@fitlab-ai/agent-infra 0.9.3 → 0.9.5

package/dist/lib/task/resolve-ref.js

@@ -91,6 +91,46 @@ function enumerateTaskDirs(repoRoot) {
     }
     return out;
 }
+/**
+ * Enumerate every task directory, including the cold YYYY/MM/DD archive.
+ * Invalid directory names, symlinks and entries without task.md are ignored;
+ * duplicate task ids fail closed because their identity would be ambiguous.
+ */
+function enumerateAllTaskDirs(repoRoot) {
+    const out = [];
+    const seen = new Set();
+    const add = (taskId, taskDir, state) => {
+        if (!TASK_ID_RE.test(taskId))
+            return;
+        const stat = fs.lstatSync(taskDir);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || !fs.existsSync(path.join(taskDir, 'task.md')))
+            return;
+        if (seen.has(taskId))
+            throw new Error(`duplicate task identity: ${taskId}`);
+        seen.add(taskId);
+        out.push({ taskId, taskDir, state });
+    };
+    for (const state of FLAT_WORKSPACE_DIRS) {
+        const base = path.join(repoRoot, '.agents', 'workspace', state);
+        if (!fs.existsSync(base))
+            continue;
+        for (const taskId of fs.readdirSync(base).sort())
+            add(taskId, path.join(base, taskId), state);
+    }
+    const archive = path.join(repoRoot, '.agents', 'workspace', 'archive');
+    for (const year of listSortedNumeric(archive, 4).reverse()) {
+        const yearDir = path.join(archive, year);
+        for (const month of listSortedNumeric(yearDir, 2).reverse()) {
+            const monthDir = path.join(yearDir, month);
+            for (const day of listSortedNumeric(monthDir, 2).reverse()) {
+                const dayDir = path.join(monthDir, day);
+                for (const taskId of fs.readdirSync(dayDir).sort())
+                    add(taskId, path.join(dayDir, taskId), 'archive');
+            }
+        }
+    }
+    return out;
+}
 function locateHotTaskDirs(repoRoot, taskId) {
     return FLAT_WORKSPACE_DIRS.flatMap((state) => {
         const taskDir = path.join(repoRoot, '.agents', 'workspace', state, taskId);
@@ -266,5 +306,5 @@ function resolveTaskContext(taskRef, options = {}) {
     const match = matches[0];
     return { ok: true, repoRoot, ...match, state: 'active' };
 }
-export { resolveTaskRef, resolveTaskContext, detectRepoRoot, enumerateTaskDirs, locateHotTaskDirs, TASK_ID_RE };
+export { resolveTaskRef, resolveTaskContext, detectRepoRoot, enumerateTaskDirs, enumerateAllTaskDirs, locateHotTaskDirs, TASK_ID_RE };
 //# sourceMappingURL=resolve-ref.js.map

package/dist/lib/task/review-fingerprint.js

@@ -1,6 +1,10 @@
 import fs from "node:fs";
 import path from "node:path";
 import { artifactName, maxRound } from "./review-artifacts.js";
+const REVIEWED_TREE_RE = /^[a-f0-9]{40,64}$/;
+export function parseReviewedGitTree(value) {
+    return REVIEWED_TREE_RE.test(value) ? value : null;
+}
 // Paths excluded from the post-review coverage gate. Fail-closed: the gate
 // covers ALL tracked changes by default. This default denylist is EMPTY —
 // projects opt into exclusions explicitly via review.post_review_exclude_globs.

