@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/lib/platform/verification-sync.ts

@@ -7,9 +7,7 @@ import { resolvePlatformProviderContext } from "./context.ts";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.ts";
 import { requirementSectionAnchors } from "./issues.ts";
 import { taskTypeLabel } from "./metadata-labels.ts";
-import { planInLabelUpdate, validateInLabelMapping, validateRepositoryLabelPayload } from "./in-label-sync.ts";
-import { inspectGitHubPullRequest } from "./pull-requests.ts";
-import { createGitHubClient } from "./github-client.ts";
+import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.ts";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.ts";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.ts";
 import { taskIssueIdentity } from "./task-identities.ts";
@@ -200,7 +198,6 @@ async function buildSyncContext({ taskDir, config, artifactFile }: any): Promise
     prIdentity,
     issueNumber,
     prNumber,
-    upstreamRepo: platformContext.platform.repository,
     repoOwnerType: String(loaded.ok ? loaded.value.snapshot.metadata?.ownerType || "unknown" : "unknown"),
     hasTriage: platformContext.capabilities.triage,
     hasPush: platformContext.capabilities.push,
@@ -314,6 +311,27 @@ async function fetchRemoteData(context: any): Promise<any> {
     prComments = listed.value.map((comment: { id: string; body: string }) => ({ id: comment.id, body: comment.body }));
   }
   const changeRequest = facts.value.changeRequest;
+  let inLabelMapping: Record<string, string[]> = {};
+  let repositoryLabels: string[] = [];
+  if (context.config.verify_in_labels_computed && context.hasTriage) {
+    const mapping = loadInLabelMapping();
+    if (!mapping.ok) return { earlyReturn: failResult(CHECK_TYPE, mapping.message, "check_failed") };
+    inLabelMapping = mapping.value;
+    if (Object.keys(inLabelMapping).length > 0) {
+      const labels = provider?.issues?.listLabels
+        ? await provider.issues.listLabels({ context: operationContext })
+        : unsupportedProviderOperation(provider, "issues.listLabels");
+      if (!labels.ok) {
+        const error = providerError(labels.error, "PLATFORM_PROVIDER_OPERATION_FAILED");
+        return {
+          earlyReturn: error.retryable
+            ? blockedResult(CHECK_TYPE, `${error.code}: ${error.message}`, "network_error")
+            : failResult(CHECK_TYPE, `${error.code}: ${error.message}`, "check_failed")
+        };
+      }
+      repositoryLabels = labels.value;
+    }
+  }
   return {
     issue,
     comments: facts.value.comments.map((comment: { id: string; body: string }) => ({ id: comment.id, body: comment.body })),
@@ -327,7 +345,9 @@ async function fetchRemoteData(context: any): Promise<any> {
       ? (changeRequest.milestone ? { title: changeRequest.milestone } : null)
       : undefined,
     prAssignees: changeRequest?.assignees,
-    prHeadSha: changeRequest?.headSha
+    prHeadSha: changeRequest?.headSha,
+    inLabelMapping,
+    repositoryLabels
   };
 }
 
@@ -605,7 +625,7 @@ function checkInLabelsComputed(context: any, remoteData: any): any {
     return null;
   }
 
-  const expectedInLabels = computeExpectedInLabels(context.taskDir, context.upstreamRepo);
+  const expectedInLabels = computeExpectedInLabels(context.taskDir, remoteData.repositoryLabels, remoteData.inLabelMapping);
   if (!expectedInLabels.ok) {
     return expectedInLabels.type === "check_failed"
       ? failResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type)
@@ -1015,7 +1035,7 @@ function formatLabelList(labels: any): any {
   return labels.length > 0 ? labels.join(", ") : "none";
 }
 
-function computeExpectedInLabels(taskDir: any, repository: any): any {
+function computeExpectedInLabels(taskDir: any, repositoryLabels: string[] = [], mappingOverride?: Record<string, string[]>): any {
   const task = loadTask(taskDir);
   if (!task.ok) {
     return task;
@@ -1034,32 +1054,16 @@ function computeExpectedInLabels(taskDir: any, repository: any): any {
     .map((value) => value.trim())
     .filter(Boolean);
 
