@fitlab-ai/agent-infra 0.9.5 → 0.9.7

package/dist/lib/agent-clients/adapters/codex-lifecycle/capability-store.js

@@ -0,0 +1,244 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { verifyLifecycleBuildIdentity } from './build-identity.js';
+const DEFAULT_TTL_MS = 30_000;
+const DEFAULT_TOMBSTONE_MS = 86_400_000;
+const DEFAULT_MAX_RECORDS = 128;
+const LOCK_RETRY_MS = 10;
+const LOCK_TIMEOUT_MS = 1_000;
+const LOCK_STALE_MS = 30_000;
+function digest(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function capabilityError(code, message) {
+    const error = new Error(`${code}: ${message}`);
+    error.name = code;
+    return error;
+}
+function sameController(left, right) {
+    return left?.instanceDigest === right?.instanceDigest
+        && left?.controlGeneration === right?.controlGeneration;
+}
+function createCodexCapabilityStore(options = {}) {
+    const root = options.root
+        ?? path.join(process.cwd(), '.agents', 'workspace', '.runtime', 'codex-capabilities');
+    const now = options.now ?? Date.now;
+    const createToken = options.token ?? (() => crypto.randomBytes(32).toString('base64url'));
+    const ttlMs = options.ttlMs ?? DEFAULT_TTL_MS;
+    const tombstoneMs = options.tombstoneMs ?? DEFAULT_TOMBSTONE_MS;
+    const maxRecords = options.maxRecords ?? DEFAULT_MAX_RECORDS;
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    fs.chmodSync(root, 0o700);
+    function fileFor(token) {
+        return path.join(root, `${digest(token)}.json`);
+    }
+    function read(file) {
+        const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (value.schemaVersion !== 1 || !Number.isSafeInteger(value.revision) || value.revision < 1) {
+            throw capabilityError('CODEX_CAPABILITY_STATE_INVALID', 'capability record schema is invalid');
+        }
+        return value;
+    }
+    function withWriteLock(operation) {
+        const lock = path.join(root, '.write.lock');
+        const deadline = Date.now() + LOCK_TIMEOUT_MS;
+        let descriptor = null;
+        while (descriptor === null) {
+            try {
+                descriptor = fs.openSync(lock, 'wx', 0o600);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                try {
+                    if (Date.now() - fs.statSync(lock).mtimeMs > LOCK_STALE_MS) {
+                        fs.unlinkSync(lock);
+                        continue;
+                    }
+                }
+                catch (lockError) {
+                    if (lockError.code === 'ENOENT')
+                        continue;
+                    throw lockError;
+                }
+                if (Date.now() >= deadline) {
+                    throw capabilityError('CODEX_CAPABILITY_STORE_BUSY', 'capability store is busy');
+                }
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_MS);
+            }
+        }
+        try {
+            return operation();
+        }
+        finally {
+            fs.closeSync(descriptor);
+            fs.unlinkSync(lock);
+        }
+    }
+    function write(file, value, expectedRevision) {
+        const temporary = `${file}.${process.pid}.${crypto.randomUUID()}.tmp`;
+        fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: 'utf8',
+            flag: 'wx',
+            mode: 0o600
+        });
+        try {
+            withWriteLock(() => {
+                options.beforeCompareAndSwap?.({ path: file, expectedRevision });
+                const actualRevision = fs.existsSync(file) ? read(file).revision : 0;
+                if (actualRevision !== expectedRevision) {
+                    throw capabilityError('CODEX_CAPABILITY_REVISION_CONFLICT', `capability revision changed from ${expectedRevision} to ${actualRevision}`);
+                }
+                fs.renameSync(temporary, file);
+                fs.chmodSync(file, 0o600);
+            });
+        }
+        finally {
+            if (fs.existsSync(temporary))
+                fs.unlinkSync(temporary);
+        }
+    }
+    function files() {
+        return fs.readdirSync(root)
+            .filter((name) => /^[a-f0-9]{64}\.json$/u.test(name))
+            .map((name) => path.join(root, name));
+    }
+    function expire(record, file, timestamp) {
+        if ((record.status === 'armed' || record.status === 'attested') && timestamp > record.expiresAt) {
