@fitlab-ai/agent-infra 0.9.2 → 0.9.4

package/dist/lib/sandbox/commands/ls.js

@@ -1,10 +1,10 @@
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { loadConfig } from '../config.js';
-import { sandboxBranchLabel, sandboxLabel } from '../constants.js';
+import { sandboxBranchLabel, sandboxLabel, sandboxTaskIdLabel, sandboxWorkspaceModeLabel } from '../constants.js';
 import { detectEngine } from '../engine.js';
 import { formatTable } from '../../table.js';
-import { lookupShortIdByBranch } from '../../task/short-id.js';
+import { loadShortIdByTaskId } from '../../task/short-id.js';
 import { fetchSandboxRows } from './list-running.js';
 export { containerListFormat, parseLabels } from './list-running.js';
 const USAGE = `Usage: ai sandbox ls
@@ -19,9 +19,9 @@ to remove with "ai sandbox rm <branch>".
 
 Use "ai sandbox show <ref>" for a single sandbox's worktree and per-tool
 state paths.`;
-const CONTAINER_TABLE_HEADERS = ['#', 'SHORT', 'NAMES', 'STATUS', 'BRANCH'];
+const CONTAINER_TABLE_HEADERS = ['#', 'SHORT', 'NAMES', 'STATUS', 'WORKSPACE', 'TASK', 'BRANCH'];
 export function formatContainerTable(rows, zebra = false) {
-    return formatTable(CONTAINER_TABLE_HEADERS, rows.map((r) => [r.row, r.shortId, r.name, r.status, r.branch]), { zebra });
+    return formatTable(CONTAINER_TABLE_HEADERS, rows.map((r) => [r.row, r.shortId, r.name, r.status, r.workspace, r.taskId, r.branch]), { zebra });
 }
 export function ls(args = []) {
     if (args.length > 0 && (args[0] === '--help' || args[0] === '-h')) {
@@ -31,7 +31,7 @@ export function ls(args = []) {
     const config = loadConfig();
     const engine = detectEngine(config);
     const label = sandboxLabel(config);
-    const { running, nonRunning } = fetchSandboxRows(engine, label, sandboxBranchLabel(config));
+    const { running, nonRunning } = fetchSandboxRows(engine, label, sandboxBranchLabel(config), { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) });
     p.intro(pc.cyan(`Sandbox status for ${config.project}`));
     p.log.step('Containers');
     const ordered = [...running, ...nonRunning];
@@ -40,12 +40,16 @@ export function ls(args = []) {
     }
     else {
         const tableRows = ordered.map((container, i) => {
-            const shortId = container.branch ? lookupShortIdByBranch(container.branch, config.repoRoot) : null;
+            const shortId = container.taskId
+                ? loadShortIdByTaskId(config.repoRoot).get(container.taskId) ?? null
+                : null;
             return {
                 row: String(i + 1),
                 shortId: shortId ?? '-',
                 name: container.name,
                 status: container.status,
+                workspace: container.workspaceMode ?? 'legacy-invalid',
+                taskId: container.taskId ?? '-',
                 branch: container.branch
             };
         });

package/dist/lib/sandbox/commands/rebuild.js

@@ -7,7 +7,7 @@ import { sandboxImageRefreshLabel } from '../constants.js';
 import { detectEngine, ensureDocker } from '../engine.js';
 import { runEngine, runOkEngine, runSafeEngine, runVerboseEngine } from '../shell.js';
 import { pruneSandboxDanglingImages } from '../image-prune.js';
-import { resolveTools } from '../tools.js';
+import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
 import { buildImageSignature, buildSandboxImageArgs, parseImageLabels, parseRefreshTimestamp } from '../image-build.js';
 import { assertBuildProxyCompatibility, buildProxyFailureHint, prepareBuildProxy, redactBuildProxyValues } from '../build-proxy.js';
 const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh] [--inherit-build-proxy|-B]`;
@@ -52,8 +52,9 @@ export async function rebuild(args) {
         return;
     }
     const config = loadConfig();
-    const tools = resolveTools(config);
-    const preparedDockerfile = prepareDockerfile(config);
+    const capabilityPlan = createSandboxCapabilityPlan(config);
+    const tools = [...capabilityPlan.tools];
+    const preparedDockerfile = prepareDockerfile(config, capabilityPlan.image);
     const imageSignature = buildImageSignature(preparedDockerfile, tools);
     const quiet = values.quiet ?? false;
     const refresh = values.refresh ?? false;