-  const mapping = loadInLabelMapping();
-  if (!mapping.ok) {
-    return mapping;
-  }
-
-  if (Object.keys(mapping.value ?? {}).length === 0) {
+  const mapping = mappingOverride ?? {};
+  if (Object.keys(mapping).length === 0) {
     return { ok: true, labels: [], mode: "mapped" };
   }
 
-  const client = createGitHubClient();
-  const repoLabelsResult = withRetry(() => client.json([
-    "api", "--paginate", "--slurp", `repos/${repository}/labels?per_page=100`
-  ], { cwd: taskDir }));
-  if (!repoLabelsResult.ok) {
-    return repoLabelsResult;
-  }
-
-  const repositoryLabels = validateRepositoryLabelPayload(repoLabelsResult.value);
-  if (!repositoryLabels.ok) {
-    return { ok: false, type: "check_failed", message: repositoryLabels.error.message };
-  }
   const planned = planInLabelUpdate({
     changedFiles,
     currentLabels: [],
-    mapping: mapping.value ?? {},
-    repositoryLabels: new Set(repositoryLabels.value)
+    mapping,
+    repositoryLabels: new Set(repositoryLabels)
   });
   if (planned.error) {
     return { ok: false, type: "check_failed", message: planned.error.message };
@@ -1084,7 +1088,7 @@ function loadInLabelMapping(): any {
   }
 }
 
-// === GitHub API ===
+// === Git working tree ===
 
 function gitText(args: any, cwd: any): any {
   try {

package/lib/process-data/index.ts

@@ -10,6 +10,7 @@ import { readAppliedOverlays, repairSnapshot } from './repair.ts';
 import { collectGitHubBoundary, resolveGitHubRepository } from './sources.ts';
 import { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshotV2, verifySnapshot } from './store.ts';
 import { createGitHubClient } from '../platform/github-client.ts';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from '../internal/cli-route-inventory.ts';
 
 import type { NormalizedRecord } from './types.ts';
 
@@ -22,6 +23,7 @@ Commands:
   repair <snapshot-id> [--root <dir>] [--apply]
   export <snapshot-id> [--root <dir>] [--repairs none|applied] [--as-of <ISO>] [--output <file|->]
 `;
+const DATA_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS.data;
 
 type ParsedArgs = { positionals: string[]; options: Map<string, string | true> };
 
@@ -256,6 +258,11 @@ async function cmdData(args: string[]): Promise<number> {
     return command ? 0 : 1;
   }
   try {
+    if (!DATA_OPERATIONS.includes(command as typeof DATA_OPERATIONS[number])) {
+      process.stderr.write(`Unknown data command: ${command}\n`);
+      process.stdout.write(USAGE);
+      return 1;
+    }
     switch (command) {
       case 'capture': return capture(rest);
       case 'verify': return verify(rest);

package/lib/run/index.ts

@@ -7,6 +7,7 @@ import { loadShortIdByTaskId, normalizeShortIdInput } from '../task/short-id.ts'
 import { buildTuiCommand, renderPrompt, selectTui } from './tui.ts';
 import { getSkillRunSpec } from './skills.ts';
 import { runHostCommand, type RunProcessResult } from './host.ts';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from '../internal/cli-route-inventory.ts';
 
 export type ParsedRunArgs = {
   skill: string;
@@ -107,6 +108,10 @@ export function parseRunArgs(args: string[]): ParsedRunArgs {
   if (!skill) throw new Error("option '--skill' is required");
   const spec = getSkillRunSpec(skill);
   if (!spec) throw new Error(`Unknown skill '${skill}'`);
+  const routeSelector = spec.kind === 'create' ? 'create-task' : recreate ? 'recreate' : 'task-skill';
+  if (!PUBLIC_CLI_ROUTE_SELECTORS.run.includes(routeSelector as typeof PUBLIC_CLI_ROUTE_SELECTORS.run[number])) {
+    throw new Error(`Unsupported run route '${routeSelector}'`);
+  }
   if (spec.kind === 'create') {
     if (taskRef !== null) throw new Error("create-task does not accept '--task'");
     if (recreate) throw new Error('--recreate is only valid for sandbox task runs');

