@fitlab-ai/agent-infra 0.9.2 → 0.9.4

package/dist/lib/process-data/store.js

@@ -0,0 +1,282 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+function sha256(bytes) {
+    return crypto.createHash('sha256').update(bytes).digest('hex');
+}
+function compareCodePoints(left, right) {
+    const a = Array.from(left, (char) => char.codePointAt(0));
+    const b = Array.from(right, (char) => char.codePointAt(0));
+    for (let index = 0; index < Math.min(a.length, b.length); index += 1) {
+        if (a[index] !== b[index])
+            return a[index] - b[index];
+    }
+    return a.length - b.length;
+}
+function canonicalString(value, seen) {
+    if (value === null || typeof value === 'boolean' || typeof value === 'string') {
+        return JSON.stringify(value);
+    }
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new Error('canonical JSON accepts only finite JSON values');
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        if (seen.has(value))
+            throw new Error('canonical JSON accepts only acyclic JSON values');
+        seen.add(value);
+        const output = `[${value.map((entry) => canonicalString(entry, seen)).join(',')}]`;
+        seen.delete(value);
+        return output;
+    }
+    if (typeof value === 'object') {
+        if (seen.has(value))
+            throw new Error('canonical JSON accepts only acyclic JSON values');
+        seen.add(value);
+        const record = value;
+        const fields = Object.keys(record)
+            .sort(compareCodePoints)
+            .map((key) => `${JSON.stringify(key)}:${canonicalString(record[key], seen)}`);
+        seen.delete(value);
+        return `{${fields.join(',')}}`;
+    }
+    throw new Error('canonical JSON accepts only JSON values');
+}
+function canonicalJsonBytes(value) {
+    return Buffer.from(canonicalString(value, new Set()), 'utf8');
+}
+function ensurePrivateDirectory(directory) {
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    if (process.platform !== 'win32')
+        fs.chmodSync(directory, 0o700);
+}
+function writeExclusive(filePath, bytes) {
+    ensurePrivateDirectory(path.dirname(filePath));
+    try {
+        const fd = fs.openSync(filePath, 'wx', 0o600);
+        try {
+            fs.writeFileSync(fd, bytes);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        return true;
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        return false;
+    }
+}
+function createObjectStore(root) {
+    const objectRoot = path.join(root, 'objects', 'sha256');
+    ensurePrivateDirectory(objectRoot);
+    return {
+        pathFor(digest) {
+            if (!/^[a-f0-9]{64}$/.test(digest))
+                throw new Error(`invalid SHA-256: ${digest}`);
+            return path.join(objectRoot, digest.slice(0, 2), digest);
+        },
+        put(bytes) {
+            const digest = sha256(bytes);
+            const objectPath = path.join(objectRoot, digest.slice(0, 2), digest);
+            const created = writeExclusive(objectPath, bytes);
+            const stored = fs.readFileSync(objectPath);
+            if (sha256(stored) !== digest)
+                throw new Error(`CAS hash mismatch for ${digest}`);
+            return { sha256: digest, path: objectPath, created };
+        }
+    };
+}
+function dispositionCounts(objects) {
+    const counts = { included: 0, 'excluded-sensitive': 0, unavailable: 0 };
+    for (const object of objects)
+        counts[object.disposition?.state ?? 'included'] += 1;
+    return counts;
+}
+function jsonLine(value) {
+    return `${canonicalJsonBytes(value).toString('utf8')}\n`;
+}
+function writePrivateFile(filePath, content) {
+    fs.writeFileSync(filePath, content, { mode: 0o600, flag: 'wx' });
+    if (process.platform !== 'win32')
+        fs.chmodSync(filePath, 0o600);
+}
+function manifestDigest(manifest) {
+    return sha256(canonicalJsonBytes(manifest));
+}
+function publishSnapshot(root, input) {
+    ensurePrivateDirectory(root);
+    ensurePrivateDirectory(path.join(root, 'repairs'));
+    const date = new Date(input.observedTo);
+    if (!Number.isFinite(date.getTime()))
+        throw new Error('observedTo must be an ISO timestamp');
+    const identity = {
+        scope: input.scope,
+        repository: input.repository,
+        observedFrom: input.observedFrom,
+        observedTo: input.observedTo,
+        objects: input.objects,
+        endpoints: input.endpoints,
+        excerptsEnabled: input.excerptsEnabled,
+        dispositionCounts: dispositionCounts(input.objects),
+        recordCount: input.records.length,
+        findingCount: input.quality.length,
+        repairCount: input.repairs.length
+    };
+    const identityDigest = sha256(canonicalJsonBytes(identity));
+    const stamp = input.observedTo.replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z');
+    const snapshotId = `${stamp}-${identityDigest.slice(0, 12)}`;
+    const partialManifest = {
+        schema: 'raw-manifest/v1',
+        snapshotId,
+        ...identity,
+        privacyPolicyVersion: 'process-data-privacy/v1'
+    };
+    const manifest = { ...partialManifest, manifestSha256: manifestDigest(partialManifest) };
+    const stagingRoot = path.join(root, '.staging');
+    ensurePrivateDirectory(stagingRoot);
+    const staging = fs.mkdtempSync(path.join(stagingRoot, `${snapshotId}-`));
+    if (process.platform !== 'win32')
+        fs.chmodSync(staging, 0o700);
+    try {
+        writePrivateFile(path.join(staging, 'manifest.json'), jsonLine(manifest));
+        writePrivateFile(path.join(staging, 'normalized.jsonl'), input.records.map((record) => jsonLine({ schema: 'normalized/v1', ...record })).join(''));
+        writePrivateFile(path.join(staging, 'quality.json'), jsonLine({ schema: 'quality/v1', findings: input.quality }));
+        writePrivateFile(path.join(staging, 'repair-manifest.jsonl'), input.repairs.map((repair) => jsonLine({ schema: 'repair/v1', ...repair })).join(''));
+        const destination = path.join(root, 'snapshots', String(date.getUTCFullYear()), String(date.getUTCMonth() + 1).padStart(2, '0'), String(date.getUTCDate()).padStart(2, '0'), snapshotId);
+        ensurePrivateDirectory(path.dirname(destination));
