@fitlab-ai/agent-infra 0.9.5 → 0.9.6

package/dist/lib/internal/release-workflow.js

@@ -154,11 +154,47 @@ function inspectLocalReleaseFacts(cwd, version, run = command) {
     const localTagConflict = Boolean(tagCommit && !localTag && !localTagAncestor);
     const postSubject = `chore: prepare next dev iteration after v${version}`;
     const postLog = localTag || localTagAncestor
-        ? git(cwd, ['log', '--format=%s', `${tag}..HEAD`], run) ?? ''
+        ? git(cwd, ['log', '--format=%H%x00%s', `${tag}..HEAD`], run) ?? ''
         : '';
-    const postCommit = postLog.split('\n').some((subject) => subject === postSubject);
+    const postCommit = postLog.split('\n').map((line) => line.split('\0'))
+        .find(([, subject]) => subject === postSubject)?.[0] ?? null;
     return { localTag, localTagAncestor, localTagConflict, postCommit };
 }
+function inspectPostReleaseFacts(cwd, commit, run = command) {
+    const inspected = inspectGitWorkflow(cwd);
+    const snapshot = inspected.snapshot;
+    const branch = snapshot?.branch ?? '';
+    const remoteLine = branch ? git(cwd, ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], run) : null;
+    const remoteHead = remoteLine?.split(/\s+/)[0] ?? null;
+    const packageJson = commit ? git(cwd, ['show', `${commit}:package.json`], run, false) : null;
+    let newVersion = null;
+    if (packageJson) {
+        try {
+            const version = JSON.parse(packageJson).version;
+            newVersion = typeof version === 'string' ? version : null;
+        }
+        catch {
+            newVersion = null;
+        }
+    }
+    const paths = commit ? git(cwd, ['diff-tree', '--root', '--no-commit-id', '--name-only', '-r', '-z', commit], run, false) : null;
+    const changedPaths = paths ? paths.split('\0').filter(Boolean)
+        .sort((left, right) => Buffer.from(left).compare(Buffer.from(right))) : [];
+    const digest = commit ? git(cwd, ['show', `${commit}:${DEMO_DIGEST_PATH}`], run) : null;
+    return {
+        commit,
+        isHead: Boolean(commit && snapshot?.head === commit),
+        published: Boolean(commit && remoteHead === commit),
+        branch,
+        upstream: snapshot?.upstream ?? null,
+        remoteHead,
+        newVersion,
+        changedPaths,
+        demoInputSha256: digest && /^[0-9a-f]{64}$/.test(digest) ? digest : null,
+        worktree: snapshot?.worktree ?? [],
+        staged: snapshot?.staged ?? []
+    };
+}
 function releaseSmokeStatus(workflows, version, tagCommit) {
     const manualTitle = `Post-Release Smoke v${version}`;
     const targets = workflows.filter((run) => {
@@ -209,12 +245,15 @@ async function inspectFacts(cwd, version) {
     const workflows = platform.workflows;
     const smoke = releaseSmokeStatus(workflows, version, localTagTarget);
     return {
-        ...local,
+        localTag: local.localTag,
+        localTagAncestor: local.localTagAncestor,
+        localTagConflict: local.localTagConflict,
         remoteBranch: Boolean(remoteBranch && remoteBranch.split(/\s+/)[0] === head), remoteTag: Boolean(remoteTag),
         githubRelease: platform.platform.type !== 'github'
             ? true
             : platform.status === 'blocked' ? null : Boolean(platform.release?.published),
-        npm: npm.published, homebrew: homebrew.published, smoke
+        npm: npm.published, homebrew: homebrew.published, smoke,
+        post: inspectPostReleaseFacts(cwd, local.postCommit)
