@fitlab-ai/agent-infra 0.9.15 → 0.11.0

package/dist/lib/sandbox/control/server.js

@@ -14,6 +14,7 @@ import { requestAuditFields, resultAuditFields, appendCriticalAudit, appendDiagn
 import { parseTaskControlOperation } from '../../task/control-authority.js';
 import { parseControlOutput, classifySandboxControlRecovery, findSandboxControlRecoveryOperation, operationRecoveryBinding, SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES } from '../../task/control-recovery.js';
 import { readRun } from '../../task/orchestration.js';
+import { readLifecycleRecoveryDomainEvidence } from '../../task/lifecycle-recovery.js';
 import { captureRepositorySnapshot } from '../../task/workspace-snapshot.js';
 import { parseTypedTaskFrontmatter } from '../../task/frontmatter.js';
 import { readLifecycleJournalEvidence } from '../../task/lifecycle.js';
@@ -256,7 +257,7 @@ function outputMatchesEvidence(output, bytes, sha256) {
     return Buffer.byteLength(output, 'utf8') === bytes
         && createHash('sha256').update(output, 'utf8').digest('hex') === sha256;
 }
-function genericRecoveryResponse(request, exitCode, payload, cause = 'recovery') {
+export function genericRecoveryResponse(request, exitCode, payload, cause = 'recovery', warning = null) {
     const outputUnavailable = request.family === 'task-create' && !payload;
     return {
         version: 2,
@@ -264,9 +265,11 @@ function genericRecoveryResponse(request, exitCode, payload, cause = 'recovery')
         phase: 'completed',
         exitCode,
         stdout: outputUnavailable ? `${JSON.stringify(taskCreateOutputUnavailableResult(request.id))}\n` : '',
-        stderr: payload ? '' : cause === 'publish'
-            ? 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n'
-            : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
+        stderr: payload ? '' : warning
+            ? `${warning.code}: ${warning.message}\nAction: ${warning.action}\n`
+            : cause === 'publish'
+                ? 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n'
+                : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
         error: null,
         outputState: payload ? 'available' : 'unavailable',
         payload: payload ? payloadReference(payload) : null
@@ -365,6 +368,23 @@ function readRecoveryDomain(manifest, manifestPath, request, operation, terminal
         return { domain: null };
     }
     if (operation.family === 'task-lifecycle') {
+        if (operation.intent === 'recover-started') {
+            try {
+                if (!('args' in request))
+                    return { domain: null };
+                const parsed = parseTaskControlOperation('task-lifecycle', request.args);
+                if (parsed.family !== 'task-lifecycle' || parsed.request.intent !== 'recover-started') {
+                    return { domain: null };
+                }
+                return {
+                    domain: readLifecycleRecoveryDomainEvidence(manifest.repoRoot, parsed.request, terminalResult),
+                    journal: readLifecycleJournalEvidence(manifest.repoRoot, taskRef)
+                };
+            }
+            catch {
+                return { domain: null };
+            }
+        }
         if (!taskRef || !terminalResult.targetState)
             return { domain: null };
         const journal = readLifecycleJournalEvidence(manifest.repoRoot, taskRef);
@@ -441,7 +461,7 @@ function readCommittedCriticalPhases(manifest, requestId) {
         }
     });
 }
-function recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult) {
+export function recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult) {
     const operationName = recoveryOperationKey(request, terminalResult, payload?.stdout);
     const operation = operationName ? findSandboxControlRecoveryOperation(request.family, operationName) : null;
     if (!operation)
@@ -503,7 +523,7 @@ function recoveryResponse(manifest, manifestPath, request, evidence, payload, te
             return null;
         return finalization.response ?? null;
     }
-    return genericRecoveryResponse(request, evidence.exitCode, payload);
+    return genericRecoveryResponse(request, evidence.exitCode, payload, 'recovery', terminalResult.warning ?? null);
 }
 function terminalMatchesEvidence(manifest, manifestPath, request, response, evidence, payload, payloadInvalid, terminalResult) {
     if (request.family === 'task-finalization' && evidence.exitCode === 0) {
@@ -538,7 +558,7 @@ function terminalMatchesEvidence(manifest, manifestPath, request, response, evid
     if (response.outputState === 'unavailable') {
         const causes = ['recovery', 'publish'];
         const valid = causes.some((cause) => JSON.stringify(response)
-            === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause)));
+            === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause, terminalResult?.warning ?? null)));
         return { valid, payloadReferenced: false };
     }
     return {
@@ -550,7 +570,7 @@ function terminalMatchesEvidence(manifest, manifestPath, request, response, evid
 }
 function publishExecutionResult(manifest, request, result, broker, brokerOwns) {
     const normalized = sanitizeSandboxControlResult(manifest, result);
-    writeSandboxControlTerminalResult(manifest, {
+    const terminalResult = writeSandboxControlTerminalResult(manifest, {
         id: request.id,
         family: request.family,
         operation: operationKey(request, normalized.stdout)
@@ -590,7 +610,7 @@ function publishExecutionResult(manifest, request, result, broker, brokerOwns) {
             catch {
                 payload = null;
             }
-            terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
+            terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish', terminalResult.warning ?? null);
         }
     }
     if (!brokerOwns())