+        if (fs.existsSync(destination)) {
+            const existing = fs.readFileSync(path.join(destination, 'manifest.json'), 'utf8');
+            if (existing !== jsonLine(manifest))
+                throw new Error(`snapshot collision: ${snapshotId}`);
+            fs.rmSync(staging, { recursive: true, force: true });
+            return { snapshotId, path: destination, created: false };
+        }
+        fs.renameSync(staging, destination);
+        return { snapshotId, path: destination, created: true };
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        throw error;
+    }
+}
+function findSnapshot(root, snapshotId) {
+    const snapshotRoot = path.join(root, 'snapshots');
+    if (!fs.existsSync(snapshotRoot))
+        return null;
+    const stack = [snapshotRoot];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+            if (!entry.isDirectory())
+                continue;
+            const candidate = path.join(current, entry.name);
+            if (entry.name === snapshotId && fs.existsSync(path.join(candidate, 'manifest.json')))
+                return candidate;
+            stack.push(candidate);
+        }
+    }
+    return null;
+}
+function verifySnapshot(root, snapshotId) {
+    const snapshotPath = findSnapshot(root, snapshotId);
+    if (!snapshotPath)
+        return { ok: false, snapshotId, snapshotPath: null, errors: ['snapshot not found'] };
+    const errors = [];
+    const checkMode = (target, expected, label) => {
+        if (process.platform === 'win32' || !fs.existsSync(target))
+            return;
+        const actual = fs.statSync(target).mode & 0o777;
+        if (actual !== expected)
+            errors.push(`${label} permission mismatch: expected ${expected.toString(8)}, got ${actual.toString(8)}`);
+    };
+    checkMode(snapshotPath, 0o700, 'snapshot directory');
+    for (const file of ['manifest.json', 'normalized.jsonl', 'quality.json', 'repair-manifest.jsonl']) {
+        checkMode(path.join(snapshotPath, file), 0o600, file);
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'manifest.json'), 'utf8'));
+    }
+    catch {
+        return { ok: false, snapshotId, snapshotPath, errors: ['manifest is invalid JSON'] };
+    }
+    if (manifest.schema !== 'raw-manifest/v1')
+        errors.push(`unsupported manifest schema: ${manifest.schema}`);
+    if (manifest.snapshotId !== snapshotId)
+        errors.push('snapshot identity mismatch');
+    if (typeof manifest.excerptsEnabled !== 'boolean')
+        errors.push('manifest excerpts opt-in is invalid');
+    if (!manifest.dispositionCounts || canonicalJsonBytes(manifest.dispositionCounts).toString('utf8') !== canonicalJsonBytes(dispositionCounts(manifest.objects)).toString('utf8')) {
+        errors.push('manifest disposition counts mismatch');
+    }
+    const { manifestSha256, ...partial } = manifest;
+    if (manifestDigest(partial) !== manifestSha256)
+        errors.push('manifest hash mismatch');
+    const store = createObjectStore(root);
+    try {
+        const lines = fs.readFileSync(path.join(snapshotPath, 'normalized.jsonl'), 'utf8').split('\n').filter(Boolean);
+        const ids = new Set();
+        for (const line of lines) {
+            const record = JSON.parse(line);
+            if (record.schema !== 'normalized/v1' || typeof record.recordId !== 'string') {
+                errors.push('normalized record schema is invalid');
+                continue;
+            }
+            if (ids.has(record.recordId))
+                errors.push(`duplicate normalized record: ${record.recordId}`);
+            ids.add(record.recordId);
+        }
+        if (lines.length !== manifest.recordCount)
+            errors.push('normalized record count mismatch');
+        const quality = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'quality.json'), 'utf8'));
+        if (quality.schema !== 'quality/v1' || !Array.isArray(quality.findings))
+            errors.push('quality schema is invalid');
+        else if (quality.findings.length !== manifest.findingCount)
+            errors.push('quality finding count mismatch');
+        const repairLines = fs.readFileSync(path.join(snapshotPath, 'repair-manifest.jsonl'), 'utf8').split('\n').filter(Boolean);
+        for (const line of repairLines) {
+            const repair = JSON.parse(line);
+            if (repair.schema !== 'repair/v1' || typeof repair.repairId !== 'string')
+                errors.push('repair manifest schema is invalid');
+        }
+        if (repairLines.length !== manifest.repairCount)
+            errors.push('repair manifest count mismatch');
+    }
+    catch {
+        errors.push('snapshot derived files are missing or invalid');
+    }
+    for (const object of manifest.objects) {
+        if (object.disposition?.state && object.disposition.state !== 'included')
+            continue;
+        try {
+            const objectPath = store.pathFor(object.sha256);
+            checkMode(path.dirname(objectPath), 0o700, `object directory ${object.sha256.slice(0, 2)}`);
+            checkMode(objectPath, 0o600, `object ${object.sourceIdentity}`);
+            const bytes = fs.readFileSync(objectPath);
+            if (sha256(bytes) !== object.sha256)
+                errors.push(`object hash mismatch: ${object.sourceIdentity}`);
+            if (bytes.length !== object.bytes)
+                errors.push(`object byte count mismatch: ${object.sourceIdentity}`);
+        }
+        catch {
+            errors.push(`object missing: ${object.sourceIdentity}`);
+        }
+    }
+    for (const page of manifest.endpoints.flatMap((endpoint) => endpoint.pages)) {
+        try {
+            if (sha256(fs.readFileSync(store.pathFor(page.canonicalSha256))) !== page.canonicalSha256) {
+                errors.push(`page hash mismatch: ${page.index}`);
+            }
+        }
+        catch {
+            errors.push(`page object missing: ${page.canonicalSha256}`);
+        }
+    }
+    return { ok: errors.length === 0, snapshotId, snapshotPath, errors, manifest };
+}
+export { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshot, sha256, verifySnapshot };
+//# sourceMappingURL=store.js.map

