@fitlab-ai/agent-infra 0.9.4 → 0.9.6

package/dist/lib/internal/task-orchestration.js

@@ -1,7 +1,8 @@
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
-import { abortCommitIntent, activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginCommitIntent, beginOrResumeOrchestration, checkpointCommitIntent, completeCommitIntent, pauseOrchestration, prepareOrchestrationDelegation, recoverCommitIntent, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusCommitIntent, statusOrchestration } from '../task/orchestration.js';
+import { abortCommitIntent, activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginCommitIntent, beginOrResumeOrchestration, checkpointCommitIntent, completeCommitIntent, pauseOrchestration, recoverCommitIntent, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, startCommitAttempt, statusCommitIntent, statusOrchestration, terminateCommitAttempt } from '../task/orchestration.js';
+import { prepareCodexOrchestrationDelegation } from '../task/codex-orchestration.js';
 import { isAgentClientId } from '../agent-clients/types.js';
-const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-status> [options]\n';
+const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-start|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-terminate|commit-status> [options]\n';
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({
         status: 'failed', changed: false,
@@ -10,7 +11,7 @@ function usageFailure(message) {
     process.stderr.write(USAGE);
     process.exitCode = 2;
 }
-function taskOrchestration(args = []) {
+async function taskOrchestration(args = []) {
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
@@ -22,7 +23,7 @@ function taskOrchestration(args = []) {
     const [taskRef, intent] = args;
     if (![
         'begin-or-resume', 'route', 'prepare', 'hook-start', 'hook-stop', 'advance', 'pause', 'status',
-        'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-status'
+        'commit-start', 'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-terminate', 'commit-status'
     ].includes(intent)) {
         usageFailure(`unknown intent '${intent}'`);
         return;
@@ -48,7 +49,8 @@ function taskOrchestration(args = []) {
             '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--actual-reasoning-effort',
             '--model-fallback-reason', '--reasoning-effort-fallback-reason',
             '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent',
-            '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
+            '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head',
+            '--attempt', '--git-worktree-root'
         ].includes(flag)) {
             usageFailure(`unknown option '${flag}'`);
             return;
@@ -66,12 +68,14 @@ function taskOrchestration(args = []) {
         values[flag] = value;
     }
     const commitIntentFlags = {
-        'commit-begin': ['--agent', '--baseline-head', '--orchestrated'],
-        'commit-checkpoint': ['--token', '--kind', '--head', '--remote', '--ref'],
-        'commit-complete': ['--token', '--agent'],
-        'commit-recover': ['--agent'],
-        'commit-abort': ['--token', '--expected-head'],
-        'commit-status': []
+        'commit-start': ['--agent', '--git-worktree-root'],
+        'commit-begin': ['--agent', '--baseline-head', '--attempt', '--orchestrated', '--git-worktree-root'],
+        'commit-checkpoint': ['--token', '--kind', '--head', '--remote', '--ref', '--git-worktree-root'],
+        'commit-complete': ['--token', '--agent', '--git-worktree-root'],
+        'commit-recover': ['--agent', '--git-worktree-root'],
+        'commit-abort': ['--token', '--expected-head', '--git-worktree-root'],
+        'commit-terminate': ['--attempt', '--agent', '--code', '--git-worktree-root'],
+        'commit-status': ['--git-worktree-root']
     };
     if (intent in commitIntentFlags) {
         const allowed = commitIntentFlags[intent];
@@ -83,7 +87,7 @@ function taskOrchestration(args = []) {
     }
     else {
         const commitOnly = [...seen].find((flag) => [
-            '--orchestrated', '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
+            '--orchestrated', '--baseline-head', '--attempt', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
         ].includes(flag));
         if (commitOnly) {
             usageFailure(`intent '${intent}' does not accept '${commitOnly}'`);
@@ -91,13 +95,29 @@ function taskOrchestration(args = []) {
