@fitlab-ai/agent-infra 0.9.14 → 0.9.15

package/dist/lib/sandbox/control/state.js

@@ -1,3 +1,5 @@
+import { isCompletionEvidence } from '../../task/orchestration.js';
+import { parseControlOutput } from '../../task/control-recovery.js';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -70,6 +72,62 @@ export function reservationPath(manifest, requestId) {
         throw new Error('SANDBOX_CONTROL_RESERVATION_INVALID');
     return path.join(manifest.processingDir, requestId, 'reservation.json');
 }
+export function terminalResultPath(manifest, requestId) {
+    if (!/^[a-f0-9-]{16,64}$/u.test(requestId))
+        throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
+    return path.join(manifest.processingDir, requestId, 'terminal-result.json');
+}
+export function createSandboxControlTerminalResult(manifest, request, output) {
+    const nested = parseControlOutput(output) ?? {};
+    const run = nested.run && typeof nested.run === 'object' && !Array.isArray(nested.run)
+        ? nested.run : null;
+    const rawCompletion = nested.completionEvidence ?? run?.completionEvidence;
+    const operation = request.operation ?? (typeof nested.intent === 'string' ? nested.intent : null) ?? '';
+    return {
+        version: 1,
+        requestId: request.id,
+        generation: manifest.generation,
+        taskId: manifest.taskId,
+        intentDigest: createHash('sha256').update(`${request.family}\0${operation}`, 'utf8').digest('hex'),
+        targetState: typeof nested.targetState === 'string' ? nested.targetState : null,
+        status: typeof nested.status === 'string' ? nested.status : 'completed',
+        changed: typeof nested.changed === 'boolean' ? nested.changed : null,
+        completionEvidence: isCompletionEvidence(rawCompletion) ? rawCompletion : null
+    };
+}
+export function writeSandboxControlTerminalResult(manifest, request, output) {
+    const result = createSandboxControlTerminalResult(manifest, request, output);
+    const filePath = terminalResultPath(manifest, request.id);
+    try {
+        atomicWriteJsonNoReplace(filePath, result);
+    }
+    catch (error) {
+        if (!(error instanceof Error) || error.message !== 'SANDBOX_CONTROL_TERMINAL_ALREADY_EXISTS')
+            throw error;
+        const existing = readSandboxControlTerminalResult(filePath);
+        if (JSON.stringify(existing) !== JSON.stringify(result))
+            throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_CONFLICT');
+    }
+    return readSandboxControlTerminalResult(filePath);
+}
+export function readSandboxControlTerminalResult(filePath) {
+    const value = readJsonFile(filePath);
+    if (!value || value.version !== 1 || typeof value.requestId !== 'string'
+        || typeof value.generation !== 'string' || (value.taskId !== null && typeof value.taskId !== 'string')
+        || typeof value.intentDigest !== 'string' || !/^[a-f0-9]{64}$/u.test(value.intentDigest)
+        || (value.targetState !== null && typeof value.targetState !== 'string')
+        || typeof value.status !== 'string'
+        || (value.changed !== null && typeof value.changed !== 'boolean')) {
+        throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
+    }
+    if (value.completionEvidence !== null && !isCompletionEvidence(value.completionEvidence)) {
+        throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
+    }
+    if (value.changed === undefined) {
+        throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
+    }
+    return value;
+}
 export function readSandboxControlResultEvidence(filePath) {
     assertRegularFile(filePath);
     const raw = fs.readFileSync(filePath, 'utf8');