package/dist/lib/process-data/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/lib/run/index.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { loadServerConfig } from '../server/config.js';
-import { resolveTaskBranch } from '../sandbox/task-resolver.js';
+import { resolveSandboxTarget } from '../sandbox/workspace-identity.js';
 import { createRunId, runInSandbox } from '../sandbox/capture.js';
 import { loadShortIdByTaskId, normalizeShortIdInput } from '../task/short-id.js';
 import { buildTuiCommand, renderPrompt, selectTui } from './tui.js';
@@ -101,7 +101,6 @@ function resolveActiveTaskIdentity(taskRef, repoRoot) {
     let resolvedTaskRef = taskRef;
     if (TASK_ID_RE.test(taskRef)) {
         taskId = taskRef;
-        resolvedTaskRef = loadShortIdByTaskId(repoRoot).get(taskId) ?? taskRef;
     }
     else {
         const normalized = normalizeShortIdInput(taskRef, { shortIdLength: readShortIdLength(repoRoot) });
@@ -165,7 +164,8 @@ export async function runSkill(args, options = {}) {
         return result.exitCode ?? (result.signal ? 1 : 0);
     }
     const repoRoot = options.repoRoot ?? config?.repoRoot ?? process.cwd();
-    const branch = resolveTaskBranch(parsed.taskRef, repoRoot);
+    const target = resolveSandboxTarget(parsed.taskRef, repoRoot);
+    const branch = target.branch;
     const identity = resolveActiveTaskIdentity(parsed.taskRef, repoRoot);
     const runId = identity ? createRunId() : undefined;
     const writeStdout = options.writeStdout ?? ((chunk) => process.stdout.write(chunk));
@@ -175,6 +175,7 @@ export async function runSkill(args, options = {}) {
     const result = await runSandbox({
         taskRef: parsed.taskRef,
         branch,
+        workspace: target.workspace,
         command,
         runId,
         recreate: parsed.recreate