package/dist/lib/sandbox/commands/refresh.js

@@ -1,85 +1,5 @@
-import { homedir } from 'node:os';
-import { parseArgs } from 'node:util';
-import { buildLockedGuidance, discoverProjects, formatCredentialWarnings, formatRemaining, reconcileClaudeCredentials, redactCommandError, validateClaudeCredentialsEnvOverride } from '../credentials.js';
-import { runProbe } from '../shell.js';
-const USAGE = 'Usage: ai sandbox refresh';
-export function probeClaudeStatus(spawnFn = runProbe) {
-    const result = spawnFn('claude', ['/status'], {
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'pipe'],
-        timeout: 30_000
-    });
-    return {
-        ok: result.status === 0,
-        stderr: result.stderr?.toString() ?? '',
-        error: result.error?.message ?? null
-    };
-}
-export async function refresh(args, deps = {}) {
-    const { spawnFn = runProbe, execFn, readFn, existsFn, writeFn, writeHostFn, discoverFn = discoverProjects, writeStdout = (chunk) => process.stdout.write(chunk), writeStderr = (chunk) => process.stderr.write(chunk) } = deps;
-    if (args[0] === '--help' || args[0] === '-h' || args[0] === 'help') {
-        writeStdout(`${USAGE}\n`);
-        return 0;
-    }
-    const { positionals } = parseArgs({ args, allowPositionals: true, strict: true });
-    if (positionals.length > 0) {
-        throw new Error(USAGE);
-    }
-    validateClaudeCredentialsEnvOverride();
-    const home = homedir();
-    if (!home) {
-        throw new Error('sandbox: home directory is required');
-    }
-    const projects = discoverFn(home);
-    if (projects.length === 0) {
-        writeStdout('No project credentials to refresh.\n');
-        return 0;
-    }
-    const reconcileOptions = { execFn, readFn, existsFn, writeFn, writeHostFn, projects };
-    let result = reconcileClaudeCredentials(home, reconcileOptions);
-    if (result.status === 'STALE_ACCESS' && result.authoritative === null) {
-        writeStdout('Host credentials appear stale; probing claude /status to trigger refresh...\n');
-        const probe = probeClaudeStatus(spawnFn);
-        if (!probe.ok) {
-            writeStderr(`Probe failed: ${redactCommandError(probe.stderr || probe.error || 'unknown error')}\n`);
-            writeStderr('Run "claude /login" on the host to renew credentials.\n');
-            return 1;
-        }
-        writeStdout('Probe succeeded; re-inspecting host credentials.\n');
-        result = reconcileClaudeCredentials(home, reconcileOptions);
-    }
-    if (result.status === 'MISSING') {
-        writeStderr('No Claude Code credentials found on host.\n');
-        writeStderr('Run "claude /login" on the host to authenticate.\n');
-        return 1;
-    }
-    if (result.status === 'KEYCHAIN_LOCKED') {
-        writeStderr(`${buildLockedGuidance()}\n`);
-        return 1;
-    }
-    if (result.status === 'KEYCHAIN_ERROR') {
-        writeStderr(`Host keychain error: ${redactCommandError(result.detail || 'unknown error')}\n`);
-        writeStderr(`${buildLockedGuidance()}\n`);
-        return 1;
-    }
-    if (result.status === 'KEYCHAIN_WRITE_FAILED') {
-        writeStderr(`[host] keychain write failed: ${formatCredentialWarnings(result.warnings) || 'unknown error'}\n`);
-        return 1;
-    }
-    if (result.status !== 'OK') {
-        writeStderr('Host credentials still invalid after probe; run "claude /login".\n');
-        return 1;
-    }
-    if (result.authoritative && result.authoritative !== 'host' && result.hostWritten) {
-        writeStdout(`[host] reconciled from ${result.authoritative}\n`);
-    }
-    for (const project of projects) {
-        const action = result.filesWritten.includes(project) ? 'updated' : 'unchanged';
-        writeStdout(`[${project}] ${action}; expires in ${formatRemaining(result.expiresAt)}\n`);
-    }
-    for (const failure of result.fileErrors) {
-        writeStderr(`[${failure.project}] sync failed: ${failure.error}\n`);
-    }
-    return result.fileErrors.length > 0 ? 1 : 0;
-}
+import { runClaudeCodeRefresh } from '../../agent-clients/adapters/claude-code-refresh.js';
+const refresh = runClaudeCodeRefresh;
+export { probeClaudeStatus, runClaudeCodeRefresh } from '../../agent-clients/adapters/claude-code-refresh.js';
+export { refresh };
 //# sourceMappingURL=refresh.js.map

