@fitlab-ai/agent-infra 0.9.14 → 0.10.0

package/dist/lib/sandbox/control/audit.js

@@ -0,0 +1,203 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { identityDigest as digestIdentity } from './identity-sentinel.js';
+import { acquireSandboxResourceLock } from './native-file-lock.js';
+import { fsyncDirectory, writeDurableFile } from '../../fs/durable-write.js';
+export const SANDBOX_CONTROL_AUDIT_PHASES = Object.freeze([
+    'validated', 'gated', 'reserved', 'prepared', 'accepted-authorized', 'accepted-committed',
+    'start-authorized', 'started-committed', 'completed', 'evidence-written',
+    'publish-authorized', 'published-committed', 'rejected', 'recovered'
+]);
+const REQUEST_ID = /^[a-f0-9-]{16,64}$/u;
+const SAFE_OPERATION = /^[a-z][a-z0-9.-]{0,96}$/u;
+const AUDIT_MAX_BYTES = 1024 * 1024;
+export function requestAuditFields(manifest, request) {
+    return {
+        requestId: request.id, requestFamily: request.family, sandboxTaskId: manifest.taskId,
+        requestGeneration: request.generation, requestIssuedAt: request.issuedAt, requestExpiresAt: request.expiresAt
+    };
+}
+export function resultAuditFields(result) {
+    return {
+        exitCode: result.exitCode,
+        outputBytes: Buffer.byteLength(result.stdout, 'utf8'), errorBytes: Buffer.byteLength(result.stderr, 'utf8'),
+        outputDigest: createHash('sha256').update(result.stdout, 'utf8').digest('hex'),
+        errorDigest: createHash('sha256').update(result.stderr, 'utf8').digest('hex')
+    };
+}
+function auditRoot(manifest) {
+    return path.dirname(path.resolve(manifest.publicStatusDir));
+}
+function auditPath(manifest) {
+    return path.join(auditRoot(manifest), 'audit.ndjson');
+}
+function manifestIdentityDigest(manifest) {
+    return digestIdentity({
+        version: 1,
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+}
+export function createSandboxControlAuditContext(manifest, params) {
+    if (!REQUEST_ID.test(params.requestId))
+        throw new Error('SANDBOX_CONTROL_AUDIT_REQUEST_INVALID');
+    if (params.operation !== null && params.operation !== undefined && !SAFE_OPERATION.test(params.operation)) {
+        throw new Error('SANDBOX_CONTROL_AUDIT_OPERATION_INVALID');
+    }
+    if (!SANDBOX_CONTROL_AUDIT_PHASES.includes(params.phase))
+        throw new Error('SANDBOX_CONTROL_AUDIT_PHASE_INVALID');
+    return {
+        requestId: params.requestId,
+        taskId: manifest.taskId,
+        family: params.family,
+        operation: params.operation ?? null,
+        phase: params.phase,
+        outcome: params.outcome,
+        generation: manifest.generation,
+        identityDigest: manifestIdentityDigest(manifest)
+    };
+}
+function safeFields(fields) {
+    const result = {};
+    for (const [key, value] of Object.entries(fields)) {
+        if (!/^[a-z][a-zA-Z0-9]{0,63}$/u.test(key))
+            continue;
+        if (/(token|secret|credential|proof|password|path|root|cwd|stdout|stderr|args|command|taskref)/iu.test(key))
+            continue;
+        if (typeof value === 'string' && value.length > 256)
+            continue;
+        result[key] = value;
+    }
+    return result;
+}
+function requestHasTerminalTransition(directory) {
+    const transitions = path.join(directory, 'transitions');
+    if (!fs.existsSync(transitions))
+        return false;
+    return ['published-committed', 'recovered'].some((phase) => fs.existsSync(path.join(transitions, `${phase}.json`)));
+}
+function hasActiveRequest(manifest) {
+    if (!fs.existsSync(manifest.processingDir))
+        return false;
+    return fs.readdirSync(manifest.processingDir, { withFileTypes: true })
+        .some((entry) => entry.isDirectory() && REQUEST_ID.test(entry.name)
+        && !requestHasTerminalTransition(path.join(manifest.processingDir, entry.name)));
+}
+function rotateAuditUnderLock(manifest, filePath) {
+    if (!fs.existsSync(filePath) || fs.statSync(filePath).size < AUDIT_MAX_BYTES)
+        return;
+    if (hasActiveRequest(manifest))
+        return;
+    fs.rmSync(`${filePath}.1`, { force: true });
+    fs.renameSync(filePath, `${filePath}.1`);
+    fsyncDirectory(auditRoot(manifest));
+    const descriptor = fs.openSync(filePath, 'a', 0o600);
+    try {
+        fs.fsyncSync(descriptor);
+    }
+    finally {
+        fs.closeSync(descriptor);
+    }
+}
+function appendAuditRecord(manifest, record, critical) {
+    const root = auditRoot(manifest);
