))
+        throw new Error(`${option} requires a value`);
+    return value;
+}
+function extractHostOptions(args) {
+    const positionals = [];
+    const forwarded = [];
+    let skill = null;
+    let taskRef = null;
     let tui = null;
+    let recreate = false;
+    let separator = false;
     for (let i = 0; i < args.length; i += 1) {
         const arg = args[i];
-        if (arg === '--tui') {
-            const value = args[i + 1];
-            if (!value)
-                throw new Error('--tui requires a value');
-            tui = value;
+        if (separator) {
+            forwarded.push(arg);
+        }
+        else if (arg === '--') {
+            separator = true;
+        }
+        else if (arg === '--skill') {
+            if (skill !== null)
+                throw new Error("duplicate option '--skill'");
+            skill = optionValue(args, i, '--skill');
+            i += 1;
+        }
+        else if (arg === '--task') {
+            if (taskRef !== null)
+                throw new Error("duplicate option '--task'");
+            taskRef = optionValue(args, i, '--task');
+            i += 1;
+        }
+        else if (arg === '--tui') {
+            if (tui !== null)
+                throw new Error("duplicate option '--tui'");
+            tui = optionValue(args, i, '--tui');
             i += 1;
-            continue;
         }
-        rest.push(arg);
+        else if (arg === '--recreate') {
+            if (recreate)
+                throw new Error("duplicate option '--recreate'");
+            recreate = true;
+        }
+        else if (arg.startsWith('-')) {
+            throw new Error(`Unknown option '${arg}'`);
+        }
+        else {
+            positionals.push(arg);
+        }
     }
-    return { rest, tui };
+    return { positionals, forwarded, skill, taskRef, tui, recreate };
 }
 export function parseRunArgs(args) {
     if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
         throw new Error(USAGE);
     }
-    const { rest: withRecoveryFlags, tui } = extractTui(args);
-    const recreate = withRecoveryFlags.includes('--recreate');
-    const rest = withRecoveryFlags.filter((arg) => arg !== '--recreate');
-    const [skill = '', maybeTaskRef, ...remaining] = rest;
+    const { positionals, forwarded, skill, taskRef, tui, recreate } = extractHostOptions(args);
+    if (!skill)
+        throw new Error("option '--skill' is required");
     const spec = getSkillRunSpec(skill);
     if (!spec)
         throw new Error(`Unknown skill '${skill}'`);
+    const routeSelector = spec.kind === 'create' ? 'create-task' : recreate ? 'recreate' : 'task-skill';
+    if (!PUBLIC_CLI_ROUTE_SELECTORS.run.includes(routeSelector)) {
+        throw new Error(`Unsupported run route '${routeSelector}'`);
+    }
     if (spec.kind === 'create') {
+        if (taskRef !== null)
+            throw new Error("create-task does not accept '--task'");
         if (recreate)
             throw new Error('--recreate is only valid for sandbox task runs');
-        const createArgs = rest.slice(1);
+        const createArgs = [...positionals, ...forwarded];
         if (createArgs.length === 0)
             throw new Error('create-task requires a description');
         return { skill, taskRef: null, args: createArgs, tui };
     }
-    if (!maybeTaskRef)
+    if (positionals.length > 0) {
+        throw new Error('ai run requires --skill and --task; positional host arguments are not supported');
+    }
+    if (taskRef === null)
         throw new Error(`${skill} requires a task-ref`);
     return {
         skill,
-        taskRef: maybeTaskRef,
-        args: remaining,
+        taskRef,
+        args: forwarded,
         tui,
         ...(recreate ? { recreate: true } : {})
     };
@@ -155,8 +201,7 @@ export async function runSkill(args, options = {}) {
     const commandConfig = options.command ?? config?.command ?? {};
     assertAllowedByConfig(parsed.skill, commandConfig);
     const tui = selectTui(parsed.skill, { cliTui: parsed.tui, command: commandConfig });
-    const promptArgs = parsed.taskRef === null ? parsed.args : [parsed.taskRef, ...parsed.args];
-    const prompt = renderPrompt({ tui, skill: parsed.skill, args: promptArgs });
+    const prompt = renderPrompt({ tui, skill: parsed.skill, args: parsed.args });
     const [file, argv] = buildTuiCommand(tui, prompt);
     const command = [file, ...argv];
     if (parsed.taskRef === null) {

package/dist/lib/sandbox/commands/control-status.js

@@ -0,0 +1,22 @@
+import { readSandboxControlStatus } from '../control/state.js';
+import { sandboxControlPaths } from '../workspace-view.js';
+export function readSandboxControlStatusForRow(config, row) {
+    if (!row.workspaceMode || row.workspaceMode === 'legacy-invalid')
+        return null;
+    const identity = row.workspaceMode === 'task-bound' && row.taskId
+        ? { mode: 'task-bound', taskId: row.taskId }
+        : { mode: 'branch-only' };
+    const control = sandboxControlPaths({
+        base: config.controlBase,
+        project: config.project,
+        container: row.name,
+        identity
+    });
+    try {
+        return readSandboxControlStatus(control.statusDir);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=control-status.js.map

