@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/sandbox/engines/authority.js

@@ -0,0 +1,289 @@
+import { createHash } from 'node:crypto';
+import { runProbe } from '../shell.js';
+import { getAdapter } from './index.js';
+function digest(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    if (!value || typeof value !== 'object')
+        return JSON.stringify(value) ?? 'null';
+    return `{${Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => `${JSON.stringify(key)}:${canonical(entry)}`)
+        .join(',')}}`;
+}
+function text(value) {
+    return typeof value === 'string' ? value : value?.toString('utf8') ?? '';
+}
+function safeEndpoint(value) {
+    if (!value)
+        return 'docker-default';
+    try {
+        const parsed = new URL(value);
+        const hasUnreplayableParts = Boolean(parsed.username || parsed.password || parsed.search || parsed.hash);
+        parsed.username = '';
+        parsed.password = '';
+        parsed.search = '';
+        parsed.hash = '';
+        const normalized = parsed.toString().replace(/\/$/u, '');
+        return hasUnreplayableParts
+            ? `${normalized}#<redacted>`
+            : normalized;
+    }
+    catch {
+        const normalized = value
+            .replace(/\/\/[^/@]+@/u, '//<redacted>@')
+            .replace(/[?&](?:token|password|secret|key)=[^&]*/giu, '');
+        return /[@?#]/u.test(value) ? `${normalized.replace(/[?#].*$/u, '')}#<redacted>` : normalized;
+    }
+}
+function lockDomainFor(engine, endpoint) {
+    return digest(`${process.platform}\0${process.arch}\0${engine}\0${endpoint}`);
+}
+function contextRoute(context) {
+    return {
+        kind: 'context',
+        selector: { context },
+        endpoint: `docker-context://${context}`,
+        command: (args) => ({ cmd: 'docker', args: ['--context', context, ...args] })
+    };
+}
+function endpointRoute(endpoint, rawEndpoint, unreplayable) {
+    return {
+        kind: 'endpoint',
+        selector: {
+            source: 'DOCKER_HOST',
+            endpoint,
+            ...(unreplayable ? { unreplayable } : {})
+        },
+        endpoint,
+        command: (args) => ({ cmd: 'docker', args: ['--host', rawEndpoint, ...args] })
+    };
+}
+function tlsEnvironmentReason(env) {
+    return env.DOCKER_TLS_VERIFY || env.DOCKER_CERT_PATH || env.DOCKER_TLS
+        ? 'tls-environment'
+        : undefined;
+}
+function routeFor(engine, env) {
+    const context = getAdapter(engine).dockerContext;
+    if (context) {
+        return contextRoute(context);
+    }
+    if (env.DOCKER_CONTEXT) {
+        return contextRoute(env.DOCKER_CONTEXT);
+    }
+    if (env.DOCKER_HOST) {
+        return endpointRoute(safeEndpoint(env.DOCKER_HOST), env.DOCKER_HOST, tlsEnvironmentReason(env));
+    }
+    return contextRoute('default');
+}
+function validRouteName(value) {
+    return /^[A-Za-z0-9][A-Za-z0-9_.@/-]*$/u.test(value);
+}
+function resolveWslDistro(probe, timeoutMs, explicit) {
+    if (explicit) {
+        if (!validRouteName(explicit))
+            throw new Error('SANDBOX_AUTHORITY_ROUTE_CAPTURE_FAILED');
+        return explicit;
+    }
+    const result = probe('wsl.exe', ['--list', '--verbose'], timeoutMs === undefined ? {} : { timeout: timeoutMs });
+    if (result.status !== 0)
+        throw new Error('SANDBOX_AUTHORITY_ROUTE_CAPTURE_FAILED');
+    const output = text(result.stdout).replace(/\0/gu, '').replace(/\r/gu, '');
+    const defaultLine = output.split('\n').find((line) => /^\s*\*\s+/u.test(line));
+    const distro = defaultLine?.replace(/^\s*\*\s+/u, '').replace(/\s+(?:Running|Stopped)\s+\d+\s*$/iu, '').trim();
+    if (!distro || !validRouteName(distro))
+        throw new Error('SANDBOX_AUTHORITY_ROUTE_CAPTURE_FAILED');
+    return distro;
+}
+function wslRoute(distro, context, env) {
+    const endpoint = env.DOCKER_HOST
+        ? safeEndpoint(env.DOCKER_HOST)
+        : `wsl://${distro}/${context ?? 'default'}`;
+    const unreplayable = tlsEnvironmentReason(env)
+        ?? (endpoint.includes('<redacted>') ? 'ambient-endpoint-secret' : undefined);