         }
     }
     const requireValues = (flags) => flags.find((flag) => values[flag] === undefined);
+    const coreOptions = values['--git-worktree-root'] === undefined
+        ? {}
+        : { gitWorktreeRoot: values['--git-worktree-root'] };
     if (values['--client'] !== undefined && !isAgentClientId(values['--client'])) {
         usageFailure(`unknown client '${values['--client']}'`);
         return;
     }
     let result;
-    if (intent === 'commit-begin') {
-        const missing = requireValues(['--agent', '--baseline-head']);
+    if (intent === 'commit-start') {
+        const missing = requireValues(['--agent']);
+        if (missing) {
+            usageFailure(`intent 'commit-start' requires '${missing}'`);
+            return;
+        }
+        const agent = normalizeAgentToken(values['--agent']);
+        if (!agent) {
+            usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
+            return;
+        }
+        result = startCommitAttempt(taskRef, { agent }, coreOptions);
+    }
+    else if (intent === 'commit-begin') {
+        const missing = requireValues(['--agent', '--baseline-head', '--attempt']);
         if (missing) {
             usageFailure(`intent 'commit-begin' requires '${missing}'`);
             return;
@@ -108,8 +128,8 @@ function taskOrchestration(args = []) {
             return;
         }
         result = beginCommitIntent(taskRef, {
-            agent, orchestrated, baselineHead: values['--baseline-head']
-        });
+            agent, orchestrated, baselineHead: values['--baseline-head'], attempt: values['--attempt']
+        }, coreOptions);
     }
     else if (intent === 'commit-checkpoint') {
         const missing = requireValues(['--token', '--kind', '--head']);
@@ -135,7 +155,7 @@ function taskOrchestration(args = []) {
         result = checkpointCommitIntent(taskRef, {
             token: values['--token'], kind: values['--kind'],
             head: values['--head'], remote: values['--remote'], ref: values['--ref']
-        });
+        }, coreOptions);
     }
     else if (intent === 'commit-complete') {
         const missing = requireValues(['--token', '--agent']);
@@ -148,7 +168,7 @@ function taskOrchestration(args = []) {
             usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
             return;
         }
-        result = completeCommitIntent(taskRef, { token: values['--token'], agent });
+        result = completeCommitIntent(taskRef, { token: values['--token'], agent }, coreOptions);
     }
     else if (intent === 'commit-recover') {
         const missing = requireValues(['--agent']);
@@ -161,7 +181,7 @@ function taskOrchestration(args = []) {
             usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
             return;
         }
-        result = recoverCommitIntent(taskRef, { agent });
+        result = recoverCommitIntent(taskRef, { agent }, coreOptions);
     }
     else if (intent === 'commit-abort') {
         const missing = requireValues(['--token', '--expected-head']);
@@ -169,10 +189,29 @@ function taskOrchestration(args = []) {
             usageFailure(`intent 'commit-abort' requires '${missing}'`);
             return;
         }
-        result = abortCommitIntent(taskRef, { token: values['--token'], expectedHead: values['--expected-head'] });
+        result = abortCommitIntent(taskRef, { token: values['--token'], expectedHead: values['--expected-head'] }, coreOptions);
+    }
+    else if (intent === 'commit-terminate') {
+        const missing = requireValues(['--attempt', '--agent', '--code']);
+        if (missing) {
+            usageFailure(`intent 'commit-terminate' requires '${missing}'`);
+            return;
+        }
+        const agent = normalizeAgentToken(values['--agent']);
+        if (!agent) {
+            usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
+            return;
+        }
+        if (!/^[A-Z][A-Z0-9_]{2,63}$/.test(values['--code'])) {
+            usageFailure('--code must be a stable uppercase identifier');
+            return;
+        }
+        result = terminateCommitAttempt(taskRef, {
+            attempt: values['--attempt'], agent, code: values['--code']
+        }, coreOptions);
     }
     else if (intent === 'commit-status') {
-        result = statusCommitIntent(taskRef);
+        result = statusCommitIntent(taskRef, coreOptions);
     }
     else if (intent === 'begin-or-resume') {
         const missing = requireValues(['--client']);