package/dist/lib/sandbox/control/state.js

@@ -1,5 +1,6 @@
 import { isCompletionEvidence } from '../../task/orchestration.js';
 import { parseControlOutput } from '../../task/control-recovery.js';
+import { isRecoveryWarning } from '../../task/recovery-warning.js';
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -83,6 +84,7 @@ export function createSandboxControlTerminalResult(manifest, request, output) {
         ? nested.run : null;
     const rawCompletion = nested.completionEvidence ?? run?.completionEvidence;
     const operation = request.operation ?? (typeof nested.intent === 'string' ? nested.intent : null) ?? '';
+    const warning = isRecoveryWarning(nested.warning) ? nested.warning : null;
     return {
         version: 1,
         requestId: request.id,
@@ -92,7 +94,8 @@ export function createSandboxControlTerminalResult(manifest, request, output) {
         targetState: typeof nested.targetState === 'string' ? nested.targetState : null,
         status: typeof nested.status === 'string' ? nested.status : 'completed',
         changed: typeof nested.changed === 'boolean' ? nested.changed : null,
-        completionEvidence: isCompletionEvidence(rawCompletion) ? rawCompletion : null
+        completionEvidence: isCompletionEvidence(rawCompletion) ? rawCompletion : null,
+        ...(warning ? { warning } : {})
     };
 }
 export function writeSandboxControlTerminalResult(manifest, request, output) {
@@ -123,6 +126,9 @@ export function readSandboxControlTerminalResult(filePath) {
     if (value.completionEvidence !== null && !isCompletionEvidence(value.completionEvidence)) {
         throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
     }
+    if (value.warning !== undefined && value.warning !== null && !isRecoveryWarning(value.warning)) {
+        throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
+    }
     if (value.changed === undefined) {
         throw new Error('SANDBOX_CONTROL_TERMINAL_RESULT_INVALID');
     }

package/dist/lib/sandbox/control/task-workflow.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { readStableFile, SecureFileError, writeAtomicFile } from '../../host-control/secure-fs.js';
+import { readStableFile, SecureFileError, writeAtomicFile } from '../../task/secure-fs.js';
 import { TASK_WORKFLOW_COMMANDS, TASK_WORKFLOW_OPERATIONS } from '../../task/workflow-command.js';
 export function validateTaskWorkflowRequest(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))