     };
 }
 function parsePorcelainPath(record) {
@@ -245,13 +284,21 @@ function updateReleaseMetadata(cwd, version) {
         fs.writeFileSync(filePath, content);
     }
 }
+function optionValues(args, name) {
+    const values = [];
+    for (let index = 0; index < args.length; index += 1) {
+        if (args[index] === name)
+            values.push(args[index + 1] ?? '');
+    }
+    return values;
+}
 async function releaseWorkflow(args = []) {
     const [action, rawVersion, ...rest] = args;
     const version = String(rawVersion || '').replace(/^v/, '');
     const cwdIndex = rest.indexOf('--cwd');
     const cwd = path.resolve(cwdIndex >= 0 && rest[cwdIndex + 1] ? rest[cwdIndex + 1] : process.cwd());
-    if (!['inspect', 'prepare', 'publish', 'post'].includes(action || '') || !semver.valid(version)) {
-        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'RELEASE_INPUT_INVALID', message: 'Usage: release-workflow inspect|prepare|publish|post <version>' } })}\n`);
+    if (!['inspect', 'prepare', 'publish', 'post-prepare', 'post-publish'].includes(action || '') || !semver.valid(version)) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'RELEASE_INPUT_INVALID', message: 'Usage: release-workflow inspect|prepare|publish|post-prepare|post-publish <version>' } })}\n`);
         process.exitCode = 1;
         return;
     }
@@ -331,10 +378,56 @@ async function releaseWorkflow(args = []) {
         process.exitCode = result.status === 'failed' ? 1 : result.status === 'degraded' ? 2 : 0;
         return;
     }
+    if (action === 'post-publish') {
+        const expectedValues = optionValues(rest, '--expected-sha256');
+        if (expectedValues.length !== 1 || !/^sha256:[0-9a-f]{64}$/.test(expectedValues[0])) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'RELEASE_INPUT_INVALID', message: 'post-publish requires one --expected-sha256 sha256:<64 hex>' } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (before.phase === 'complete') {
+            process.stdout.write(`${JSON.stringify({ status: 'no-op', changed: false, snapshot: before, error: null })}\n`);
+            return;
+        }
+        const confirmation = 'postConfirmation' in before ? before.postConfirmation : null;
+        if (before.phase !== 'post-prepared' || !confirmation) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: confirmation ? 'RELEASE_PHASE_INVALID' : 'RELEASE_POST_CONFIRMATION_UNAVAILABLE', message: 'Post-release facts cannot authorize publish' } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (confirmation.sha256 !== expectedValues[0]) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, snapshot: before, error: { code: 'RELEASE_POST_SNAPSHOT_MISMATCH', message: 'Post-release confirmation snapshot changed' } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const channelsComplete = before.facts.githubRelease === true && before.facts.npm === true && before.facts.homebrew === true;
+        if (!channelsComplete || before.facts.smoke !== 'success') {
+            process.stdout.write(`${JSON.stringify({ status: before.facts.smoke === 'failed' ? 'failed' : 'blocked', changed: false, snapshot: before, error: { code: 'RELEASE_CHANNELS_PENDING', message: 'Release channels or smoke workflow are not complete' } })}\n`);
+            process.exitCode = before.facts.smoke === 'failed' ? 1 : 2;
+            return;
+        }