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    const lock = acquireSandboxResourceLock(`sandbox-control-audit:${root}`);
+    try {
+        const filePath = auditPath(manifest);
+        rotateAuditUnderLock(manifest, filePath);
+        const descriptor = fs.openSync(filePath, 'a', 0o600);
+        try {
+            fs.writeSync(descriptor, `${JSON.stringify(record)}\n`, undefined, 'utf8');
+            if (critical)
+                fs.fsyncSync(descriptor);
+        }
+        finally {
+            fs.closeSync(descriptor);
+        }
+    }
+    catch (error) {
+        if (critical)
+            throw new Error(`SANDBOX_CONTROL_AUDIT_UNAVAILABLE: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    finally {
+        lock.release();
+    }
+}
+export function appendCriticalAudit(manifest, context, fields = {}, now = Date.now()) {
+    appendAuditRecord(manifest, {
+        version: 2,
+        at: now,
+        event: context.phase,
+        ...context,
+        ...safeFields(fields)
+    }, true);
+}
+export function appendDiagnosticAudit(manifest, event, fields = {}, now = Date.now()) {
+    try {
+        appendAuditRecord(manifest, {
+            version: 2,
+            at: now,
+            event,
+            generation: manifest.generation,
+            identityDigest: manifestIdentityDigest(manifest),
+            ...safeFields(fields)
+        }, false);
+    }
+    catch {
+        // Diagnostics are deliberately best effort.
+    }
+}
+function transitionPath(manifest, requestId, phase) {
+    if (!REQUEST_ID.test(requestId))
+        throw new Error('SANDBOX_CONTROL_TRANSITION_REQUEST_INVALID');
+    return path.join(manifest.processingDir, requestId, 'transitions', `${phase}.json`);
+}
+export function writeSandboxControlTransition(manifest, params) {
+    const transition = {
+        version: 1,
+        requestId: params.requestId,
+        generation: manifest.generation,
+        phase: params.phase,
+        at: params.now ?? Date.now(),
+        identityDigest: manifestIdentityDigest(manifest),
+        reference: params.reference ?? null
+    };
+    const target = transitionPath(manifest, params.requestId, params.phase);
+    fs.mkdirSync(path.dirname(target), { recursive: true, mode: 0o700 });
+    try {
+        writeDurableFile(target, `${JSON.stringify(transition)}\n`, { mode: 0o600, replace: false });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const existing = readSandboxControlTransition(manifest, params.requestId, params.phase);
+        if (JSON.stringify(existing) !== JSON.stringify(transition))
+            throw new Error('SANDBOX_CONTROL_TRANSITION_CONFLICT');
+    }
+    return transition;
+}
+export function readSandboxControlTransition(manifest, requestId, phase) {
+    const filePath = transitionPath(manifest, requestId, phase);
+    if (!fs.existsSync(filePath))
+        throw new Error('SANDBOX_CONTROL_TRANSITION_MISSING');
+    let value;
+    try {
+        value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        throw new Error('SANDBOX_CONTROL_TRANSITION_INVALID');
+    }
+    const candidate = value;
+    if (!candidate || candidate.version !== 1 || candidate.requestId !== requestId
+        || candidate.generation !== manifest.generation || candidate.phase !== phase
+        || !Number.isSafeInteger(candidate.at) || typeof candidate.identityDigest !== 'string'
+        || (candidate.reference !== null && typeof candidate.reference !== 'string')) {
+        throw new Error('SANDBOX_CONTROL_TRANSITION_INVALID');
+    }
+    return candidate;
+}
+//# sourceMappingURL=audit.js.map

package/dist/lib/sandbox/control/client.js

@@ -1,57 +1,14 @@
 import fs from 'node:fs';
+import { hasTaskBoundMarker } from '../../internal/task-operation-registry.js';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { SANDBOX_CONTROL_ADMISSION_WINDOW_MS, SANDBOX_CONTROL_MAX_BYTES, SANDBOX_CONTROL_STATUS_STALE_MS, isSandboxControlFamily } from './protocol.js';
 import { normalizeAgentToken } from '../../agent-clients/tokens.js';
 import { readSandboxControlPayload, readSandboxControlStatus } from './state.js';
 import { accessSandboxTaskView, taskViewFromStatus } from './task-view.js';
+import { readSandboxControlIdentitySentinel } from './identity-sentinel.js';
+import { configuredShortIdLength, resolveShortIdReadOnly } from '../../task/short-id.js';
 const SANDBOX_CONTROL_RESPONSE_SETTLE_MS = 250;
-export function classifySandboxControlEnvironment(env = process.env) {