package/dist/lib/sandbox/commands/rm.js

@@ -9,7 +9,7 @@ import { ENGINES, detectEngine, engineDisplayName, isManagedEngine, stopManagedV
 import { pruneSandboxDanglingImages } from '../image-prune.js';
 import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
 import { runOk, runSafe, runSafeEngine } from '../shell.js';
-import { resolveTaskBranch } from '../task-resolver.js';
+import { resolveSandboxTarget } from '../workspace-identity.js';
 import { toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.js';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
 import { fetchSandboxRows } from './list-running.js';
@@ -57,6 +57,17 @@ async function rmOne(config, tools, branch, options = {}) {
         for (const name of matchedContainers) {
             runSafeEngine(engine, 'docker', ['stop', name]);
             runSafeEngine(engine, 'docker', ['rm', name]);
+            for (const [base, label] of [
+                [path.join(config.workspaceViewBase, config.project), 'Workspace view'],
+                [path.join(config.controlBase, config.project), 'Control channel']
+            ]) {
+                const directory = path.join(base, name);
+                if (fs.existsSync(directory)) {
+                    removeManagedDir(base, directory);
+                    if (!options.quiet)
+                        p.log.success(`${label} removed: ${directory}`);
+                }
+            }
         }
         spinner.stop(pc.green(`Removed container(s): ${matchedContainers.join(', ')}`));
     }
@@ -184,6 +195,16 @@ async function rmPurge(config, tools) {
             p.log.success(`Project share dirs removed: ${config.shareBase}`);
         }
     }
+    for (const [base, label] of [
+        [config.workspaceViewBase, 'workspace views'],
+        [config.controlBase, 'control channels']
+    ]) {
+        const projectDir = path.join(base, config.project);
+        if (fs.existsSync(projectDir)) {
+            removeManagedDir(base, projectDir);
+            p.log.success(`Removed project ${label}: ${projectDir}`);
+        }
+    }
     const shouldRemoveImage = await p.confirm({
         message: `Remove image ${config.imageName}?`,
         initialValue: false
@@ -297,7 +318,7 @@ export async function rm(args) {
         });
         return;
     }
-    const branch = resolveTaskBranch(positionals[0] ?? '', config.repoRoot);
-    await rmOne(config, tools, branch);
+    const target = resolveSandboxTarget(positionals[0] ?? '', config.repoRoot);
+    await rmOne(config, tools, target.branch);
 }
 //# sourceMappingURL=rm.js.map

package/dist/lib/sandbox/commands/show.js

@@ -2,13 +2,15 @@ import fs from 'node:fs';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { loadConfig } from '../config.js';
-import { assertValidBranchName, worktreeDirCandidates } from '../constants.js';
-import { resolveBranchArg } from './list-running.js';
+import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel, sandboxTaskIdLabel, sandboxWorkspaceModeLabel, worktreeDirCandidates } from '../constants.js';
+import { fetchSandboxRows, selectSandboxContainer } from './list-running.js';
 import { resolveTools, toolConfigDirCandidates } from '../tools.js';
+import { detectEngine } from '../engine.js';
+import { resolveSandboxTarget } from '../workspace-identity.js';
 const USAGE = `Usage: ai sandbox show <branch | TASK-id | N>
 