+        const pushed = pushGitRefs({ cwd, remote: 'origin', refs: [before.facts.post.branch] });
+        const snapshot = releaseSnapshot(version, await inspectFacts(cwd, version));
+        if (snapshot.phase === 'complete') {
+            process.stdout.write(`${JSON.stringify({ ...pushed, status: 'applied', changed: true, snapshot, error: null })}\n`);
+            return;
+        }
+        const blocked = pushed.status !== 'failed';
+        process.stdout.write(`${JSON.stringify({ ...pushed, status: blocked ? 'blocked' : 'failed', snapshot, error: pushed.error ?? { code: 'RELEASE_PROGRESS_PENDING', message: 'Post-release push is not visible at the expected remote head' } })}\n`);
+        process.exitCode = blocked ? 2 : 1;
+        return;
+    }
     if (before.phase === 'complete') {
         process.stdout.write(`${JSON.stringify({ status: 'no-op', changed: false, snapshot: before, error: null })}\n`);
         return;
     }
+    if (before.phase === 'post-prepared') {
+        const confirmation = 'postConfirmation' in before ? before.postConfirmation : null;
+        const status = confirmation ? 'no-op' : 'blocked';
+        process.stdout.write(`${JSON.stringify({ status, changed: false, snapshot: before, error: confirmation ? null : { code: 'RELEASE_POST_CONFIRMATION_UNAVAILABLE', message: 'Post commit is not the clean current HEAD' } })}\n`);
+        process.exitCode = confirmation ? 0 : 2;
+        return;
+    }
     const channelsComplete = before.facts.githubRelease === true && before.facts.npm === true && before.facts.homebrew === true;
     if (!['published', 'post-pending'].includes(before.phase) || !channelsComplete || before.facts.smoke !== 'success') {
         process.stdout.write(`${JSON.stringify({ status: before.facts.smoke === 'failed' ? 'failed' : 'blocked', changed: false, snapshot: before, error: { code: 'RELEASE_CHANNELS_PENDING', message: 'Release channels or smoke workflow are not complete' } })}\n`);
@@ -373,10 +466,14 @@ async function releaseWorkflow(args = []) {
         process.exitCode = 1;
         return;
     }
-    const branch = git(cwd, ['branch', '--show-current']) || '';
-    const pushed = pushGitRefs({ cwd, remote: 'origin', refs: [branch] });
-    process.stdout.write(`${JSON.stringify({ ...pushed, demo, snapshot: releaseSnapshot(version, await inspectFacts(cwd, version)) })}\n`);
-    process.exitCode = pushed.status === 'failed' ? 1 : pushed.status === 'degraded' ? 2 : 0;
+    const snapshot = releaseSnapshot(version, await inspectFacts(cwd, version));
+    const confirmation = 'postConfirmation' in snapshot ? snapshot.postConfirmation : null;
+    if (snapshot.phase !== 'post-prepared' || !confirmation) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: true, demo, snapshot, error: { code: 'RELEASE_POST_CONFIRMATION_UNAVAILABLE', message: 'Prepared post commit did not produce a confirmation snapshot' } })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    process.stdout.write(`${JSON.stringify({ status: 'applied', changed: true, demo, snapshot, error: null })}\n`);
 }
-export { changedPaths, computeDemoInputDigest, inspectFacts, inspectLocalReleaseFacts, inspectPostWorktree, releaseSmokeStatus, releaseWorkflow, runOptionalDemo };
+export { changedPaths, computeDemoInputDigest, inspectFacts, inspectLocalReleaseFacts, inspectPostReleaseFacts, inspectPostWorktree, releaseSmokeStatus, releaseWorkflow, runOptionalDemo };
 //# sourceMappingURL=release-workflow.js.map