package/dist/lib/run/tui.js

@@ -1,6 +1,12 @@
 import { renderAgentClientInvocation } from '../agent-clients/invocation.js';
 import { getAgentClientAdapter } from '../agent-clients/registry.js';
-const TUI_NAMES = new Set(['claude', 'codex', 'gemini', 'opencode']);
+const TUI_NAMES = new Set(['claude', 'codex', 'antigravity', 'opencode']);
+const TUI_AGENT_CLIENT_IDS = Object.freeze({
+    claude: 'claude-code',
+    codex: 'codex',
+    antigravity: 'antigravity-cli',
+    opencode: 'opencode'
+});
 function isTuiName(value) {
     return typeof value === 'string' && TUI_NAMES.has(value);
 }
@@ -18,22 +24,13 @@ export function selectTui(skill, options) {
     return 'codex';
 }
 export function renderPrompt(params) {
-    const suffix = [params.skill, ...params.args].join(' ').trim();
-    if (params.tui === 'codex') {
-        return renderAgentClientInvocation(getAgentClientAdapter('codex').invocation, {
-            skillName: params.skill,
-            args: params.args
-        });
-    }
-    if (params.tui === 'gemini')
-        return `/agent-infra:${suffix}`;
-    return `/${suffix}`;
+    return renderAgentClientInvocation(getAgentClientAdapter(TUI_AGENT_CLIENT_IDS[params.tui]).invocation, { skillName: params.skill, args: params.args });
 }
 export function buildTuiCommand(tui, prompt) {
     if (tui === 'claude')
         return ['claude', ['--dangerously-skip-permissions', '--print', prompt]];
-    if (tui === 'gemini')
-        return ['gemini', ['--approval-mode', 'yolo', '--prompt', prompt]];
+    if (tui === 'antigravity')
+        return ['agy', ['--dangerously-skip-permissions', '--print', prompt]];
     if (tui === 'opencode')
         return ['opencode', ['run', '--dangerously-skip-permissions', prompt]];
     return ['codex', ['exec', '--dangerously-bypass-approvals-and-sandbox', prompt]];

