@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/sandbox/control/executor.js

@@ -3,11 +3,14 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getProcessStartTime } from '../../server/process-state.js';
-import { createTask } from '../../task/create-service.js';
+import { createTask, projectTaskCreateResult, taskCreateExitCode, taskCreateFailure } from '../../task/create-service.js';
 import { applyTaskFinalization } from '../../task/finalization.js';
 import { bindSandboxControlTask, validateSandboxControlRequest } from './protocol.js';
 import { atomicWriteJson, executionPath, readActiveLease, terminateSandboxControlExecution } from './state.js';
-import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../../task/control-authority.js';
+import { requestAuditFields, resultAuditFields, appendDiagnosticAudit, createSandboxControlAuditContext, appendCriticalAudit, writeSandboxControlTransition } from './audit.js';
+import { validateSandboxControlIdentity } from './identity-sentinel.js';
+import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation, validateLifecycleRecoveryAttestation } from '../../task/control-authority.js';
+import { executeTaskWorkflow } from './workflow-executor.js';
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest } from './lifecycle.js';
 import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
 import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
@@ -30,6 +33,22 @@ export function assertSandboxControlExecutorAuthority(manifest, gateOwner) {
 function safeEnv(env) {
     return Object.fromEntries(Object.entries(env).filter(([key]) => !key.toUpperCase().startsWith('AGENT_INFRA_CONTROL_')));
 }
+function safeRealpath(value) {
+    try {
+        return fs.realpathSync.native(value);
+    }
+    catch {
+        return null;
+    }
+}
+function appendExecutorAudit(manifest, event, fields = {}) {
+    try {
+        appendDiagnosticAudit(manifest, event, { source: 'executor', ...fields });
+    }
+    catch {
+        // Diagnostics must never change the control protocol.
+    }
+}
 export function nodeEntryArgs(entry, args) {
     return path.extname(entry) === '.ts'
         ? ['--experimental-strip-types', '--no-warnings', entry, ...args]
@@ -99,7 +118,16 @@ export async function prepareSandboxControlExecution(params) {
             atomicWriteJson(executionPath(params.manifest, params.request.id), { ...execution, phase: 'running', updatedAt: Date.now() });
             if (!canWrite())
                 throw new Error('SANDBOX_CONTROL_OWNER_LOST');
-            child.send({ version: 1, nonce, owner: gateOwner });
+            const authority = params.lifecycleAuthority?.attestation ?? null;
+            child.send({
+                version: 2,
+                nonce,
+                owner: gateOwner,
+                requestId: params.request.id,
+                operationId: authority?.operationId ?? params.request.id,
+                phase: authority?.phase ?? (params.request.family === 'task-workflow' ? 'artifact.finalize-local' : 'orchestration.prepare'),
+                authority
+            });
         },
         completion,
         terminate(updateState = true) {
@@ -125,7 +153,8 @@ function waitForGate(nonce, timeoutMs = 2_000) {
             process.off('disconnect', onDisconnect);
             const value = message;
             const owner = value?.owner;
-            if (!value || value.version !== 1 || value.nonce !== nonce
+            if (!value || Object.keys(value).sort().join(',') !== 'authority,nonce,operationId,owner,phase,requestId,version'
+                || value.version !== 2 || value.nonce !== nonce
                 || !owner || owner.version !== 3 || !Number.isSafeInteger(owner.pid) || (owner.pid ?? 0) <= 0
                 || typeof owner.startTime !== 'number' || !Number.isSafeInteger(owner.startTime)
                 || typeof owner.brokerId !== 'string' || owner.brokerId.length === 0
@@ -133,7 +162,27 @@ function waitForGate(nonce, timeoutMs = 2_000) {
                 reject(new Error('SANDBOX_CONTROL_EXECUTOR_GATE_INVALID'));
                 return;
             }
-            resolve(owner);
+            if (typeof value.requestId !== 'string' || typeof value.operationId !== 'string'