package/dist/lib/task/workspace-snapshot.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -25,12 +26,70 @@ function captureWorktreeTree(repoRoot, forcedPath) {
         fs.rmSync(tempDir, { recursive: true, force: true });
     }
 }
-function captureWorkspaceSnapshot(repoRoot, taskId) {
+function captureLegacyWorkspaceSnapshot(repoRoot, taskId) {
     const workspaceRelative = taskId
         ? `.agents/workspace/active/${taskId}`
         : '.agents/workspace/active';
     return captureWorktreeTree(repoRoot, workspaceRelative);
 }
+function taskFileFingerprints(stateRoot, taskId) {
+    const activeRoot = path.join(stateRoot, '.agents', 'workspace', 'active');
+    const roots = taskId ? [path.join(activeRoot, taskId)] : [activeRoot];
+    const records = [];
+    const visit = (absolute, relative) => {
+        const stat = fs.lstatSync(absolute);
+        if (stat.isDirectory()) {
+            for (const name of fs.readdirSync(absolute).sort()) {
+                visit(path.join(absolute, name), path.posix.join(relative, name));
+            }
+            return;
+        }
+        if (!stat.isFile() && !stat.isSymbolicLink())
+            return;
+        const content = stat.isSymbolicLink()
+            ? Buffer.from(fs.readlinkSync(absolute))
+            : fs.readFileSync(absolute);
+        records.push({
+            path: relative,
+            mode: stat.mode & 0o777,
+            kind: stat.isSymbolicLink() ? 'symlink' : 'file',
+            sha256: createHash('sha256').update(content).digest('hex')
+        });
+    };
+    for (const root of roots) {
+        if (!fs.existsSync(root))
+            continue;
+        const relative = path.posix.join('.agents/workspace/active', path.relative(activeRoot, root).split(path.sep).join('/'));
+        visit(root, relative.replace(/\/$/, ''));
+    }
+    return records.sort((left, right) => left.path.localeCompare(right.path));
+}
+function encodeWorkspaceFingerprint(value) {
+    return `ws2:${Buffer.from(JSON.stringify(value)).toString('base64url')}`;
+}
+function decodeWorkspaceFingerprint(value) {
+    if (!value.startsWith('ws2:'))
+        return null;
+    try {
+        const parsed = JSON.parse(Buffer.from(value.slice(4), 'base64url').toString('utf8'));
+        if (parsed.version !== 2 || !/^[a-f0-9]{40,64}$/.test(parsed.gitTree) || !Array.isArray(parsed.taskFiles)) {
+            throw new Error('invalid workspace fingerprint fields');
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`ORCHESTRATION_SNAPSHOT_FAILED: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function captureWorkspaceSnapshot(contextOrRoot, taskId) {
+    if (typeof contextOrRoot === 'string')
+        return captureLegacyWorkspaceSnapshot(contextOrRoot, taskId ?? null);
+    return encodeWorkspaceFingerprint({
+        version: 2,
+        gitTree: captureWorktreeTree(contextOrRoot.gitRoot, null),
+        taskFiles: taskFileFingerprints(contextOrRoot.stateRoot, contextOrRoot.taskId)
+    });
+}
 function captureRepositorySnapshot(repoRoot) {
     return {
         head: git(repoRoot, null, ['rev-parse', 'HEAD']).trim(),
@@ -39,8 +98,24 @@ function captureRepositorySnapshot(repoRoot) {
     };
 }
 function diffWorkspaceSnapshots(repoRoot, before, after) {
-    const output = git(repoRoot, null, ['diff', '--name-only', '-z', before, after]);
-    return output.split('\0').filter(Boolean);
+    const beforeV2 = decodeWorkspaceFingerprint(before);
+    const afterV2 = decodeWorkspaceFingerprint(after);
+    if ((beforeV2 === null) !== (afterV2 === null)) {
+        throw new Error('ORCHESTRATION_SNAPSHOT_FAILED: workspace fingerprint versions cannot be mixed');
+    }
+    if (!beforeV2 || !afterV2) {
+        const output = git(repoRoot, null, ['diff', '--name-only', '-z', before, after]);
+        return output.split('\0').filter(Boolean);
+    }
+    const output = git(repoRoot, null, ['diff', '--name-only', '-z', beforeV2.gitTree, afterV2.gitTree]);
+    const changed = new Set(output.split('\0').filter(Boolean));
+    const beforeFiles = new Map(beforeV2.taskFiles.map((record) => [record.path, JSON.stringify(record)]));
+    const afterFiles = new Map(afterV2.taskFiles.map((record) => [record.path, JSON.stringify(record)]));
+    for (const filePath of new Set([...beforeFiles.keys(), ...afterFiles.keys()])) {
+        if (beforeFiles.get(filePath) !== afterFiles.get(filePath))
+            changed.add(filePath);
+    }
+    return [...changed].sort();
 }
 export { captureRepositorySnapshot, captureWorkspaceSnapshot, diffWorkspaceSnapshots };
 //# sourceMappingURL=workspace-snapshot.js.map