-    const controlKeys = [
-        'AGENT_INFRA_CONTROL_TOKEN',
-        'AGENT_INFRA_CONTROL_GENERATION',
-        'AGENT_INFRA_CONTROL_DIR',
-        'AGENT_INFRA_CONTROL_STATUS_DIR'
-    ];
-    const hasControlMarker = controlKeys.some((key) => Boolean(env[key]));
-    const hasTaskIdentity = Boolean(env.AGENT_INFRA_TASK_ID);
-    const hasRuntime = Boolean(env.AGENT_INFRA_RUNTIME_DIR);
-    const hasExecutorMarker = Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
-    const hasControllerBinding = Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING);
-    const hasAnyMarker = hasControlMarker || hasTaskIdentity || hasRuntime || hasExecutorMarker || hasControllerBinding;
-    const hasCompleteControl = controlKeys.every((key) => Boolean(env[key]));
-    if (!hasAnyMarker)
-        return { kind: 'direct' };
-    if (hasExecutorMarker) {
-        return {
-            kind: 'invalid',
-            code: 'TASK_CONTROL_TRANSPORT_INVALID',
-            message: 'executor context is only valid for sandbox-control execute'
-        };
-    }
-    if (hasControllerBinding) {
-        return {
-            kind: 'invalid',
-            code: 'TASK_CONTROL_TRANSPORT_INVALID',
-            message: 'sandbox client control configuration is incomplete or conflicting'
-        };
-    }
-    if (!hasCompleteControl) {
-        return {
-            kind: 'invalid',
-            code: 'TASK_CONTROL_TRANSPORT_INVALID',
-            message: 'sandbox client control configuration is incomplete or conflicting'
-        };
-    }
-    if (hasTaskIdentity !== hasRuntime) {
-        return {
-            kind: 'invalid',
-            code: 'TASK_CONTROL_TRANSPORT_INVALID',
-            message: 'sandbox task identity and runtime binding must be provided together'
-        };
-    }
-    return { kind: 'controlled', mode: hasTaskIdentity ? 'task-bound' : 'branch-only' };
-}
 export class SandboxControlClientError extends Error {
     detail;
     accepted;
@@ -70,12 +27,25 @@ function sleep(milliseconds) {
 function clientError(code, message, retryable, accepted = false, requestId = null) {
     throw new SandboxControlClientError({ code, message: `${code}: ${message}`, retryable }, accepted, requestId);
 }
-function hasTaskBoundMarker(env = process.env) {
-    return Boolean(env.AGENT_INFRA_TASK_ID)
-        && Boolean(env.AGENT_INFRA_CONTROL_TOKEN || env.AGENT_INFRA_CONTROL_GENERATION
-            || env.AGENT_INFRA_CONTROL_STATUS_DIR || env.AGENT_INFRA_RUNTIME_DIR || env.AGENT_INFRA_CONTROL_DIR);
-}
 function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(), env = process.env) {
+    if (fs.existsSync(statusDir)) {
+        let identity;
+        try {
+            identity = readSandboxControlIdentitySentinel(statusDir);
+        }
+        catch (error) {
+            const code = error instanceof Error && error.message.endsWith('MISSING')
+                ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
+                : 'SANDBOX_CONTROL_IDENTITY_MALFORMED';
+            clientError(code, 'sandbox control identity is missing or invalid', false);
+        }
+        if (identity.generation !== generation) {
+            clientError('SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH', 'sandbox control identity generation does not match the request', false);
+        }
+        if (env.AGENT_INFRA_CONTROL_ROOT_ID && identity.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
+            clientError('SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH', 'sandbox control identity root does not match the client configuration', false);
+        }
+    }
     let status;
     try {
         status = readSandboxControlStatus(statusDir);
@@ -113,6 +83,8 @@ function taskViewEffectForRequest(request) {
         return 'progress';
     if (request.family === 'task-orchestration')
         return request.args[1] === 'status' ? 'diagnostic' : 'progress';
+    if (request.family === 'task-workflow')
+        return request.workflow.operation === 'artifact-inspect' || request.workflow.operation === 'decision-next-id' ? 'diagnostic' : 'progress';
     return null;
 }
 function parseResponse(raw, id, accepted = false) {
@@ -158,11 +130,59 @@ function cancelPendingRequest(requestPath) {
         throw error;
     }
 }
+const CONTROL_TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
+const CONTROL_SHORT_ID_RE = /^\d+$/;
+// Use the current short-id contract for the first visible active registry.