package/lib/sandbox/commands/control-status.ts

@@ -0,0 +1,26 @@
+import type { SandboxConfig } from '../config.ts';
+import { readSandboxControlStatus } from '../control/state.ts';
+import type { SandboxControlStatus } from '../control/protocol.ts';
+import { sandboxControlPaths } from '../workspace-view.ts';
+import type { SandboxRow } from './list-running.ts';
+
+export function readSandboxControlStatusForRow(
+  config: SandboxConfig,
+  row: Pick<SandboxRow, 'name' | 'workspaceMode' | 'taskId'>
+): SandboxControlStatus | null {
+  if (!row.workspaceMode || row.workspaceMode === 'legacy-invalid') return null;
+  const identity = row.workspaceMode === 'task-bound' && row.taskId
+    ? { mode: 'task-bound' as const, taskId: row.taskId }
+    : { mode: 'branch-only' as const };
+  const control = sandboxControlPaths({
+    base: config.controlBase,
+    project: config.project,
+    container: row.name,
+    identity
+  });
+  try {
+    return readSandboxControlStatus(control.statusDir);
+  } catch {
+    return null;
+  }
+}

package/lib/sandbox/commands/create.ts

@@ -92,6 +92,12 @@ import {
 } from '../workspace-view.ts';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.ts';
 import { validateSelinuxDisableEnv } from '../engines/selinux.ts';
+import {
+  captureSandboxAuthority,
+  commandForSandboxAuthority,
+  verifySandboxAuthority,
+  type SandboxAuthorityEvidenceV1
+} from '../engines/authority.ts';
 import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.ts';
 import { ensureSandboxDiscoveryReadmes } from '../readme-scaffold.ts';
 import { removeDirRecursive } from '../../remove-dir.ts';
@@ -923,6 +929,24 @@ function runEngineTaskCommand(engine: string, cmd: string, args: string[], opts:
   return runTaskCommand(command.cmd, command.args, opts);
 }
 
+function runSandboxAuthorityTaskCommand(
+  authority: SandboxAuthorityEvidenceV1,
+  cmd: string,
+  args: string[],
+  opts: { cwd?: string } = {}
+): string {
+  const command = commandForSandboxAuthority(authority, cmd, args);
+  return runTaskCommand(command.cmd, command.args, opts);
+}
+
+function runSandboxAuthoritySafeCommand(
+  authority: SandboxAuthorityEvidenceV1,
+  args: string[]
+): string {
+  const command = commandForSandboxAuthority(authority, 'docker', args);
+  return runSafe(command.cmd, command.args);
+}
+
 // `docker run` args for mounting a tool's containerMount as an in-container
 // tmpfs. containerMount is an in-container path, so it is NOT engine-converted.
 export function buildTmpfsRunArgs(containerMount: string, tmpfs: { size?: string }): string[] {
@@ -1481,8 +1505,11 @@ export async function create(args: string[]): Promise<void> {
             const tzFlags = hostTz ? ['-e', `TZ=${hostTz}`] : [];
 