package/lib/agent-clients/adapter.ts

@@ -12,6 +12,7 @@ import {
 } from '../sandbox/tool-types.ts';
 import type {
   AgentClientSandboxRecoveryCheck,
+  AgentClientSandboxImageDescriptor,
   AgentClientSandboxDescriptor,
   SandboxAlias,
   SandboxTool,
@@ -38,8 +39,8 @@ type AgentClientModelSelectionContext =
     }>;
 
 type AgentClientDelegationEvidence = Readonly<{
-  actualModel: 'host-event' | 'unavailable';
-  actualReasoningEffort: 'host-event' | 'spawn-ack' | 'unavailable';
+  actualModel: 'host-event' | 'app-server' | 'unavailable';
+  actualReasoningEffort: 'host-event' | 'app-server' | 'spawn-ack' | 'unavailable';
 }>;
 
 type AgentClientSeedCommand = Readonly<{
@@ -50,12 +51,21 @@ type AgentClientSeedCommand = Readonly<{
   target: string;
 }>;
 
+type AgentClientCustomCommandDescriptor = Readonly<{
+  target: string;
+  frontmatter: Readonly<Record<string, string | boolean>>;
+  argumentsToken?: string;
+  includeUsage?: boolean;
+  inheritDisableModelInvocation?: boolean;
+}>;
+
 type AgentClientProjectDescriptor = Readonly<{
   ownedPathPrefixes: readonly string[];
   managed: readonly string[];
   merged: readonly string[];
   ejected: readonly string[];
   seedCommands: readonly AgentClientSeedCommand[];
+  customCommand?: AgentClientCustomCommandDescriptor;
 }>;
 
 type AgentClientAdapter = Readonly<{
@@ -81,12 +91,59 @@ type AgentClientManifestEntry = Readonly<{
   managed: readonly string[];
   merged: readonly string[];
   ejected: readonly string[];
+  customCommand?: AgentClientCustomCommandDescriptor;
 }>;
 
 const PROJECT_ASSET_CATEGORIES = ['managed', 'merged', 'ejected'] as const;
 const MAX_SANDBOX_HOOK_TIMEOUT_MS = 300_000;
 const TOOL_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 
+function freezeSandboxImageDescriptor(
+  id: AgentClientId,
+  value: AgentClientSandboxImageDescriptor | undefined
+): AgentClientSandboxImageDescriptor | undefined {
+  if (value === undefined) return undefined;
+  const keys = value && typeof value === 'object' && !Array.isArray(value)
+    ? Object.keys(value)
+    : [];
+  const fragment = value?.dockerfileFragment;
+  const exclusions = value?.dotfilesExclusions;
+  const validExclusion = (entry: unknown): entry is string => {
+    if (
+      typeof entry !== 'string'
+      || entry === ''
+      || entry.startsWith('/')
+      || entry.endsWith('/')
+      || entry.includes('\\')
+      || /[*?[\]]/.test(entry)
+    ) {
+      return false;
+    }
+    return entry.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+  };
+  if (
+    !value
+    || typeof value !== 'object'
+    || Array.isArray(value)
+    || keys.length === 0
+    || keys.some((key) => !['dockerfileFragment', 'dotfilesExclusions'].includes(key))
+    || (fragment !== undefined && (typeof fragment !== 'string' || !TOOL_ID_PATTERN.test(fragment)))
+    || (exclusions !== undefined && (
+      !Array.isArray(exclusions)
+      || exclusions.some((entry) => !validExclusion(entry))
+      || new Set(exclusions).size !== exclusions.length
+    ))
+  ) {
+    throw new Error(`Agent Client '${id}' has an invalid sandbox image descriptor`);
+  }
+  return Object.freeze({
+    ...(fragment === undefined ? {} : { dockerfileFragment: fragment }),
+    ...(exclusions === undefined
+      ? {}
+      : { dotfilesExclusions: Object.freeze([...exclusions]) })
+  });
+}
+
 function freezeRecoveryProbe(
   id: AgentClientId,
   checkId: string,
@@ -274,8 +331,8 @@ function defineAgentClientAdapter(
   const evidence = candidate.delegationEvidence;
   if (
     !evidence
-    || !['host-event', 'unavailable'].includes(evidence.actualModel)
-    || !['host-event', 'spawn-ack', 'unavailable'].includes(evidence.actualReasoningEffort)
+    || !['host-event', 'app-server', 'unavailable'].includes(evidence.actualModel)
+    || !['host-event', 'app-server', 'spawn-ack', 'unavailable'].includes(evidence.actualReasoningEffort)
   ) {
     throw new Error(`Agent Client '${candidate.id}' has invalid delegation evidence`);
   }
@@ -394,9 +451,68 @@ function defineAgentClientAdapter(
     });
   });
 
