@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/sandbox/commands/show.js

@@ -7,6 +7,7 @@ import { fetchSandboxRows, selectSandboxContainer } from './list-running.js';
 import { resolveTools, toolConfigDirCandidates } from '../tools.js';
 import { detectEngine } from '../engine.js';
 import { resolveSandboxTarget } from '../workspace-identity.js';
+import { readSandboxControlStatusForRow } from './control-status.js';
 const USAGE = `Usage: ai sandbox show <branch | TASK-id | N>
 
 Shows one sandbox's worktree path and per-tool state paths (Claude Code,
@@ -62,6 +63,21 @@ export function show(args = []) {
     p.log.step('Workspace identity');
     process.stdout.write(`  Mode: ${container?.workspaceMode ?? 'legacy-invalid'}\n`);
     process.stdout.write(`  Task: ${container?.taskId ?? '-'}\n`);
+    p.log.step('Control status');
+    const controlStatus = container
+        ? readSandboxControlStatusForRow(config, container)
+        : null;
+    if (!controlStatus) {
+        p.log.warn('  Control status unavailable');
+    }
+    else {
+        process.stdout.write(`  Health: ${controlStatus.state}\n`);
+        process.stdout.write(`  Task view: ${controlStatus.taskView.state}\n`);
+        process.stdout.write(`  Task source: ${controlStatus.taskView.observedSource ?? '-'}\n`);
+        if (controlStatus.taskView.reasonCode) {
+            process.stdout.write(`  Task view reason: ${controlStatus.taskView.reasonCode}\n`);
+        }
+    }
     for (const tool of detail.toolStates) {
         p.log.step(`${tool.name} state`);
         if (tool.entries.length === 0) {

package/dist/lib/sandbox/control/audit.js

@@ -0,0 +1,203 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { identityDigest as digestIdentity } from './identity-sentinel.js';
+import { acquireSandboxResourceLock } from './native-file-lock.js';
+import { fsyncDirectory, writeDurableFile } from '../../fs/durable-write.js';
+export const SANDBOX_CONTROL_AUDIT_PHASES = Object.freeze([
+    'validated', 'gated', 'reserved', 'prepared', 'accepted-authorized', 'accepted-committed',
+    'start-authorized', 'started-committed', 'completed', 'evidence-written',
+    'publish-authorized', 'published-committed', 'rejected', 'recovered'
+]);
+const REQUEST_ID = /^[a-f0-9-]{16,64}$/u;
+const SAFE_OPERATION = /^[a-z][a-z0-9.-]{0,96}$/u;
+const AUDIT_MAX_BYTES = 1024 * 1024;
+export function requestAuditFields(manifest, request) {
+    return {
+        requestId: request.id, requestFamily: request.family, sandboxTaskId: manifest.taskId,
+        requestGeneration: request.generation, requestIssuedAt: request.issuedAt, requestExpiresAt: request.expiresAt
+    };
+}
+export function resultAuditFields(result) {
+    return {
+        exitCode: result.exitCode,
+        outputBytes: Buffer.byteLength(result.stdout, 'utf8'), errorBytes: Buffer.byteLength(result.stderr, 'utf8'),
+        outputDigest: createHash('sha256').update(result.stdout, 'utf8').digest('hex'),
+        errorDigest: createHash('sha256').update(result.stderr, 'utf8').digest('hex')
+    };
+}
+function auditRoot(manifest) {
+    return path.dirname(path.resolve(manifest.publicStatusDir));
+}
+function auditPath(manifest) {
+    return path.join(auditRoot(manifest), 'audit.ndjson');
+}
+function manifestIdentityDigest(manifest) {
+    return digestIdentity({
+        version: 1,
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+}
+export function createSandboxControlAuditContext(manifest, params) {
+    if (!REQUEST_ID.test(params.requestId))
+        throw new Error('SANDBOX_CONTROL_AUDIT_REQUEST_INVALID');
+    if (params.operation !== null && params.operation !== undefined && !SAFE_OPERATION.test(params.operation)) {