 Shows one sandbox's worktree path and per-tool state paths (Claude Code,
-Codex, Gemini CLI, OpenCode). The argument follows the same contract as
+Codex, Antigravity CLI, OpenCode). The argument follows the same contract as
 'ai sandbox exec' and 'ai sandbox start': N (bare) is the recommended form
 for task short ids (e.g. 'ai sandbox show 11'); a TASK-id or a plain
 branch name are also accepted. Use 'ai sandbox ls' for the container list.`;
@@ -40,9 +42,13 @@ export function show(args = []) {
         return;
     }
     const config = loadConfig();
-    const branch = resolveBranchArg(args[0], { repoRoot: config.repoRoot });
+    const target = resolveSandboxTarget(args[0], config.repoRoot);
+    const branch = target.branch;
     assertValidBranchName(branch);
     const detail = collectSandboxDetail(config, branch);
+    const engine = detectEngine(config);
+    const rows = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config), { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) });
+    const container = selectSandboxContainer([...rows.running, ...rows.nonRunning], containerNameCandidates(config, branch));
     p.intro(pc.cyan(`Sandbox detail for ${config.project} · ${branch}`));
     p.log.step('Worktree');
     if (detail.worktrees.length === 0) {
@@ -53,6 +59,9 @@ export function show(args = []) {
             process.stdout.write(`  ${worktree}\n`);
         }
     }
+    p.log.step('Workspace identity');
+    process.stdout.write(`  Mode: ${container?.workspaceMode ?? 'legacy-invalid'}\n`);
+    process.stdout.write(`  Task: ${container?.taskId ?? '-'}\n`);
     for (const tool of detail.toolStates) {
         p.log.step(`${tool.name} state`);
         if (tool.entries.length === 0) {

package/dist/lib/sandbox/commands/start.js

@@ -2,7 +2,8 @@ import { loadConfig } from '../config.js';
 import { assertValidBranchName, containerNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
 import { detectEngine } from '../engine.js';
 import { ensureSandboxReady } from '../recovery.js';
-import { fetchSandboxRows, resolveBranchArg, selectSandboxContainer, } from './list-running.js';
+import { fetchSandboxRows, selectSandboxContainer, } from './list-running.js';
+import { resolveSandboxTarget } from '../workspace-identity.js';
 const USAGE = `Usage: ai sandbox start [--recreate] <branch | TASK-id | N>
 
 Start an existing sandbox container that has stopped (for example after the
@@ -46,7 +47,8 @@ export async function start(args) {
     }
     const config = loadConfig();
     const engine = detectEngine(config);
-    const branch = resolveBranchArg(parsed.target, { repoRoot: config.repoRoot });
+    const target = resolveSandboxTarget(parsed.target, config.repoRoot);
+    const branch = target.branch;
     assertValidBranchName(branch);
     const { running, nonRunning } = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config));
     const found = selectSandboxContainer([...running, ...nonRunning], containerNameCandidates(config, branch));
@@ -57,11 +59,12 @@ export async function start(args) {
         config,
         engine,
         branch,
+        workspace: target.workspace,
         row: found,
         allowRecreate: parsed.recreate,
-        recreate: async (targetBranch) => {
+        recreate: async () => {
             const { create } = await import('./create.js');
-            await create([targetBranch, '--no-refresh']);
+            await create([target.requestedRef, '--no-refresh']);
         }
     });
     const message = ready.path === 'healthy'