+                || !['orchestration.prepare', 'artifact.finalize-local', 'task-event.completed'].includes(value.phase)
+                || (value.authority !== null && value.authority !== undefined && (() => {
+                    try {
+                        validateLifecycleRecoveryAttestation(value.authority);
+                        return false;
+                    }
+                    catch {
+                        return true;
+                    }
+                })())) {
+                reject(new Error('SANDBOX_CONTROL_EXECUTOR_GATE_INVALID'));
+                return;
+            }
+            resolve({
+                owner: owner,
+                authority: value.authority === null || value.authority === undefined ? null : value.authority,
+                requestId: value.requestId,
+                operationId: value.operationId,
+                phase: value.phase
+            });
         });
     });
 }
@@ -174,6 +223,20 @@ function lifecycleFailure(code, message) {
         stderr: ''
     };
 }
+function taskCreateExecutionResult(result) {
+    return {
+        exitCode: taskCreateExitCode(result),
+        stdout: `${JSON.stringify(result)}\n`,
+        stderr: ''
+    };
+}
+function taskCreateExecutionFailure(requestId, code, message) {
+    return taskCreateExecutionResult(taskCreateFailure({ code, message, retryable: false }, {
+        requestId,
+        accepted: true,
+        recovery: 'inspect-domain-state'
+    }));
+}
 function finalizationResult(result) {
     const payload = {
         version: 1,
@@ -189,14 +252,21 @@ function finalizationResult(result) {
         stderr: ''
     };
 }
-export async function executeRequest(manifest, manifestPath, request, options = {}) {
+async function executeRequestInner(manifest, manifestPath, request, options = {}) {
     if (request.family === 'task-create') {
-        const result = await createTask(request.candidate, { repoRoot: manifest.repoRoot });
-        return {
-            exitCode: result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0,
-            stdout: `${JSON.stringify(result)}\n`,
-            stderr: ''
-        };
+        try {
+            const result = await createTask(request.candidate, { repoRoot: manifest.repoRoot });
+            return taskCreateExecutionResult(projectTaskCreateResult(result, {
+                requestId: request.id,
+                accepted: true,
+                recovery: 'none'
+            }));
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            const code = /^([A-Z][A-Z0-9_]+)/u.exec(detail)?.[1] ?? 'TASK_CREATE_EXECUTION_FAILED';
+            return taskCreateExecutionFailure(request.id, code, detail);
+        }
     }
     if (request.family === 'codex-controller') {
         try {
@@ -239,9 +309,21 @@ export async function executeRequest(manifest, manifestPath, request, options =
             return { exitCode: 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
         }
         catch (error) {
+            const errorCode = error instanceof CodexControllerRegistrationError
+                ? error.code
+                : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
+                    ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+            appendExecutorAudit(manifest, 'controller-operation-failed', {
+                ...requestAuditFields(manifest, request),
+                controllerCommand: request.command,
+                errorCode,
+                errorType: error instanceof Error ? error.name : typeof error,
+            });
             return controllerFailure(error);
         }
     }
+    if (request.family === 'task-workflow')
+        return executeTaskWorkflow(manifest, request.workflow, options.lifecycleRecoveryAttestation ?? null);
     if (request.family === 'task-finalization') {
         const operation = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
         if (operation.family !== 'task-finalization')
@@ -253,7 +335,8 @@ export async function executeRequest(manifest, manifestPath, request, options =
             taskId: manifest.taskId,
             generation: manifest.generation,
             manifestPath,
-            requestId: request.id
+            requestId: request.id,