             let createdContainerRef: string | null = null;
+            let creationAuthority: SandboxAuthorityEvidenceV1 | null = null;
             try {
-              const dockerRunId = runEngineTaskCommand(engine, 'docker', [
+              creationAuthority = captureSandboxAuthority(engine);
+              commandForSandboxAuthority(creationAuthority, 'docker');
+              const dockerRunId = runSandboxAuthorityTaskCommand(creationAuthority, 'docker', [
               'run',
               '-d',
               '--init',
@@ -1537,11 +1564,11 @@ export async function create(args: string[]): Promise<void> {
               effectiveConfig.imageName
               ]);
               createdContainerRef = dockerRunId.trim();
-              const containerId = runEngineTaskCommand(engine, 'docker', [
+              const containerId = runSandboxAuthorityTaskCommand(creationAuthority, 'docker', [
                 'inspect', '--format', '{{.Id}}', dockerRunId.trim()
               ]).trim();
               if (!containerId) throw new Error('SANDBOX_CONTROL_CONTAINER_ID_INVALID');
-              const rawContainerLabels = runEngineTaskCommand(engine, 'docker', [
+              const rawContainerLabels = runSandboxAuthorityTaskCommand(creationAuthority, 'docker', [
                 'inspect', '--format', '{{json .Config.Labels}}', containerId
               ]).trim();
               let inspectedLabels: unknown;
@@ -1566,10 +1593,18 @@ export async function create(args: string[]): Promise<void> {
               for (const [key, expected] of Object.entries(expectedLabels)) {
                 if (labels[key] !== expected) throw new Error('SANDBOX_CONTROL_CONTAINER_IDENTITY_MISMATCH');
               }
+              const authorityEvidence = captureSandboxAuthority(engine, {
+                route: creationAuthority,
+                lockDomain: creationAuthority.lockDomain
+              });
+              if (verifySandboxAuthority(creationAuthority, authorityEvidence).state !== 'verified') {
+                throw new Error('SANDBOX_AUTHORITY_DRIFT_DURING_CREATE');
+              }
               finalizeSandboxControlManifest(control, {
                 engine,
                 id: containerId,
-                labels: expectedLabels
+                labels: expectedLabels,
+                authorityEvidence
               });
               replacementLease.clearQuiescing();
               await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
@@ -1580,8 +1615,13 @@ export async function create(args: string[]): Promise<void> {
               createdTmpfsSeedPlan = tmpfsSeedPlan;
             } catch (error) {
               if (createdContainerRef) {
-                runSafeEngine(engine, 'docker', ['stop', createdContainerRef]);
-                runSafeEngine(engine, 'docker', ['rm', createdContainerRef]);
+                if (creationAuthority) {
+                  runSandboxAuthoritySafeCommand(creationAuthority, ['stop', createdContainerRef]);
+                  runSandboxAuthoritySafeCommand(creationAuthority, ['rm', createdContainerRef]);
+                } else {
+                  runSafeEngine(engine, 'docker', ['stop', createdContainerRef]);
+                  runSafeEngine(engine, 'docker', ['rm', createdContainerRef]);
+                }
               }
               if (!hadExistingControlRoot) removeDirRecursive(control.root);
               if (replacementCutover) {

package/lib/sandbox/commands/ls.ts

@@ -11,6 +11,7 @@ import { detectEngine } from '../engine.ts';
 import { formatTable } from '../../table.ts';
 import { loadShortIdByTaskId } from '../../task/short-id.ts';
 import { fetchSandboxRows } from './list-running.ts';
+import { readSandboxControlStatusForRow } from './control-status.ts';
 
 export { containerListFormat, parseLabels } from './list-running.ts';
 
@@ -88,6 +89,12 @@ export function ls(args: string[] = []): void {
       process.stdout.write(`  ${line}\n`);
     }
     process.stdout.write(`  Total: ${ordered.length} containers\n`);
+    for (const row of ordered) {
+      const controlStatus = readSandboxControlStatusForRow(config, row);
+      process.stdout.write(
+        `  ${row.name}: health=${controlStatus?.state ?? 'unavailable'} task-view=${controlStatus?.taskView.state ?? 'unavailable'}\n`
+      );
+    }
     if (tableRows.some((r) => r.shortId === '-')) {
       process.stdout.write(
         `  SHORT '-' = no active task bound; that sandbox is free to remove with 'ai sandbox rm <branch>'.\n`