+            const expired = Object.freeze({
+                ...record,
+                revision: record.revision + 1,
+                status: 'expired'
+            });
+            write(file, expired, record.revision);
+            return expired;
+        }
+        return record;
+    }
+    function sweep() {
+        const timestamp = now();
+        const records = files().map((file) => ({ file, record: expire(read(file), file, timestamp) }));
+        for (const entry of records) {
+            const terminalAt = entry.record.consumedAt ?? entry.record.expiresAt;
+            if (['consumed', 'expired'].includes(entry.record.status)
+                && timestamp - terminalAt > tombstoneMs) {
+                fs.unlinkSync(entry.file);
+            }
+        }
+        const remaining = files().map((file) => ({ file, record: read(file) }));
+        if (remaining.length <= maxRecords)
+            return;
+        const removable = remaining
+            .filter(({ record }) => ['consumed', 'expired'].includes(record.status))
+            .sort((left, right) => (left.record.consumedAt ?? left.record.expiresAt)
+            - (right.record.consumedAt ?? right.record.expiresAt));
+        while (files().length > maxRecords && removable.length > 0) {
+            fs.unlinkSync(removable.shift().file);
+        }
+        if (files().length > maxRecords) {
+            throw capabilityError('CODEX_CAPABILITY_CAPACITY_EXCEEDED', 'capability store has too many active records');
+        }
+    }
+    function arm(input) {
+        sweep();
+        const token = createToken();
+        const file = fileFor(token);
+        if (fs.existsSync(file))
+            throw capabilityError('CODEX_CAPABILITY_TOKEN_COLLISION', 'capability token already exists');
+        const timestamp = now();
+        const record = Object.freeze({
+            schemaVersion: 1,
+            revision: 1,
+            tokenDigest: digest(token),
+            taskId: input.taskId,
+            status: 'armed',
+            buildIdentity: input.buildIdentity,
+            controller: input.controller ?? null,
+            sessionId: null,
+            turnId: null,
+            toolUseId: null,
+            hookDefinitionHash: null,
+            armedAt: timestamp,
+            expiresAt: timestamp + ttlMs,
+            attestedAt: null,
+            consumedAt: null
+        });
+        write(file, record, 0);
+        return Object.freeze({
+            ...record,
+            token,
+            path: file,
+            marker: `agent-infra-codex-capability:${token}`
+        });
+    }
+    function loadActive(token) {
+        const file = fileFor(token);
+        if (!fs.existsSync(file)) {
+            throw capabilityError('CODEX_CAPABILITY_MISSING', 'capability token was not found');
+        }
+        const record = expire(read(file), file, now());
+        if (record.status === 'expired') {
+            throw capabilityError('CODEX_CAPABILITY_EXPIRED', 'capability token expired');
+        }
+        return { file, record };
+    }
+    function attest(input) {
+        const { file, record } = loadActive(input.token);
+        if (record.status !== 'armed') {
+            throw capabilityError(record.status === 'consumed' ? 'CODEX_CAPABILITY_REPLAY' : 'CODEX_CAPABILITY_STATE_INVALID', `capability is ${record.status}, expected armed`);
+        }
+        const identity = verifyLifecycleBuildIdentity(record.buildIdentity, input.buildIdentity);
+        if (!identity.ok || !sameController(record.controller, input.controller ?? null)) {
+            throw capabilityError('CODEX_CAPABILITY_PROVENANCE_MISMATCH', 'capability build or controller identity does not match');
+        }
+        if (![input.sessionId, input.turnId, input.toolUseId, input.hookDefinitionHash]
+            .every((value) => value.trim().length > 0)) {
+            throw capabilityError('CODEX_CAPABILITY_IDENTITY_INVALID', 'hook identity is incomplete');
+        }
+        const timestamp = now();
+        const next = Object.freeze({
+            ...record,
+            revision: record.revision + 1,
+            status: 'attested',
+            sessionId: input.sessionId,
+            turnId: input.turnId,
+            toolUseId: input.toolUseId,
+            hookDefinitionHash: input.hookDefinitionHash,