package/dist/lib/sandbox/config.js

@@ -111,6 +111,8 @@ export function loadConfig({ platformFn = platform, writeStderr = (chunk) => pro
         worktreeBase: hostJoin(home, '.agent-infra', 'worktrees', project),
         shareBase: hostJoin(home, '.agent-infra', 'share', project),
         shellConfigBase: hostJoin(home, '.agent-infra', 'config', project),
+        workspaceViewBase: hostJoin(home, '.agent-infra', 'workspace-views'),
+        controlBase: hostJoin(home, '.agent-infra', 'sandbox-control'),
         dotfilesDir: hostJoin(home, '.agent-infra', 'dotfiles'),
         engine,
         runtimes,

package/dist/lib/sandbox/constants.js

@@ -69,6 +69,12 @@ export function sandboxLabel(config) {
 export function sandboxBranchLabel(config) {
     return `${sandboxLabel(config)}.branch`;
 }
+export function sandboxWorkspaceModeLabel(config) {
+    return `${sandboxLabel(config)}.workspace-mode`;
+}
+export function sandboxTaskIdLabel(config) {
+    return `${sandboxLabel(config)}.task-id`;
+}
 export function sandboxImageConfigLabel(config) {
     return `${sandboxLabel(config)}.image-config`;
 }

package/dist/lib/sandbox/control/client.js

@@ -0,0 +1,44 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { SANDBOX_CONTROL_MAX_BYTES, isSandboxControlFamily } from './protocol.js';
+function sleep(milliseconds) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+export function requestSandboxControl(params) {
+    if (!isSandboxControlFamily(params.family)) {
+        throw new Error(`SANDBOX_CONTROL_COMMAND_DENIED: '${params.family}' is not allowed`);
+    }
+    const channelDir = params.channelDir ?? process.env.AGENT_INFRA_CONTROL_DIR ?? '/run/agent-infra/control';
+    const token = params.token ?? process.env.AGENT_INFRA_CONTROL_TOKEN;
+    if (!token)
+        throw new Error('SANDBOX_CONTROL_UNAVAILABLE: control token is missing');
+    const requestsDir = path.join(channelDir, 'requests');
+    const responsesDir = path.join(channelDir, 'responses');
+    const id = randomUUID();
+    const request = { version: 1, id, token, family: params.family, args: params.args };
+    const encoded = `${JSON.stringify(request)}\n`;
+    if (Buffer.byteLength(encoded, 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
+        throw new Error('SANDBOX_CONTROL_REQUEST_TOO_LARGE: request exceeds the control limit');
+    }
+    const temporary = path.join(requestsDir, `.${id}.tmp`);
+    const requestPath = path.join(requestsDir, `${id}.json`);
+    const responsePath = path.join(responsesDir, `${id}.json`);
+    fs.writeFileSync(temporary, encoded, { mode: 0o600, flag: 'wx' });
+    fs.renameSync(temporary, requestPath);
+    const deadline = Date.now() + (params.timeoutMs ?? 30_000);
+    while (Date.now() < deadline) {
+        if (fs.existsSync(responsePath)) {
+            const raw = fs.readFileSync(responsePath, 'utf8');
+            fs.unlinkSync(responsePath);
+            const response = JSON.parse(raw);
+            if (response.version !== 1 || response.id !== id || !Number.isInteger(response.exitCode)) {
+                throw new Error('SANDBOX_CONTROL_RESPONSE_INVALID: broker response is invalid');
+            }
+            return response;
+        }
+        sleep(25);
+    }
+    throw new Error(`SANDBOX_CONTROL_TIMEOUT: broker did not respond within ${params.timeoutMs ?? 30_000}ms`);
+}
+//# sourceMappingURL=client.js.map