package/dist/lib/sandbox/control/workflow-executor.js

@@ -1,22 +1,46 @@
 import { TASK_WORKFLOW_COMMANDS } from '../../task/workflow-command.js';
 import { parseArtifactCommand, executeArtifactCommand } from '../../task/artifact-command.js';
 import { parseReviewCommand } from '../../task/review-command.js';
-import { prepareLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.js';
+import { prepareLocalArtifact, preflightLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.js';
 import { prepareReviewSummaryCandidate, commitReviewSummaryProvenance } from '../../task/review-finalization.js';
+import { readArtifactRecoveryIntent } from '../../task/artifact-repair-intent.js';
 import { withTaskExecutionLock } from '../../task/task-execution-lock.js';
-import { dispatchHostControlCommand } from '../../host-control/command.js';
+import { dispatchWorkflowCommand } from '../../task/workflow-dispatch.js';
 import { assertSandboxTaskSource } from '../workspace-view.js';
 import { appendDiagnosticAudit } from './audit.js';
-import { readTaskArtifact, writeTaskArtifact } from './task-workflow.js';
+import { readTaskArtifact } from './task-workflow.js';
 import { applyTaskEvent } from '../../task/events.js';
 import { parseTaskEventRequest } from '../../internal/task-event.js';
 function executionResult(result) {
     return { exitCode: result.status === 'failed' || result.status === 'refused' ? 1 : 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
 }
 /** The broker already authorized this host executor; domain operations own validation. */
-export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAttestation = null) {
-    let publicationStarted = false;
+export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAttestation = null, options = {}) {
+    let publicationCommitted = false;
+    let recoveryObservation = null;
+    const observeRecoveryPublication = () => {
+        if (!recoveryObservation || recoveryObservation.wasPassed)
+            return;
+        const intent = readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, recoveryObservation.family, recoveryObservation.artifact);
+        publicationCommitted ||= intent?.state === 'preflight-ready'
+            || intent?.state === 'preflight-commit-started'
+            || intent?.state === 'preflight-passed'
+            || intent?.state === 'passed'
+            || intent?.state === 'commit-started';
+    };
+    let faultTriggered = false;
+    const fault = (window) => {
+        if (faultTriggered || options.faultWindow !== window)
+            return;
+        faultTriggered = true;
+        throw new Error(`TASK_WORKFLOW_FAULT_INJECTED:${window}`);
+    };
+    const response = (result) => {
+        fault('before-result-return');
+        return executionResult(result);
+    };
     try {
+        fault('before-call');
         const taskDir = assertSandboxTaskSource(manifest.repoRoot, request.taskId);
         const [command] = TASK_WORKFLOW_COMMANDS[request.operation];
         if (request.operation === 'event') {
@@ -24,76 +48,104 @@ export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAt
             const boundEventRequest = lifecycleRecoveryAttestation && eventRequest.requestId === undefined
                 ? { ...eventRequest, requestId: lifecycleRecoveryAttestation.lifecycleRequestId }
                 : eventRequest;
+            fault('before-domain-write');
             const result = applyTaskEvent(boundEventRequest, {
                 repoRoot: manifest.repoRoot,
                 lifecycleRecoveryAttestation,
                 deferLifecycleRecoveryConsumption: true
             });
-            return executionResult(result);
+            publicationCommitted = result.changed;
+            fault('after-atomic-rename');
+            return response(result);
         }
         if (command !== 'task-artifact' && command !== 'task-review') {
-            publicationStarted = true;
-            // Inherit this executor's process group so its existing recovery owns the worker too.
-            const result = await dispatchHostControlCommand({
-                operation: command, payload: { workingDirectory: manifest.repoRoot, args: request.args }
-            });
-            return result;
+            // The broker owns this short-lived executor; no global service or worker
+            // credential participates in the command's authority or recovery path.
+            fault('before-domain-write');
+            const result = dispatchWorkflowCommand(manifest.repoRoot, request.operation, request.args);
+            publicationCommitted = result.changed === true;
+            fault('after-atomic-rename');
+            return response(result);
         }
         const input = command === 'task-artifact' ? parseArtifactCommand(request.args) : parseReviewCommand(request.args);
         if (command === 'task-artifact' && 'operation' in input && input.operation === 'inspect') {
-            return executionResult(executeArtifactCommand(input, { repoRoot: manifest.repoRoot }));
+            fault('before-domain-write');
+            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot });
+            publicationCommitted = result.changed === true;
+            fault('after-atomic-rename');
+            return response(result);
         }
-        if ('operation' in input && (input.operation === 'init' || input.operation === 'repair')) {
-            return executionResult(executeArtifactCommand(input, { repoRoot: manifest.repoRoot, artifactDir: taskDir }));
+        if ('operation' in input && input.operation === 'init') {
+            fault('before-domain-write');
+            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot, artifactDir: taskDir });
+            publicationCommitted = result.changed === true;
+            fault('after-atomic-rename');
+            return response(result);
         }
         return await withTaskExecutionLock(manifest.repoRoot, request.taskId, `sandbox-control.${request.operation}`, async () => {