+    return {
+        kind: 'wsl2',
+        selector: {
+            distro,
+            ...(context ? { context } : {}),
+            ...(unreplayable ? { unreplayable } : {}),
+            ...(env.DOCKER_HOST ? { endpoint } : {})
+        },
+        endpoint,
+        command: (args) => ({
+            cmd: 'wsl.exe',
+            args: [
+                '--distribution', distro,
+                '--exec', 'docker',
+                ...(context ? ['--context', context] : []),
+                ...(env.DOCKER_HOST ? ['--host', env.DOCKER_HOST] : []),
+                ...args
+            ]
+        })
+    };
+}
+function currentWslRoute(env, probe, timeoutMs) {
+    const distro = resolveWslDistro(probe, timeoutMs, env.WSL_DISTRO_NAME);
+    let context = env.DOCKER_CONTEXT;
+    if (!context && !env.DOCKER_HOST) {
+        const result = probe('wsl.exe', ['--distribution', distro, '--exec', 'docker', 'context', 'show'], timeoutMs === undefined ? {} : { timeout: timeoutMs });
+        context = text(result.stdout).trim();
+        if (result.status !== 0 || !validRouteName(context)) {
+            throw new Error('SANDBOX_AUTHORITY_ROUTE_CAPTURE_FAILED');
+        }
+    }
+    return wslRoute(distro, context, env);
+}
+function routeFromEvidence(evidence) {
+    return {
+        kind: evidence.routeKind,
+        selector: evidence.routeSelector,
+        endpoint: evidence.normalizedEndpoint,
+        command: (args) => commandForSandboxAuthority(evidence, 'docker', args)
+    };
+}
+function currentContextRoute(engine, env, probe, timeoutMs) {
+    const configured = routeFor(engine, env);
+    if (configured.kind !== 'context' || configured.selector.context !== 'default')
+        return configured;
+    if (env.DOCKER_CONTEXT || env.DOCKER_HOST || getAdapter(engine).dockerContext)
+        return configured;
+    const result = probe('docker', ['context', 'show'], timeoutMs === undefined ? {} : { timeout: timeoutMs });
+    const context = text(result.stdout).trim();
+    if (result.status !== 0 || !/^[A-Za-z0-9][A-Za-z0-9_.@/-]*$/u.test(context)) {
+        throw new Error('SANDBOX_AUTHORITY_ROUTE_CAPTURE_FAILED');
+    }
+    return contextRoute(context);
+}
+/** Build a command using only the route persisted with the sandbox authority. */
+export function commandForSandboxAuthority(evidence, cmd, args = []) {
+    if (cmd !== 'docker') {
+        throw new Error('SANDBOX_AUTHORITY_ROUTE_UNSUPPORTED');
+    }
+    if (evidence.routeKind === 'context') {
+        const context = evidence.routeSelector.context;
+        if (!context)
+            throw new Error('SANDBOX_AUTHORITY_ROUTE_INVALID');
+        return { cmd, args: ['--context', context, ...args] };
+    }
+    if (evidence.routeKind === 'endpoint') {
+        const endpoint = evidence.routeSelector.endpoint;
+        if (!endpoint || endpoint.includes('<redacted>') || evidence.routeSelector.unreplayable) {
+            throw new Error('SANDBOX_AUTHORITY_ROUTE_UNREPLAYABLE');
+        }
+        return { cmd, args: ['--host', endpoint, ...args] };
+    }
+    if (evidence.routeKind === 'wsl2') {
+        const distro = evidence.routeSelector.distro;
+        const context = evidence.routeSelector.context;
+        const endpoint = evidence.routeSelector.endpoint;
+        if (!distro || evidence.routeSelector.unreplayable || endpoint?.includes('<redacted>')) {
+            throw new Error('SANDBOX_AUTHORITY_ROUTE_UNREPLAYABLE');
+        }
+        return {
+            cmd: 'wsl.exe',
+            args: [
+                '--distribution', distro,
+                '--exec', cmd,
+                ...(context ? ['--context', context] : []),
+                ...(endpoint && !endpoint.startsWith('wsl://') ? ['--host', endpoint] : []),
+                ...args
+            ]
+        };
+    }
+    return { cmd, args: ['--context', 'default', ...args] };
+}
+export function authorityVersionArgs() {
+    return ['version', '--format', '{{json .Server}}'];
+}
+export function captureSandboxAuthority(engine, options = {}) {