package/dist/lib/sandbox/control/task-workflow.js

@@ -0,0 +1,74 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { readStableFile, SecureFileError, writeAtomicFile } from '../../host-control/secure-fs.js';
+import { TASK_WORKFLOW_COMMANDS, TASK_WORKFLOW_OPERATIONS } from '../../task/workflow-command.js';
+export function validateTaskWorkflowRequest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
+    const request = value;
+    if (Object.keys(request).sort().join(',') !== 'args,generation,id,operation,taskId,version'
+        || request.version !== 1 || typeof request.id !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(request.id)
+        || typeof request.taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/u.test(request.taskId)
+        || typeof request.generation !== 'string' || !request.generation
+        || !Object.hasOwn(TASK_WORKFLOW_COMMANDS, request.operation)
+        || !Array.isArray(request.args) || request.args.length < 2 || request.args.length > 128
+        || !request.args.every((arg) => typeof arg === 'string' && !/[\r\n]/u.test(arg))
+        || request.args[0] !== request.taskId)
+        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
+    const [, selector] = TASK_WORKFLOW_COMMANDS[request.operation];
+    if (selector !== null && request.args[1] !== selector)
+        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
+    return request;
+}
+/** Preserve argv verbatim; the domain command owns option parsing and validation. */
+export function createTaskWorkflowRequest(command, args, taskId, generation) {
+    const operation = TASK_WORKFLOW_OPERATIONS.find((key) => {
+        const [name, selector] = TASK_WORKFLOW_COMMANDS[key];
+        return name === command && (selector === null || selector === args[1]);
+    });
+    if (!operation)
+        throw new Error('TASK_WORKFLOW_OPERATION_UNSUPPORTED');
+    return validateTaskWorkflowRequest({ version: 1, id: randomUUID(), taskId, generation, operation, args: [...args] });
+}
+export function canonicalArtifactName(value) {
+    return /^(?:analysis|plan|code|review-analysis|review-plan|review-code)(?:-r[1-9]\d*)?\.md$/u.test(value)
+        && path.basename(value) === value;
+}
+function assertTaskArtifactDirectory(directory) {
+    const resolved = path.resolve(directory);
+    let stat;
+    try {
+        stat = fs.lstatSync(resolved);
+    }
+    catch {
+        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory is unavailable');
+    }
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory must be a real directory');
+    }
+    return resolved;
+}
+export async function readTaskArtifact(taskDir, input) {
+    if (!canonicalArtifactName(input.artifact))
+        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
+    const root = assertTaskArtifactDirectory(taskDir);
+    const candidate = path.join(root, input.artifact);
+    if (path.dirname(candidate) !== root)
+        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
+    const stable = await readStableFile(candidate, {
+        maxBytes: 1024 * 1024,
+        ...(input.expectedSha256 ? { expectedSha256: input.expectedSha256 } : {})
+    });
+    return { artifact: input.artifact, bytes: stable.bytes, sha256: stable.sha256 };
+}
+export async function writeTaskArtifact(taskDir, artifact) {
+    if (!canonicalArtifactName(artifact.artifact))
+        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
+    const root = assertTaskArtifactDirectory(taskDir);
+    const target = path.join(root, artifact.artifact);
+    if (path.dirname(target) !== root)
+        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
+    await writeAtomicFile(target, artifact.bytes, 0o600, artifact.expectedSha256);
+}
+//# sourceMappingURL=task-workflow.js.map