+  let customCommand: AgentClientCustomCommandDescriptor | undefined;
+  if (candidate.project.customCommand !== undefined) {
+    const descriptor = candidate.project.customCommand;
+    const placeholders = typeof descriptor?.target === 'string'
+      ? [...descriptor.target.matchAll(/\$\{([^}]+)\}/g)].map((match) => match[1])
+      : [];
+    const targetProbe = typeof descriptor?.target === 'string'
+      ? descriptor.target.replaceAll('${skillName}', 'skill')
+      : '';
+    const frontmatter = descriptor?.frontmatter;
+    if (
+      !descriptor
+      || typeof descriptor !== 'object'
+      || placeholders.length !== 1
+      || placeholders[0] !== 'skillName'
+      || targetProbe.includes('${')
+      || !isProjectRelativeLiteral(targetProbe)
+      || !paths.some((prefix) => targetProbe.startsWith(prefix))
+      || !frontmatter
+      || typeof frontmatter !== 'object'
+      || Array.isArray(frontmatter)
+      || Object.values(frontmatter).some((value) =>
+        typeof value !== 'string' && typeof value !== 'boolean'
+      )
+      || (
+        descriptor.argumentsToken !== undefined
+        && (
+          typeof descriptor.argumentsToken !== 'string'
+          || descriptor.argumentsToken === ''
+          || /[\r\n]/.test(descriptor.argumentsToken)
+        )
+      )
+      || (
+        descriptor.includeUsage !== undefined
+        && typeof descriptor.includeUsage !== 'boolean'
+      )
+      || (
+        descriptor.inheritDisableModelInvocation !== undefined
+        && typeof descriptor.inheritDisableModelInvocation !== 'boolean'
+      )
+    ) {
+      throw new Error(`Agent Client '${candidate.id}' has an invalid custom command`);
+    }
+    customCommand = Object.freeze({
+      target: descriptor.target,
+      frontmatter: Object.freeze({ ...frontmatter }),
+      ...(descriptor.argumentsToken === undefined
+        ? {}
+        : { argumentsToken: descriptor.argumentsToken }),
+      ...(descriptor.includeUsage === undefined
+        ? {}
+        : { includeUsage: descriptor.includeUsage }),
+      ...(descriptor.inheritDisableModelInvocation === undefined
+        ? {}
+        : { inheritDisableModelInvocation: descriptor.inheritDisableModelInvocation })
+    });
+  }
+
   if (!candidate.sandbox || typeof candidate.sandbox.createTool !== 'function') {
     throw new Error(`Agent Client '${candidate.id}' requires a sandbox descriptor`);
   }
+  const image = freezeSandboxImageDescriptor(candidate.id, candidate.sandbox.image);
   const hookIds = new Set<string>();
   const hooks = Object.freeze(candidate.sandbox.hooks.map((hook) => {
     if (
@@ -515,9 +631,16 @@ function defineAgentClientAdapter(
     project: Object.freeze({
       ownedPathPrefixes: Object.freeze(paths),
       ...projectAssets,
-      seedCommands: Object.freeze(seedCommands)
+      seedCommands: Object.freeze(seedCommands),
+      ...(customCommand === undefined ? {} : { customCommand })
     }),
-    sandbox: Object.freeze({ createTool, aliases, hooks, recoveryChecks })
+    sandbox: Object.freeze({
+      createTool,
+      aliases,
+      hooks,
+      recoveryChecks,
+      ...(image === undefined ? {} : { image })
+    })
   });
 }
 