package/dist/lib/sandbox/commands/create.js

@@ -24,6 +24,7 @@ import { sandboxCoreBindMounts } from '../mounts.js';
 import { assertSandboxTaskSource, finalizeSandboxControlManifest, materializeSandboxControl, materializeSandboxWorkspaceView, prepareSandboxWorkspaceMountTargets, sandboxControlPaths, } from '../workspace-view.js';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.js';
 import { validateSelinuxDisableEnv } from '../engines/selinux.js';
+import { captureSandboxAuthority, commandForSandboxAuthority, verifySandboxAuthority } from '../engines/authority.js';
 import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
 import { ensureSandboxDiscoveryReadmes } from '../readme-scaffold.js';
 import { removeDirRecursive } from '../../remove-dir.js';
@@ -616,6 +617,14 @@ function runEngineTaskCommand(engine, cmd, args, opts = {}) {
     const command = commandForEngine(engine, cmd, args);
     return runTaskCommand(command.cmd, command.args, opts);
 }
+function runSandboxAuthorityTaskCommand(authority, cmd, args, opts = {}) {
+    const command = commandForSandboxAuthority(authority, cmd, args);
+    return runTaskCommand(command.cmd, command.args, opts);
+}
+function runSandboxAuthoritySafeCommand(authority, args) {
+    const command = commandForSandboxAuthority(authority, 'docker', args);
+    return runSafe(command.cmd, command.args);
+}
 // `docker run` args for mounting a tool's containerMount as an in-container
 // tmpfs. containerMount is an in-container path, so it is NOT engine-converted.
 export function buildTmpfsRunArgs(containerMount, tmpfs) {
@@ -1076,8 +1085,11 @@ export async function create(args) {
                             const hostTz = detectHostTimezone();
                             const tzFlags = hostTz ? ['-e', `TZ=${hostTz}`] : [];
                             let createdContainerRef = null;
+                            let creationAuthority = null;
                             try {
-                                const dockerRunId = runEngineTaskCommand(engine, 'docker', [
+                                creationAuthority = captureSandboxAuthority(engine);
+                                commandForSandboxAuthority(creationAuthority, 'docker');
+                                const dockerRunId = runSandboxAuthorityTaskCommand(creationAuthority, 'docker', [
                                     'run',
                                     '-d',
                                     '--init',
@@ -1128,12 +1140,12 @@ export async function create(args) {
                                     effectiveConfig.imageName
                                 ]);
                                 createdContainerRef = dockerRunId.trim();
-                                const containerId = runEngineTaskCommand(engine, 'docker', [
+                                const containerId = runSandboxAuthorityTaskCommand(creationAuthority, 'docker', [
                                     'inspect', '--format', '{{.Id}}', dockerRunId.trim()
                                 ]).trim();
                                 if (!containerId)
                                     throw new Error('SANDBOX_CONTROL_CONTAINER_ID_INVALID');
-                                const rawContainerLabels = runEngineTaskCommand(engine, 'docker', [
+                                const rawContainerLabels = runSandboxAuthorityTaskCommand(creationAuthority, 'docker', [
                                     'inspect', '--format', '{{json .Config.Labels}}', containerId
                                 ]).trim();
                                 let inspectedLabels;
@@ -1160,10 +1172,18 @@ export async function create(args) {
                                     if (labels[key] !== expected)
                                         throw new Error('SANDBOX_CONTROL_CONTAINER_IDENTITY_MISMATCH');
                                 }
+                                const authorityEvidence = captureSandboxAuthority(engine, {
+                                    route: creationAuthority,
+                                    lockDomain: creationAuthority.lockDomain
+                                });
+                                if (verifySandboxAuthority(creationAuthority, authorityEvidence).state !== 'verified') {
+                                    throw new Error('SANDBOX_AUTHORITY_DRIFT_DURING_CREATE');
+                                }
                                 finalizeSandboxControlManifest(control, {
                                     engine,
                                     id: containerId,
-                                    labels: expectedLabels
+                                    labels: expectedLabels,
+                                    authorityEvidence
                                 });
                                 replacementLease.clearQuiescing();
                                 await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
@@ -1175,8 +1195,14 @@ export async function create(args) {
                             }
                             catch (error) {
                                 if (createdContainerRef) {
-                                    runSafeEngine(engine, 'docker', ['stop', createdContainerRef]);
-                                    runSafeEngine(engine, 'docker', ['rm', createdContainerRef]);
+                                    if (creationAuthority) {
+                                        runSandboxAuthoritySafeCommand(creationAuthority, ['stop', createdContainerRef]);
+                                        runSandboxAuthoritySafeCommand(creationAuthority, ['rm', createdContainerRef]);
+                                    }
+                                    else {
+                                        runSafeEngine(engine, 'docker', ['stop', createdContainerRef]);
+                                        runSafeEngine(engine, 'docker', ['rm', createdContainerRef]);
+                                    }
                                 }
                                 if (!hadExistingControlRoot)
                                     removeDirRecursive(control.root);

package/dist/lib/sandbox/commands/ls.js

@@ -6,6 +6,7 @@ import { detectEngine } from '../engine.js';
 import { formatTable } from '../../table.js';
 import { loadShortIdByTaskId } from '../../task/short-id.js';
 import { fetchSandboxRows } from './list-running.js';
+import { readSandboxControlStatusForRow } from './control-status.js';
 export { containerListFormat, parseLabels } from './list-running.js';
 const USAGE = `Usage: ai sandbox ls
 
@@ -57,6 +58,10 @@ export function ls(args = []) {
             process.stdout.write(`  ${line}\n`);
         }
         process.stdout.write(`  Total: ${ordered.length} containers\n`);
+        for (const row of ordered) {
+            const controlStatus = readSandboxControlStatusForRow(config, row);
+            process.stdout.write(`  ${row.name}: health=${controlStatus?.state ?? 'unavailable'} task-view=${controlStatus?.taskView.state ?? 'unavailable'}\n`);
+        }
         if (tableRows.some((r) => r.shortId === '-')) {
             process.stdout.write(`  SHORT '-' = no active task bound; that sandbox is free to remove with 'ai sandbox rm <branch>'.\n`);
         }