+            attestedAt: timestamp
+        });
+        write(file, next, record.revision);
+        return next;
+    }
+    function consume(token, expected) {
+        sweep();
+        const { file, record } = loadActive(token);
+        if (record.status === 'consumed') {
+            throw capabilityError('CODEX_CAPABILITY_REPLAY', 'capability token was already consumed');
+        }
+        if (record.status !== 'attested') {
+            throw capabilityError('CODEX_CAPABILITY_NOT_ATTESTED', 'capability token has no current-session hook attestation');
+        }
+        const identity = verifyLifecycleBuildIdentity(record.buildIdentity, expected.buildIdentity);
+        if (!identity.ok
+            || record.taskId !== expected.taskId
+            || record.hookDefinitionHash !== expected.hookDefinitionHash
+            || !sameController(record.controller, expected.controller ?? null)) {
+            throw capabilityError('CODEX_CAPABILITY_PROVENANCE_MISMATCH', 'capability consumption identity does not match');
+        }
+        const next = Object.freeze({
+            ...record,
+            revision: record.revision + 1,
+            status: 'consumed',
+            consumedAt: now()
+        });
+        write(file, next, record.revision);
+        return next;
+    }
+    function inspect(token) {
+        return loadActive(token).record;
+    }
+    return Object.freeze({ arm, attest, consume, inspect, sweep });
+}
+export { createCodexCapabilityStore };
+//# sourceMappingURL=capability-store.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/evidence.js

@@ -35,17 +35,29 @@ function requiredStrings(event) {
 }
 function derive(state) {
     const { spawn, child, thread, settings, reroute, terminal, stop } = state;
-    if (spawn && child && (spawn.sessionId !== child.sessionId
+    if (spawn && child && (spawn.sessionId !== child.parentThreadId
         || spawn.nativeAgent !== child.nativeAgent)) {
         return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook spawn and child identity do not match');
     }
+    if (child && child.sessionId !== child.parentThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'child event session does not match the parent thread');
+    }
     if (child && thread && child.childThreadId !== thread.childThreadId) {
         return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook and App Server child identity do not match');
     }
+    if (child && thread && child.nativeAgent !== thread.nativeAgent) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'hook and App Server agent roles do not match');
+    }
+    if (child && thread && child.parentThreadId !== thread.parentThreadId) {
+        return invalid(state, 'CODEX_EVIDENCE_PARENT_MISMATCH', 'hook and App Server parent identity do not match');
+    }
     if (spawn && thread && (thread.parentThreadId !== spawn.sessionId
         || thread.sourceParentThreadId !== spawn.sessionId)) {
         return invalid(state, 'CODEX_EVIDENCE_PARENT_MISMATCH', 'App Server parent identity does not match the spawning session');
     }
+    if (spawn && thread && spawn.nativeAgent !== thread.nativeAgent) {
+        return invalid(state, 'CODEX_EVIDENCE_IDENTITY_MISMATCH', 'spawn and App Server agent roles do not match');
+    }
     if (thread?.forkedFromId !== null && thread?.forkedFromId !== undefined) {
         return invalid(state, 'CODEX_EVIDENCE_FORK_FORBIDDEN', 'forked child threads are not fresh lifecycle evidence');
     }
@@ -105,7 +117,7 @@ function derive(state) {
             childThreadId: startEvidence.childThreadId,
             turnId: terminal.turnId,
             terminalStatus: 'completed',
-            hookStopObserved: true
+            hookStopObserved: stop.source !== 'parent-rollout'
         });
     }
     const status = stopEvidence

package/dist/lib/agent-clients/adapters/codex-lifecycle/sandbox-controller.js

@@ -0,0 +1,370 @@
+import crypto from 'node:crypto';
+import { spawn, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import semver from 'semver';
+import * as toml from 'smol-toml';
+import { requestSandboxControl } from '../../../sandbox/control/client.js';
+import { readSandboxControlStatus } from '../../../sandbox/control/state.js';
+import { getProcessStartTime, isProcessAlive } from '../../../server/process-state.js';