package/dist/lib/sandbox/control/workflow-executor.js

@@ -0,0 +1,99 @@
+import { TASK_WORKFLOW_COMMANDS } from '../../task/workflow-command.js';
+import { parseArtifactCommand, executeArtifactCommand } from '../../task/artifact-command.js';
+import { parseReviewCommand } from '../../task/review-command.js';
+import { prepareLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.js';
+import { prepareReviewSummaryCandidate, commitReviewSummaryProvenance } from '../../task/review-finalization.js';
+import { withTaskExecutionLock } from '../../task/task-execution-lock.js';
+import { dispatchHostControlCommand } from '../../host-control/command.js';
+import { assertSandboxTaskSource } from '../workspace-view.js';
+import { appendDiagnosticAudit } from './audit.js';
+import { readTaskArtifact, writeTaskArtifact } from './task-workflow.js';
+import { applyTaskEvent } from '../../task/events.js';
+import { parseTaskEventRequest } from '../../internal/task-event.js';
+function executionResult(result) {
+    return { exitCode: result.status === 'failed' || result.status === 'refused' ? 1 : 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
+}
+/** The broker already authorized this host executor; domain operations own validation. */
+export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAttestation = null) {
+    let publicationStarted = false;
+    try {
+        const taskDir = assertSandboxTaskSource(manifest.repoRoot, request.taskId);
+        const [command] = TASK_WORKFLOW_COMMANDS[request.operation];
+        if (request.operation === 'event') {
+            const eventRequest = parseTaskEventRequest(request.args);
+            const boundEventRequest = lifecycleRecoveryAttestation && eventRequest.requestId === undefined
+                ? { ...eventRequest, requestId: lifecycleRecoveryAttestation.lifecycleRequestId }
+                : eventRequest;
+            const result = applyTaskEvent(boundEventRequest, {
+                repoRoot: manifest.repoRoot,
+                lifecycleRecoveryAttestation,
+                deferLifecycleRecoveryConsumption: true
+            });
+            return executionResult(result);
+        }
+        if (command !== 'task-artifact' && command !== 'task-review') {
+            publicationStarted = true;
+            // Inherit this executor's process group so its existing recovery owns the worker too.
+            const result = await dispatchHostControlCommand({
+                operation: command, payload: { workingDirectory: manifest.repoRoot, args: request.args }
+            });
+            return result;
+        }
+        const input = command === 'task-artifact' ? parseArtifactCommand(request.args) : parseReviewCommand(request.args);
+        if (command === 'task-artifact' && 'operation' in input && input.operation === 'inspect') {
+            return executionResult(executeArtifactCommand(input, { repoRoot: manifest.repoRoot }));
+        }
+        if ('operation' in input && (input.operation === 'init' || input.operation === 'repair')) {
+            return executionResult(executeArtifactCommand(input, { repoRoot: manifest.repoRoot, artifactDir: taskDir }));
+        }
+        return await withTaskExecutionLock(manifest.repoRoot, request.taskId, `sandbox-control.${request.operation}`, async () => {
+            const artifact = await readTaskArtifact(taskDir, { artifact: input.artifact });
+            const content = artifact.bytes.toString('utf8');
+            let result;
+            if ('operation' in input) {
+                const { family } = input;
+                if (family !== 'analysis' && family !== 'plan' && family !== 'code')
+                    throw new Error('ARTIFACT_IDENTITY_INVALID');
+                const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot };
+                const prepared = prepareLocalArtifact(local, content, lifecycleRecoveryAttestation ?? undefined);
+                if (prepared.result.status === 'failed')
+                    return executionResult(commitLocalArtifactProvenance(prepared));
+                publicationStarted = true;
+                await writeTaskArtifact(taskDir, {
+                    artifact: artifact.artifact,
+                    bytes: artifact.bytes,
+                    expectedSha256: artifact.sha256
+                });
+                result = commitLocalArtifactProvenance(prepared);
+            }
+            else {
+                if (input.overrideTicket)
+                    throw new Error('TASK_WORKFLOW_OVERRIDE_UNSUPPORTED');
+                const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot });
+                if (input.dryRun || prepared.result.status === 'planned')
+                    return executionResult(prepared.result);
+                if (prepared.result.status === 'failed')
+                    return executionResult(commitReviewSummaryProvenance(prepared, manifest.repoRoot));
+                publicationStarted = true;
+                await writeTaskArtifact(taskDir, {
+                    artifact: input.artifact,
+                    bytes: Buffer.from(prepared.content, 'utf8'),
+                    expectedSha256: artifact.sha256
+                });
+                result = commitReviewSummaryProvenance(prepared, manifest.repoRoot);
+            }
+            if (result.status !== 'failed')
+                appendDiagnosticAudit(manifest, 'task-workflow-artifact-finalized', {
+                    requestId: request.id, sandboxTaskId: request.taskId, workflowOperation: request.operation,
+                    artifact: input.artifact, sha256: result.artifactSha256, semanticDigest: result.semanticDigest
+                });
+            return executionResult({ ...result, changed: true });
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = error?.code ?? /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_WORKFLOW_REQUEST_INVALID';
+        return executionResult({ status: 'failed', changed: publicationStarted ? null : false, error: { code, message } });
+    }
+}
+//# sourceMappingURL=workflow-executor.js.map