+        throw new Error('SANDBOX_CONTROL_AUDIT_OPERATION_INVALID');
+    }
+    if (!SANDBOX_CONTROL_AUDIT_PHASES.includes(params.phase))
+        throw new Error('SANDBOX_CONTROL_AUDIT_PHASE_INVALID');
+    return {
+        requestId: params.requestId,
+        taskId: manifest.taskId,
+        family: params.family,
+        operation: params.operation ?? null,
+        phase: params.phase,
+        outcome: params.outcome,
+        generation: manifest.generation,
+        identityDigest: manifestIdentityDigest(manifest)
+    };
+}
+function safeFields(fields) {
+    const result = {};
+    for (const [key, value] of Object.entries(fields)) {
+        if (!/^[a-z][a-zA-Z0-9]{0,63}$/u.test(key))
+            continue;
+        if (/(token|secret|credential|proof|password|path|root|cwd|stdout|stderr|args|command|taskref)/iu.test(key))
+            continue;
+        if (typeof value === 'string' && value.length > 256)
+            continue;
+        result[key] = value;
+    }
+    return result;
+}
+function requestHasTerminalTransition(directory) {
+    const transitions = path.join(directory, 'transitions');
+    if (!fs.existsSync(transitions))
+        return false;
+    return ['published-committed', 'recovered'].some((phase) => fs.existsSync(path.join(transitions, `${phase}.json`)));
+}
+function hasActiveRequest(manifest) {
+    if (!fs.existsSync(manifest.processingDir))
+        return false;
+    return fs.readdirSync(manifest.processingDir, { withFileTypes: true })
+        .some((entry) => entry.isDirectory() && REQUEST_ID.test(entry.name)
+        && !requestHasTerminalTransition(path.join(manifest.processingDir, entry.name)));
+}
+function rotateAuditUnderLock(manifest, filePath) {
+    if (!fs.existsSync(filePath) || fs.statSync(filePath).size < AUDIT_MAX_BYTES)
+        return;
+    if (hasActiveRequest(manifest))
+        return;
+    fs.rmSync(`${filePath}.1`, { force: true });
+    fs.renameSync(filePath, `${filePath}.1`);
+    fsyncDirectory(auditRoot(manifest));
+    const descriptor = fs.openSync(filePath, 'a', 0o600);
+    try {
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function appendAuditRecord(manifest, record, critical) {
+    const root = auditRoot(manifest);
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    const lock = acquireSandboxResourceLock(`sandbox-control-audit:${root}`);
+    try {
+        const filePath = auditPath(manifest);
+        rotateAuditUnderLock(manifest, filePath);
+        const descriptor = fs.openSync(filePath, 'a', 0o600);
+        try {
+            fs.writeSync(descriptor, `${JSON.stringify(record)}\n`, undefined, 'utf8');
+            if (critical)
+                fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+    }
+    catch (error) {
+        if (critical)
+            throw new Error(`SANDBOX_CONTROL_AUDIT_UNAVAILABLE: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        lock.release();
+    }
+}
+export function appendCriticalAudit(manifest, context, fields = {}, now = Date.now()) {
+    appendAuditRecord(manifest, {
+        version: 2,
+        at: now,
+        event: context.phase,
+        ...context,
+        ...safeFields(fields)
+    }, true);
+}
+export function appendDiagnosticAudit(manifest, event, fields = {}, now = Date.now()) {
+    try {
+        appendAuditRecord(manifest, {
+            version: 2,
+            at: now,
+            event,
+            generation: manifest.generation,
+            identityDigest: manifestIdentityDigest(manifest),
+            ...safeFields(fields)
+        }, false);
+    }
+    catch {
+        // Diagnostics are deliberately best effort.