package/dist/lib/sandbox/control/protocol.js

@@ -0,0 +1,35 @@
+export const SANDBOX_CONTROL_MAX_BYTES = 64 * 1024;
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-orchestration'];
+export function isSandboxControlFamily(value) {
+    return SANDBOX_CONTROL_FAMILIES.includes(value);
+}
+export function validateSandboxControlRequest(value, manifest) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('SANDBOX_CONTROL_REQUEST_INVALID: request must be an object');
+    }
+    const request = value;
+    if (request.version !== 1
+        || typeof request.id !== 'string'
+        || !/^[a-f0-9-]{16,64}$/.test(request.id)
+        || request.token !== manifest.token
+        || typeof request.family !== 'string'
+        || !isSandboxControlFamily(request.family)
+        || !Array.isArray(request.args)
+        || !request.args.every((arg) => typeof arg === 'string')) {
+        throw new Error('SANDBOX_CONTROL_REQUEST_INVALID: request schema or authorization is invalid');
+    }
+    if (manifest.mode !== 'task-bound' || !manifest.taskId) {
+        throw new Error('SANDBOX_CONTROL_BRANCH_ONLY: branch-only sandboxes cannot coordinate tasks');
+    }
+    if (Buffer.byteLength(JSON.stringify(request), 'utf8') > SANDBOX_CONTROL_MAX_BYTES) {
+        throw new Error('SANDBOX_CONTROL_REQUEST_TOO_LARGE: request exceeds the control limit');
+    }
+    return request;
+}
+export function bindSandboxControlTask(request, taskId) {
+    if (request.args.length === 0) {
+        throw new Error('SANDBOX_CONTROL_REQUEST_INVALID: command arguments are required');
+    }
+    return [taskId, ...request.args.slice(1)];
+}
+//# sourceMappingURL=protocol.js.map

package/dist/lib/sandbox/control/server.js

@@ -0,0 +1,109 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getProcessStartTime } from '../../server/process-state.js';
+import { bindSandboxControlTask, validateSandboxControlRequest } from './protocol.js';
+function readManifest(manifestPath) {
+    const stat = fs.lstatSync(manifestPath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    if (manifest.version !== 1
+        || typeof manifest.repoRoot !== 'string'
+        || typeof manifest.channelDir !== 'string'
+        || typeof manifest.token !== 'string')
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    if (path.resolve(manifest.channelDir) !== path.join(path.dirname(path.resolve(manifestPath)), 'channel')) {
+        throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
+    }
+    return manifest;
+}
+function assertRealDirectory(directory, parent) {
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('SANDBOX_CONTROL_CHANNEL_INVALID');
+    if (parent && path.dirname(fs.realpathSync.native(directory)) !== fs.realpathSync.native(parent)) {
+        throw new Error('SANDBOX_CONTROL_CHANNEL_INVALID');
+    }
+}
+function writeResponse(directory, response) {
+    const temporary = path.join(directory, `.${response.id}.tmp`);
+    fs.writeFileSync(temporary, `${JSON.stringify(response)}\n`, { mode: 0o600, flag: 'wx' });
+    fs.renameSync(temporary, path.join(directory, `${response.id}.json`));
+}
+export function serveSandboxControl(manifestPath, signal = new AbortController().signal) {
+    const manifest = readManifest(manifestPath);
+    const brokerPath = path.join(path.dirname(manifestPath), 'broker.json');
+    const startTime = getProcessStartTime(process.pid);
+    if (!startTime)
+        throw new Error('SANDBOX_CONTROL_BROKER_IDENTITY_UNAVAILABLE');
+    fs.writeFileSync(brokerPath, `${JSON.stringify({
+        version: 1,
+        pid: process.pid,
+        startTime,
+        token: manifest.token
+    })}\n`, { mode: 0o600, flag: 'wx' });
+    const requestsDir = path.join(manifest.channelDir, 'requests');
+    const responsesDir = path.join(manifest.channelDir, 'responses');
+    assertRealDirectory(manifest.channelDir);
+    fs.mkdirSync(requestsDir, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(responsesDir, { recursive: true, mode: 0o700 });
+    assertRealDirectory(requestsDir, manifest.channelDir);
+    assertRealDirectory(responsesDir, manifest.channelDir);
+    const consumed = new Set();
+    while (!signal.aborted) {
+        const current = readManifest(manifestPath);
+        if (current.token !== manifest.token)
+            return;
+        assertRealDirectory(requestsDir, manifest.channelDir);
+        assertRealDirectory(responsesDir, manifest.channelDir);
+        for (const name of fs.readdirSync(requestsDir).sort()) {
+            if (!/^[a-f0-9-]{16,64}\.json$/.test(name))
+                continue;
+            const requestPath = path.join(requestsDir, name);
+            let id = name.slice(0, -5);
+            let response;
+            try {
+                const stat = fs.lstatSync(requestPath);
+                if (!stat.isFile() || stat.isSymbolicLink())
+                    throw new Error('SANDBOX_CONTROL_REQUEST_INVALID');
+                const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(requestPath, 'utf8')), manifest);
+                id = request.id;
+                if (consumed.has(id))
+                    throw new Error('SANDBOX_CONTROL_REQUEST_REPLAYED');
+                consumed.add(id);
+                const result = spawnSync(process.execPath, ['--experimental-strip-types', '--no-warnings', process.argv[1], request.family, ...bindSandboxControlTask(request, manifest.taskId)], {
+                    cwd: manifest.repoRoot,
+                    encoding: 'utf8',
+                    env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('AGENT_INFRA_CONTROL_')))
+                });
+                response = {
+                    version: 1,
+                    id,
+                    exitCode: result.status ?? 1,
+                    stdout: result.stdout ?? '',
+                    stderr: result.stderr ?? ''
+                };
+            }
+            catch (error) {
+                response = {
+                    version: 1,
+                    id,
+                    exitCode: 1,
+                    stdout: '',
+                    stderr: `${error instanceof Error ? error.message : String(error)}\n`
+                };
+            }
+            try {
+                fs.unlinkSync(requestPath);
+                writeResponse(responsesDir, response);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+        }
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/lib/sandbox/dockerfile.js