package/dist/lib/sandbox/index.js

@@ -19,8 +19,8 @@ Commands:
   rm <branch | TASK-id> | --unbound | --purge
                                Remove one sandbox; use a full TASK-id for task-bound
                                cleanup and a branch for branch-only cleanup. --unbound
-                               removes completed task-bound and branch-only sandboxes;
-                               active, blocked, and archive tasks are protected.
+                               removes completed task-bound and branch-only sandboxes
+                               plus verified auxiliary state; active, blocked, and archive tasks are protected.
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure

package/dist/lib/sandbox/recovery.js

@@ -18,7 +18,9 @@ import { declaredTmpfsSeedEntries, resolveTools, toolConfigDirCandidates } from
 import { fetchSandboxRows, selectSandboxContainer, startSandboxContainer } from './commands/list-running.js';
 import { getProcessIdentityState, getProcessStartTime, removePidFileIfMatches } from '../server/process-state.js';
 import { acquireSandboxControlBrokerStartup, garbageCollectSandboxControlRoot, isSandboxControlRootQuiescing, readSandboxControlManifest } from './control/lifecycle.js';
-import { appendSandboxControlAudit, readSandboxControlStatus } from './control/state.js';
+import { readSandboxControlStatus } from './control/state.js';
+import { validateSandboxControlIdentity } from './control/identity-sentinel.js';
+import { appendDiagnosticAudit as appendControlDiagnosticAudit } from './control/audit.js';
 import { inspectSandboxControlContainer } from './control/container-identity.js';
 import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from './control/protocol.js';
 export function worktreeProbeForEngine(engine, probe = runProbe) {
@@ -61,6 +63,17 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
     const internalCli = path.resolve(directory, '..', '..', 'bin', `internal-cli${extension}`);
     const manifest = readSandboxControlManifest(manifestPath);
     const root = path.dirname(manifestPath);
+    const identity = validateSandboxControlIdentity({
+        publicStatusDir: manifest.publicStatusDir,
+        root,
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+    if (identity.state !== 'valid') {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${identity.state.replaceAll('-', '_').toUpperCase()}`);
+    }
     if (isSandboxControlRootQuiescing(root))
         throw new Error('SANDBOX_CONTROL_QUIESCING');
     const brokerPath = path.join(root, 'broker.json');
@@ -130,8 +143,8 @@ export async function startSandboxControlBroker(repoRoot, manifestPath) {
             }
         }
         if (replacedBrokerRecord) {
-            appendSandboxControlAudit(manifest, 'broker-observed-crash');
-            appendSandboxControlAudit(manifest, 'broker-restart');
+            appendControlDiagnosticAudit(manifest, 'broker-observed-crash');
+            appendControlDiagnosticAudit(manifest, 'broker-restart');
         }
         child = spawn(process.execPath, nodeEntryArgs(internalCli, ['sandbox-control', 'serve', '--manifest', manifestPath]), { cwd: repoRoot, detached: true, stdio: 'ignore' });
     }
@@ -168,6 +181,17 @@ async function ensureSandboxControlBroker(params) {
     if (!fs.existsSync(control.manifestPath))
         return;
     const validatedManifest = readSandboxControlManifest(control.manifestPath);
+    const identity = validateSandboxControlIdentity({
+        publicStatusDir: validatedManifest.publicStatusDir,
+        root: control.root,
+        mode: validatedManifest.mode,
+        taskId: validatedManifest.taskId,
+        generation: validatedManifest.generation,
+        controlRootId: validatedManifest.controlRootId
+    });
+    if (identity.state !== 'valid') {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${identity.state.replaceAll('-', '_').toUpperCase()}`);
+    }
     const containerObservation = await inspectSandboxControlContainer(validatedManifest);
     if (containerObservation.state === 'unknown') {
         throw new Error(`SANDBOX_CONTROL_CONTAINER_UNKNOWN: ${containerObservation.reason}`);
@@ -514,7 +538,7 @@ function expectedMounts(params) {
             ? {}
             : {
                 runtimeDir: control.runtimeDir,
-                taskSources: taskSources.mountPaths,
+                taskSources: taskSources.accessiblePaths,
                 taskId: taskId
             })
     }).map((mount) => ({