+    }
+}
+function transitionPath(manifest, requestId, phase) {
+    if (!REQUEST_ID.test(requestId))
+        throw new Error('SANDBOX_CONTROL_TRANSITION_REQUEST_INVALID');
+    return path.join(manifest.processingDir, requestId, 'transitions', `${phase}.json`);
+}
+export function writeSandboxControlTransition(manifest, params) {
+    const transition = {
+        version: 1,
+        requestId: params.requestId,
+        generation: manifest.generation,
+        phase: params.phase,
+        at: params.now ?? Date.now(),
+        identityDigest: manifestIdentityDigest(manifest),
+        reference: params.reference ?? null
+    };
+    const target = transitionPath(manifest, params.requestId, params.phase);
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    try {
+        writeDurableFile(target, `${JSON.stringify(transition)}\n`, { mode: 0o600, replace: false });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const existing = readSandboxControlTransition(manifest, params.requestId, params.phase);
+        if (JSON.stringify(existing) !== JSON.stringify(transition))
+            throw new Error('SANDBOX_CONTROL_TRANSITION_CONFLICT');
+    }
+    return transition;
+}
+export function readSandboxControlTransition(manifest, requestId, phase) {
+    const filePath = transitionPath(manifest, requestId, phase);
+    if (!fs.existsSync(filePath))
+        throw new Error('SANDBOX_CONTROL_TRANSITION_MISSING');
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        throw new Error('SANDBOX_CONTROL_TRANSITION_INVALID');
+    }
+    const candidate = value;
+    if (!candidate || candidate.version !== 1 || candidate.requestId !== requestId
+        || candidate.generation !== manifest.generation || candidate.phase !== phase
+        || !Number.isSafeInteger(candidate.at) || typeof candidate.identityDigest !== 'string'
+        || (candidate.reference !== null && typeof candidate.reference !== 'string')) {
+        throw new Error('SANDBOX_CONTROL_TRANSITION_INVALID');
+    }
+    return candidate;
+}
+//# sourceMappingURL=audit.js.map

package/dist/lib/sandbox/control/client.js

@@ -1,9 +1,13 @@
 import fs from 'node:fs';
+import { hasTaskBoundMarker } from '../../internal/task-operation-registry.js';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { SANDBOX_CONTROL_ADMISSION_WINDOW_MS, SANDBOX_CONTROL_MAX_BYTES, SANDBOX_CONTROL_STATUS_STALE_MS, isSandboxControlFamily } from './protocol.js';
 import { normalizeAgentToken } from '../../agent-clients/tokens.js';
 import { readSandboxControlPayload, readSandboxControlStatus } from './state.js';
+import { accessSandboxTaskView, taskViewFromStatus } from './task-view.js';
+import { readSandboxControlIdentitySentinel } from './identity-sentinel.js';
+import { configuredShortIdLength, resolveShortIdReadOnly } from '../../task/short-id.js';
 const SANDBOX_CONTROL_RESPONSE_SETTLE_MS = 250;
 export class SandboxControlClientError extends Error {
     detail;
@@ -23,7 +27,25 @@ function sleep(milliseconds) {
 function clientError(code, message, retryable, accepted = false, requestId = null) {
     throw new SandboxControlClientError({ code, message: `${code}: ${message}`, retryable }, accepted, requestId);
 }
-function preflight(statusDir, generation, now = Date.now()) {
+function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(), env = process.env) {
+    if (fs.existsSync(statusDir)) {
+        let identity;
+        try {
+            identity = readSandboxControlIdentitySentinel(statusDir);
+        }
+        catch (error) {
+            const code = error instanceof Error && error.message.endsWith('MISSING')
+                ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
+                : 'SANDBOX_CONTROL_IDENTITY_MALFORMED';
+            clientError(code, 'sandbox control identity is missing or invalid', false);
+        }
+        if (identity.generation !== generation) {
+            clientError('SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH', 'sandbox control identity generation does not match the request', false);
+        }
+        if (env.AGENT_INFRA_CONTROL_ROOT_ID && identity.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
+            clientError('SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH', 'sandbox control identity root does not match the client configuration', false);
+        }
+    }
     let status;
     try {
         status = readSandboxControlStatus(statusDir);
@@ -45,8 +67,27 @@ function preflight(statusDir, generation, now = Date.now()) {
     }
     if (status.state !== 'healthy')
         clientError('SANDBOX_CONTROL_BROKER_UNAVAILABLE', 'broker is not ready', true);
+    if (taskViewEffect && hasTaskBoundMarker(env)) {
+        const view = taskViewFromStatus(status);
+        if (view.taskId !== env.AGENT_INFRA_TASK_ID) {
+            clientError('SANDBOX_TASK_VIEW_TASK_ID_MISMATCH', 'task view task id does not match the sandbox task marker', false);
+        }
+        const access = accessSandboxTaskView(view, taskViewEffect);
+        if (!access.allowed) {
+            clientError(access.reasonCode ?? 'SANDBOX_TASK_VIEW_DENIED', access.message ?? 'task view denied', false);
+        }
+    }
 }
-function parseResponse(raw, id) {