+            lifecycleRecoveryAttestation: options.lifecycleRecoveryAttestation ?? null
         }), operation);
         return finalizationResult(await result);
     }
@@ -279,27 +362,44 @@ export async function executeRequest(manifest, manifestPath, request, options =
             && operation.input.client === 'codex';
         if (codexPrepare) {
             if (!request.controllerProof) {
-                return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_REQUIRED', 'Codex prepare requires a current controller lease proof');
-            }
-            try {
-                controllerBinding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
-                    manifest,
-                    manifestPath,
-                    proof: request.controllerProof,
-                    buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
-                });
+                const authority = options.lifecycleRecoveryAttestation;
+                if (!authority || authority.phase !== 'orchestration.prepare') {
+                    return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_REQUIRED', 'Codex prepare requires a current controller lease proof');
+                }
+                controllerBinding = {
+                    instanceDigest: authority.controllerInstanceDigest,
+                    controlGeneration: authority.controlGeneration
+                };
             }
-            catch (error) {
-                const code = error instanceof CodexControllerRegistrationError
-                    ? error.code
-                    : 'CODEX_SANDBOX_CONTROLLER_PROOF_INVALID';
-                return orchestrationFailure(code, `${code}: Codex controller proof was rejected`);
+            else {
+                try {
+                    controllerBinding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
+                        manifest,
+                        manifestPath,
+                        proof: request.controllerProof,
+                        buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
+                    });
+                }
+                catch (error) {
+                    const code = error instanceof CodexControllerRegistrationError
+                        ? error.code
+                        : 'CODEX_SANDBOX_CONTROLLER_PROOF_INVALID';
+                    return orchestrationFailure(code, `${code}: Codex controller proof was rejected`);
+                }
             }
         }
         else if (request.controllerProof !== null) {
             return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_INVALID', 'Controller proof is only accepted for canonical Codex prepare');
         }
     }
+    const diagnosticLog = (event, fields) => {
+        appendExecutorAudit(manifest, event.startsWith('orchestration-') ? event : `orchestration-${event}`, {
+            requestId: request.id,
+            requestFamily: request.family,
+            sandboxTaskId: manifest.taskId,
+            ...fields
+        });
+    };
     const context = createSandboxExecutorExecutionContext({
         repoRoot: manifest.repoRoot,
         worktreeRoot: manifest.worktreeRoot,
@@ -308,7 +408,9 @@ export async function executeRequest(manifest, manifestPath, request, options =
         generation: manifest.generation,
         manifestPath,
         requestId: request.id,
-        ...(controllerBinding ? { controllerBinding } : {})
+        diagnosticLog,
+        ...(controllerBinding ? { controllerBinding } : {}),
+        lifecycleRecoveryAttestation: options.lifecycleRecoveryAttestation ?? null
     });
     const format = (value) => {
         const result = value;
@@ -327,30 +429,119 @@ export async function executeRequest(manifest, manifestPath, request, options =
         throw new Error('SANDBOX_CONTROL_LIFECYCLE_OPERATION_INVALID');
     return format(await dispatchTaskControlOperation(context, operation));
 }
+export async function executeRequest(manifest, manifestPath, request, options = {}) {
+    const fields = requestAuditFields(manifest, request);
+    appendExecutorAudit(manifest, 'executor-request-start', fields);
+    try {
+        const result = await executeRequestInner(manifest, manifestPath, request, options);
+        appendExecutorAudit(manifest, 'executor-request-finished', {