package/dist/lib/internal/sandbox-control.js

@@ -1,24 +1,61 @@
-import { requestSandboxControl } from '../sandbox/control/client.js';
+import { requestSandboxControl, SandboxControlClientError } from '../sandbox/control/client.js';
 import { serveSandboxControl } from '../sandbox/control/server.js';
-function sandboxControl(args) {
+import { runSandboxControlExecutor } from '../sandbox/control/executor.js';
+async function sandboxControl(args) {
     const [operation, ...rest] = args;
     if (operation === 'serve') {
         const manifestIndex = rest.indexOf('--manifest');
         const manifest = manifestIndex >= 0 ? rest[manifestIndex + 1] : undefined;
         if (!manifest)
             throw new Error('sandbox-control serve requires --manifest');
-        serveSandboxControl(manifest);
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        process.once('SIGINT', abort);
+        process.once('SIGTERM', abort);
+        try {
+            await serveSandboxControl(manifest, controller.signal);
+        }
+        finally {
+            process.off('SIGINT', abort);
+            process.off('SIGTERM', abort);
+        }
+        return;
+    }
+    if (operation === 'execute') {
+        const requestIndex = rest.indexOf('--request');
+        const nonceIndex = rest.indexOf('--nonce');
+        const request = requestIndex >= 0 ? rest[requestIndex + 1] : undefined;
+        const nonce = nonceIndex >= 0 ? rest[nonceIndex + 1] : undefined;
+        if (!request || !nonce)
+            throw new Error('sandbox-control execute requires --request and --nonce');
+        await runSandboxControlExecutor(request, nonce);
         return;
     }
     if (operation === 'client') {
         const [family = '', ...commandArgs] = rest;
-        const response = requestSandboxControl({ family, args: commandArgs });
+        let response;
+        try {
+            response = requestSandboxControl({ family, args: commandArgs });
+        }
+        catch (error) {
+            if (!(error instanceof SandboxControlClientError))
+                throw error;
+            process.stderr.write(`${error.detail.message}\n`);
+            process.exitCode = error.detail.retryable ? 75 : 1;
+            return;
+        }
         process.stdout.write(response.stdout);
         process.stderr.write(response.stderr);
-        process.exitCode = response.exitCode;
+        if (response.phase === 'rejected') {
+            process.stderr.write(response.error?.message ?? response.stderr);
+            process.exitCode = response.error?.retryable ? 75 : 1;
+        }
+        else {
+            process.exitCode = response.exitCode ?? 1;
+        }
         return;
     }
-    throw new Error('Usage: agent-infra-internal sandbox-control serve --manifest <path> | client <family> [args...]');
+    throw new Error('Usage: agent-infra-internal sandbox-control serve --manifest <path> | execute --request <path> --nonce <nonce> | client <family> [args...]');
 }
 export { sandboxControl };
 //# sourceMappingURL=sandbox-control.js.map

package/dist/lib/internal/task-create.js

@@ -1,13 +1,13 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { requestSandboxTaskCreate } from '../sandbox/control/client.js';
+import { requestSandboxTaskCreate, SandboxControlClientError } from '../sandbox/control/client.js';
 import { SANDBOX_CONTROL_MAX_BYTES } from '../sandbox/control/protocol.js';
 import { validateTaskCreateCandidate } from '../task/create.js';
 import { createTask } from '../task/create-service.js';
-function failed(code, message) {
+function failed(code, message, retryable = false) {
     return {
-        status: 'failed', changed: false, task: { id: null, shortId: null }, issue: null,
-        operations: [], warnings: [], error: { code, message, retryable: false }
+        status: retryable ? 'blocked' : 'failed', changed: false, task: { id: null, shortId: null }, issue: null,
+        operations: [], warnings: [], error: { code, message, retryable }
     };
 }
 function output(result) {
@@ -31,6 +31,10 @@ function taskCreate(args) {
         const candidate = validateTaskCreateCandidate(JSON.parse(fs.readFileSync(inputPath, 'utf8')));
         if (process.env.AGENT_INFRA_CONTROL_TOKEN) {
             const response = requestSandboxTaskCreate({ candidate });
+            if (response.phase === 'rejected') {
+                output(failed(response.error?.code ?? 'SANDBOX_CONTROL_REJECTED', response.error?.message ?? response.stderr, response.error?.retryable ?? false));
+                return;
+            }
             process.stdout.write(response.stdout);
             process.stderr.write(response.stderr);
             process.exitCode = response.exitCode;
@@ -39,6 +43,10 @@ function taskCreate(args) {
         output(createTask(candidate, { repoRoot: process.cwd() }));
     }
     catch (error) {
+        if (error instanceof SandboxControlClientError) {
+            output(failed(error.detail.code, error.detail.message, error.detail.retryable));
+            return;
+        }
         const message = error instanceof Error ? error.message : String(error);
         const code = /^([A-Z][A-Z0-9_]+)/.exec(message)?.[1] ?? 'TASK_CREATE_INPUT_INVALID';
         output(failed(code, message));