@@ -195,6 +234,7 @@ function taskOrchestration(args = []) {
             return;
         }
         result = beginOrResumeOrchestration(taskRef, {
+            ...coreOptions,
             maxSteps,
             client: values['--client'],
             modelPolicy: hasAnyPolicy ? {
@@ -210,10 +250,10 @@ function taskOrchestration(args = []) {
         });
     }
     else if (intent === 'route') {
-        result = routeOrchestration(taskRef);
+        result = routeOrchestration(taskRef, coreOptions);
     }
     else if (intent === 'status') {
-        result = statusOrchestration(taskRef);
+        result = statusOrchestration(taskRef, coreOptions);
     }
     else if (intent === 'prepare') {
         const missing = requireValues(['--client']);
@@ -221,11 +261,11 @@ function taskOrchestration(args = []) {
             usageFailure(`intent 'prepare' requires '${missing}'`);
             return;
         }
-        result = prepareOrchestrationDelegation(taskRef, {
+        result = await prepareCodexOrchestrationDelegation(taskRef, {
             client: values['--client'],
             requestedModel: values['--requested-model'],
             requestedReasoningEffort: values['--requested-reasoning-effort']
-        });
+        }, { orchestrationOptions: coreOptions });
     }
     else if (intent === 'hook-start') {
         const missing = requireValues([
@@ -245,8 +285,8 @@ function taskOrchestration(args = []) {
             reasoningEffortFallbackReason: values['--reasoning-effort-fallback-reason']
         };
         result = taskRef === 'auto'
-            ? activateMatchingOrchestrationDelegation(values['--client'], event)
-            : activateOrchestrationDelegation(taskRef, event);
+            ? activateMatchingOrchestrationDelegation(values['--client'], event, coreOptions)
+            : activateOrchestrationDelegation(taskRef, event, coreOptions);
     }
     else if (intent === 'hook-stop') {
         if (taskRef === 'auto') {
@@ -257,7 +297,7 @@ function taskOrchestration(args = []) {
             }
             result = sealMatchingOrchestrationDelegation(values['--client'], {
                 nativeAgent: values['--native-agent'], childId: values['--child-id']
-            });
+            }, coreOptions);
         }
         else {
             const missing = requireValues(['--child-id', '--exit-code', '--after-fingerprint']);
@@ -274,11 +314,11 @@ function taskOrchestration(args = []) {
                 childId: values['--child-id'], exitCode,
                 afterFingerprint: values['--after-fingerprint'],
                 changedPaths: values['--changed-paths'] ? values['--changed-paths'].split(',').filter(Boolean) : []
-            });
+            }, coreOptions);
         }
     }
     else if (intent === 'advance') {
-        result = advanceOrchestration(taskRef);
+        result = advanceOrchestration(taskRef, coreOptions);
     }
     else {
         const missing = requireValues(['--code', '--message', '--recoverable']);
@@ -290,7 +330,7 @@ function taskOrchestration(args = []) {
             usageFailure('--recoverable must be true or false');
             return;
         }
-        result = pauseOrchestration(taskRef, values['--code'], values['--message'], values['--recoverable'] === 'true');
+        result = pauseOrchestration(taskRef, values['--code'], values['--message'], values['--recoverable'] === 'true', coreOptions);
     }
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')

package/dist/lib/platform/issue-comments.js

@@ -20,6 +20,7 @@ const ARTIFACT_TITLES = {
     code: '实现报告',
     'review-code': '代码审查',
     'manual-validation': '人工验证报告',
+    'validation-run': '验证运行证据',
     'pr-review': 'PR 审查报告'
 };
 function normalizeCommentContent(content) {
@@ -52,7 +53,7 @@ function renderTaskComment(content, taskId, agent) {
 }
 function artifactIdentity(artifact) {
     const stem = path.basename(artifact, '.md');
-    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|pr-review)(?:-r(\d+))?$/);
+    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
     if (!match)
         throw new Error(`unsupported artifact '${artifact}'`);
     const base = ARTIFACT_TITLES[match[1]];

package/dist/lib/release/workflow.js

@@ -1,34 +1,42 @@
+import crypto from 'node:crypto';
+function byteSort(values) {
+    return [...values].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+}
 function deriveReleasePhase(facts) {
     if (!facts.localTag && !facts.localTagAncestor)