+            requestId: request.id,
+            requestFamily: request.family,
+            sandboxTaskId: manifest.taskId,
+            ...resultAuditFields(result)
+        });
+        return result;
+    }
+    catch (error) {
+        appendExecutorAudit(manifest, 'executor-request-failed', {
+            requestId: request.id,
+            requestFamily: request.family,
+            sandboxTaskId: manifest.taskId,
+            errorType: error instanceof Error ? error.name : typeof error,
+        });
+        throw error;
+    }
+}
 export async function runSandboxControlExecutor(requestPath, nonce) {
-    const gateOwner = await waitForGate(nonce);
+    const gate = await waitForGate(nonce);
+    const gateOwner = gate.owner;
     process.disconnect?.();
     const manifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
     if (!manifestPath)
         throw new Error('SANDBOX_CONTROL_EXECUTOR_MANIFEST_MISSING');
     const manifest = readSandboxControlManifest(manifestPath);
+    const identity = validateSandboxControlIdentity({
+        publicStatusDir: manifest.publicStatusDir,
+        root: path.dirname(path.resolve(manifestPath)),
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+    if (identity.state !== 'valid') {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${identity.state.replaceAll('-', '_').toUpperCase()}`);
+    }
     const root = fs.realpathSync.native(process.cwd());
-    if (fs.realpathSync.native(manifest.repoRoot) !== root)
+    const expectedRoot = safeRealpath(manifest.repoRoot);
+    if (expectedRoot !== root) {
+        appendExecutorAudit(manifest, 'executor-root-validation-failed', {
+            hostCwd: process.cwd(),
+            observedRoot: root,
+            expectedRoot
+        });
         throw new Error('SANDBOX_CONTROL_EXECUTOR_ROOT_INVALID');
+    }
     const raw = JSON.parse(fs.readFileSync(requestPath, 'utf8'));
     const request = validateSandboxControlRequest(raw, manifest);
+    if (gate.requestId !== request.id)
+        throw new Error('SANDBOX_CONTROL_EXECUTOR_GATE_REQUEST_MISMATCH');
+    if (gate.authority !== null
+        && (gate.authority.requestId !== request.id
+            || gate.authority.operationId !== gate.operationId
+            || gate.authority.phase !== gate.phase)) {
+        throw new Error('SANDBOX_CONTROL_EXECUTOR_GATE_AUTHORITY_MISMATCH');
+    }
+    appendExecutorAudit(manifest, 'executor-request-validated', requestAuditFields(manifest, request));
     const requestDirectory = path.resolve(path.dirname(requestPath));
     const processingDirectory = path.resolve(path.join(manifest.processingDir, request.id));
     const channelRequestDirectory = path.resolve(path.join(manifest.channelDir, 'requests'));
     if (requestDirectory !== processingDirectory && requestDirectory !== channelRequestDirectory) {
+        appendExecutorAudit(manifest, 'executor-request-path-validation-failed', {
+            ...requestAuditFields(manifest, request),
+            requestPath,
+            requestDirectory,
+            processingDirectory,
+            channelRequestDirectory
+        });
         throw new Error('SANDBOX_CONTROL_EXECUTOR_REQUEST_INVALID');
     }
     let result;
     try {
         assertSandboxControlExecutorAuthority(manifest, gateOwner);
-        result = await executeRequest(manifest, manifestPath, request);
+        const operation = request.family === 'task-lifecycle' || request.family === 'task-orchestration'
+            ? (() => {
+                try {
+                    return parseTaskControlOperation(request.family, request.args);
+                }
+                catch {
+                    return null;
+                }
+            })()
+            : null;
+        const context = createSandboxControlAuditContext(manifest, {
+            requestId: request.id,
+            family: request.family,
+            operation: operation?.family === 'task-orchestration'
+                ? operation.intent
+                : operation?.family === 'task-lifecycle'
+                    ? operation.request.intent
+                    : request.family === 'task-finalization' ? request.operation : null,
+            phase: 'started-committed',