package/dist/lib/internal/task-orchestration.js

@@ -1,5 +1,6 @@
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
-import { abortCommitIntent, activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginCommitIntent, beginOrResumeOrchestration, checkpointCommitIntent, completeCommitIntent, pauseOrchestration, prepareOrchestrationDelegation, recoverCommitIntent, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, startCommitAttempt, statusCommitIntent, statusOrchestration, terminateCommitAttempt } from '../task/orchestration.js';
+import { abortCommitIntent, activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginCommitIntent, beginOrResumeOrchestration, checkpointCommitIntent, completeCommitIntent, pauseOrchestration, recoverCommitIntent, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, startCommitAttempt, statusCommitIntent, statusOrchestration, terminateCommitAttempt } from '../task/orchestration.js';
+import { prepareCodexOrchestrationDelegation } from '../task/codex-orchestration.js';
 import { isAgentClientId } from '../agent-clients/types.js';
 const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-start|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-terminate|commit-status> [options]\n';
 function usageFailure(message) {
@@ -10,7 +11,7 @@ function usageFailure(message) {
     process.stderr.write(USAGE);
     process.exitCode = 2;
 }
-function taskOrchestration(args = []) {
+async function taskOrchestration(args = []) {
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
@@ -260,11 +261,11 @@ function taskOrchestration(args = []) {
             usageFailure(`intent 'prepare' requires '${missing}'`);
             return;
         }
-        result = prepareOrchestrationDelegation(taskRef, {
+        result = await prepareCodexOrchestrationDelegation(taskRef, {
             client: values['--client'],
             requestedModel: values['--requested-model'],
             requestedReasoningEffort: values['--requested-reasoning-effort']
-        }, coreOptions);
+        }, { orchestrationOptions: coreOptions });
     }
     else if (intent === 'hook-start') {
         const missing = requireValues([

package/dist/lib/platform/issue-comments.js

@@ -20,6 +20,7 @@ const ARTIFACT_TITLES = {
     code: '实现报告',
     'review-code': '代码审查',
     'manual-validation': '人工验证报告',
+    'validation-run': '验证运行证据',
     'pr-review': 'PR 审查报告'
 };
 function normalizeCommentContent(content) {
@@ -52,7 +53,7 @@ function renderTaskComment(content, taskId, agent) {
 }
 function artifactIdentity(artifact) {
     const stem = path.basename(artifact, '.md');
-    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|pr-review)(?:-r(\d+))?$/);
+    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
     if (!match)
         throw new Error(`unsupported artifact '${artifact}'`);
     const base = ARTIFACT_TITLES[match[1]];

package/dist/lib/release/workflow.js

@@ -1,34 +1,42 @@
+import crypto from 'node:crypto';
+function byteSort(values) {
+    return [...values].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+}
 function deriveReleasePhase(facts) {
     if (!facts.localTag && !facts.localTagAncestor)