+    const env = options.env ?? process.env;
+    const probe = options.probe ?? runProbe;
+    const route = options.route
+        ? routeFromEvidence(options.route)
+        : engine === 'wsl2'
+            ? currentWslRoute(env, probe, options.timeoutMs)
+            : currentContextRoute(engine, env, probe, options.timeoutMs);
+    function probeJson(args) {
+        const command = options.route
+            ? commandForSandboxAuthority(options.route, 'docker', args)
+            : route.command(args);
+        try {
+            const response = probe(command.cmd, command.args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
+            if (response.status !== 0)
+                throw new Error('SANDBOX_AUTHORITY_CAPTURE_FAILED');
+            return JSON.parse(text(response.stdout).trim());
+        }
+        catch {
+            throw new Error('SANDBOX_AUTHORITY_CAPTURE_FAILED');
+        }
+    }
+    const server = probeJson(authorityVersionArgs());
+    if (!server || typeof server !== 'object' || Array.isArray(server)) {
+        throw new Error('SANDBOX_AUTHORITY_CAPTURE_FAILED');
+    }
+    const record = server;
+    const api = typeof record.ApiVersion === 'string' ? /^(\d+)\.(\d+)$/u.exec(record.ApiVersion) : null;
+    if (!api)
+        throw new Error('SANDBOX_AUTHORITY_CAPTURE_FAILED');
+    // Docker version exposes API metadata; the daemon ID belongs to Docker info.
+    const serverId = probeJson(['info', '--format', '{{json .ID}}']);
+    if (typeof serverId !== 'string' || !serverId.trim())
+        throw new Error('SANDBOX_AUTHORITY_CAPTURE_FAILED');
+    const normalizedEndpoint = route.endpoint;
+    const evidenceWithoutFingerprint = {
+        version: 1,
+        provider: engine,
+        lockDomain: options.lockDomain ?? options.route?.lockDomain ?? lockDomainFor(engine, normalizedEndpoint),
+        routeKind: route.kind,
+        routeSelector: route.selector,
+        normalizedEndpoint,
+        endpointFingerprint: digest(normalizedEndpoint),
+        daemonIdentity: { kind: 'docker-server-id', fingerprint: digest(serverId) },
+        apiVersion: { major: Number(api[1]), minor: Number(api[2]) }
+    };
+    return {
+        ...evidenceWithoutFingerprint,
+        authorityFingerprint: digest(canonical(evidenceWithoutFingerprint))
+    };
+}
+export function verifySandboxAuthority(expected, actual) {
+    if (!expected)
+        return { state: 'unknown', reason: 'SANDBOX_AUTHORITY_EVIDENCE_MISSING' };
+    if (!actual)
+        return { state: 'unknown', reason: 'SANDBOX_AUTHORITY_UNAVAILABLE' };
+    if (expected.authorityFingerprint !== actual.authorityFingerprint
+        || expected.lockDomain !== actual.lockDomain
+        || expected.routeKind !== actual.routeKind
+        || expected.endpointFingerprint !== actual.endpointFingerprint
+        || expected.daemonIdentity.fingerprint !== actual.daemonIdentity.fingerprint) {
+        return { state: 'conflict', reason: 'SANDBOX_AUTHORITY_DRIFT' };
+    }
+    return { state: 'verified' };
+}
+export function isSandboxAuthorityEvidence(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const evidence = value;
+    const selector = evidence.routeSelector;
+    const daemon = evidence.daemonIdentity;
+    const api = evidence.apiVersion;
+    return evidence.version === 1
+        && typeof evidence.provider === 'string'
+        && /^[a-f0-9]{64}$/u.test(evidence.lockDomain)
+        && ['default', 'context', 'endpoint', 'wsl2'].includes(evidence.routeKind)
+        && !!selector && typeof selector === 'object' && !Array.isArray(selector)
+        && Object.values(selector).every((entry) => typeof entry === 'string')
+        && typeof evidence.normalizedEndpoint === 'string'
+        && /^[a-f0-9]{64}$/u.test(evidence.endpointFingerprint)
+        && !!daemon && daemon.kind === 'docker-server-id'
+        && /^[a-f0-9]{64}$/u.test(daemon.fingerprint)
+        && !!api && Number.isSafeInteger(api.major) && api.major >= 0
+        && Number.isSafeInteger(api.minor) && api.minor >= 0
