@fitlab-ai/agent-infra 0.9.4 → 0.9.6

package/lib/git/worktree-identity.ts

@@ -0,0 +1,86 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+
+type GitWorktreeIdentity = Readonly<{
+  worktreeRoot: string;
+  commonDir: string;
+  branch: string;
+}>;
+
+function normalizeCanonicalPath(value: string, platform: NodeJS.Platform = process.platform): string {
+  return platform === 'win32'
+    ? path.win32.normalize(value).replaceAll('/', '\\').toLowerCase()
+    : path.posix.normalize(value);
+}
+
+function sameFilesystemEntry(left: string, right: string, platform: NodeJS.Platform = process.platform): boolean {
+  const leftReal = fs.realpathSync.native(left);
+  const rightReal = fs.realpathSync.native(right);
+  const leftStat = fs.statSync(leftReal, { bigint: true });
+  const rightStat = fs.statSync(rightReal, { bigint: true });
+  if (leftStat.ino !== 0n && rightStat.ino !== 0n) {
+    return leftStat.dev === rightStat.dev && leftStat.ino === rightStat.ino;
+  }
+  return normalizeCanonicalPath(leftReal, platform) === normalizeCanonicalPath(rightReal, platform);
+}
+
+function git(root: string, args: string[]): string {
+  return execFileSync('git', args, {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe']
+  }).trim();
+}
+
+function resolveGitWorktreeIdentity(worktreeRoot: string): GitWorktreeIdentity {
+  try {
+    const canonical = fs.realpathSync.native(worktreeRoot);
+    const topLevel = fs.realpathSync.native(git(canonical, ['rev-parse', '--show-toplevel']));
+    if (!sameFilesystemEntry(canonical, topLevel)) {
+      throw new Error('worktree root is not the Git top-level directory');
+    }
+    const commonDir = fs.realpathSync.native(git(canonical, [
+      'rev-parse', '--path-format=absolute', '--git-common-dir'
+    ]));
+    const branch = git(canonical, ['symbolic-ref', '--short', 'HEAD']);
+    return { worktreeRoot: canonical, commonDir, branch };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`SANDBOX_CONTROL_WORKTREE_INVALID: ${message}`);
+  }
+}
+
+function assertGitWorktreeBinding(
+  stateRoot: string,
+  worktreeRoot: string,
+  expectedBranch: string
+): GitWorktreeIdentity {
+  const state = resolveGitWorktreeIdentity(stateRoot);
+  const worktree = resolveGitWorktreeIdentity(worktreeRoot);
+  if (!sameFilesystemEntry(state.commonDir, worktree.commonDir)) {
+    throw new Error('SANDBOX_CONTROL_WORKTREE_INVALID: state and worktree roots have different Git common directories');
+  }
+  if (worktree.branch !== expectedBranch) {
+    throw new Error(`SANDBOX_CONTROL_WORKTREE_INVALID: expected branch '${expectedBranch}', got '${worktree.branch}'`);
+  }
+  return worktree;
+}
+
+function assertGitRepositoryBinding(stateRoot: string, worktreeRoot: string): GitWorktreeIdentity {
+  const state = resolveGitWorktreeIdentity(stateRoot);
+  const worktree = resolveGitWorktreeIdentity(worktreeRoot);
+  if (!sameFilesystemEntry(state.commonDir, worktree.commonDir)) {
+    throw new Error('SANDBOX_CONTROL_WORKTREE_INVALID: state and worktree roots have different Git common directories');
+  }
+  return worktree;
+}
+
+export {
+  assertGitWorktreeBinding,
+  assertGitRepositoryBinding,
+  normalizeCanonicalPath,
+  resolveGitWorktreeIdentity,
+  sameFilesystemEntry
+};
+export type { GitWorktreeIdentity };