         return 'unprepared';
+    if (facts.post.commit)
+        return facts.post.published ? 'complete' : 'post-prepared';
     if (!facts.remoteBranch && !facts.remoteTag)
         return 'prepared';
     if (!facts.remoteBranch || !facts.remoteTag)
         return 'partially-published';
     if (facts.githubRelease !== true || facts.npm !== true || facts.homebrew !== true)
         return 'published';
-    if (facts.smoke !== 'success' || !facts.postCommit)
-        return 'post-pending';
-    return 'complete';
+    return 'post-pending';
 }
-function releaseSnapshot(version, facts) {
-    return { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+function createPostConfirmation(version, post) {
+    if (!post.commit || !post.isHead || post.worktree.length || post.staged.length)
+        return null;
+    const canonical = {
+        version,
+        commit: post.commit,
+        branch: post.branch,
+        upstream: post.upstream,
+        remoteHead: post.remoteHead,
+        newVersion: post.newVersion,
+        changedPaths: byteSort(post.changedPaths),
+        demoInputSha256: post.demoInputSha256,
+        worktree: byteSort(post.worktree),
+        staged: byteSort(post.staged)
+    };
+    const sha256 = `sha256:${crypto.createHash('sha256').update(JSON.stringify(canonical), 'utf8').digest('hex')}`;
+    return { ...canonical, sha256 };
 }
-async function runReleaseAction(input) {
-    const before = releaseSnapshot(input.version, await input.inspect());
-    if (input.action === 'inspect')
-        return { status: 'no-op', changed: false, before, snapshot: before, error: null };
-    if (before.facts.localTagConflict)
-        return { status: 'failed', changed: false, before, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag ${before.tag} is not reachable from HEAD` } };
-    const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
-        : input.action === 'publish' ? before.facts.localTag && ['prepared', 'partially-published'].includes(before.phase)
-            : ['published', 'post-pending'].includes(before.phase);
-    if (!allowed)
-        return { status: before.phase === 'complete' ? 'no-op' : 'failed', changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };
-    await input[input.action]?.();
-    const snapshot = releaseSnapshot(input.version, await input.inspect());
-    const progressed = snapshot.phase !== before.phase;
-    return { status: progressed ? 'applied' : 'blocked', changed: progressed, before, snapshot, error: progressed ? null : { code: 'RELEASE_PROGRESS_PENDING', message: `${input.action} has not reached the next observable phase` } };
+function releaseSnapshot(version, facts) {
+    const snapshot = { version, tag: `v${version.replace(/^v/, '')}`, phase: deriveReleasePhase(facts), facts };
+    const postConfirmation = createPostConfirmation(version, facts.post);
+    return postConfirmation ? { ...snapshot, postConfirmation } : snapshot;
 }
-export { deriveReleasePhase, releaseSnapshot, runReleaseAction };
+export { createPostConfirmation, deriveReleasePhase, releaseSnapshot };
 //# sourceMappingURL=workflow.js.map