+export function resolveVisibleActiveShortId(ref) {
+    let dir = process.cwd();
+    for (let depth = 0; depth < 64; depth += 1) {
+        const registryPath = path.join(dir, '.agents', 'workspace', 'active', '.short-ids.json');
+        if (fs.existsSync(registryPath)) {
+            const resolved = resolveShortIdReadOnly(ref, dir, { shortIdLength: configuredShortIdLength(dir) });
+            return resolved.ok ? resolved.taskId : null;
+        }
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+// A request's leading argument is only a task reference for some families and
+// may be a documented short id. Compare canonical ids so a bound sandbox keeps
+// refusing other tasks without rejecting its own task's short id.
+function canonicalRequestTask(request) {
+    const ref = request.family === 'task-workflow'
+        ? request.workflow.taskId
+        : 'args' in request ? request.args[0] ?? null : null;
+    if (!ref)
+        return { kind: 'none' };
+    if (CONTROL_TASK_ID_RE.test(ref))
+        return { kind: 'task', taskId: ref };
+    if (!CONTROL_SHORT_ID_RE.test(ref))
+        return { kind: 'none' };
+    const resolved = resolveVisibleActiveShortId(ref);
+    return resolved ? { kind: 'task', taskId: resolved } : { kind: 'unresolved' };
+}
 function exchangeSandboxControl(request, params) {
     const channelDir = params.channelDir ?? process.env.AGENT_INFRA_CONTROL_DIR ?? '/run/agent-infra/control';
     const statusDir = params.statusDir ?? process.env.AGENT_INFRA_CONTROL_STATUS_DIR ?? '/run/agent-infra/control-status';
     const taskViewEffect = taskViewEffectForRequest(request);
     preflight(statusDir, request.generation, taskViewEffect);
+    const identityPath = path.join(statusDir, 'identity.json');
+    if (fs.existsSync(statusDir)) {
+        const identity = readSandboxControlIdentitySentinel(statusDir);
+        const requestTask = canonicalRequestTask(request);
+        if (identity.mode === 'task-bound'
+            && ((process.env.AGENT_INFRA_TASK_ID && process.env.AGENT_INFRA_TASK_ID !== identity.taskId)
+                || requestTask.kind === 'unresolved'
+                || (requestTask.kind === 'task' && requestTask.taskId !== identity.taskId))) {
+            clientError('SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH', 'request task does not match the sandbox identity', false);
+        }
+        if (identity.mode === 'branch-only' && (request.family === 'task-finalization' || request.family === 'task-workflow')) {
+            clientError('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot finalize tasks', false);
+        }
+    }
     const encoded = `${JSON.stringify(request)}\n`;
     if (Buffer.byteLength(encoded, 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
         clientError('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit', false, false, request.id);
@@ -306,7 +326,7 @@ function authority(params) {
 export function requestSandboxControl(params) {
     if (!isSandboxControlFamily(params.family))
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' is not allowed`, false);
-    if (params.family === 'task-create' || params.family === 'codex-controller' || params.family === 'task-finalization') {
+    if (params.family === 'task-create' || params.family === 'codex-controller' || params.family === 'task-finalization' || params.family === 'task-workflow') {
         clientError('SANDBOX_CONTROL_COMMAND_DENIED', `'${params.family}' requires a typed request`, false);
     }
     const auth = authority(params);
@@ -325,14 +345,15 @@ export function requestSandboxTaskControl(params) {
     const issuedAt = Date.now();
     const request = {
         version: 3,
-        id: randomUUID(),
+        id: params.authority?.requestId ?? randomUUID(),
         ...auth,
         issuedAt,
         expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
         family: params.family,
         args: params.args,
         controllerProcess: null,
-        controllerProof: params.controllerProof
+        controllerProof: params.authority ? null : params.controllerProof,
+        ...(params.authority ? { authority: params.authority } : {})
     };
     return exchangeSandboxControl(request, params);
 }
@@ -357,6 +378,24 @@ export function requestSandboxTaskFinalization(params) {
     };
     return exchangeSandboxControl(request, params);
 }
+export function requestSandboxTaskWorkflow(params) {
+    const auth = authority(params);
+    const issuedAt = Date.now();
+    const request = {
+        version: 3,
+        id: params.workflow.id,
+        ...auth,
+        issuedAt,
+        expiresAt: issuedAt + SANDBOX_CONTROL_ADMISSION_WINDOW_MS,
+        family: 'task-workflow',
+        args: [],
+        controllerProcess: null,
+        controllerProof: null,
+        workflow: params.workflow,
+        ...(params.authority ? { authority: params.authority } : {})
+    };
+    return exchangeSandboxControl(request, params);
+}
 function exactKeys(value, keys) {
     return Object.keys(value).sort().join(',') === [...keys].sort().join(',');
 }