+import { computeLifecycleBuildIdentity } from './build-identity.js';
+const CONTEXT_TTL_MS = 4 * 60 * 60 * 1_000;
+function digestFiles(files) {
+    const hash = crypto.createHash('sha256');
+    for (const file of [...files].sort()) {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink()) {
+            throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
+        }
+        hash.update(path.basename(file));
+        hash.update('\0');
+        hash.update(fs.readFileSync(file));
+        hash.update('\0');
+    }
+    return hash.digest('hex');
+}
+function copyRegular(source, destination, mode) {
+    const stat = fs.lstatSync(source);
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_INPUT_INVALID');
+    }
+    fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
+    fs.copyFileSync(source, destination);
+    fs.chmodSync(destination, mode);
+}
+function controlFromEnvironment() {
+    const token = process.env.AGENT_INFRA_CONTROL_TOKEN;
+    const generation = process.env.AGENT_INFRA_CONTROL_GENERATION;
+    const channelDir = process.env.AGENT_INFRA_CONTROL_DIR;
+    const statusDir = process.env.AGENT_INFRA_CONTROL_STATUS_DIR;
+    if (!token || !generation || !channelDir || !statusDir) {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_CONTROL_MISSING');
+    }
+    return { token, generation, channelDir, statusDir };
+}
+function verifyControl(taskId, control) {
+    let status = null;
+    let lastError = null;
+    for (let attempt = 0; attempt < 5; attempt += 1) {
+        try {
+            status = readSandboxControlStatus(control.statusDir);
+            break;
+        }
+        catch (error) {
+            lastError = error;
+            if (attempt < 4)
+                Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+        }
+    }
+    if (!status) {
+        throw new Error(`CODEX_SANDBOX_CONTROLLER_CONTROL_UNAVAILABLE: ${String(lastError)}`);
+    }
+    if (status.generation !== control.generation
+        || status.state !== 'healthy'
+        || Date.now() - status.updatedAt > 1_500) {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_CONTROL_UNAVAILABLE');
+    }
+    const response = requestSandboxControl({
+        family: 'task-orchestration',
+        args: [taskId, 'status'],
+        ...control,
+        timeoutMs: 30_000
+    });
+    let payload = {};
+    try {
+        payload = JSON.parse(response.stdout);
+    }
+    catch {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_BINDING_INVALID');
+    }
+    if (payload.taskId !== taskId)
+        throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_BINDING_INVALID');
+}
+function detectedCodexVersion() {
+    const result = spawnSync('codex', ['--version'], { encoding: 'utf8' });
+    const version = /codex-cli\s+(\d+\.\d+\.\d+)/u.exec(result.stdout ?? '')?.[1];
+    if (result.status !== 0 || !version)
+        throw new Error('CODEX_SANDBOX_CONTROLLER_CODEX_UNAVAILABLE');
+    return version;
+}
+function sanitizedConfig(source, destination, sourceHome, targetHome) {
+    if (!fs.existsSync(source))
+        return [];
+    const parsed = toml.parse(fs.readFileSync(source, 'utf8'));
+    const allowed = new Set([
+        'model',
+        'model_provider',
+        'model_providers',
+        'model_reasoning_effort',
+        'model_auto_compact_token_limit',
+        'preferred_auth_method'
+    ]);
+    const output = Object.fromEntries(Object.entries(parsed).filter(([key]) => allowed.has(key)));
+    const catalog = parsed.model_catalog_json;
+    if (typeof catalog === 'string' && catalog.trim()) {
+        const resolved = path.resolve(sourceHome, catalog.replace(/^~[/\\]/u, ''));
+        const relative = path.relative(sourceHome, resolved);
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+            throw new Error('CODEX_SANDBOX_CONTROLLER_CONFIG_PATH_INVALID');
+        }
+        const target = path.join(targetHome, 'model-catalogs', path.basename(resolved));
+        copyRegular(resolved, target, 0o600);
+        output.model_catalog_json = target;
+    }
+    fs.writeFileSync(destination, `${toml.stringify(output)}\n`, { mode: 0o600 });
+    const providerEnvironment = new Set();
+    const providers = output.model_providers;
+    if (providers && typeof providers === 'object' && !Array.isArray(providers)) {