+function taskViewEffectForRequest(request) {
+    if (request.family === 'task-lifecycle' || request.family === 'task-finalization')
+        return 'progress';
+    if (request.family === 'task-orchestration')
+        return request.args[1] === 'status' ? 'diagnostic' : 'progress';
+    if (request.family === 'task-workflow')
+        return request.workflow.operation === 'artifact-inspect' || request.workflow.operation === 'decision-next-id' ? 'diagnostic' : 'progress';
+    return null;
+}
+function parseResponse(raw, id, accepted = false) {
     const response = JSON.parse(raw);
     if (response.version !== 2 || response.id !== id
         || !['completed', 'rejected'].includes(response.phase)
@@ -54,12 +95,12 @@ function parseResponse(raw, id) {
         || (response.outputState !== undefined && response.outputState !== 'available' && response.outputState !== 'unavailable')
         || (response.outputState === 'available' && !response.payload)
         || (response.outputState === 'unavailable' && response.payload !== null && response.payload !== undefined)) {
-        clientError('SANDBOX_CONTROL_RESPONSE_INVALID', 'broker response is invalid', false, false, id);
+        clientError('SANDBOX_CONTROL_RESPONSE_INVALID', 'broker response is invalid', false, accepted, id);
     }
     return response;
 }
-function readPublishedResponse(raw, id, channelDir) {
-    const response = parseResponse(raw, id);
+function readPublishedResponse(raw, id, channelDir, accepted = false) {
+    const response = parseResponse(raw, id, accepted);
     if (response.outputState !== 'available')
         return response;
     const filePath = path.join(channelDir, 'responses', `${id}.payload.json`);
@@ -89,10 +130,59 @@ function cancelPendingRequest(requestPath) {
         throw error;
     }
 }
+const CONTROL_TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
+const CONTROL_SHORT_ID_RE = /^\d+$/;
+// Use the current short-id contract for the first visible active registry.
+export function resolveVisibleActiveShortId(ref) {
+    let dir = process.cwd();
+    for (let depth = 0; depth < 64; depth += 1) {
+        const registryPath = path.join(dir, '.agents', 'workspace', 'active', '.short-ids.json');
+        if (fs.existsSync(registryPath)) {
+            const resolved = resolveShortIdReadOnly(ref, dir, { shortIdLength: configuredShortIdLength(dir) });
+            return resolved.ok ? resolved.taskId : null;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+// A request's leading argument is only a task reference for some families and
+// may be a documented short id. Compare canonical ids so a bound sandbox keeps
+// refusing other tasks without rejecting its own task's short id.
+function canonicalRequestTask(request) {
+    const ref = request.family === 'task-workflow'
+        ? request.workflow.taskId
+        : 'args' in request ? request.args[0] ?? null : null;
+    if (!ref)
+        return { kind: 'none' };
+    if (CONTROL_TASK_ID_RE.test(ref))
+        return { kind: 'task', taskId: ref };
+    if (!CONTROL_SHORT_ID_RE.test(ref))
+        return { kind: 'none' };
+    const resolved = resolveVisibleActiveShortId(ref);
+    return resolved ? { kind: 'task', taskId: resolved } : { kind: 'unresolved' };
+}
 function exchangeSandboxControl(request, params) {
     const channelDir = params.channelDir ?? process.env.AGENT_INFRA_CONTROL_DIR ?? '/run/agent-infra/control';
     const statusDir = params.statusDir ?? process.env.AGENT_INFRA_CONTROL_STATUS_DIR ?? '/run/agent-infra/control-status';
-    preflight(statusDir, request.generation);
+    const taskViewEffect = taskViewEffectForRequest(request);
+    preflight(statusDir, request.generation, taskViewEffect);
+    const identityPath = path.join(statusDir, 'identity.json');
+    if (fs.existsSync(statusDir)) {
+        const identity = readSandboxControlIdentitySentinel(statusDir);
+        const requestTask = canonicalRequestTask(request);
+        if (identity.mode === 'task-bound'
+            && ((process.env.AGENT_INFRA_TASK_ID && process.env.AGENT_INFRA_TASK_ID !== identity.taskId)
+                || requestTask.kind === 'unresolved'
+                || (requestTask.kind === 'task' && requestTask.taskId !== identity.taskId))) {
+            clientError('SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH', 'request task does not match the sandbox identity', false);
+        }
+        if (identity.mode === 'branch-only' && (request.family === 'task-finalization' || request.family === 'task-workflow')) {
+            clientError('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot finalize tasks', false);
+        }
+    }
     const encoded = `${JSON.stringify(request)}\n`;
     if (Buffer.byteLength(encoded, 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
         clientError('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit', false, false, request.id);
@@ -127,7 +217,9 @@ function exchangeSandboxControl(request, params) {
             }
             let response;
             try {
-                response = readPublishedResponse(raw, request.id, channelDir);
+                // The request-specific terminal proves the broker claimed the request; preserve recovery evidence if marker cleanup won the race.