+        && /^[a-f0-9]{64}$/u.test(evidence.authorityFingerprint);
+}
+//# sourceMappingURL=authority.js.map

package/dist/lib/sandbox/engines/docker-exact-discovery.js

@@ -0,0 +1,97 @@
+import { commandForEngine, runProbe } from '../shell.js';
+import { commandForSandboxAuthority } from './authority.js';
+const FULL_CONTAINER_ID = /^[a-f0-9]{64}$/u;
+function outputText(value) {
+    return typeof value === 'string' ? value : value?.toString('utf8') ?? '';
+}
+function unknown(reason) {
+    return { state: 'unknown', reason };
+}
+export function buildExactContainerListArgs(id) {
+    if (!FULL_CONTAINER_ID.test(id))
+        throw new Error('SANDBOX_CONTAINER_ID_NOT_FULL');
+    return ['container', 'ls', '--all', '--no-trunc', '--filter', `id=${id}`, '--format', '{{.ID}}'];
+}
+function buildExactContainerInspectArgs(id) {
+    return ['container', 'inspect', '--format', '{{json .}}', id];
+}
+function runDockerProbe(engine, args, options) {
+    const command = options.authority
+        ? commandForSandboxAuthority(options.authority, 'docker', args)
+        : commandForEngine(engine, 'docker', args);
+    return (options.probe ?? runProbe)(command.cmd, command.args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
+}
+function parseExactList(stdout, expectedId) {
+    const rows = stdout.split(/\r?\n/u).map((row) => row.trim()).filter(Boolean);
+    if (rows.length === 0)
+        return 'empty';
+    if (rows.length !== 1)
+        return 'exact container query returned multiple rows';
+    if (!FULL_CONTAINER_ID.test(rows[0]))
+        return 'exact container query returned a malformed ID';
+    if (rows[0] !== expectedId)
+        return 'conflict';
+    return 'present';
+}
+function parseExactInspect(stdout, expectedId) {
+    let value;
+    try {
+        value = JSON.parse(stdout);
+    }
+    catch {
+        return unknown('exact container inspection returned malformed JSON');
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return unknown('exact container inspection returned an incomplete object');
+    }
+    const inspected = value;
+    if (inspected.Id !== expectedId || typeof inspected.State?.Running !== 'boolean'
+        || !inspected.Config?.Labels || typeof inspected.Config.Labels !== 'object'
+        || Array.isArray(inspected.Config.Labels)) {
+        return unknown('exact container inspection identity is incomplete');
+    }
+    const rawLabels = inspected.Config.Labels;
+    if (Object.values(rawLabels).some((value) => typeof value !== 'string')) {
+        return unknown('exact container inspection labels are malformed');
+    }
+    return {
+        state: 'found',
+        id: expectedId,
+        running: inspected.State.Running,
+        labels: { ...rawLabels },
+        evidence: 'exact-present'
+    };
+}
+export function discoverExactContainer(engine, id, options = {}) {
+    if (!FULL_CONTAINER_ID.test(id))
+        return unknown('container identity is not a full 64-character ID');
+    let listed;
+    try {
+        listed = runDockerProbe(engine, buildExactContainerListArgs(id), options);
+    }
+    catch {
+        return unknown('exact container query failed before producing a result');
+    }
+    if (listed.status !== 0) {
+        return unknown(`exact container query exited with ${listed.status ?? 'unknown status'}`);
+    }
+    const listState = parseExactList(outputText(listed.stdout), id);
+    if (listState === 'empty')
+        return { state: 'absent', id, evidence: 'exact-empty' };
+    if (listState === 'conflict')
+        return { state: 'conflict', reason: 'exact container query returned a different ID' };
+    if (listState !== 'present')
+        return unknown(listState);
+    let inspected;
+    try {
+        inspected = runDockerProbe(engine, buildExactContainerInspectArgs(id), options);
+    }
+    catch {
+        return unknown('exact container inspection failed before producing a result');
+    }
+    if (inspected.status !== 0) {
+        return unknown(`exact container inspection exited with ${inspected.status ?? 'unknown status'}`);