+        for (const provider of Object.values(providers)) {
+            if (!provider || typeof provider !== 'object' || Array.isArray(provider))
+                continue;
+            for (const key of ['env_key', 'envKey']) {
+                const name = provider[key];
+                if (typeof name === 'string' && /^[A-Z][A-Z0-9_]{1,127}$/u.test(name)) {
+                    providerEnvironment.add(name);
+                }
+            }
+        }
+    }
+    return Object.freeze([...providerEnvironment]);
+}
+function isolatedEnvironment(home, shimDir, contextPath, taskId, control, providerEnvironment, sourceEnvironment) {
+    const inherited = new Set([
+        'LANG', 'LC_ALL', 'TERM', 'COLORTERM',
+        'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY',
+        'http_proxy', 'https_proxy', 'no_proxy',
+        'SSL_CERT_FILE', 'SSL_CERT_DIR', 'NODE_EXTRA_CA_CERTS',
+        'CODEX_CI',
+        ...providerEnvironment
+    ]);
+    const env = {};
+    for (const key of inherited) {
+        if (sourceEnvironment[key] !== undefined)
+            env[key] = sourceEnvironment[key];
+    }
+    return {
+        ...env,
+        HOME: home,
+        CODEX_HOME: home,
+        PATH: `${shimDir}${path.delimiter}${sourceEnvironment.PATH ?? ''}`,
+        AGENT_INFRA_TASK_ID: taskId,
+        AGENT_INFRA_CONTROL_TOKEN: control.token,
+        AGENT_INFRA_CONTROL_GENERATION: control.generation,
+        AGENT_INFRA_CONTROL_DIR: control.channelDir,
+        AGENT_INFRA_CONTROL_STATUS_DIR: control.statusDir,
+        AGENT_INFRA_CODEX_CONTROLLER_CONTEXT: contextPath
+    };
+}
+function shellQuote(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function prepareCodexSandboxController(input, options = {}) {
+    const repoRoot = path.resolve(options.repoRoot ?? process.cwd());
+    const sourceHome = path.resolve(options.codexHome ?? process.env.CODEX_HOME ?? path.join(os.homedir(), '.codex'));
+    const control = options.control ?? controlFromEnvironment();
+    (options.verifyTaskBinding ?? verifyControl)(input.taskId, control);
+    const version = (options.codexVersion ?? detectedCodexVersion)();
+    if (!semver.gte(version, '0.147.0'))
+        throw new Error('CODEX_SANDBOX_CONTROLLER_CODEX_UNSUPPORTED');
+    const runtimeRoot = path.resolve(options.temporaryRoot
+        ?? path.join(os.tmpdir(), 'agent-infra-codex-controllers'));
+    fs.mkdirSync(runtimeRoot, { recursive: true, mode: 0o700 });
+    fs.chmodSync(runtimeRoot, 0o700);
+    const key = crypto.createHash('sha256')
+        .update(`${input.taskId}\0${control.generation}`)
+        .digest('hex');
+    const leasePath = path.join(runtimeRoot, `${key}.lease.json`);
+    if (fs.existsSync(leasePath)) {
+        const lease = JSON.parse(fs.readFileSync(leasePath, 'utf8'));
+        if (Number.isSafeInteger(lease.pid) && typeof lease.startTime === 'number'
+            && getProcessStartTime(lease.pid) === lease.startTime) {
+            throw new Error('CODEX_SANDBOX_CONTROLLER_BUSY');
+        }
+        fs.unlinkSync(leasePath);
+    }
+    const parentStartTime = getProcessStartTime(process.pid);
+    if (!parentStartTime)
+        throw new Error('CODEX_SANDBOX_CONTROLLER_PROCESS_IDENTITY_INVALID');
+    const instanceDigest = crypto.randomBytes(32).toString('hex');
+    fs.writeFileSync(leasePath, `${JSON.stringify({
+        version: 1,
+        pid: process.pid,
+        startTime: parentStartTime,
+        taskId: input.taskId,
+        generation: control.generation,
+        instanceDigest
+    })}\n`, { mode: 0o600, flag: 'wx' });
+    const home = fs.mkdtempSync(path.join(runtimeRoot, `${key}-`));
+    fs.chmodSync(home, 0o700);
+    let cleaned = false;
+    const cleanup = () => {
+        if (cleaned)
+            return;
+        cleaned = true;
+        const relative = path.relative(runtimeRoot, home);
+        if (!relative.startsWith('..') && !path.isAbsolute(relative)) {
+            fs.rmSync(home, { recursive: true, force: true });
+        }
+        try {
+            const lease = JSON.parse(fs.readFileSync(leasePath, 'utf8'));
+            if (lease.instanceDigest === instanceDigest)
+                fs.unlinkSync(leasePath);
+        }
+        catch {
+            // A missing or replaced lease is owned by another cleanup path.