@@ -525,6 +648,7 @@ export { defineAgentClientAdapter };
 export type {
   AgentClientAdapter,
   AgentClientCapabilities,
+  AgentClientCustomCommandDescriptor,
   AgentClientDelegationEvidence,
   AgentClientManifestEntry,
   AgentClientModelSelectionContext,

package/lib/{sandbox/credentials.ts → agent-clients/adapters/claude-code-credentials.ts}

@@ -2,7 +2,8 @@ import { execFileSync } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { hostJoin } from './engines/wsl2-paths.ts';
+import { hostJoin } from '../../sandbox/engines/wsl2-paths.ts';
+import { redactCommandError } from '../../sandbox/redaction.ts';
 
 type ExecFn = (file: string, args: string[], options?: Record<string, unknown>) => string | Buffer | void;
 type ReadFn = (targetPath: string) => string;
@@ -112,12 +113,6 @@ type CredentialPayload = {
 
 const LOCKED_PATTERN = /errSecInteractionNotAllowed|User interaction is not allowed/i;
 const NOT_FOUND_PATTERN = /errSecItemNotFound|specified item could not be found/i;
-const REDACTION_PATTERNS = [
-  { pattern: /\{[^{}]*"claudeAiOauth"[\s\S]*?\}\s*\}/g, replacement: '[REDACTED credentials blob]' },
-  { pattern: /sk-ant-[A-Za-z0-9_-]{20,}/g, replacement: '[REDACTED claude token]' },
-  { pattern: /gh[psoru]_[A-Za-z0-9]{30,}/g, replacement: '[REDACTED github token]' },
-  { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]{20,}/gi, replacement: 'Bearer [REDACTED]' }
-];
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -131,18 +126,8 @@ function errorMessage(error: unknown): string {
   return error instanceof Error ? error.message : 'unknown error';
 }
 
-export function redactCommandError(text: unknown): string {
-  if (!text || typeof text !== 'string') {
-    return '';
-  }
-
-  return REDACTION_PATTERNS.reduce(
-    (result, { pattern, replacement }) => result.replace(pattern, replacement),
-    text
-  );
-}
-
 export const redactSecurityOutput = redactCommandError;
+export { redactCommandError };
 
 function extractStderrSafely(error: unknown): string {
   const stderr = typeof error === 'object' && error !== null && 'stderr' in error