+            outcome: 'in-progress'
+        });
+        appendCriticalAudit(manifest, context, { transition: 'started-committed' });
+        writeSandboxControlTransition(manifest, { requestId: request.id, phase: 'started-committed' });
+        const execution = readJsonExecution(executionPath(manifest, request.id));
+        atomicWriteJson(executionPath(manifest, request.id), { ...execution, phase: 'running', updatedAt: Date.now() });
+        result = await executeRequest(manifest, manifestPath, request, {
+            lifecycleRecoveryAttestation: gate.authority
+        });
     }
     catch (error) {
+        appendExecutorAudit(manifest, 'executor-authority-or-dispatch-failed', {
+            ...requestAuditFields(manifest, request),
+            errorType: error instanceof Error ? error.name : typeof error,
+        });
         const detail = error instanceof Error ? error.message : String(error);
         const code = /^([A-Z][A-Z0-9_]+)/u.exec(detail)?.[1] ?? 'SANDBOX_CONTROL_EXECUTOR_FAILED';
         result = request.family === 'task-finalization'
@@ -362,14 +553,22 @@ export async function runSandboxControlExecutor(requestPath, nonce) {
                 })}\n`,
                 stderr: ''
             }
-            : request.family === 'task-lifecycle'
-                ? lifecycleFailure(code, detail)
-                : orchestrationFailure(code, detail);
+            : request.family === 'task-create'
+                ? taskCreateExecutionFailure(request.id, code, detail)
+                : request.family === 'task-lifecycle'
+                    ? lifecycleFailure(code, detail)
+                    : orchestrationFailure(code, detail);
     }
     process.stdout.write(result.stdout);
     process.stderr.write(result.stderr);
     process.exitCode = result.exitCode;
 }
+function readJsonExecution(filePath) {
+    const value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    if (!value || value.requestId.length === 0)
+        throw new Error('SANDBOX_CONTROL_EXECUTION_INVALID');
+    return value;
+}
 export function disconnectExecutor(child) {
     if (child.connected)
         child.disconnect();

package/dist/lib/sandbox/control/finalization-response.js

@@ -0,0 +1,27 @@
+export function finalizationTerminalResponse(taskId, requestId, receipt) {
+    const pendingSteps = [
+        receipt.taskComment === 'pending' ? 'task-comment' : null,
+        receipt.verification === 'pending' ? 'verification' : null
+    ].filter((step) => step !== null);
+    const completedSteps = ['lifecycle', receipt.taskComment === 'pending' ? null : 'task-comment', receipt.verification === 'pending' ? null : 'verification']
+        .filter((step) => step !== null);
+    const warnings = receipt.warnings
+        .filter((warning) => warning.status === 'open')
+        .map(({ status: _status, resolvedAt: _resolvedAt, ...warning }) => warning);
+    const result = {
+        status: 'completed', changed: false, taskId,
+        lifecycle: { status: 'no-op', changed: false, error: null },
+        taskComment: receipt.taskComment === 'pending' ? null : { status: 'no-op', changed: false, error: null },
+        verification: receipt.verification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
+        completedSteps, pendingSteps,
+        result: pendingSteps.length > 0 || receipt.warningProjection === 'pending' || warnings.length > 0
+            ? 'completed_with_warnings' : 'completed',
+        warnings, error: null
+    };
+    return {
+        version: 2, id: requestId, phase: 'completed', exitCode: 0,
+        stdout: `${JSON.stringify({ version: 1, status: 'completed', changed: false, accepted: true, result, error: null })}\n`,
+        stderr: '', error: null
+    };
+}
+//# sourceMappingURL=finalization-response.js.map

package/dist/lib/sandbox/control/identity-sentinel.js

@@ -0,0 +1,107 @@
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { writeDurableFile } from '../../fs/durable-write.js';
+export const SANDBOX_CONTROL_IDENTITY_FILE = 'identity.json';
+function identityError(code) {
+    return new Error(`SANDBOX_CONTROL_IDENTITY_${code.replaceAll('-', '_').toUpperCase()}`);
+}
+function canonicalIdentity(value) {
+    return JSON.stringify({
+        version: value.version,