         return 'unprepared';
+    if (facts.post.commit)
+        return facts.post.published ? 'complete' : 'post-prepared';
     if (!facts.remoteBranch && !facts.remoteTag)
         return 'prepared';
     if (!facts.remoteBranch || !facts.remoteTag)
         return 'partially-published';
     if (facts.githubRelease !== true || facts.npm !== true || facts.homebrew !== true)
         return 'published';
-    if (facts.smoke !== 'success' || !facts.postCommit)
-        return 'post-pending';
-    return 'complete';
+    return 'post-pending';
 }
-function releaseSnapshot(version, facts) {
-    return { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+function createPostConfirmation(version, post) {
+    if (!post.commit || !post.isHead || post.worktree.length || post.staged.length)
+        return null;
+    const canonical = {
+        version,
+        commit: post.commit,
+        branch: post.branch,
+        upstream: post.upstream,
+        remoteHead: post.remoteHead,
+        newVersion: post.newVersion,
+        changedPaths: byteSort(post.changedPaths),
+        demoInputSha256: post.demoInputSha256,
+        worktree: byteSort(post.worktree),
+        staged: byteSort(post.staged)
+    };
+    const sha256 = `sha256:${crypto.createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
+    return { ...canonical, sha256 };
 }
-async function runReleaseAction(input) {
-    const before = releaseSnapshot(input.version, await input.inspect());
-    if (input.action === 'inspect')
-        return { status: 'no-op', changed: false, before, snapshot: before, error: null };
-    if (before.facts.localTagConflict)
-        return { status: 'failed', changed: false, before, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag ${before.tag} is not reachable from HEAD` } };
-    const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
-        : input.action === 'publish' ? before.facts.localTag && ['prepared', 'partially-published'].includes(before.phase)
-            : ['published', 'post-pending'].includes(before.phase);
-    if (!allowed)
-        return { status: before.phase === 'complete' ? 'no-op' : 'failed', changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };
-    await input[input.action]?.();
-    const snapshot = releaseSnapshot(input.version, await input.inspect());
-    const progressed = snapshot.phase !== before.phase;
-    return { status: progressed ? 'applied' : 'blocked', changed: progressed, before, snapshot, error: progressed ? null : { code: 'RELEASE_PROGRESS_PENDING', message: `${input.action} has not reached the next observable phase` } };
+function releaseSnapshot(version, facts) {
+    const snapshot = { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+    const postConfirmation = createPostConfirmation(version, facts.post);
+    return postConfirmation ? { ...snapshot, postConfirmation } : snapshot;
 }
-export { deriveReleasePhase, releaseSnapshot, runReleaseAction };
+export { createPostConfirmation, deriveReleasePhase, releaseSnapshot };
 //# sourceMappingURL=workflow.js.map

package/dist/lib/sandbox/commands/create.js

@@ -2,9 +2,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { execFileSync, spawn } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { parseArgs } from 'node:util';
-import { fileURLToPath } from 'node:url';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { listAgentClientAdapters } from '../../agent-clients/registry.js';
@@ -17,10 +16,10 @@ import { commandForEngine, execEngine, run, runEngine, runOk, runOkEngine, runSa
 import { parseSandboxWorkspaceIdentity, resolveSandboxTarget, sameSandboxWorkspaceIdentity } from '../workspace-identity.js';
 import { createSandboxCapabilityPlan, runSandboxHooks, runBoundedSandboxHookCommand } from '../agent-client-reconciler.js';
 import { resolveTools, tmpfsSeedStagingPath, tmpfsSeedTargetPath, toolConfigDirCandidates } from '../tools.js';
-import { assertFreshSandboxReady, hydrateTmpfsSeedEntries, prepareTmpfsMounts } from '../recovery.js';
+import { assertFreshSandboxReady, hydrateTmpfsSeedEntries, prepareTmpfsMounts, startSandboxControlBroker } from '../recovery.js';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from '../mounts.js';
-import { assertSandboxTaskSource, materializeSandboxControl, materializeSandboxWorkspaceView } from '../workspace-view.js';