+    }
+    return parseExactInspect(outputText(inspected.stdout).trim(), id);
+}
+//# sourceMappingURL=docker-exact-discovery.js.map

package/dist/lib/sandbox/index.js

@@ -1,3 +1,4 @@
+import { PUBLIC_CLI_ROUTE_SELECTORS } from '../internal/cli-route-inventory.js';
 const USAGE = `Usage: ai sandbox <command> [options]
 
 Commands:
@@ -18,14 +19,15 @@ Commands:
   rm <branch | TASK-id> | --unbound | --purge
                                Remove one sandbox; use a full TASK-id for task-bound
                                cleanup and a branch for branch-only cleanup. --unbound
-                               removes completed task-bound and branch-only sandboxes;
-                               active, blocked, and archive tasks are protected.
+                               removes completed task-bound and branch-only sandboxes
+                               plus verified auxiliary state; active, blocked, and archive tasks are protected.
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure
   vm status|start|stop         Manage the sandbox VM (macOS) or check the backend (Windows)
 
 Run 'ai sandbox <command> --help' for details.`;
+const SANDBOX_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS.sandbox;
 export async function runSandbox(args) {
     const [subcommand, ...rest] = args;
     if (!subcommand) {
@@ -37,6 +39,9 @@ export async function runSandbox(args) {
         process.stdout.write(`${USAGE}\n`);
         return;
     }
+    if (!SANDBOX_OPERATIONS.includes(subcommand)) {
+        throw new Error(`Unknown sandbox command: ${subcommand}`);
+    }
     switch (subcommand) {
         case 'create': {
             const { create } = await import('./commands/create.js');

package/dist/lib/sandbox/recovery.js

@@ -1,3 +1,4 @@
+import { prepareCompletedReentry, publishCompletedReentry, waitForCompletedReentry } from './control/completed-reentry.js';
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
@@ -17,7 +18,9 @@ import { declaredTmpfsSeedEntries, resolveTools, toolConfigDirCandidates } from
 import { fetchSandboxRows, selectSandboxContainer, startSandboxContainer } from './commands/list-running.js';
 import { getProcessIdentityState, getProcessStartTime, removePidFileIfMatches } from '../server/process-state.js';
 import { acquireSandboxControlBrokerStartup, garbageCollectSandboxControlRoot, isSandboxControlRootQuiescing, readSandboxControlManifest } from './control/lifecycle.js';
-import { appendSandboxControlAudit, readSandboxControlStatus } from './control/state.js';
+import { readSandboxControlStatus } from './control/state.js';
+import { validateSandboxControlIdentity } from './control/identity-sentinel.js';
+import { appendDiagnosticAudit as appendControlDiagnosticAudit } from './control/audit.js';
 import { inspectSandboxControlContainer } from './control/container-identity.js';
 import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from './control/protocol.js';
 export function worktreeProbeForEngine(engine, probe = runProbe) {
@@ -60,6 +63,17 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
     const internalCli = path.resolve(directory, '..', '..', 'bin', `internal-cli${extension}`);
     const manifest = readSandboxControlManifest(manifestPath);
     const root = path.dirname(manifestPath);
+    const identity = validateSandboxControlIdentity({
+        publicStatusDir: manifest.publicStatusDir,
+        root,
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+    if (identity.state !== 'valid') {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${identity.state.replaceAll('-', '_').toUpperCase()}`);
+    }
     if (isSandboxControlRootQuiescing(root))
         throw new Error('SANDBOX_CONTROL_QUIESCING');
     const brokerPath = path.join(root, 'broker.json');
@@ -129,8 +143,8 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
             }
         }
         if (replacedBrokerRecord) {
-            appendSandboxControlAudit(manifest, 'broker-observed-crash');