+                accepted = true;
+                response = readPublishedResponse(raw, request.id, channelDir, accepted);
                 malformedResponseRaw = null;
             }
             catch (error) {
@@ -153,7 +245,7 @@ function exchangeSandboxControl(request, params) {
         }
         if (!accepted) {
             try {
-                preflight(statusDir, request.generation);
+                preflight(statusDir, request.generation, taskViewEffect);
             }
             catch (error) {
                 if (cancelPendingRequest(requestPath))
@@ -196,7 +288,9 @@ export function recoverSandboxControl(requestId, params = {}) {
             }
             let response;
             try {
-                response = readPublishedResponse(raw, requestId, channelDir);
+                // The request-specific terminal proves the broker claimed the request; preserve recovery evidence if marker cleanup won the race.
+                accepted = true;
+                response = readPublishedResponse(raw, requestId, channelDir, accepted);
                 malformedResponseRaw = null;
             }
             catch (error) {
@@ -232,7 +326,7 @@ function authority(params) {
 export function requestSandboxControl(params) {
     if (!isSandboxControlFamily(params.family))
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' is not allowed`, false);
-    if (params.family === 'task-create' || params.family === 'codex-controller' || params.family === 'task-finalization') {
+    if (params.family === 'task-create' || params.family === 'codex-controller' || params.family === 'task-finalization' || params.family === 'task-workflow') {
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' requires a typed request`, false);
     }
     const auth = authority(params);
@@ -251,14 +345,15 @@ export function requestSandboxTaskControl(params) {
     const issuedAt = Date.now();
     const request = {
         version: 3,
-        id: randomUUID(),
+        id: params.authority?.requestId ?? randomUUID(),
         ...auth,
         issuedAt,
         expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
         family: params.family,
         args: params.args,
         controllerProcess: null,
-        controllerProof: params.controllerProof
+        controllerProof: params.authority ? null : params.controllerProof,
+        ...(params.authority ? { authority: params.authority } : {})
     };
     return exchangeSandboxControl(request, params);
 }
@@ -283,6 +378,24 @@ export function requestSandboxTaskFinalization(params) {
     };
     return exchangeSandboxControl(request, params);
 }
+export function requestSandboxTaskWorkflow(params) {
+    const auth = authority(params);
+    const issuedAt = Date.now();
+    const request = {
+        version: 3,
+        id: params.workflow.id,
+        ...auth,
+        issuedAt,
+        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+        family: 'task-workflow',
+        args: [],
+        controllerProcess: null,
+        controllerProof: null,
+        workflow: params.workflow,
+        ...(params.authority ? { authority: params.authority } : {})
+    };
+    return exchangeSandboxControl(request, params);
+}
 function exactKeys(value, keys) {
     return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
 }

package/dist/lib/sandbox/control/completed-reentry.js

@@ -0,0 +1,85 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveTaskWorkspace } from '../task-resolver.js';
+import { assertGitWorktreeBinding } from '../../git/worktree-identity.js';
+import { parseTypedTaskFrontmatter } from '../../task/frontmatter.js';
+import { readTaskFinalizationReceipt } from '../../task/finalization.js';
+import { inspectSandboxControlContainer } from './container-identity.js';
+import { atomicWriteJson, readSandboxControlStatus } from './state.js';
+import { taskViewForManifest } from './task-view.js';
+function evidencePath(manifest) {
+    return path.join(path.dirname(manifest.processingDir), 'completed-reentry.json');
+}
+function invalid() {
+    return new Error('SANDBOX_COMPLETED_REENTRY_EVIDENCE_INVALID');
+}