+        mode: value.mode,
+        taskId: value.taskId,
+        generation: value.generation,
+        controlRootId: value.controlRootId
+    });
+}
+export function identitySentinelPath(publicStatusDir) {
+    return path.join(publicStatusDir, SANDBOX_CONTROL_IDENTITY_FILE);
+}
+export function createSandboxControlRootId() {
+    return `${randomBytes(32).toString('hex')}${randomUUID().replaceAll('-', '')}`;
+}
+export function createSandboxControlIdentitySentinel(params) {
+    const sentinel = {
+        version: 1,
+        mode: params.mode,
+        taskId: params.mode === 'task-bound' ? params.taskId : null,
+        generation: params.generation,
+        controlRootId: params.controlRootId ?? createSandboxControlRootId()
+    };
+    parseSandboxControlIdentitySentinel(sentinel);
+    return sentinel;
+}
+export function identityDigest(value) {
+    const normalized = parseSandboxControlIdentitySentinel(value);
+    return createHash('sha256').update(canonicalIdentity(normalized), 'utf8').digest('hex');
+}
+export function parseSandboxControlIdentitySentinel(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw identityError('malformed');
+    const candidate = value;
+    if (Object.keys(candidate).sort().join(',') !== 'controlRootId,generation,mode,taskId,version'
+        || candidate.version !== 1
+        || (candidate.mode !== 'task-bound' && candidate.mode !== 'branch-only')
+        || (candidate.taskId !== null && typeof candidate.taskId !== 'string')
+        || (candidate.mode === 'task-bound' && !candidate.taskId)
+        || (candidate.mode === 'branch-only' && candidate.taskId !== null)
+        || typeof candidate.generation !== 'string' || candidate.generation.length === 0
+        || typeof candidate.controlRootId !== 'string' || !/^[a-f0-9]{64,128}$/u.test(candidate.controlRootId)) {
+        throw identityError('malformed');
+    }
+    return candidate;
+}
+export function writeSandboxControlIdentitySentinel(publicStatusDir, value) {
+    const sentinel = parseSandboxControlIdentitySentinel(value);
+    fs.mkdirSync(publicStatusDir, { recursive: true, mode: 0o700 });
+    const target = identitySentinelPath(publicStatusDir);
+    writeDurableFile(target, `${canonicalIdentity(sentinel)}\n`, { mode: 0o400, replace: true });
+    return sentinel;
+}
+export function readSandboxControlIdentitySentinel(publicStatusDir) {
+    const filePath = identitySentinelPath(publicStatusDir);
+    if (!fs.existsSync(filePath))
+        throw identityError('missing');
+    try {
+        const stat = fs.lstatSync(filePath);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw identityError('malformed');
+        return parseSandboxControlIdentitySentinel(JSON.parse(fs.readFileSync(filePath, 'utf8')));
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith('SANDBOX_CONTROL_IDENTITY_'))
+            throw error;
+        throw identityError('malformed');
+    }
+}
+export function validateSandboxControlIdentity(params) {
+    let sentinel;
+    try {
+        sentinel = readSandboxControlIdentitySentinel(params.publicStatusDir);
+    }
+    catch (error) {
+        const code = error instanceof Error ? error.message : '';
+        if (code.endsWith('MISSING'))
+            return { state: 'missing', sentinel: null };
+        return { state: 'malformed', sentinel: null };
+    }
+    if (sentinel.generation !== params.generation)
+        return { state: 'generation-mismatch', sentinel };
+    if (sentinel.controlRootId !== params.controlRootId)
+        return { state: 'root-id-mismatch', sentinel };
+    if (sentinel.mode !== params.mode || sentinel.taskId !== params.taskId)
+        return { state: 'topology-mismatch', sentinel };
+    if (params.manifestRoot && path.resolve(params.manifestRoot) !== path.resolve(params.root)) {
+        return { state: 'topology-mismatch', sentinel };
+    }
+    return { state: 'valid', sentinel };
+}
+export function assertSandboxControlIdentity(params) {
+    const result = validateSandboxControlIdentity(params);
+    if (result.state !== 'valid' || !result.sentinel) {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${result.state.replaceAll('-', '_').toUpperCase()}`);
+    }
+    return result.sentinel;
+}
+//# sourceMappingURL=identity-sentinel.js.map