@@ -5,6 +5,11 @@ import { createHash } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import { removeDirRecursive } from '../remove-dir.js';
 const RUNTIMES_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), 'runtimes');
+const AGENT_CLIENT_RUNTIMES_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'agent-clients', 'adapters', 'runtimes');
+const EMPTY_IMAGE_CONTRIBUTION = Object.freeze({
+    dockerfileFragments: Object.freeze([]),
+    dotfilesExclusions: Object.freeze([])
+});
 function listRuntimeFragments() {
     return fs.readdirSync(RUNTIMES_DIR)
         .filter((file) => file.endsWith('.dockerfile'))
@@ -15,7 +20,24 @@ export function availableRuntimes() {
         .filter((name) => name !== 'base' && name !== 'ai-tools')
         .sort();
 }
-function dockerfileContent(config) {
+function exclusionsFragment(exclusions) {
+    return [
+        "RUN mkdir -p /etc/agent-infra && cat > /etc/agent-infra/dotfiles-exclusions <<'EXCLUSIONS'",
+        ...exclusions,
+        'EXCLUSIONS'
+    ].join('\n');
+}
+function adapterFragmentPath(fragment) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(fragment)) {
+        throw new Error(`Invalid Agent Client Dockerfile fragment: ${fragment}`);
+    }
+    const fragmentPath = path.join(AGENT_CLIENT_RUNTIMES_DIR, `${fragment}.dockerfile`);
+    if (!fs.existsSync(fragmentPath)) {
+        throw new Error(`Unknown Agent Client Dockerfile fragment: ${fragment}`);
+    }
+    return fragmentPath;
+}
+function dockerfileContent(config, image = EMPTY_IMAGE_CONTRIBUTION) {
     if (config.dockerfile) {
         const customPath = path.resolve(config.repoRoot, config.dockerfile);
         if (!fs.existsSync(customPath)) {
@@ -30,22 +52,23 @@ function dockerfileContent(config) {
         }
     }
     const fragments = [
-        'base.dockerfile',
-        ...config.runtimes.map((runtime) => `${runtime}.dockerfile`),
-        'ai-tools.dockerfile'
+        fs.readFileSync(path.join(RUNTIMES_DIR, 'base.dockerfile'), 'utf8').trimEnd(),
+        exclusionsFragment(image.dotfilesExclusions),
+        ...image.dockerfileFragments.map((fragment) => fs.readFileSync(adapterFragmentPath(fragment), 'utf8').trimEnd()),
+        ...config.runtimes.map((runtime) => fs.readFileSync(path.join(RUNTIMES_DIR, `${runtime}.dockerfile`), 'utf8').trimEnd()),
+        fs.readFileSync(path.join(RUNTIMES_DIR, 'ai-tools.dockerfile'), 'utf8').trimEnd()
     ];
     const content = fragments
-        .map((fragment) => fs.readFileSync(path.join(RUNTIMES_DIR, fragment), 'utf8').trimEnd())
         .join('\n\n');
     return `${content}\n`;
 }
-export function dockerfileSignature(config) {
+export function dockerfileSignature(config, image = EMPTY_IMAGE_CONTRIBUTION) {
     return createHash('sha256')
-        .update(dockerfileContent(config))
+        .update(dockerfileContent(config, image))
         .digest('hex')
         .slice(0, 12);
 }
-export function prepareDockerfile(config) {
+export function prepareDockerfile(config, image = EMPTY_IMAGE_CONTRIBUTION) {
     if (config.dockerfile) {
         const customPath = path.resolve(config.repoRoot, config.dockerfile);
         if (!fs.existsSync(customPath)) {
@@ -53,23 +76,23 @@ export function prepareDockerfile(config) {
         }
         return {
             path: customPath,
-            signature: dockerfileSignature(config),
+            signature: dockerfileSignature(config, image),
             cleanup() { }
         };
     }
     const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), `${config.project}-sandbox-`));
     const tempPath = path.join(tempDir, 'Dockerfile');
-    fs.writeFileSync(tempPath, dockerfileContent(config), 'utf8');
+    fs.writeFileSync(tempPath, dockerfileContent(config, image), 'utf8');
     return {
         path: tempPath,
-        signature: dockerfileSignature(config),
+        signature: dockerfileSignature(config, image),
         cleanup() {
             removeDirRecursive(tempDir);
         }
     };
 }
-export function composeDockerfile(config) {
-    const content = dockerfileContent(config);
+export function composeDockerfile(config, image = EMPTY_IMAGE_CONTRIBUTION) {
+    const content = dockerfileContent(config, image);
     const tempPath = path.join(os.tmpdir(), `${config.project}-sandbox.Dockerfile`);
     fs.writeFileSync(tempPath, content, 'utf8');
     return tempPath;