+import { assertSandboxTaskSource, materializeSandboxControl, materializeSandboxWorkspaceView, prepareSandboxWorkspaceMountTargets } from '../workspace-view.js';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.js';
 import { validateSelinuxDisableEnv } from '../engines/selinux.js';
 import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
@@ -65,11 +64,6 @@ const MANAGED_GITHUB_GIT_CONFIG = [
     '[url "https://github.com/"]',
     '\tinsteadOf = git@github.com:'
 ];
-function internalCliPath() {
-    const directory = path.dirname(fileURLToPath(import.meta.url));
-    const extension = path.extname(fileURLToPath(import.meta.url));
-    return path.resolve(directory, '..', '..', '..', 'bin', `internal-cli${extension}`);
-}
 function resolveToolDirs(config, tools, branch) {
     return tools.map((tool) => {
         const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -895,8 +889,12 @@ export async function create(args) {
                                 const requestedDescription = target.workspace.mode === 'task-bound'
                                     ? `task-bound:${target.workspace.taskId}`
                                     : target.workspace.mode;
+                                const recoveryTarget = target.workspace.mode === 'task-bound'
+                                    ? target.workspace.taskId
+                                    : branch;
                                 throw new Error(`SANDBOX_WORKSPACE_IDENTITY_CONFLICT: container '${name}' is ${existingDescription}, `
-                                    + `but this request is ${requestedDescription}. Run 'ai sandbox rm ${branch}' and retry.`);
+                                    + `but this request is ${requestedDescription}. `
+                                    + `Run 'ai sandbox start --recreate ${recoveryTarget}' on the host, then retry.`);
                             }
                         }
                         message('Removing old container instance...');
@@ -962,9 +960,11 @@ export async function create(args) {
                             container,
                             identity: target.workspace
                         });
+                        prepareSandboxWorkspaceMountTargets(worktree);
                         const control = materializeSandboxControl({
                             base: effectiveConfig.controlBase,
                             repoRoot: effectiveConfig.repoRoot,
+                            worktreeRoot: worktree,
                             project: effectiveConfig.project,
                             container,
                             branch,
@@ -981,6 +981,7 @@ export async function create(args) {
                             shellConfigHostDir: hostShellConfig.hostDir,
                             workspaceViewRoot: workspaceView.root,
                             controlDir: control.channelDir,
+                            controlStatusDir: control.statusDir,
                             ...(target.workspace.mode === 'task-bound'
                                 ? {
                                     taskSource: assertSandboxTaskSource(effectiveConfig.repoRoot, target.workspace.taskId),
@@ -1051,7 +1052,11 @@ export async function create(args) {
                             '-e',
                             `AGENT_INFRA_CONTROL_TOKEN=${control.token}`,
                             '-e',
+                            `AGENT_INFRA_CONTROL_GENERATION=${control.generation}`,
+                            '-e',
                             'AGENT_INFRA_CONTROL_DIR=/run/agent-infra/control',
+                            '-e',
+                            'AGENT_INFRA_CONTROL_STATUS_DIR=/run/agent-infra/control-status',
                             '--label',
                             `${sandboxRuntimeCapabilityLabel(effectiveConfig)}=${capabilityPlan.runtimeSignature}`,
                             ...coreVolumes,
@@ -1069,12 +1074,7 @@ export async function create(args) {
                             '/workspace',
                             effectiveConfig.imageName
                         ]);
-                        const broker = spawn(process.execPath, [internalCliPath(), 'sandbox-control', 'serve', '--manifest', control.manifestPath], { cwd: effectiveConfig.repoRoot, detached: true, stdio: 'ignore' });
-                        broker.once('error', () => {
-                            // Fresh readiness verification below remains the source of truth;
-                            // consume detached spawn errors so they cannot crash the command.