package/lib/internal/codex-lifecycle.ts

@@ -0,0 +1,308 @@
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import {
+  preflightCodexLifecycleEvidence,
+  resolveCodexTerminal,
+  resolveCodexThread
+} from '../agent-clients/adapters/codex-lifecycle/app-server.ts';
+import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.ts';
+import type { CodexLifecycleEvent } from '../agent-clients/adapters/codex-lifecycle/evidence.ts';
+import {
+  activateCodexOrchestrationDelegation,
+  activateCodexSpawnDelegation,
+  reconcileCodexOrchestrationDelegation,
+  sealCodexOrchestrationDelegation,
+  sealCodexParentDelegation
+} from '../task/codex-orchestration.ts';
+
+const USAGE = 'Usage: agent-infra-internal codex-lifecycle <hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
+const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
+
+type Parsed = Readonly<{ operation: string; values: Readonly<Record<string, string>> }>;
+type UnresolvedHookChild = Omit<Extract<CodexLifecycleEvent, { type: 'hook-child' }>, 'parentThreadId'>;
+
+function output(value: unknown): void {
+  process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+
+function failure(code: string, message: string): void {
+  output({ status: 'failed', changed: false, evidence: null, diagnostics: [], error: { code, message } });
+  process.exitCode = 1;
+}
+
+function outputBridgeResult(result: Awaited<ReturnType<typeof activateCodexOrchestrationDelegation>>): void {
+  if (result.error?.code === 'ORCHESTRATION_DELEGATION_MISSING') {
+    output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+    return;
+  }
+  output(result);
+  if (result.status !== 'running') process.exitCode = 1;
+}
+
+function parse(args: string[]): Parsed | null {
+  if (args[0] === '--help' || args[0] === '-h') {
+    process.stdout.write(USAGE);
+    return null;
+  }
+  const operation = args[0];
+  if (!operation) {
+    failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', 'operation is required');
+    return null;
+  }
+  const allowed = {
+    'hook-event': ['--event', '--bridge'],
+    'resolve-start': ['--child-id'],
+    'resolve-stop': ['--child-id'],
+    preflight: ['--format', '--session-id', '--turn-id', '--tool-use-id'],
+    consume: ['--child-id', '--consumer']
+  }[operation];
+  if (!allowed) {
+    failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', 'unknown operation');
+    return null;
+  }
+  const values: Record<string, string> = {};
+  for (let index = 1; index < args.length; index += 1) {
+    const flag = args[index]!;
+    if (!allowed.includes(flag) || Object.hasOwn(values, flag)) {
+      failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', `invalid or duplicate option '${flag}'`);
+      return null;
+    }
+    const value = args[++index];
+    if (!value || value.startsWith('--')) {
+      failure('CODEX_LIFECYCLE_PAYLOAD_INVALID', `option '${flag}' requires a value`);
+      return null;
+    }
+    values[flag] = value;
+  }
+  return Object.freeze({ operation, values: Object.freeze(values) });
+}
+
+function cliVersion(): string {
+  const result = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+  const version = /codex-cli\s+(\d+\.\d+\.\d+)/.exec(result.stdout ?? '')?.[1];
+  if (result.status !== 0 || !version) throw new Error('Codex CLI version is unavailable');
+  return version;
+}
+
+function hookDefinitionHash(): string {
+  const file = path.join(process.cwd(), '.codex', 'hooks.json');
+  return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+
+async function readStdin(): Promise<unknown> {
+  let input = '';
+  process.stdin.setEncoding('utf8');
+  for await (const chunk of process.stdin) {
+    input += chunk;
+    if (Buffer.byteLength(input) > 64 * 1024) throw new Error('Codex lifecycle input exceeds 64 KiB');
+  }
+  return JSON.parse(input || '{}') as unknown;
+}
+
+function recordFromPayload(phase: string, payload: unknown): CodexLifecycleEvent | UnresolvedHookChild | null {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+    throw new Error('Codex lifecycle hook payload must be an object');
+  }
+  const value = payload as Record<string, unknown>;
+  const text = (key: string) => typeof value[key] === 'string' ? value[key] as string : '';
+  if (!MANAGED_AGENT.test(text('nativeAgent'))) return null;
+  if (phase === 'pre-tool') return {
+    type: 'hook-spawn',
+    sessionId: text('sessionId'),
+    turnId: text('turnId'),
+    toolUseId: text('toolUseId'),
+    nativeAgent: text('nativeAgent'),
+    ...(text('requestedModel') ? { requestedModel: text('requestedModel') } : {}),
+    ...(text('requestedReasoningEffort') ? { requestedReasoningEffort: text('requestedReasoningEffort') } : {}),
+    hookDefinitionHash: text('hookDefinitionHash')
+  };
+  if (phase === 'subagent-start') return {
+    type: 'hook-child',
+    sessionId: text('sessionId'),
+    turnId: text('turnId'),
+    childThreadId: text('childThreadId'),
+    nativeAgent: text('nativeAgent')
+  };
+  if (phase === 'subagent-stop') return {
+    type: 'hook-stop',
+    sessionId: text('sessionId'),
+    turnId: text('turnId'),
+    childThreadId: text('childThreadId'),
+    nativeAgent: text('nativeAgent')
+  };
+  if (phase === 'post-tool') return null;
+  throw new Error(`unknown Codex lifecycle hook phase '${phase}'`);
+}
+
+function payloadText(payload: unknown, key: string): string {
+  return payload && typeof payload === 'object' && !Array.isArray(payload)
+    && typeof (payload as Record<string, unknown>)[key] === 'string'
+    ? (payload as Record<string, string>)[key]!
+    : '';
+}
+
+async function codexLifecycle(args: string[] = []): Promise<void> {
+  const parsed = parse(args);
+  if (!parsed || process.exitCode) return;
+  try {
+    if (parsed.operation === 'preflight') {
+      const format = parsed.values['--format'] ?? 'json';
+      if (!['text', 'json'].includes(format)) throw new Error("format must be 'text' or 'json'");
+      const runtimeFields = [
+        parsed.values['--session-id'],
+        parsed.values['--turn-id'],
+        parsed.values['--tool-use-id']
+      ];
+      if (runtimeFields.some(Boolean) && !runtimeFields.every(Boolean)) {
+        throw new Error('preflight runtime identity requires --session-id, --turn-id, and --tool-use-id together');
+      }
+      const runtimeIdentity = runtimeFields.every(Boolean) ? {
+        sessionId: runtimeFields[0]!,
+        turnId: runtimeFields[1]!,
+        toolUseId: runtimeFields[2]!
+      } : undefined;
+      const result = await preflightCodexLifecycleEvidence(process.cwd(), runtimeIdentity);
+      if (format === 'text') {
+        process.stdout.write(`Codex lifecycle static preflight: ready\nCLI: ${result.cliVersion}\nRuntime hook liveness: ${result.runtimeLiveness ? 'observed' : 'not-yet-observed'}\n`);
+      } else output({ status: 'ready', changed: false, evidence: result, diagnostics: result.diagnostics, error: null });
+      return;
+    }
+
+    const store = createCodexLifecycleStore({ cliVersion: cliVersion() });
+    if (parsed.operation === 'hook-event') {
+      const phase = parsed.values['--event'];
+      if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
+        throw new Error('hook-event requires a known --event');
+      }
+      if (parsed.values['--bridge'] !== undefined && parsed.values['--bridge'] !== 'true') {
+        throw new Error("hook-event --bridge must be 'true'");
+      }
+      const payload = await readStdin();
+      if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+        const toolName = payloadText(payload, 'toolName');
+        if (toolName === 'collaborationspawn_agent') {
+          const nativeAgent = payloadText(payload, 'nativeAgent');
+          if (!MANAGED_AGENT.test(nativeAgent)) {
+            output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+            return;
+          }
+          const requestedModel = payloadText(payload, 'requestedModel');
+          const requestedReasoningEffort = payloadText(payload, 'requestedReasoningEffort');
+          const bridged = await activateCodexSpawnDelegation({
+            sessionId: payloadText(payload, 'sessionId'),
+            turnId: payloadText(payload, 'turnId'),
+            toolUseId: payloadText(payload, 'toolUseId'),
+            transcriptPath: payloadText(payload, 'transcriptPath'),
+            nativeAgent,
+            taskName: payloadText(payload, 'taskName'),
+            ...(requestedModel ? { requestedModel } : {}),
+            ...(requestedReasoningEffort ? { requestedReasoningEffort } : {})
+          }, { store });
+          outputBridgeResult(bridged);
+          return;
+        }
+        if (toolName === 'collaborationwait_agent') {
+          outputBridgeResult(await sealCodexParentDelegation(payloadText(payload, 'sessionId'), { store }));
+          return;
+        }
+        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+        return;
+      }
+      const event = recordFromPayload(phase, payload);
+      if (!event) {
+        if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
+          const value = payload as Record<string, unknown>;
+          const childThreadId = String(value.childThreadId ?? '');
+          const reconciled = reconcileCodexOrchestrationDelegation(childThreadId);
+          outputBridgeResult(reconciled);
+          return;
+        }
+        output({ status: 'ignored', changed: false, evidence: null, diagnostics: [], error: null });
+        return;
+      }
+      if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+        try {
+          if (store.read(event.childThreadId).consumer) {
+            const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
+            outputBridgeResult(bridged);
+            return;
+          }
+        } catch {
+          // The normal apply path below owns missing or invalid evidence errors.
+        }
+      }
+      if (parsed.values['--bridge'] === 'true' && event.type === 'hook-child') {
+        const resolved = await resolveCodexThread(event.childThreadId);
+        store.apply({
+          ...event,
+          parentThreadId: resolved.resolution.thread.parentThreadId
+        });
+        const bridged = await activateCodexOrchestrationDelegation(event.childThreadId, {
+          store,
+          resolveThread: async () => resolved
+        });
+        outputBridgeResult(bridged);
+        return;
+      }
+      if (event.type === 'hook-child') {
+        const resolved = await resolveCodexThread(event.childThreadId);
+        const result = store.apply({
+          ...event,
+          parentThreadId: resolved.resolution.thread.parentThreadId
+        });
+        output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: resolved.diagnostics, error: result.state.error });
+        if (result.state.status === 'invalid') process.exitCode = 1;
+        return;
+      }
+      const result = store.apply(event);
+      if (parsed.values['--bridge'] === 'true' && event.type === 'hook-stop') {
+        const bridged = await sealCodexOrchestrationDelegation(event.childThreadId, { store });
+        outputBridgeResult(bridged);
+        return;
+      }
+      output({ status: result.state.status, changed: true, evidence: result.state, diagnostics: [], error: result.state.error });
+      if (result.state.status === 'invalid') process.exitCode = 1;
+      return;
+    }
+
+    const childThreadId = parsed.values['--child-id'];
+    if (!childThreadId) throw new Error(`operation '${parsed.operation}' requires --child-id`);
+    if (parsed.operation === 'resolve-start') {
+      if (store.read(childThreadId).state.spawn?.hookDefinitionHash !== hookDefinitionHash()) {
+        throw new Error('Codex lifecycle hook definition hash is stale');
+      }
+      const resolved = await resolveCodexThread(childThreadId);
+      let latest = store.apply(resolved.resolution.thread);
+      for (const reroute of resolved.reroutes) latest = store.apply(reroute);
+      latest = store.apply(resolved.resolution.settings);
+      output({ status: latest.state.status, changed: true, evidence: latest.state.startEvidence, diagnostics: resolved.diagnostics, error: latest.state.error });
+      if (latest.state.status !== 'start-ready') process.exitCode = 1;
+      return;
+    }
+    if (parsed.operation === 'resolve-stop') {
+      const terminal = await resolveCodexTerminal(childThreadId);
+      const latest = store.apply(terminal);
+      if (latest.state.status !== 'stop-ready') {
+        throw new Error(`Codex lifecycle stop evidence is not ready (status=${latest.state.status})`);
+      }
+      output({ status: latest.state.status, changed: true, evidence: latest.state.stopEvidence, diagnostics: [], error: latest.state.error });
+      return;
+    }
+    if (parsed.operation === 'consume') {
+      const consumer = parsed.values['--consumer'];
+      if (!consumer) throw new Error('consume requires --consumer');
+      const consumed = store.consume(childThreadId, consumer, hookDefinitionHash());
+      output({ status: 'consumed', changed: true, evidence: {
+        start: consumed.state.startEvidence,
+        stop: consumed.state.stopEvidence
+      }, diagnostics: [], error: null });
+    }
+  } catch (error) {
+    failure('CODEX_LIFECYCLE_FAILED', error instanceof Error ? error.message : String(error));
+  }
+}
+
+export { codexLifecycle };

package/lib/internal/release-workflow.ts

@@ -8,7 +8,7 @@ import { commitExplicitPaths, inspectGitWorkflow, pushGitRefs } from '../git/wor
 import { inspectPlatformRelease, reconcileReleaseMilestones } from '../platform/releases.ts';
 import { inspectHomebrewChannel, inspectNpmChannel } from '../release/channels.ts';
 import { releaseSnapshot } from '../release/workflow.ts';
-import type { ReleaseFacts } from '../release/workflow.ts';
+import type { PostReleaseFacts, ReleaseFacts } from '../release/workflow.ts';
 
 function command(cwd: string, executable: string, args: string[]) {
   return spawnSync(executable, args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
@@ -168,12 +168,52 @@ function inspectLocalReleaseFacts(cwd: string, version: string, run: CommandRunn
   const localTagConflict = Boolean(tagCommit && !localTag && !localTagAncestor);
   const postSubject = `chore: prepare next dev iteration after v${version}`;
   const postLog = localTag || localTagAncestor
-    ? git(cwd, ['log', '--format=%s', `${tag}..HEAD`], run) ?? ''
+    ? git(cwd, ['log', '--format=%H%x00%s', `${tag}..HEAD`], run) ?? ''
     : '';
-  const postCommit = postLog.split('\n').some((subject) => subject === postSubject);
+  const postCommit = postLog.split('\n').map((line) => line.split('\0'))
+    .find(([, subject]) => subject === postSubject)?.[0] ?? null;
   return { localTag, localTagAncestor, localTagConflict, postCommit };
 }
 
+function inspectPostReleaseFacts(
+  cwd: string,
+  commit: string | null,
+  run: CommandRunner = command
+): PostReleaseFacts {
+  const inspected = inspectGitWorkflow(cwd);
+  const snapshot = inspected.snapshot;
+  const branch = snapshot?.branch ?? '';
+  const remoteLine = branch ? git(cwd, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], run) : null;
+  const remoteHead = remoteLine?.split(/\s+/)[0] ?? null;
+  const packageJson = commit ? git(cwd, ['show', `${commit}:package.json`], run, false) : null;
+  let newVersion: string | null = null;
+  if (packageJson) {
+    try {
+      const version = (JSON.parse(packageJson) as { version?: unknown }).version;
+      newVersion = typeof version === 'string' ? version : null;
+    } catch {
+      newVersion = null;
+    }
+  }
+  const paths = commit ? git(cwd, ['diff-tree', '--root', '--no-commit-id', '--name-only', '-r', '-z', commit], run, false) : null;
+  const changedPaths = paths ? paths.split('\0').filter(Boolean)
+    .sort((left, right) => Buffer.from(left).compare(Buffer.from(right))) : [];
+  const digest = commit ? git(cwd, ['show', `${commit}:${DEMO_DIGEST_PATH}`], run) : null;
+  return {
+    commit,
+    isHead: Boolean(commit && snapshot?.head === commit),
+    published: Boolean(commit && remoteHead === commit),
+    branch,
+    upstream: snapshot?.upstream ?? null,
+    remoteHead,
+    newVersion,
+    changedPaths,
+    demoInputSha256: digest && /^[0-9a-f]{64}$/.test(digest) ? digest : null,
+    worktree: snapshot?.worktree ?? [],
+    staged: snapshot?.staged ?? []
+  };
+}
+
 function releaseSmokeStatus(workflows: Array<Record<string, unknown>>, version: string, tagCommit: string | null): ReleaseFacts['smoke'] {
   const manualTitle = `Post-Release Smoke v${version}`;
   const targets = workflows.filter((run) => {
@@ -220,12 +260,15 @@ async function inspectFacts(cwd: string, version: string): Promise<ReleaseFacts>
   const workflows = platform.workflows as Array<Record<string, unknown>>;
   const smoke = releaseSmokeStatus(workflows, version, localTagTarget);
   return {
-    ...local,
+    localTag: local.localTag,
+    localTagAncestor: local.localTagAncestor,
+    localTagConflict: local.localTagConflict,
     remoteBranch: Boolean(remoteBranch && remoteBranch.split(/\s+/)[0] === head), remoteTag: Boolean(remoteTag),
     githubRelease: platform.platform.type !== 'github'
       ? true
       : platform.status === 'blocked' ? null : Boolean(platform.release?.published),
-    npm: npm.published, homebrew: homebrew.published, smoke
+    npm: npm.published, homebrew: homebrew.published, smoke,
+    post: inspectPostReleaseFacts(cwd, local.postCommit)
   };
 }
 
@@ -258,13 +301,21 @@ function updateReleaseMetadata(cwd: string, version: string): void {
   }
 }
 
+function optionValues(args: string[], name: string): string[] {
+  const values: string[] = [];
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === name) values.push(args[index + 1] ?? '');
+  }
+  return values;
+}
+
 async function releaseWorkflow(args: string[] = []): Promise<void> {
   const [action, rawVersion, ...rest] = args;
   const version = String(rawVersion || '').replace(/^v/, '');
   const cwdIndex = rest.indexOf('--cwd');
   const cwd = path.resolve(cwdIndex >= 0 && rest[cwdIndex + 1] ? rest[cwdIndex + 1]! : process.cwd());
-  if (!['inspect', 'prepare', 'publish', 'post'].includes(action || '') || !semver.valid(version)) {
-    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'RELEASE_INPUT_INVALID', message: 'Usage: release-workflow inspect|prepare|publish|post <version>' } })}\n`);
+  if (!['inspect', 'prepare', 'publish', 'post-prepare', 'post-publish'].includes(action || '') || !semver.valid(version)) {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'RELEASE_INPUT_INVALID', message: 'Usage: release-workflow inspect|prepare|publish|post-prepare|post-publish <version>' } })}\n`);
     process.exitCode = 1; return;
   }
   const before = releaseSnapshot(version, await inspectFacts(cwd, version));
@@ -310,10 +361,51 @@ async function releaseWorkflow(args: string[] = []): Promise<void> {
     const result = pushGitRefs({ cwd, remote: 'origin', refs });
     process.stdout.write(`${JSON.stringify({ ...result, snapshot: releaseSnapshot(version, await inspectFacts(cwd, version)) })}\n`); process.exitCode = result.status === 'failed' ? 1 : result.status === 'degraded' ? 2 : 0; return;
   }
+  if (action === 'post-publish') {
+    const expectedValues = optionValues(rest, '--expected-sha256');
+    if (expectedValues.length !== 1 || !/^sha256:[0-9a-f]{64}$/.test(expectedValues[0]!)) {
+      process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'RELEASE_INPUT_INVALID', message: 'post-publish requires one --expected-sha256 sha256:<64 hex>' } })}\n`);
+      process.exitCode = 1; return;
+    }
+    if (before.phase === 'complete') {
+      process.stdout.write(`${JSON.stringify({ status: 'no-op', changed: false, snapshot: before, error: null })}\n`);
+      return;
+    }
+    const confirmation = 'postConfirmation' in before ? before.postConfirmation : null;
+    if (before.phase !== 'post-prepared' || !confirmation) {
+      process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: confirmation ? 'RELEASE_PHASE_INVALID' : 'RELEASE_POST_CONFIRMATION_UNAVAILABLE', message: 'Post-release facts cannot authorize publish' } })}\n`);
+      process.exitCode = 1; return;
+    }
+    if (confirmation.sha256 !== expectedValues[0]) {
+      process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'RELEASE_POST_SNAPSHOT_MISMATCH', message: 'Post-release confirmation snapshot changed' } })}\n`);
+      process.exitCode = 1; return;
+    }
+    const channelsComplete = before.facts.githubRelease === true && before.facts.npm === true && before.facts.homebrew === true;
+    if (!channelsComplete || before.facts.smoke !== 'success') {
+      process.stdout.write(`${JSON.stringify({ status: before.facts.smoke === 'failed' ? 'failed' : 'blocked', changed: false, snapshot: before, error: { code: 'RELEASE_CHANNELS_PENDING', message: 'Release channels or smoke workflow are not complete' } })}\n`);
+      process.exitCode = before.facts.smoke === 'failed' ? 1 : 2; return;
+    }
+    const pushed = pushGitRefs({ cwd, remote: 'origin', refs: [before.facts.post.branch] });
+    const snapshot = releaseSnapshot(version, await inspectFacts(cwd, version));
+    if (snapshot.phase === 'complete') {
+      process.stdout.write(`${JSON.stringify({ ...pushed, status: 'applied', changed: true, snapshot, error: null })}\n`);
+      return;
+    }
+    const blocked = pushed.status !== 'failed';
+    process.stdout.write(`${JSON.stringify({ ...pushed, status: blocked ? 'blocked' : 'failed', snapshot, error: pushed.error ?? { code: 'RELEASE_PROGRESS_PENDING', message: 'Post-release push is not visible at the expected remote head' } })}\n`);
+    process.exitCode = blocked ? 2 : 1; return;
+  }
+
   if (before.phase === 'complete') {
     process.stdout.write(`${JSON.stringify({ status: 'no-op', changed: false, snapshot: before, error: null })}\n`);
     return;
   }
+  if (before.phase === 'post-prepared') {
+    const confirmation = 'postConfirmation' in before ? before.postConfirmation : null;
+    const status = confirmation ? 'no-op' : 'blocked';
+    process.stdout.write(`${JSON.stringify({ status, changed: false, snapshot: before, error: confirmation ? null : { code: 'RELEASE_POST_CONFIRMATION_UNAVAILABLE', message: 'Post commit is not the clean current HEAD' } })}\n`);
+    process.exitCode = confirmation ? 0 : 2; return;
+  }
   const channelsComplete = before.facts.githubRelease === true && before.facts.npm === true && before.facts.homebrew === true;
   if (!['published', 'post-pending'].includes(before.phase) || !channelsComplete || before.facts.smoke !== 'success') {
     process.stdout.write(`${JSON.stringify({ status: before.facts.smoke === 'failed' ? 'failed' : 'blocked', changed: false, snapshot: before, error: { code: 'RELEASE_CHANNELS_PENDING', message: 'Release channels or smoke workflow are not complete' } })}\n`); process.exitCode = before.facts.smoke === 'failed' ? 1 : 2; return;
@@ -338,10 +430,14 @@ async function releaseWorkflow(args: string[] = []): Promise<void> {
   }
   const committed = commitExplicitPaths({ cwd, paths: changedPaths(cwd), message: `chore: prepare next dev iteration after v${version}` });
   if (committed.status === 'failed') { process.stdout.write(`${JSON.stringify(committed)}\n`); process.exitCode = 1; return; }
-  const branch = git(cwd, ['branch', '--show-current']) || '';
-  const pushed = pushGitRefs({ cwd, remote: 'origin', refs: [branch] });
-  process.stdout.write(`${JSON.stringify({ ...pushed, demo, snapshot: releaseSnapshot(version, await inspectFacts(cwd, version)) })}\n`); process.exitCode = pushed.status === 'failed' ? 1 : pushed.status === 'degraded' ? 2 : 0;
+  const snapshot = releaseSnapshot(version, await inspectFacts(cwd, version));
+  const confirmation = 'postConfirmation' in snapshot ? snapshot.postConfirmation : null;
+  if (snapshot.phase !== 'post-prepared' || !confirmation) {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: true, demo, snapshot, error: { code: 'RELEASE_POST_CONFIRMATION_UNAVAILABLE', message: 'Prepared post commit did not produce a confirmation snapshot' } })}\n`);
+    process.exitCode = 1; return;
+  }
+  process.stdout.write(`${JSON.stringify({ status: 'applied', changed: true, demo, snapshot, error: null })}\n`);
 }
 