-            appendSandboxControlAudit(manifest, 'broker-restart');
+            appendControlDiagnosticAudit(manifest, 'broker-observed-crash');
+            appendControlDiagnosticAudit(manifest, 'broker-restart');
         }
         child = spawn(process.execPath, nodeEntryArgs(internalCli, ['sandbox-control', 'serve', '--manifest', manifestPath]), { cwd: repoRoot, detached: true, stdio: 'ignore' });
     }
@@ -167,6 +181,17 @@ async function ensureSandboxControlBroker(params) {
     if (!fs.existsSync(control.manifestPath))
         return;
     const validatedManifest = readSandboxControlManifest(control.manifestPath);
+    const identity = validateSandboxControlIdentity({
+        publicStatusDir: validatedManifest.publicStatusDir,
+        root: control.root,
+        mode: validatedManifest.mode,
+        taskId: validatedManifest.taskId,
+        generation: validatedManifest.generation,
+        controlRootId: validatedManifest.controlRootId
+    });
+    if (identity.state !== 'valid') {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${identity.state.replaceAll('-', '_').toUpperCase()}`);
+    }
     const containerObservation = await inspectSandboxControlContainer(validatedManifest);
     if (containerObservation.state === 'unknown') {
         throw new Error(`SANDBOX_CONTROL_CONTAINER_UNKNOWN: ${containerObservation.reason}`);
@@ -441,7 +466,7 @@ function recoveryTaskSources(repoRoot, taskId) {
     }
     return { mountPaths, accessiblePaths: [completedSource] };
 }
-function startCompletedSandboxContainer(params) {
+export function startCompletedSandboxContainer(params) {
     const taskSources = recoveryTaskSources(params.config.repoRoot, params.taskId);
     const completedSource = taskSources.accessiblePaths[0];
     const activeRoot = path.join(params.config.repoRoot, '.agents', 'workspace', 'active');
@@ -513,7 +538,7 @@ function expectedMounts(params) {
             ? {}
             : {
                 runtimeDir: control.runtimeDir,
-                taskSources: taskSources.mountPaths,
+                taskSources: taskSources.accessiblePaths,
                 taskId: taskId
             })
     }).map((mount) => ({
@@ -879,7 +904,17 @@ export async function ensureSandboxReady(params) {
             throw new Error('Explicit container recreation requested.');
         }
         if (!params.row.running) {
+            let completedReentry = null;
             if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
+                const control = sandboxControlPaths({
+                    base: params.config.controlBase, project: params.config.project,
+                    container: params.row.name, identity: params.workspace
+                });
+                const manifest = readSandboxControlManifest(control.manifestPath);
+                if (manifest.taskId !== params.workspace.taskId || manifest.branch !== params.branch) {
+                    throw new Error('SANDBOX_COMPLETED_REENTRY_EVIDENCE_INVALID');
+                }
+                completedReentry = { manifest, evidence: await prepareCompletedReentry(manifest) };
                 startCompletedSandboxContainer({
                     config: params.config,
                     engine: params.engine,
@@ -943,6 +978,15 @@ export async function ensureSandboxReady(params) {
             if (final.findings.length > 0) {
                 throw new Error(describeFindings(final.findings));
             }
+            if (completedReentry) {
+                const { manifest, evidence } = completedReentry;
+                const current = await prepareCompletedReentry(manifest);
+                if (JSON.stringify(current) !== JSON.stringify(evidence)) {
+                    throw new Error('SANDBOX_COMPLETED_REENTRY_EVIDENCE_INVALID');
+                }
+                publishCompletedReentry(manifest, evidence);
+                await waitForCompletedReentry(manifest, evidence);
+            }
             return { container: params.row.name, path: 'recovered', warnings };
         }
         const initial = assess({