-                        });
-                        broker.unref();
+                        await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
                         createdTmpfsSeedPlan = tmpfsSeedPlan;
                     }
                     finally {

package/dist/lib/sandbox/commands/prune.js

@@ -5,12 +5,13 @@ import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { loadConfig } from '../config.js';
 import { safeNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
-import { detectEngine } from '../engine.js';
+import { detectEngine, ENGINES } from '../engine.js';
 import { hostJoin } from '../engines/wsl2-paths.js';
 import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
 import { parseLabels } from './ls.js';
 import { runEngine, runSafe } from '../shell.js';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
+import { createCleanPermit, formatWorktreeSnapshot, inspectWorktrees } from '../worktree-safety.js';
 const USAGE = `Usage: ai sandbox prune [--dry-run]`;
 function listChildDirs(base) {
     if (!fs.existsSync(base)) {
@@ -83,12 +84,15 @@ export function collectOrphanGroups(config, tools, activeBranches) {
     }
     return groups;
 }
-export function removeOrphanGroups(config, groups) {
+export function removeOrphanGroups(config, groups, permits, allowRegisteredPathFallback = false) {
     let removedWorktrees = false;
     for (const group of groups) {
         for (const dir of group.dirs) {
             if (group.kind === 'worktree') {
-                removeWorktreeDir(config.repoRoot, group.base, dir);
+                const permit = permits.get(path.resolve(dir));
+                if (!permit)
+                    throw new Error(`Missing worktree removal permit: ${dir}`);
+                removeWorktreeDir(config.repoRoot, group.base, dir, permit, { allowRegisteredPathFallback });
                 removedWorktrees = true;
             }
             else {
@@ -115,7 +119,7 @@ function writeGroups(groups) {
         }
     }
 }
-export async function prune(args) {
+export async function prune(args, dependencies = {}) {
     const { values } = parseArgs({
         args,
         strict: true,
@@ -128,9 +132,9 @@ export async function prune(args) {
         process.stdout.write(`${USAGE}\n`);
         return;
     }
-    const config = loadConfig();
-    const tools = [...createSandboxCapabilityPlan(config).cleanupInventory];
-    const engine = detectEngine(config);
+    const config = dependencies.config ?? loadConfig();
+    const tools = dependencies.tools ?? [...createSandboxCapabilityPlan(config).cleanupInventory];
+    const engine = dependencies.engine ?? detectEngine(config);
     const psArgs = [
         'ps',
         '-a',
@@ -139,15 +143,27 @@ export async function prune(args) {
         '--format',
         '{{.Labels}}'
     ];
-    let labelsOutput;
-    try {
-        labelsOutput = runEngine(engine, 'docker', psArgs);
-    }
-    catch {
-        throw new Error('Unable to determine active sandbox branches: docker ps failed');
+    let labelsOutput = dependencies.labelsOutput;
+    if (labelsOutput === undefined) {
+        try {
+            labelsOutput = runEngine(engine, 'docker', psArgs);
+        }
+        catch {
+            throw new Error('Unable to determine active sandbox branches: docker ps failed');
+        }
     }
+    const confirm = dependencies.confirm ?? p.confirm;
+    const isCancel = dependencies.isCancel ?? p.isCancel;
     const groups = collectOrphanGroups(config, tools, activeBranchesFromLabels(config, labelsOutput));
     const count = orphanCount(groups);
+    const worktrees = groups.filter((group) => group.kind === 'worktree').flatMap((group) => group.dirs);
+    const inspections = inspectWorktrees(worktrees);
+    const blockers = inspections.filter((inspection) => inspection.status !== 'clean');
+    const permits = new Map();
+    for (const inspection of inspections) {
+        if (inspection.status === 'clean')
+            permits.set(inspection.snapshot.worktree, createCleanPermit(inspection.snapshot));
+    }
     p.intro(pc.cyan(`Pruning orphaned sandbox state for ${config.project}`));
     if (count === 0) {
         p.log.success('No orphaned sandbox state dirs found');
@@ -155,19 +171,27 @@ export async function prune(args) {
         return;
     }
     writeGroups(groups);
+    for (const blocker of blockers) {
+        p.log.error(blocker.status === 'failed'
+            ? `${JSON.stringify(blocker.worktree)}: ${blocker.message}`
+            : formatWorktreeSnapshot(blocker.snapshot));
+    }
     if (values['dry-run']) {
         p.outro(pc.green('Dry run complete'));
         return;
     }
-    const shouldRemove = await p.confirm({
+    if (blockers.length > 0) {
+        throw new Error('Refusing to prune because worktree preflight found blocker(s); no orphan state was deleted');
+    }
+    const shouldRemove = await confirm({
         message: `Remove ${count} orphaned sandbox state dirs?`,
         initialValue: true
     });
-    if (p.isCancel(shouldRemove) || !shouldRemove) {
+    if (isCancel(shouldRemove) || !shouldRemove) {
         p.outro('Cancelled');
         return;
     }
-    const removedWorktrees = removeOrphanGroups(config, groups);
+    const removedWorktrees = removeOrphanGroups(config, groups, permits, engine === ENGINES.WSL2);
     if (removedWorktrees) {
         runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
     }