package/dist/lib/sandbox/commands/create.js

@@ -2,9 +2,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
-import { execFileSync, spawn } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { parseArgs } from 'node:util';
-import { fileURLToPath } from 'node:url';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { listAgentClientAdapters } from '../../agent-clients/registry.js';
@@ -17,10 +16,10 @@ import { commandForEngine, execEngine, run, runEngine, runOk, runOkEngine, runSa
 import { parseSandboxWorkspaceIdentity, resolveSandboxTarget, sameSandboxWorkspaceIdentity } from '../workspace-identity.js';
 import { createSandboxCapabilityPlan, runSandboxHooks, runBoundedSandboxHookCommand } from '../agent-client-reconciler.js';
 import { resolveTools, tmpfsSeedStagingPath, tmpfsSeedTargetPath, toolConfigDirCandidates } from '../tools.js';
-import { assertFreshSandboxReady, hydrateTmpfsSeedEntries, prepareTmpfsMounts } from '../recovery.js';
+import { assertFreshSandboxReady, hydrateTmpfsSeedEntries, prepareTmpfsMounts, startSandboxControlBroker } from '../recovery.js';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from '../mounts.js';
-import { assertSandboxTaskSource, materializeSandboxControl, materializeSandboxWorkspaceView } from '../workspace-view.js';
+import { assertSandboxTaskSource, materializeSandboxControl, materializeSandboxWorkspaceView, prepareSandboxWorkspaceMountTargets } from '../workspace-view.js';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.js';
 import { validateSelinuxDisableEnv } from '../engines/selinux.js';
 import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
@@ -65,11 +64,6 @@ const MANAGED_GITHUB_GIT_CONFIG = [
     '[url "https://github.com/"]',
     '\tinsteadOf = git@github.com:'
 ];
-function internalCliPath() {
-    const directory = path.dirname(fileURLToPath(import.meta.url));
-    const extension = path.extname(fileURLToPath(import.meta.url));
-    return path.resolve(directory, '..', '..', '..', 'bin', `internal-cli${extension}`);
-}
 function resolveToolDirs(config, tools, branch) {
     return tools.map((tool) => {
         const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -895,8 +889,12 @@ export async function create(args) {
                                 const requestedDescription = target.workspace.mode === 'task-bound'
                                     ? `task-bound:${target.workspace.taskId}`
                                     : target.workspace.mode;
+                                const recoveryTarget = target.workspace.mode === 'task-bound'
+                                    ? target.workspace.taskId
+                                    : branch;
                                 throw new Error(`SANDBOX_WORKSPACE_IDENTITY_CONFLICT: container '${name}' is ${existingDescription}, `
-                                    + `but this request is ${requestedDescription}. Run 'ai sandbox rm ${branch}' and retry.`);
+                                    + `but this request is ${requestedDescription}. `
+                                    + `Run 'ai sandbox start --recreate ${recoveryTarget}' on the host, then retry.`);
                             }
                         }
                         message('Removing old container instance...');
@@ -962,6 +960,7 @@ export async function create(args) {
                             container,
                             identity: target.workspace
                         });
+                        prepareSandboxWorkspaceMountTargets(worktree);
                         const control = materializeSandboxControl({
                             base: effectiveConfig.controlBase,
                             repoRoot: effectiveConfig.repoRoot,
@@ -982,6 +981,7 @@ export async function create(args) {
                             shellConfigHostDir: hostShellConfig.hostDir,
                             workspaceViewRoot: workspaceView.root,
                             controlDir: control.channelDir,
+                            controlStatusDir: control.statusDir,
                             ...(target.workspace.mode === 'task-bound'
                                 ? {
                                     taskSource: assertSandboxTaskSource(effectiveConfig.repoRoot, target.workspace.taskId),
@@ -1052,7 +1052,11 @@ export async function create(args) {
                             '-e',
                             `AGENT_INFRA_CONTROL_TOKEN=${control.token}`,
                             '-e',
+                            `AGENT_INFRA_CONTROL_GENERATION=${control.generation}`,
+                            '-e',
                             'AGENT_INFRA_CONTROL_DIR=/run/agent-infra/control',
+                            '-e',
+                            'AGENT_INFRA_CONTROL_STATUS_DIR=/run/agent-infra/control-status',
                             '--label',
                             `${sandboxRuntimeCapabilityLabel(effectiveConfig)}=${capabilityPlan.runtimeSignature}`,
                             ...coreVolumes,
@@ -1070,12 +1074,7 @@ export async function create(args) {
                             '/workspace',
                             effectiveConfig.imageName
                         ]);
-                        const broker = spawn(process.execPath, [internalCliPath(), 'sandbox-control', 'serve', '--manifest', control.manifestPath], { cwd: effectiveConfig.repoRoot, detached: true, stdio: 'ignore' });
-                        broker.once('error', () => {
-                            // Fresh readiness verification below remains the source of truth;
-                            // consume detached spawn errors so they cannot crash the command.
-                        });
-                        broker.unref();
+                        await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
                         createdTmpfsSeedPlan = tmpfsSeedPlan;
                     }
                     finally {