             const artifact = await readTaskArtifact(taskDir, { artifact: input.artifact });
             const content = artifact.bytes.toString('utf8');
+            fault('before-domain-write');
             let result;
             if ('operation' in input) {
                 const { family } = input;
                 if (family !== 'analysis' && family !== 'plan' && family !== 'code')
                     throw new Error('ARTIFACT_IDENTITY_INVALID');
-                const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot };
+                const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot, recoveryId: input.recoveryId, lockAlreadyHeld: true };
+                if (input.operation === 'preflight') {
+                    // Preflight only seals a verified generation. It must not publish the
+                    // formal artifact, set publicationStarted, or append finalizer audit.
+                    const result = preflightLocalArtifact(local);
+                    recoveryObservation = { family, artifact: input.artifact, wasPassed: false };
+                    observeRecoveryPublication();
+                    return response(result);
+                }
+                recoveryObservation = {
+                    family,
+                    artifact: input.artifact,
+                    wasPassed: readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, family, input.artifact)?.state === 'passed'
+                };
                 const prepared = prepareLocalArtifact(local, content, lifecycleRecoveryAttestation ?? undefined);
+                observeRecoveryPublication();
+                const commitOptions = { afterPublish: () => fault('after-atomic-rename') };
                 if (prepared.result.status === 'failed')
-                    return executionResult(commitLocalArtifactProvenance(prepared));
-                publicationStarted = true;
-                await writeTaskArtifact(taskDir, {
-                    artifact: artifact.artifact,
-                    bytes: artifact.bytes,
-                    expectedSha256: artifact.sha256
-                });
-                result = commitLocalArtifactProvenance(prepared);
+                    return executionResult(commitLocalArtifactProvenance(prepared, commitOptions));
+                result = commitLocalArtifactProvenance(prepared, commitOptions);
             }
             else {
                 if (input.overrideTicket)
                     throw new Error('TASK_WORKFLOW_OVERRIDE_UNSUPPORTED');
-                const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot });
+                const family = `review-${input.stage}`;
+                recoveryObservation = {
+                    family,
+                    artifact: input.artifact,
+                    wasPassed: readArtifactRecoveryIntent(manifest.repoRoot, request.taskId, family, input.artifact)?.state === 'passed'
+                };
+                const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true, startRecovery: true });
+                observeRecoveryPublication();
                 if (input.dryRun || prepared.result.status === 'planned')
                     return executionResult(prepared.result);
+                const commitOptions = { afterPublish: () => fault('after-atomic-rename') };
                 if (prepared.result.status === 'failed')
-                    return executionResult(commitReviewSummaryProvenance(prepared, manifest.repoRoot));
-                publicationStarted = true;
-                await writeTaskArtifact(taskDir, {
-                    artifact: input.artifact,
-                    bytes: Buffer.from(prepared.content, 'utf8'),
-                    expectedSha256: artifact.sha256
-                });
-                result = commitReviewSummaryProvenance(prepared, manifest.repoRoot);
+                    return executionResult(commitReviewSummaryProvenance(prepared, manifest.repoRoot, commitOptions));
+                result = commitReviewSummaryProvenance(prepared, manifest.repoRoot, commitOptions);
             }
+            observeRecoveryPublication();
+            publicationCommitted ||= result.changed === true;
             if (result.status !== 'failed')
                 appendDiagnosticAudit(manifest, 'task-workflow-artifact-finalized', {
                     requestId: request.id, sandboxTaskId: request.taskId, workflowOperation: request.operation,
                     artifact: input.artifact, sha256: result.artifactSha256, semanticDigest: result.semanticDigest
                 });
-            return executionResult({ ...result, changed: true });
+            fault('after-atomic-rename');
+            return response(result);
         });
     }
     catch (error) {
+        observeRecoveryPublication();
         const message = error instanceof Error ? error.message : String(error);
         const code = error?.code ?? /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_WORKFLOW_REQUEST_INVALID';
-        return executionResult({ status: 'failed', changed: publicationStarted ? null : false, error: { code, message } });
+        return executionResult({ status: 'failed', changed: publicationCommitted ? null : false, error: { code, message } });
     }
 }
 //# sourceMappingURL=workflow-executor.js.map

package/dist/lib/sandbox/index.js

@@ -19,8 +19,7 @@ Commands:
   rm <branch | TASK-id> | --unbound | --purge
                                Remove one sandbox; use a full TASK-id for task-bound
                                cleanup and a branch for branch-only cleanup. --unbound
-                               removes completed task-bound and branch-only sandboxes
-                               plus verified auxiliary state; active, blocked, and archive tasks are protected.
+                               removes discovered task-bound and branch-only sandboxes.
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure