@fitlab-ai/agent-infra 0.9.4 → 0.9.6

package/lib/internal/task-create.ts

@@ -0,0 +1,61 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { requestSandboxTaskCreate, SandboxControlClientError } from '../sandbox/control/client.ts';
+import { SANDBOX_CONTROL_MAX_BYTES } from '../sandbox/control/protocol.ts';
+import { validateTaskCreateCandidate } from '../task/create.ts';
+import { createTask, type TaskCreateResult } from '../task/create-service.ts';
+
+function failed(code: string, message: string, retryable = false): TaskCreateResult {
+  return {
+    status: retryable ? 'blocked' : 'failed', changed: false, task: { id: null, shortId: null }, issue: null,
+    operations: [], warnings: [], error: { code, message, retryable }
+  };
+}
+
+function output(result: TaskCreateResult): void {
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  process.exitCode = result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+}
+
+function taskCreate(args: string[]): void {
+  const inputIndex = args.indexOf('--input');
+  const input = inputIndex >= 0 ? args[inputIndex + 1] : undefined;
+  if (!input || args.length !== 2 || inputIndex !== 0) {
+    output(failed('TASK_CREATE_PAYLOAD_INVALID', 'Usage: agent-infra-internal task-create --input <candidate.json>'));
+    return;
+  }
+  try {
+    const inputPath = path.resolve(input);
+    const stat = fs.lstatSync(inputPath);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('TASK_CREATE_INPUT_INVALID: input must be a regular file');
+    if (stat.size > SANDBOX_CONTROL_MAX_BYTES) throw new Error('TASK_CREATE_INPUT_TOO_LARGE: input exceeds the control limit');
+    const candidate = validateTaskCreateCandidate(JSON.parse(fs.readFileSync(inputPath, 'utf8')));
+    if (process.env.AGENT_INFRA_CONTROL_TOKEN) {
+      const response = requestSandboxTaskCreate({ candidate });
+      if (response.phase === 'rejected') {
+        output(failed(
+          response.error?.code ?? 'SANDBOX_CONTROL_REJECTED',
+          response.error?.message ?? response.stderr,
+          response.error?.retryable ?? false
+        ));
+        return;
+      }
+      process.stdout.write(response.stdout);
+      process.stderr.write(response.stderr);
+      process.exitCode = response.exitCode;
+      return;
+    }
+    output(createTask(candidate, { repoRoot: process.cwd() }));
+  } catch (error) {
+    if (error instanceof SandboxControlClientError) {
+      output(failed(error.detail.code, error.detail.message, error.detail.retryable));
+      return;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_INPUT_INVALID';
+    output(failed(code, message));
+  }
+}
+
+export { taskCreate };

package/lib/internal/task-orchestration.ts

@@ -9,18 +9,20 @@ import {
   checkpointCommitIntent,
   completeCommitIntent,
   pauseOrchestration,
-  prepareOrchestrationDelegation,
   recoverCommitIntent,
   routeOrchestration,
   sealMatchingOrchestrationDelegation,
   sealOrchestrationDelegation,
+  startCommitAttempt,
   statusCommitIntent,
-  statusOrchestration
+  statusOrchestration,
+  terminateCommitAttempt
 } from '../task/orchestration.ts';
+import { prepareCodexOrchestrationDelegation } from '../task/codex-orchestration.ts';
 import { isAgentClientId } from '../agent-clients/types.ts';
 import type { AgentClientId } from '../agent-clients/types.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-status> [options]\n';
+const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-start|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-terminate|commit-status> [options]\n';
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({
@@ -31,7 +33,7 @@ function usageFailure(message: string): void {
   process.exitCode = 2;
 }
 
-function taskOrchestration(args: string[] = []): void {
+async function taskOrchestration(args: string[] = []): Promise<void> {
   if (args[0] === '--help' || args[0] === '-h') {
     process.stdout.write(USAGE);
     return;
@@ -43,7 +45,7 @@ function taskOrchestration(args: string[] = []): void {
   const [taskRef, intent] = args;
   if (![
     'begin-or-resume', 'route', 'prepare', 'hook-start', 'hook-stop', 'advance', 'pause', 'status',
-    'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-status'
+    'commit-start', 'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-terminate', 'commit-status'
   ].includes(intent!)) {
     usageFailure(`unknown intent '${intent}'`);
     return;
@@ -67,6 +69,7 @@ function taskOrchestration(args: string[] = []): void {
       '--model-fallback-reason', '--reasoning-effort-fallback-reason',
       '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent',
       '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
+      , '--attempt', '--git-worktree-root'
     ].includes(flag)) {
       usageFailure(`unknown option '${flag}'`);
       return;
@@ -84,12 +87,14 @@ function taskOrchestration(args: string[] = []): void {
     values[flag] = value;
   }
   const commitIntentFlags: Record<string, readonly string[]> = {
-    'commit-begin': ['--agent', '--baseline-head', '--orchestrated'],
-    'commit-checkpoint': ['--token', '--kind', '--head', '--remote', '--ref'],
-    'commit-complete': ['--token', '--agent'],
-    'commit-recover': ['--agent'],
-    'commit-abort': ['--token', '--expected-head'],
-    'commit-status': []
+    'commit-start': ['--agent', '--git-worktree-root'],
+    'commit-begin': ['--agent', '--baseline-head', '--attempt', '--orchestrated', '--git-worktree-root'],
+    'commit-checkpoint': ['--token', '--kind', '--head', '--remote', '--ref', '--git-worktree-root'],
+    'commit-complete': ['--token', '--agent', '--git-worktree-root'],
+    'commit-recover': ['--agent', '--git-worktree-root'],
+    'commit-abort': ['--token', '--expected-head', '--git-worktree-root'],
+    'commit-terminate': ['--attempt', '--agent', '--code', '--git-worktree-root'],
+    'commit-status': ['--git-worktree-root']
   };
   if (intent! in commitIntentFlags) {
     const allowed = commitIntentFlags[intent!]!;
@@ -97,24 +102,33 @@ function taskOrchestration(args: string[] = []): void {
     if (invalid) { usageFailure(`intent '${intent}' does not accept '${invalid}'`); return; }
   } else {
     const commitOnly = [...seen].find((flag) => [
-      '--orchestrated', '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
+      '--orchestrated', '--baseline-head', '--attempt', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
     ].includes(flag));
     if (commitOnly) { usageFailure(`intent '${intent}' does not accept '${commitOnly}'`); return; }
   }
   const requireValues = (flags: string[]) => flags.find((flag) => values[flag] === undefined);
+  const coreOptions = values['--git-worktree-root'] === undefined
+    ? {}
+    : { gitWorktreeRoot: values['--git-worktree-root'] };
   if (values['--client'] !== undefined && !isAgentClientId(values['--client'])) {
     usageFailure(`unknown client '${values['--client']}'`);
     return;
   }
   let result;
-  if (intent === 'commit-begin') {
-    const missing = requireValues(['--agent', '--baseline-head']);
+  if (intent === 'commit-start') {
+    const missing = requireValues(['--agent']);
+    if (missing) { usageFailure(`intent 'commit-start' requires '${missing}'`); return; }
+    const agent = normalizeAgentToken(values['--agent']!);
+    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
+    result = startCommitAttempt(taskRef!, { agent }, coreOptions);
+  } else if (intent === 'commit-begin') {
+    const missing = requireValues(['--agent', '--baseline-head', '--attempt']);
     if (missing) { usageFailure(`intent 'commit-begin' requires '${missing}'`); return; }
     const agent = normalizeAgentToken(values['--agent']!);
     if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
     result = beginCommitIntent(taskRef!, {
-      agent, orchestrated, baselineHead: values['--baseline-head']!
-    });
+      agent, orchestrated, baselineHead: values['--baseline-head']!, attempt: values['--attempt']!
+    }, coreOptions);
   } else if (intent === 'commit-checkpoint') {
     const missing = requireValues(['--token', '--kind', '--head']);
     if (missing) { usageFailure(`intent 'commit-checkpoint' requires '${missing}'`); return; }
@@ -130,25 +144,36 @@ function taskOrchestration(args: string[] = []): void {
     result = checkpointCommitIntent(taskRef!, {
       token: values['--token']!, kind: values['--kind'] as 'committed' | 'pushed',
       head: values['--head']!, remote: values['--remote'], ref: values['--ref']
-    });
+    }, coreOptions);
   } else if (intent === 'commit-complete') {
     const missing = requireValues(['--token', '--agent']);
     if (missing) { usageFailure(`intent 'commit-complete' requires '${missing}'`); return; }
     const agent = normalizeAgentToken(values['--agent']!);
     if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    result = completeCommitIntent(taskRef!, { token: values['--token']!, agent });
+    result = completeCommitIntent(taskRef!, { token: values['--token']!, agent }, coreOptions);
   } else if (intent === 'commit-recover') {
     const missing = requireValues(['--agent']);
     if (missing) { usageFailure(`intent 'commit-recover' requires '${missing}'`); return; }
     const agent = normalizeAgentToken(values['--agent']!);
     if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    result = recoverCommitIntent(taskRef!, { agent });
+    result = recoverCommitIntent(taskRef!, { agent }, coreOptions);
   } else if (intent === 'commit-abort') {
     const missing = requireValues(['--token', '--expected-head']);
     if (missing) { usageFailure(`intent 'commit-abort' requires '${missing}'`); return; }
-    result = abortCommitIntent(taskRef!, { token: values['--token']!, expectedHead: values['--expected-head']! });
+    result = abortCommitIntent(taskRef!, { token: values['--token']!, expectedHead: values['--expected-head']! }, coreOptions);
+  } else if (intent === 'commit-terminate') {
+    const missing = requireValues(['--attempt', '--agent', '--code']);
+    if (missing) { usageFailure(`intent 'commit-terminate' requires '${missing}'`); return; }
+    const agent = normalizeAgentToken(values['--agent']!);
+    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
+    if (!/^[A-Z][A-Z0-9_]{2,63}$/.test(values['--code']!)) {
+      usageFailure('--code must be a stable uppercase identifier'); return;
+    }
+    result = terminateCommitAttempt(taskRef!, {
+      attempt: values['--attempt']!, agent, code: values['--code']!
+    }, coreOptions);
   } else if (intent === 'commit-status') {
-    result = statusCommitIntent(taskRef!);
+    result = statusCommitIntent(taskRef!, coreOptions);
   } else if (intent === 'begin-or-resume') {
     const missing = requireValues(['--client']);
     if (missing) { usageFailure(`intent 'begin-or-resume' requires '${missing}'`); return; }
@@ -166,6 +191,7 @@ function taskOrchestration(args: string[] = []): void {
       return;
     }
     result = beginOrResumeOrchestration(taskRef!, {
+      ...coreOptions,
       maxSteps,
       client: values['--client'] as AgentClientId,
       modelPolicy: hasAnyPolicy ? {
@@ -180,17 +206,17 @@ function taskOrchestration(args: string[] = []): void {
       } : undefined
     });
   } else if (intent === 'route') {
-    result = routeOrchestration(taskRef!);
+    result = routeOrchestration(taskRef!, coreOptions);
   } else if (intent === 'status') {
-    result = statusOrchestration(taskRef!);
+    result = statusOrchestration(taskRef!, coreOptions);
   } else if (intent === 'prepare') {
     const missing = requireValues(['--client']);
     if (missing) { usageFailure(`intent 'prepare' requires '${missing}'`); return; }
-    result = prepareOrchestrationDelegation(taskRef!, {
+    result = await prepareCodexOrchestrationDelegation(taskRef!, {
       client: values['--client'] as AgentClientId,
       requestedModel: values['--requested-model'],
       requestedReasoningEffort: values['--requested-reasoning-effort']
-    });
+    }, { orchestrationOptions: coreOptions });
   } else if (intent === 'hook-start') {
     const missing = requireValues([
       ...(taskRef === 'auto' ? ['--client'] : []),
@@ -206,15 +232,15 @@ function taskOrchestration(args: string[] = []): void {
       reasoningEffortFallbackReason: values['--reasoning-effort-fallback-reason']
     };
     result = taskRef === 'auto'
-      ? activateMatchingOrchestrationDelegation(values['--client'] as AgentClientId, event)
-      : activateOrchestrationDelegation(taskRef!, event);
+      ? activateMatchingOrchestrationDelegation(values['--client'] as AgentClientId, event, coreOptions)
+      : activateOrchestrationDelegation(taskRef!, event, coreOptions);
   } else if (intent === 'hook-stop') {
     if (taskRef === 'auto') {
       const missing = requireValues(['--client', '--native-agent', '--child-id']);
       if (missing) { usageFailure(`intent 'hook-stop' requires '${missing}'`); return; }
       result = sealMatchingOrchestrationDelegation(values['--client'] as AgentClientId, {
         nativeAgent: values['--native-agent']!, childId: values['--child-id']!
-      });
+      }, coreOptions);
     } else {
       const missing = requireValues(['--child-id', '--exit-code', '--after-fingerprint']);
       if (missing) { usageFailure(`intent 'hook-stop' requires '${missing}'`); return; }
@@ -224,15 +250,15 @@ function taskOrchestration(args: string[] = []): void {
         childId: values['--child-id']!, exitCode,
         afterFingerprint: values['--after-fingerprint']!,
         changedPaths: values['--changed-paths'] ? values['--changed-paths']!.split(',').filter(Boolean) : []
-      });
+      }, coreOptions);
     }
   } else if (intent === 'advance') {
-    result = advanceOrchestration(taskRef!);
+    result = advanceOrchestration(taskRef!, coreOptions);
   } else {
     const missing = requireValues(['--code', '--message', '--recoverable']);
     if (missing) { usageFailure(`intent 'pause' requires '${missing}'`); return; }
     if (!['true', 'false'].includes(values['--recoverable']!)) { usageFailure('--recoverable must be true or false'); return; }
-    result = pauseOrchestration(taskRef!, values['--code']!, values['--message']!, values['--recoverable'] === 'true');
+    result = pauseOrchestration(taskRef!, values['--code']!, values['--message']!, values['--recoverable'] === 'true', coreOptions);
   }
   process.stdout.write(`${JSON.stringify(result)}\n`);
   if (result.status === 'failed') process.exitCode = 1;

package/lib/platform/issue-comments.ts

@@ -39,6 +39,7 @@ const ARTIFACT_TITLES: Record<string, string> = {
   code: '实现报告',
   'review-code': '代码审查',
   'manual-validation': '人工验证报告',
+  'validation-run': '验证运行证据',
   'pr-review': 'PR 审查报告'
 };
 
@@ -75,7 +76,7 @@ function renderTaskComment(content: string, taskId: string, agent: string): stri
 
 function artifactIdentity(artifact: string): { stem: string; title: string } {
   const stem = path.basename(artifact, '.md');
-  const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|pr-review)(?:-r(\d+))?$/);
+  const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
   if (!match) throw new Error(`unsupported artifact '${artifact}'`);
   const base = ARTIFACT_TITLES[match[1]!]!;
   const round = match[2] ? Number(match[2]) : 1;

package/lib/release/workflow.ts

@@ -1,32 +1,81 @@
-type ReleasePhase = 'unprepared' | 'prepared' | 'partially-published' | 'published' | 'post-pending' | 'complete';
-type ReleaseFacts = { localTag: boolean; localTagAncestor?: boolean; localTagConflict?: boolean; remoteBranch: boolean; remoteTag: boolean; githubRelease: boolean | null; npm: boolean | null; homebrew: boolean | null; smoke: 'success' | 'pending' | 'failed' | null; postCommit: boolean };
+import crypto from 'node:crypto';
+
+type ReleasePhase = 'unprepared' | 'prepared' | 'partially-published' | 'published' | 'post-pending' | 'post-prepared' | 'complete';
+type PostReleaseFacts = {
+  commit: string | null;
+  isHead: boolean;
+  published: boolean;
+  branch: string;
+  upstream: string | null;
+  remoteHead: string | null;
+  newVersion: string | null;
+  changedPaths: string[];
+  demoInputSha256: string | null;
+  worktree: string[];
+  staged: string[];
+};
+type ReleaseFacts = {
+  localTag: boolean;
+  localTagAncestor?: boolean;
+  localTagConflict?: boolean;
+  remoteBranch: boolean;
+  remoteTag: boolean;
+  githubRelease: boolean | null;
+  npm: boolean | null;
+  homebrew: boolean | null;
+  smoke: 'success' | 'pending' | 'failed' | null;
+  post: PostReleaseFacts;
+};
+type PostConfirmation = {
+  version: string;
+  commit: string;
+  branch: string;
+  upstream: string | null;
+  remoteHead: string | null;
+  newVersion: string | null;
+  changedPaths: string[];
+  demoInputSha256: string | null;
+  worktree: string[];
+  staged: string[];
+  sha256: string;
+};
+
+function byteSort(values: readonly string[]): string[] {
+  return [...values].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+}
 
 function deriveReleasePhase(facts: ReleaseFacts): ReleasePhase {
   if (!facts.localTag && !facts.localTagAncestor) return 'unprepared';
+  if (facts.post.commit) return facts.post.published ? 'complete' : 'post-prepared';
   if (!facts.remoteBranch && !facts.remoteTag) return 'prepared';
   if (!facts.remoteBranch || !facts.remoteTag) return 'partially-published';
   if (facts.githubRelease !== true || facts.npm !== true || facts.homebrew !== true) return 'published';
-  if (facts.smoke !== 'success' || !facts.postCommit) return 'post-pending';
-  return 'complete';
+  return 'post-pending';
 }
 
-function releaseSnapshot(version: string, facts: ReleaseFacts) {
-  return { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+function createPostConfirmation(version: string, post: PostReleaseFacts): PostConfirmation | null {
+  if (!post.commit || !post.isHead || post.worktree.length || post.staged.length) return null;
+  const canonical = {
+    version,
+    commit: post.commit,
+    branch: post.branch,
+    upstream: post.upstream,
+    remoteHead: post.remoteHead,
+    newVersion: post.newVersion,
+    changedPaths: byteSort(post.changedPaths),
+    demoInputSha256: post.demoInputSha256,
+    worktree: byteSort(post.worktree),
+    staged: byteSort(post.staged)
+  };
+  const sha256 = `sha256:${crypto.createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
+  return { ...canonical, sha256 };
 }
 
-async function runReleaseAction(input: { version: string; action: 'inspect' | 'prepare' | 'publish' | 'post'; inspect: () => Promise<ReleaseFacts>; prepare?: () => Promise<void>; publish?: () => Promise<void>; post?: () => Promise<void> }) {
-  const before = releaseSnapshot(input.version, await input.inspect());
-  if (input.action === 'inspect') return { status: 'no-op' as const, changed: false, before, snapshot: before, error: null };
-  if (before.facts.localTagConflict) return { status: 'failed' as const, changed: false, before, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag ${before.tag} is not reachable from HEAD` } };
-  const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
-    : input.action === 'publish' ? before.facts.localTag && ['prepared', 'partially-published'].includes(before.phase)
-      : ['published', 'post-pending'].includes(before.phase);
-  if (!allowed) return { status: before.phase === 'complete' ? 'no-op' as const : 'failed' as const, changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };
-  await input[input.action]?.();
-  const snapshot = releaseSnapshot(input.version, await input.inspect());
-  const progressed = snapshot.phase !== before.phase;
-  return { status: progressed ? 'applied' as const : 'blocked' as const, changed: progressed, before, snapshot, error: progressed ? null : { code: 'RELEASE_PROGRESS_PENDING', message: `${input.action} has not reached the next observable phase` } };
+function releaseSnapshot(version: string, facts: ReleaseFacts) {
+  const snapshot = { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+  const postConfirmation = createPostConfirmation(version, facts.post);
+  return postConfirmation ? { ...snapshot, postConfirmation } : snapshot;
 }
 
-export { deriveReleasePhase, releaseSnapshot, runReleaseAction };
-export type { ReleaseFacts, ReleasePhase };
+export { createPostConfirmation, deriveReleasePhase, releaseSnapshot };
+export type { PostConfirmation, PostReleaseFacts, ReleaseFacts, ReleasePhase };

package/lib/sandbox/commands/create.ts

@@ -2,10 +2,9 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { execFileSync, spawn } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import type { ExecFileSyncOptions, StdioOptions } from 'node:child_process';
 import { parseArgs } from 'node:util';
-import { fileURLToPath } from 'node:url';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { listAgentClientAdapters } from '../../agent-clients/registry.ts';
@@ -67,14 +66,16 @@ import type { SandboxTool, TmpfsSeedEntry } from '../tools.ts';
 import {
   assertFreshSandboxReady,
   hydrateTmpfsSeedEntries,
-  prepareTmpfsMounts
+  prepareTmpfsMounts,
+  startSandboxControlBroker
 } from '../recovery.ts';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.ts';
 import { sandboxCoreBindMounts } from '../mounts.ts';
 import {
   assertSandboxTaskSource,
   materializeSandboxControl,
-  materializeSandboxWorkspaceView
+  materializeSandboxWorkspaceView,
+  prepareSandboxWorkspaceMountTargets
 } from '../workspace-view.ts';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.ts';
 import { validateSelinuxDisableEnv } from '../engines/selinux.ts';
@@ -157,12 +158,6 @@ type HostShellConfig = {
   mounts: Array<{ hostPath: string; containerPath: string }>;
 };
 
-function internalCliPath(): string {
-  const directory = path.dirname(fileURLToPath(import.meta.url));
-  const extension = path.extname(fileURLToPath(import.meta.url));
-  return path.resolve(directory, '..', '..', '..', 'bin', `internal-cli${extension}`);
-}
-
 function resolveToolDirs(config: Pick<SandboxCreateConfig, 'project'>, tools: SandboxTool[], branch: string): ResolvedTool[] {
   return tools.map((tool) => {
     const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -1254,9 +1249,13 @@ export async function create(args: string[]): Promise<void> {
                 const requestedDescription = target.workspace.mode === 'task-bound'
                   ? `task-bound:${target.workspace.taskId}`
                   : target.workspace.mode;
+                const recoveryTarget = target.workspace.mode === 'task-bound'
+                  ? target.workspace.taskId
+                  : branch;
                 throw new Error(
                   `SANDBOX_WORKSPACE_IDENTITY_CONFLICT: container '${name}' is ${existingDescription}, `
-                  + `but this request is ${requestedDescription}. Run 'ai sandbox rm ${branch}' and retry.`
+                  + `but this request is ${requestedDescription}. `
+                  + `Run 'ai sandbox start --recreate ${recoveryTarget}' on the host, then retry.`
                 );
               }
             }
@@ -1342,9 +1341,11 @@ export async function create(args: string[]): Promise<void> {
               container,
               identity: target.workspace
             });
+            prepareSandboxWorkspaceMountTargets(worktree);
             const control = materializeSandboxControl({
               base: effectiveConfig.controlBase,
               repoRoot: effectiveConfig.repoRoot,
+              worktreeRoot: worktree,
               project: effectiveConfig.project,
               container,
               branch,
@@ -1361,6 +1362,7 @@ export async function create(args: string[]): Promise<void> {
               shellConfigHostDir: hostShellConfig.hostDir,
               workspaceViewRoot: workspaceView.root,
               controlDir: control.channelDir,
+              controlStatusDir: control.statusDir,
               ...(target.workspace.mode === 'task-bound'
                 ? {
                   taskSource: assertSandboxTaskSource(
@@ -1444,7 +1446,11 @@ export async function create(args: string[]): Promise<void> {
               '-e',
               `AGENT_INFRA_CONTROL_TOKEN=${control.token}`,
               '-e',
+              `AGENT_INFRA_CONTROL_GENERATION=${control.generation}`,
+              '-e',
               'AGENT_INFRA_CONTROL_DIR=/run/agent-infra/control',
+              '-e',
+              'AGENT_INFRA_CONTROL_STATUS_DIR=/run/agent-infra/control-status',
               '--label',
               `${sandboxRuntimeCapabilityLabel(effectiveConfig)}=${capabilityPlan.runtimeSignature}`,
               ...coreVolumes,
@@ -1466,16 +1472,7 @@ export async function create(args: string[]): Promise<void> {
               '/workspace',
               effectiveConfig.imageName
             ]);
-            const broker = spawn(
-              process.execPath,
-              [internalCliPath(), 'sandbox-control', 'serve', '--manifest', control.manifestPath],
-              { cwd: effectiveConfig.repoRoot, detached: true, stdio: 'ignore' }
-            );
-            broker.once('error', () => {
-              // Fresh readiness verification below remains the source of truth;
-              // consume detached spawn errors so they cannot crash the command.
-            });
-            broker.unref();
+            await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
             createdTmpfsSeedPlan = tmpfsSeedPlan;
           } finally {
             envFile.cleanup();

package/lib/sandbox/commands/prune.ts

@@ -6,16 +6,27 @@ import pc from 'picocolors';
 import { loadConfig } from '../config.ts';
 import type { SandboxConfig } from '../config.ts';
 import { safeNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.ts';
-import { detectEngine } from '../engine.ts';
+import { detectEngine, ENGINES } from '../engine.ts';
 import { hostJoin } from '../engines/wsl2-paths.ts';
 import { removeManagedDir, removeWorktreeDir } from '../managed-fs.ts';
 import { parseLabels } from './ls.ts';
 import { runEngine, runSafe } from '../shell.ts';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.ts';
 import type { SandboxTool } from '../tools.ts';
+import { createCleanPermit, formatWorktreeSnapshot, inspectWorktrees } from '../worktree-safety.ts';
+import type { WorktreeRemovalPermit } from '../worktree-safety.ts';
 
 const USAGE = `Usage: ai sandbox prune [--dry-run]`;
 
+type PruneDependencies = {
+  config?: SandboxConfig;
+  tools?: SandboxTool[];
+  engine?: string;
+  labelsOutput?: string;
+  confirm?: typeof p.confirm;
+  isCancel?: typeof p.isCancel;
+};
+
 type OrphanKind = 'shell' | 'worktree' | 'share' | 'tool';
 
 export type OrphanGroup = {
@@ -107,12 +118,19 @@ export function collectOrphanGroups(
   return groups;
 }
 
-export function removeOrphanGroups(config: SandboxConfig, groups: OrphanGroup[]): boolean {
+export function removeOrphanGroups(
+  config: SandboxConfig,
+  groups: OrphanGroup[],
+  permits: ReadonlyMap<string, WorktreeRemovalPermit>,
+  allowRegisteredPathFallback = false
+): boolean {
   let removedWorktrees = false;
   for (const group of groups) {
     for (const dir of group.dirs) {
       if (group.kind === 'worktree') {
-        removeWorktreeDir(config.repoRoot, group.base, dir);
+        const permit = permits.get(path.resolve(dir));
+        if (!permit) throw new Error(`Missing worktree removal permit: ${dir}`);
+        removeWorktreeDir(config.repoRoot, group.base, dir, permit, { allowRegisteredPathFallback });
         removedWorktrees = true;
       } else {
         removeManagedDir(group.base, dir);
@@ -142,7 +160,7 @@ function writeGroups(groups: OrphanGroup[]): void {
   }
 }
 
-export async function prune(args: string[]): Promise<void> {
+export async function prune(args: string[], dependencies: PruneDependencies = {}): Promise<void> {
   const { values } = parseArgs({
     args,
     strict: true,
@@ -157,9 +175,9 @@ export async function prune(args: string[]): Promise<void> {
     return;
   }
 
-  const config = loadConfig();
-  const tools = [...createSandboxCapabilityPlan(config).cleanupInventory];
-  const engine = detectEngine(config);
+  const config = dependencies.config ?? loadConfig();
+  const tools = dependencies.tools ?? [...createSandboxCapabilityPlan(config).cleanupInventory];
+  const engine = dependencies.engine ?? detectEngine(config);
   const psArgs = [
     'ps',
     '-a',
@@ -168,14 +186,25 @@ export async function prune(args: string[]): Promise<void> {
     '--format',
     '{{.Labels}}'
   ];
-  let labelsOutput: string;
-  try {
-    labelsOutput = runEngine(engine, 'docker', psArgs);
-  } catch {
-    throw new Error('Unable to determine active sandbox branches: docker ps failed');
+  let labelsOutput = dependencies.labelsOutput;
+  if (labelsOutput === undefined) {
+    try {
+      labelsOutput = runEngine(engine, 'docker', psArgs);
+    } catch {
+      throw new Error('Unable to determine active sandbox branches: docker ps failed');
+    }
   }
+  const confirm = dependencies.confirm ?? p.confirm;
+  const isCancel = dependencies.isCancel ?? p.isCancel;
   const groups = collectOrphanGroups(config, tools, activeBranchesFromLabels(config, labelsOutput));
   const count = orphanCount(groups);
+  const worktrees = groups.filter((group) => group.kind === 'worktree').flatMap((group) => group.dirs);
+  const inspections = inspectWorktrees(worktrees);
+  const blockers = inspections.filter((inspection) => inspection.status !== 'clean');
+  const permits = new Map<string, WorktreeRemovalPermit>();
+  for (const inspection of inspections) {
+    if (inspection.status === 'clean') permits.set(inspection.snapshot.worktree, createCleanPermit(inspection.snapshot));
+  }
 
   p.intro(pc.cyan(`Pruning orphaned sandbox state for ${config.project}`));
 
@@ -186,23 +215,32 @@ export async function prune(args: string[]): Promise<void> {
   }
 
   writeGroups(groups);
+  for (const blocker of blockers) {
+    p.log.error(blocker.status === 'failed'
+      ? `${JSON.stringify(blocker.worktree)}: ${blocker.message}`
+      : formatWorktreeSnapshot(blocker.snapshot));
+  }
 
   if (values['dry-run']) {
     p.outro(pc.green('Dry run complete'));
     return;
   }
 
-  const shouldRemove = await p.confirm({
+  if (blockers.length > 0) {
+    throw new Error('Refusing to prune because worktree preflight found blocker(s); no orphan state was deleted');
+  }
+
+  const shouldRemove = await confirm({
     message: `Remove ${count} orphaned sandbox state dirs?`,
     initialValue: true
   });
 
-  if (p.isCancel(shouldRemove) || !shouldRemove) {
+  if (isCancel(shouldRemove) || !shouldRemove) {
     p.outro('Cancelled');
     return;
   }
 
-  const removedWorktrees = removeOrphanGroups(config, groups);
+  const removedWorktrees = removeOrphanGroups(config, groups, permits, engine === ENGINES.WSL2);
   if (removedWorktrees) {
     runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
   }