package/dist/lib/sandbox/agent-client-reconciler.js

@@ -62,6 +62,27 @@ function assertUniqueTools(tools) {
         seen.add(tool.id);
     }
 }
+function unique(values) {
+    return Object.freeze([...new Set(values)]);
+}
+function sandboxImageContribution(adapters, tools) {
+    const homePrefix = '/home/devuser/';
+    const derivedExclusions = tools.map((tool) => {
+        if (!tool.containerMount.startsWith(homePrefix)) {
+            throw new Error(`Agent Client '${tool.id}' container mount must be below ${homePrefix.slice(0, -1)}`);
+        }
+        return tool.containerMount.slice(homePrefix.length);
+    });
+    return Object.freeze({
+        dockerfileFragments: unique(adapters.flatMap((adapter) => adapter.sandbox.image?.dockerfileFragment
+            ? [adapter.sandbox.image.dockerfileFragment]
+            : [])),
+        dotfilesExclusions: unique([
+            ...derivedExclusions,
+            ...adapters.flatMap((adapter) => adapter.sandbox.image?.dotfilesExclusions ?? [])
+        ])
+    });
+}
 function hooksByPhase(adapters) {
     const phases = [
         'prepare',
@@ -108,6 +129,7 @@ function createSandboxCapabilityPlan(config) {
     }
     const tools = Object.freeze([...nonClientTools, ...selectedTools, ...selectedCustomTools]);
     assertUniqueTools(tools);
+    const image = sandboxImageContribution(selectedAgentClients, selectedTools);
     const phaseHooks = hooksByPhase(selectedAgentClients);
     const hookProjection = selectedAgentClients.flatMap((adapter) => adapter.sandbox.hooks.map((hook) => ({
         adapterId: adapter.id,
@@ -134,7 +156,8 @@ function createSandboxCapabilityPlan(config) {
         tools: Object.freeze(tools.map(runtimeToolProjection)),
         selectedAgentClients: Object.freeze(selectedAgentClients.map((adapter) => adapter.id)),
         hooks: Object.freeze(hookProjection),
-        recoveryChecks: recoveryCheckProjection
+        recoveryChecks: recoveryCheckProjection,
+        image
     });
     const cleanupInventory = Object.freeze([
         agentInfraTool(config.home),
@@ -148,6 +171,7 @@ function createSandboxCapabilityPlan(config) {
         hooksByPhase: phaseHooks,
         recoveryChecks,
         aliases: Object.freeze(listAgentClientAdapters().flatMap((adapter) => adapter.sandbox.aliases)),
+        image,
         imageSignature: hash(tools.map(({ id, install }) => ({ id, install }))),
         runtimeSignature: hash(runtimeProjection),
         runtimeProjection,
@@ -230,5 +254,5 @@ function runBoundedSandboxHookCommand(command, options) {
         });
     });
 }
-export { DEFAULT_SANDBOX_HOOK_TIMEOUT_MS, createSandboxCapabilityPlan, runBoundedSandboxHookCommand, runSandboxHooks };
+export { DEFAULT_SANDBOX_HOOK_TIMEOUT_MS, createSandboxCapabilityPlan, runBoundedSandboxHookCommand, runSandboxHooks, sandboxImageContribution };
 //# sourceMappingURL=agent-client-reconciler.js.map

package/dist/lib/sandbox/capture.js

@@ -6,6 +6,7 @@ import { commandForEngine } from './shell.js';
 import { ensureSandboxReady } from './recovery.js';
 import { hostTimezoneEnvFlags, terminalEnvFlags } from './commands/enter.js';
 import { fetchSandboxRows, selectSandboxContainer, startSandboxContainer } from './commands/list-running.js';
+import { resolveSandboxTarget } from './workspace-identity.js';
 async function spawnCapture(file, args) {
     return new Promise((resolve, reject) => {
         const child = spawn(file, args, { stdio: ['ignore', 'pipe', 'pipe'] });
@@ -122,6 +123,8 @@ EOF
 export async function runInSandbox(request, options = {}) {
     const config = options.engine ? null : loadConfig();
     const engine = options.engine ?? detectEngine(config);
+    const workspace = request.workspace
+        ?? (config ? resolveSandboxTarget(request.taskRef, config.repoRoot).workspace : undefined);
     const rows = options.rows ??
         (() => {
             const fetched = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
@@ -136,6 +139,7 @@ export async function runInSandbox(request, options = {}) {
     if (options.ensureReady) {
         container = (await options.ensureReady({
             branch: request.branch,
+            workspace,
             row: found,
             allowRecreate: request.recreate ?? false
         })).container;
@@ -145,11 +149,12 @@ export async function runInSandbox(request, options = {}) {
             config,
             engine,
             branch: request.branch,
+            workspace,
             row: found,
             allowRecreate: request.recreate,
-            recreate: async (targetBranch) => {
+            recreate: async () => {
                 const { create } = await import('./commands/create.js');
-                await create([targetBranch, '--no-refresh']);
+                await create([request.taskRef, '--no-refresh']);
             }
         })).container;
     }