package/lib/agent-clients/adapters/claude-code-refresh.ts

@@ -0,0 +1,128 @@
+import { homedir } from 'node:os';
+import { parseArgs } from 'node:util';
+import {
+  buildLockedGuidance,
+  discoverProjects,
+  formatCredentialWarnings,
+  formatRemaining,
+  reconcileClaudeCredentials,
+  redactCommandError,
+  validateClaudeCredentialsEnvOverride
+} from './claude-code-credentials.ts';
+import { runProbe } from '../../sandbox/shell.ts';
+
+const USAGE = 'Usage: ai sandbox refresh';
+
+type ReconcileOptions = NonNullable<Parameters<typeof reconcileClaudeCredentials>[1]>;
+
+type RefreshDeps = Partial<ReconcileOptions> & {
+  spawnFn?: typeof runProbe;
+  discoverFn?: typeof discoverProjects;
+  writeStdout?: (chunk: string) => unknown;
+  writeStderr?: (chunk: string) => unknown;
+};
+
+export function probeClaudeStatus(spawnFn: typeof runProbe = runProbe): { ok: boolean; stderr: string; error: string | null } {
+  const result = spawnFn('claude', ['/status'], {
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: 30_000
+  });
+  return {
+    ok: result.status === 0,
+    stderr: result.stderr?.toString() ?? '',
+    error: result.error?.message ?? null
+  };
+}
+
+export async function runClaudeCodeRefresh(args: string[], deps: RefreshDeps = {}): Promise<number> {
+  const {
+    spawnFn = runProbe,
+    execFn,
+    readFn,
+    existsFn,
+    writeFn,
+    writeHostFn,
+    discoverFn = discoverProjects,
+    writeStdout = (chunk: string) => process.stdout.write(chunk),
+    writeStderr = (chunk: string) => process.stderr.write(chunk)
+  } = deps;
+
+  if (args[0] === '--help' || args[0] === '-h' || args[0] === 'help') {
+    writeStdout(`${USAGE}\n`);
+    return 0;
+  }
+
+  const { positionals } = parseArgs({ args, allowPositionals: true, strict: true });
+  if (positionals.length > 0) {
+    throw new Error(USAGE);
+  }
+  validateClaudeCredentialsEnvOverride();
+
+  const home = homedir();
+  if (!home) {
+    throw new Error('sandbox: home directory is required');
+  }
+
+  const projects = discoverFn(home);
+  if (projects.length === 0) {
+    writeStdout('No project credentials to refresh.\n');
+    return 0;
+  }
+
+  const reconcileOptions = { execFn, readFn, existsFn, writeFn, writeHostFn, projects };
+  let result = reconcileClaudeCredentials(home, reconcileOptions);
+  if (result.status === 'STALE_ACCESS' && result.authoritative === null) {
+    writeStdout('Host credentials appear stale; probing claude /status to trigger refresh...\n');
+    const probe = probeClaudeStatus(spawnFn);
+    if (!probe.ok) {
+      writeStderr(`Probe failed: ${redactCommandError(probe.stderr || probe.error || 'unknown error')}\n`);
+      writeStderr('Run "claude /login" on the host to renew credentials.\n');
+      return 1;
+    }
+    writeStdout('Probe succeeded; re-inspecting host credentials.\n');
+    result = reconcileClaudeCredentials(home, reconcileOptions);
+  }
+
+  if (result.status === 'MISSING') {
+    writeStderr('No Claude Code credentials found on host.\n');
+    writeStderr('Run "claude /login" on the host to authenticate.\n');
+    return 1;
+  }
+
+  if (result.status === 'KEYCHAIN_LOCKED') {
+    writeStderr(`${buildLockedGuidance()}\n`);
+    return 1;
+  }
+
+  if (result.status === 'KEYCHAIN_ERROR') {
+    writeStderr(`Host keychain error: ${redactCommandError(result.detail || 'unknown error')}\n`);
+    writeStderr(`${buildLockedGuidance()}\n`);
+    return 1;
+  }
+
+  if (result.status === 'KEYCHAIN_WRITE_FAILED') {
+    writeStderr(`[host] keychain write failed: ${formatCredentialWarnings(result.warnings) || 'unknown error'}\n`);
+    return 1;
+  }
+
+  if (result.status !== 'OK') {
+    writeStderr('Host credentials still invalid after probe; run "claude /login".\n');
+    return 1;
+  }
+
+  if (result.authoritative && result.authoritative !== 'host' && result.hostWritten) {
+    writeStdout(`[host] reconciled from ${result.authoritative}\n`);
+  }
+
+  for (const project of projects) {
+    const action = result.filesWritten.includes(project) ? 'updated' : 'unchanged';
+    writeStdout(`[${project}] ${action}; expires in ${formatRemaining(result.expiresAt)}\n`);
+  }
+
+  for (const failure of result.fileErrors) {
+    writeStderr(`[${failure.project}] sync failed: ${failure.error}\n`);
+  }
+
+  return result.fileErrors.length > 0 ? 1 : 0;
+}