+        }
+    };
+    try {
+        const auth = path.join(sourceHome, 'auth.json');
+        if (fs.existsSync(auth))
+            copyRegular(auth, path.join(home, 'auth.json'), 0o600);
+        const providerEnvironment = sanitizedConfig(path.join(sourceHome, 'config.toml'), path.join(home, 'config.toml'), sourceHome, home);
+        const hooks = path.join(repoRoot, '.codex', 'hooks.json');
+        const executor = path.join(repoRoot, '.codex', 'agents', 'agent-infra-lifecycle-executor.toml');
+        const reviewer = path.join(repoRoot, '.codex', 'agents', 'agent-infra-lifecycle-reviewer.toml');
+        copyRegular(hooks, path.join(home, 'hooks.json'), 0o600);
+        copyRegular(executor, path.join(home, 'agents', path.basename(executor)), 0o600);
+        copyRegular(reviewer, path.join(home, 'agents', path.basename(reviewer)), 0o600);
+        if (crypto.createHash('sha256').update(fs.readFileSync(path.join(home, 'hooks.json'))).digest('hex')
+            !== crypto.createHash('sha256').update(fs.readFileSync(hooks)).digest('hex')
+            || digestFiles([
+                path.join(home, 'agents', path.basename(executor)),
+                path.join(home, 'agents', path.basename(reviewer))
+            ]) !== digestFiles([executor, reviewer])) {
+            throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
+        }
+        const buildIdentity = computeLifecycleBuildIdentity(repoRoot);
+        const now = (options.now ?? Date.now)();
+        const context = Object.freeze({
+            version: 1,
+            taskId: input.taskId,
+            controlGeneration: control.generation,
+            controllerInstanceDigest: instanceDigest,
+            parentPid: process.pid,
+            parentStartTime,
+            issuedAt: now,
+            expiresAt: now + CONTEXT_TTL_MS,
+            buildIdentity,
+            hookDefinitionHash: crypto.createHash('sha256').update(fs.readFileSync(hooks)).digest('hex'),
+            lifecycleProfilesHash: digestFiles([executor, reviewer])
+        });
+        const contextPath = path.join(home, 'controller-context.json');
+        fs.writeFileSync(contextPath, `${JSON.stringify(context, null, 2)}\n`, { mode: 0o600 });
+        const shimDir = path.join(home, 'bin');
+        fs.mkdirSync(shimDir, { mode: 0o700 });
+        const internalCli = path.resolve(process.argv[1] ?? path.join(repoRoot, 'bin', 'internal-cli.ts'));
+        const source = internalCli.endsWith('.ts')
+            ? `#!/bin/sh\nexec ${shellQuote(process.execPath)} --experimental-strip-types ${shellQuote(internalCli)} "$@"\n`
+            : `#!/bin/sh\nexec ${shellQuote(process.execPath)} ${shellQuote(internalCli)} "$@"\n`;
+        fs.writeFileSync(path.join(shimDir, 'agent-infra-internal'), source, { mode: 0o700 });
+        const policy = [
+            input.executorModel ? `--executor-model ${input.executorModel}` : '',
+            input.executorReasoningEffort ? `--executor-reasoning-effort ${input.executorReasoningEffort}` : '',
+            input.reviewerModel ? `--reviewer-model ${input.reviewerModel}` : '',
+            input.reviewerReasoningEffort ? `--reviewer-reasoning-effort ${input.reviewerReasoningEffort}` : ''
+        ].filter(Boolean).join(' ');
+        const prompt = `$run-task ${input.taskRef}${policy ? ` ${policy}` : ''}`;
+        const args = Object.freeze([
+            'exec',
+            '--enable', 'hooks',
+            '--enable', 'multi_agent',
+            '--dangerously-bypass-hook-trust',