+export async function prepareCompletedReentry(manifest, inspect = inspectSandboxControlContainer) {
+    if (manifest.mode !== 'task-bound' || !manifest.taskId)
+        throw invalid();
+    assertGitWorktreeBinding(manifest.repoRoot, manifest.worktreeRoot, manifest.branch);
+    const container = await inspect(manifest);
+    if (container.state !== 'found' || container.id !== manifest.containerIdentity.id)
+        throw invalid();
+    const task = resolveTaskWorkspace(manifest.taskId, manifest.repoRoot);
+    const metadata = parseTypedTaskFrontmatter(fs.readFileSync(task.taskMd, 'utf8'));
+    if (task.state !== 'completed' || task.branch !== manifest.branch
+        || metadata.id !== manifest.taskId || metadata.status !== 'completed')
+        throw invalid();
+    const receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
+    if (!receipt || receipt.taskId !== manifest.taskId)
+        throw invalid();
+    const view = taskViewForManifest({ ...manifest, receipt });
+    if (view.state !== 'current' || view.observedSource !== 'completed' || !view.receipt)
+        throw invalid();
+    const status = readSandboxControlStatus(manifest.publicStatusDir);
+    const previous = status.taskView;
+    if (status.generation !== manifest.generation || status.activeRequestId !== null
+        || previous.taskId !== manifest.taskId || !previous.receipt
+        || previous.receipt.receiptId !== view.receipt.receiptId
+        || previous.receipt.generation !== view.receipt.generation
+        || previous.receipt.requestId !== view.receipt.requestId
+        || previous.receipt.revision > view.receipt.revision)
+        throw invalid();
+    const completedRoot = fs.realpathSync.native(path.join(manifest.repoRoot, '.agents', 'workspace', 'completed'));
+    const source = fs.realpathSync.native(path.join(completedRoot, manifest.taskId));
+    if (source !== path.join(completedRoot, manifest.taskId))
+        throw invalid();
+    const stat = fs.statSync(source, { bigint: true });
+    return {
+        taskId: manifest.taskId, generation: manifest.generation,
+        containerId: container.id, branch: manifest.branch,
+        worktreeRoot: fs.realpathSync.native(manifest.worktreeRoot),
+        source, sourceDevice: String(stat.dev), sourceInode: String(stat.ino), receipt: view.receipt
+    };
+}
+export function publishCompletedReentry(manifest, evidence) {
+    atomicWriteJson(evidencePath(manifest), evidence);
+}
+export async function completedReentryView(manifest, inspect = inspectSandboxControlContainer) {
+    const file = evidencePath(manifest);
+    if (!fs.existsSync(file))
+        return null;
+    const evidence = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const current = await prepareCompletedReentry(manifest, inspect);
+    if (JSON.stringify(evidence) !== JSON.stringify(current))
+        throw invalid();
+    return {
+        state: 'current', taskId: current.taskId, observedSource: 'completed',
+        receipt: current.receipt, reasonCode: null
+    };
+}
+export async function waitForCompletedReentry(manifest, evidence) {
+    const deadline = Date.now() + 10_000;
+    while (Date.now() < deadline) {
+        const status = readSandboxControlStatus(manifest.publicStatusDir);
+        if (status.generation !== evidence.generation)
+            throw invalid();
+        if (status.taskView.state === 'current' && status.taskView.observedSource === 'completed'
+            && status.taskView.taskId === evidence.taskId
+            && JSON.stringify(status.taskView.receipt) === JSON.stringify(evidence.receipt))
+            return;
+        await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    throw new Error('SANDBOX_COMPLETED_REENTRY_STATUS_TIMEOUT');
+}
+//# sourceMappingURL=completed-reentry.js.map

package/dist/lib/sandbox/control/container-identity.js

@@ -1,15 +1,11 @@
-import { commandForEngine, runEngine, runProbe } from '../shell.js';
-function isAuthoritativeNotFound(error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return /(?:no such (?:container|object)|container .* not found|cannot find container)/i.test(message);
-}