package/dist/lib/sandbox/mounts.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
-export function sandboxCoreBindMounts(config, branch, overrides = {}) {
-    return [
+export function sandboxCoreBindMounts(config, branch, overrides) {
+    const mounts = [
         {
             hostPaths: overrides.worktree
                 ? [overrides.worktree]
@@ -10,9 +10,9 @@ export function sandboxCoreBindMounts(config, branch, overrides = {}) {
             readOnly: false
         },
         {
-            hostPaths: [path.join(config.repoRoot, '.agents', 'workspace')],
+            hostPaths: [overrides.workspaceViewRoot],
             containerPath: '/workspace/.agents/workspace',
-            readOnly: false
+            readOnly: true
         },
         {
             hostPaths: [shareCommonDir(config)],
@@ -32,5 +32,18 @@ export function sandboxCoreBindMounts(config, branch, overrides = {}) {
             readOnly: true
         }
     ];
+    if (overrides.taskSource && overrides.taskId) {
+        mounts.splice(2, 0, {
+            hostPaths: [overrides.taskSource],
+            containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId),
+            readOnly: false
+        });
+    }
+    mounts.push({
+        hostPaths: [overrides.controlDir],
+        containerPath: '/run/agent-infra/control',
+        readOnly: false
+    });
+    return mounts;
 }
 //# sourceMappingURL=mounts.js.map