+            '--dangerously-bypass-approvals-and-sandbox',
+            '--json',
+            '-C', repoRoot,
+            prompt
+        ]);
+        const env = isolatedEnvironment(home, shimDir, contextPath, input.taskId, control, providerEnvironment, options.environment ?? process.env);
+        return Object.freeze({
+            command: 'codex',
+            args,
+            env,
+            home,
+            contextPath,
+            context,
+            cleanup
+        });
+    }
+    catch (error) {
+        cleanup();
+        throw error;
+    }
+}
+function verifyCodexSandboxControllerContext(contextPath, taskId, options = {}) {
+    const stat = fs.lstatSync(contextPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0) {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_INVALID');
+    }
+    const context = JSON.parse(fs.readFileSync(contextPath, 'utf8'));
+    const generation = options.generation ?? process.env.AGENT_INFRA_CONTROL_GENERATION;
+    if (context.version !== 1
+        || context.taskId !== taskId
+        || context.controlGeneration !== generation
+        || context.expiresAt < (options.now ?? Date.now())
+        || getProcessStartTime(context.parentPid) !== context.parentStartTime
+        || !isProcessAlive(context.parentPid)) {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_INVALID');
+    }
+    const current = computeLifecycleBuildIdentity(options.repoRoot ?? process.cwd());
+    if (JSON.stringify(current) !== JSON.stringify(context.buildIdentity)) {
+        throw new Error('CODEX_SANDBOX_CONTROLLER_BUNDLE_MISMATCH');
+    }
+    return Object.freeze(context);
+}
+async function runCodexSandboxController(input, options = {}) {
+    const prepared = prepareCodexSandboxController(input, options);
+    try {
+        const child = spawn(prepared.command, [...prepared.args], {
+            cwd: options.repoRoot ?? process.cwd(),
+            env: prepared.env,
+            stdio: 'inherit',
+            detached: process.platform !== 'win32'
+        });
+        let forceKill;
+        const terminate = () => {
+            if (child.pid && process.platform !== 'win32') {
+                try {
+                    process.kill(-child.pid, 'SIGTERM');
+                }
+                catch {
+                    child.kill('SIGTERM');
+                }
+            }
+            else
+                child.kill('SIGTERM');
+            forceKill = setTimeout(() => {
+                if (child.pid && process.platform !== 'win32') {
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        child.kill('SIGKILL');
+                    }
+                }
+                else
+                    child.kill('SIGKILL');
+            }, 5_000);
+            forceKill.unref();
+        };
+        process.once('SIGINT', terminate);
+        process.once('SIGTERM', terminate);
+        try {
+            return await new Promise((resolve, reject) => {
+                child.once('error', reject);
+                child.once('exit', (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+            });
+        }
+        finally {
+            if (forceKill)
+                clearTimeout(forceKill);
+            process.off('SIGINT', terminate);
+            process.off('SIGTERM', terminate);
+        }
+    }
+    finally {
+        prepared.cleanup();
+    }
+}
+export { prepareCodexSandboxController, runCodexSandboxController, verifyCodexSandboxControllerContext };
+//# sourceMappingURL=sandbox-controller.js.map