+import { runProbe } from '../shell.js';
+import { captureSandboxAuthority, isSandboxAuthorityEvidence, verifySandboxAuthority } from '../engines/authority.js';
+import { discoverExactContainer } from '../engines/docker-exact-discovery.js';
 export function classifySandboxContainerInspection(expected, inspection) {
     if ('notFound' in inspection)
         return { state: 'absent', id: expected.id };
     if ('error' in inspection) {
-        return isAuthoritativeNotFound(inspection.error)
-            ? { state: 'absent', id: expected.id }
-            : { state: 'unknown', reason: `container inspection failed: ${inspection.error instanceof Error ? inspection.error.message : String(inspection.error)}` };
+        return { state: 'unknown', reason: `container inspection failed: ${inspection.error instanceof Error ? inspection.error.message : String(inspection.error)}` };
     }
     const response = inspection;
     if (typeof response.id !== 'string' || response.id !== expected.id
@@ -30,32 +26,33 @@ export function classifySandboxContainerInspection(expected, inspection) {
     };
 }
 export async function inspectSandboxControlContainer(manifest, options = {}) {
+    if (!isSandboxAuthorityEvidence(manifest.authorityEvidence)) {
+        return { state: 'unknown', reason: 'SANDBOX_AUTHORITY_EVIDENCE_MISSING' };
+    }
     try {
-        const args = ['inspect', '--format', '{{json .}}', manifest.containerIdentity.id];
-        let raw;
-        if (options.run) {
-            raw = options.run(manifest.engine, 'docker', args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
-        }
-        else {
-            const command = commandForEngine(manifest.engine, 'docker', args);
-            const result = (options.probe ?? runProbe)(command.cmd, command.args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
-            if (result.status !== 0) {
-                const stderr = typeof result.stderr === 'string' ? result.stderr : result.stderr?.toString('utf8') ?? '';
-                return classifySandboxContainerInspection(manifest.containerIdentity, {
-                    error: new Error(stderr || `container inspection exited with ${result.status ?? 'unknown'}`)
-                });
-            }
-            raw = typeof result.stdout === 'string' ? result.stdout : result.stdout?.toString('utf8') ?? '';
+        const authority = captureSandboxAuthority(manifest.engine, {
+            probe: options.probe,
+            timeoutMs: options.timeoutMs,
+            lockDomain: manifest.authorityEvidence.lockDomain,
+            route: manifest.authorityEvidence
+        });
+        const authorityState = verifySandboxAuthority(manifest.authorityEvidence, authority);
+        if (authorityState.state !== 'verified') {
+            return { state: 'unknown', reason: authorityState.reason ?? 'SANDBOX_AUTHORITY_UNAVAILABLE' };
         }
-        const parsed = JSON.parse(raw);
-        const value = Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
-        if (!value || Array.isArray(value))
-            return { state: 'unknown', reason: 'container inspection response is incomplete' };
-        return classifySandboxContainerInspection(manifest.containerIdentity, {
-            id: value.Id,
-            running: value.State?.Running,
-            labels: value.Config?.Labels
+        const discovered = discoverExactContainer(manifest.engine, manifest.containerIdentity.id, {
+            probe: options.probe,
+            timeoutMs: options.timeoutMs,
+            authority: manifest.authorityEvidence
         });
+        if (discovered.state === 'absent')
+            return { state: 'absent', id: discovered.id };
+        if (discovered.state === 'conflict') {
+            return { state: 'unknown', reason: `SANDBOX_CONTROL_CONTAINER_CONFLICT: ${discovered.reason}` };
+        }
+        if (discovered.state === 'unknown')
+            return discovered;
+        return classifySandboxContainerInspection(manifest.containerIdentity, discovered);
     }
     catch (error) {
         return classifySandboxContainerInspection(manifest.containerIdentity, { error });