package/dist/lib/sandbox/commands/prune.js

@@ -5,12 +5,13 @@ import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { loadConfig } from '../config.js';
 import { safeNameCandidates, sandboxBranchLabel, sandboxLabel } from '../constants.js';
-import { detectEngine } from '../engine.js';
+import { detectEngine, ENGINES } from '../engine.js';
 import { hostJoin } from '../engines/wsl2-paths.js';
 import { removeManagedDir, removeWorktreeDir } from '../managed-fs.js';
 import { parseLabels } from './ls.js';
 import { runEngine, runSafe } from '../shell.js';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
+import { createCleanPermit, formatWorktreeSnapshot, inspectWorktrees } from '../worktree-safety.js';
 const USAGE = `Usage: ai sandbox prune [--dry-run]`;
 function listChildDirs(base) {
     if (!fs.existsSync(base)) {
@@ -83,12 +84,15 @@ export function collectOrphanGroups(config, tools, activeBranches) {
     }
     return groups;
 }
-export function removeOrphanGroups(config, groups) {
+export function removeOrphanGroups(config, groups, permits, allowRegisteredPathFallback = false) {
     let removedWorktrees = false;
     for (const group of groups) {
         for (const dir of group.dirs) {
             if (group.kind === 'worktree') {
-                removeWorktreeDir(config.repoRoot, group.base, dir);
+                const permit = permits.get(path.resolve(dir));
+                if (!permit)
+                    throw new Error(`Missing worktree removal permit: ${dir}`);
+                removeWorktreeDir(config.repoRoot, group.base, dir, permit, { allowRegisteredPathFallback });
                 removedWorktrees = true;
             }
             else {
@@ -115,7 +119,7 @@ function writeGroups(groups) {
         }
     }
 }
-export async function prune(args) {
+export async function prune(args, dependencies = {}) {
     const { values } = parseArgs({
         args,
         strict: true,
@@ -128,9 +132,9 @@ export async function prune(args) {
         process.stdout.write(`${USAGE}\n`);
         return;
     }
-    const config = loadConfig();
-    const tools = [...createSandboxCapabilityPlan(config).cleanupInventory];
-    const engine = detectEngine(config);
+    const config = dependencies.config ?? loadConfig();
+    const tools = dependencies.tools ?? [...createSandboxCapabilityPlan(config).cleanupInventory];
+    const engine = dependencies.engine ?? detectEngine(config);
     const psArgs = [
         'ps',
         '-a',
@@ -139,15 +143,27 @@ export async function prune(args) {
         '--format',
         '{{.Labels}}'
     ];
-    let labelsOutput;
-    try {
-        labelsOutput = runEngine(engine, 'docker', psArgs);
-    }
-    catch {
-        throw new Error('Unable to determine active sandbox branches: docker ps failed');
+    let labelsOutput = dependencies.labelsOutput;
+    if (labelsOutput === undefined) {
+        try {
+            labelsOutput = runEngine(engine, 'docker', psArgs);
+        }
+        catch {
+            throw new Error('Unable to determine active sandbox branches: docker ps failed');
+        }
     }
+    const confirm = dependencies.confirm ?? p.confirm;
+    const isCancel = dependencies.isCancel ?? p.isCancel;
     const groups = collectOrphanGroups(config, tools, activeBranchesFromLabels(config, labelsOutput));
     const count = orphanCount(groups);
+    const worktrees = groups.filter((group) => group.kind === 'worktree').flatMap((group) => group.dirs);
+    const inspections = inspectWorktrees(worktrees);
+    const blockers = inspections.filter((inspection) => inspection.status !== 'clean');
+    const permits = new Map();
+    for (const inspection of inspections) {
+        if (inspection.status === 'clean')
+            permits.set(inspection.snapshot.worktree, createCleanPermit(inspection.snapshot));
+    }
     p.intro(pc.cyan(`Pruning orphaned sandbox state for ${config.project}`));
     if (count === 0) {
         p.log.success('No orphaned sandbox state dirs found');
@@ -155,19 +171,27 @@ export async function prune(args) {
         return;
     }
     writeGroups(groups);
+    for (const blocker of blockers) {
+        p.log.error(blocker.status === 'failed'
+            ? `${JSON.stringify(blocker.worktree)}: ${blocker.message}`
+            : formatWorktreeSnapshot(blocker.snapshot));
+    }
     if (values['dry-run']) {
         p.outro(pc.green('Dry run complete'));
         return;
     }
-    const shouldRemove = await p.confirm({
+    if (blockers.length > 0) {
+        throw new Error('Refusing to prune because worktree preflight found blocker(s); no orphan state was deleted');
+    }
+    const shouldRemove = await confirm({
         message: `Remove ${count} orphaned sandbox state dirs?`,
         initialValue: true
     });
-    if (p.isCancel(shouldRemove) || !shouldRemove) {
+    if (isCancel(shouldRemove) || !shouldRemove) {
         p.outro('Cancelled');
         return;
     }
-    const removedWorktrees = removeOrphanGroups(config, groups);
+    const removedWorktrees = removeOrphanGroups(config, groups, permits, engine === ENGINES.WSL2);
     if (removedWorktrees) {
         runSafe('git', ['-C', config.repoRoot, 'worktree', 'prune']);
     }