-export { changedPaths, computeDemoInputDigest, inspectFacts, inspectLocalReleaseFacts, inspectPostWorktree, releaseSmokeStatus, releaseWorkflow, runOptionalDemo };
+export { changedPaths, computeDemoInputDigest, inspectFacts, inspectLocalReleaseFacts, inspectPostReleaseFacts, inspectPostWorktree, releaseSmokeStatus, releaseWorkflow, runOptionalDemo };
 export type { CommandRunner, DemoResult };

package/lib/internal/sandbox-control.ts

@@ -1,24 +1,56 @@
-import { requestSandboxControl } from '../sandbox/control/client.ts';
+import { requestSandboxControl, SandboxControlClientError } from '../sandbox/control/client.ts';
 import { serveSandboxControl } from '../sandbox/control/server.ts';
+import { runSandboxControlExecutor } from '../sandbox/control/executor.ts';
 
-function sandboxControl(args: string[]): void {
+async function sandboxControl(args: string[]): Promise<void> {
   const [operation, ...rest] = args;
   if (operation === 'serve') {
     const manifestIndex = rest.indexOf('--manifest');
     const manifest = manifestIndex >= 0 ? rest[manifestIndex + 1] : undefined;
     if (!manifest) throw new Error('sandbox-control serve requires --manifest');
-    serveSandboxControl(manifest);
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    process.once('SIGINT', abort);
+    process.once('SIGTERM', abort);
+    try {
+      await serveSandboxControl(manifest, controller.signal);
+    } finally {
+      process.off('SIGINT', abort);
+      process.off('SIGTERM', abort);
+    }
+    return;
+  }
+  if (operation === 'execute') {
+    const requestIndex = rest.indexOf('--request');
+    const nonceIndex = rest.indexOf('--nonce');
+    const request = requestIndex >= 0 ? rest[requestIndex + 1] : undefined;
+    const nonce = nonceIndex >= 0 ? rest[nonceIndex + 1] : undefined;
+    if (!request || !nonce) throw new Error('sandbox-control execute requires --request and --nonce');
+    await runSandboxControlExecutor(request, nonce);
     return;
   }
   if (operation === 'client') {
     const [family = '', ...commandArgs] = rest;
-    const response = requestSandboxControl({ family, args: commandArgs });
+    let response;
+    try {
+      response = requestSandboxControl({ family, args: commandArgs });
+    } catch (error) {
+      if (!(error instanceof SandboxControlClientError)) throw error;
+      process.stderr.write(`${error.detail.message}\n`);
+      process.exitCode = error.detail.retryable ? 75 : 1;
+      return;
+    }
     process.stdout.write(response.stdout);
     process.stderr.write(response.stderr);
-    process.exitCode = response.exitCode;
+    if (response.phase === 'rejected') {
+      process.stderr.write(response.error?.message ?? response.stderr);
+      process.exitCode = response.error?.retryable ? 75 : 1;
+    } else {
+      process.exitCode = response.exitCode ?? 1;
+    }
     return;
   }
-  throw new Error('Usage: agent-infra-internal sandbox-control serve --manifest <path> | client <family> [args...]');
+  throw new Error('Usage: agent-infra-internal sandbox-control serve --manifest <path> | execute --request <path> --nonce <nonce> | client <family> [args...]');
 }
 
 export { sandboxControl };