@fitlab-ai/agent-infra 0.9.6 → 0.9.7

package/lib/internal/codex-lifecycle.ts

@@ -9,7 +9,11 @@ import {
   resolveCodexThread
 } from '../agent-clients/adapters/codex-lifecycle/app-server.ts';
 import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.ts';
+import { createCodexCapabilityStore } from '../agent-clients/adapters/codex-lifecycle/capability-store.ts';
+import { computeLifecycleBuildIdentity } from '../agent-clients/adapters/codex-lifecycle/build-identity.ts';
+import { verifyCodexSandboxControllerContext } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
 import type { CodexLifecycleEvent } from '../agent-clients/adapters/codex-lifecycle/evidence.ts';
+import { resolveTaskRef } from '../task/resolve-ref.ts';
 import {
   activateCodexOrchestrationDelegation,
   activateCodexSpawnDelegation,
@@ -18,7 +22,7 @@ import {
   sealCodexParentDelegation
 } from '../task/codex-orchestration.ts';
 
-const USAGE = 'Usage: agent-infra-internal codex-lifecycle <hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
+const USAGE = 'Usage: agent-infra-internal codex-lifecycle <capability-arm|hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
 const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
 
 type Parsed = Readonly<{ operation: string; values: Readonly<Record<string, string>> }>;
@@ -53,6 +57,7 @@ function parse(args: string[]): Parsed | null {
     return null;
   }
   const allowed = {
+    'capability-arm': ['--task-id'],
     'hook-event': ['--event', '--bridge'],
     'resolve-start': ['--child-id'],
     'resolve-stop': ['--child-id'],
@@ -92,6 +97,16 @@ function hookDefinitionHash(): string {
   return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
 }
 
+function controllerBinding(taskId: string) {
+  const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+  if (!contextPath) return undefined;
+  const context = verifyCodexSandboxControllerContext(contextPath, taskId, { repoRoot: process.cwd() });
+  return {
+    instanceDigest: context.controllerInstanceDigest,
+    controlGeneration: context.controlGeneration
+  };
+}
+
 async function readStdin(): Promise<unknown> {
   let input = '';
   process.stdin.setEncoding('utf8');
@@ -171,6 +186,28 @@ async function codexLifecycle(args: string[] = []): Promise<void> {
       return;
     }
 
+    if (parsed.operation === 'capability-arm') {
+      const taskId = parsed.values['--task-id'];
+      if (!taskId) throw new Error('capability-arm requires --task-id');
+      const resolved = resolveTaskRef(taskId, { repoRoot: process.cwd() });
+      if (!resolved.ok) throw new Error(`${resolved.code}: ${resolved.message}`);
+      const armed = createCodexCapabilityStore().arm({
+        taskId: resolved.taskId,
+        buildIdentity: computeLifecycleBuildIdentity(process.cwd()),
+        controller: controllerBinding(resolved.taskId)
+      });
+      output({
+        status: 'armed',
+        changed: true,
+        capabilityToken: armed.token,
+        marker: armed.marker,
+        expiresAt: armed.expiresAt,
+        buildIdentity: armed.buildIdentity,
+        error: null
+      });
+      return;
+    }
+
     const store = createCodexLifecycleStore({ cliVersion: cliVersion() });
     if (parsed.operation === 'hook-event') {
       const phase = parsed.values['--event'];
@@ -181,6 +218,36 @@ async function codexLifecycle(args: string[] = []): Promise<void> {
         throw new Error("hook-event --bridge must be 'true'");
       }
       const payload = await readStdin();
+      if (phase === 'post-tool') {
+        const capabilityToken = payloadText(payload, 'capabilityToken');
+        if (capabilityToken) {
+          const capabilityStore = createCodexCapabilityStore();
+          const armed = capabilityStore.inspect(capabilityToken);
+          const capability = createCodexCapabilityStore().attest({
+            token: capabilityToken,
+            sessionId: payloadText(payload, 'sessionId'),
+            turnId: payloadText(payload, 'turnId'),
+            toolUseId: payloadText(payload, 'toolUseId'),
+            hookDefinitionHash: payloadText(payload, 'hookDefinitionHash'),
+            buildIdentity: computeLifecycleBuildIdentity(process.cwd()),
+            controller: controllerBinding(armed.taskId)
+          });
+          output({
+            status: capability.status,
+            changed: true,
+            evidence: {
+              revision: capability.revision,
+              sessionId: capability.sessionId,
+              turnId: capability.turnId,
+              toolUseId: capability.toolUseId,
+              expiresAt: capability.expiresAt
+            },
+            diagnostics: [],
+            error: null
+          });
+          return;
+        }
+      }
       if (phase === 'post-tool' && parsed.values['--bridge'] === 'true') {
         const toolName = payloadText(payload, 'toolName');
         if (toolName === 'collaborationspawn_agent') {

package/lib/internal/codex-sandbox-controller.ts

@@ -0,0 +1,109 @@
+import {
+  runCodexSandboxController,
+  verifyCodexSandboxControllerContext
+} from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
+
+const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
+
+function fail(code: string, message: string, exitCode = 1): void {
+  process.stdout.write(`${JSON.stringify({
+    status: 'failed',
+    changed: false,
+    error: { code, message }
+  })}\n`);
+  process.exitCode = exitCode;
+}
+
+function parse(args: string[]): Readonly<{ operation: string; values: Readonly<Record<string, string>> }> | null {
+  if (args[0] === '--help' || args[0] === '-h') {
+    process.stdout.write(USAGE);
+    return null;
+  }
+  const operation = args[0];
+  if (!operation || !['run', 'verify-context'].includes(operation)) {
+    process.stderr.write(USAGE);
+    fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', 'operation must be run or verify-context', 2);
+    return null;
+  }
+  const allowed = new Set([
+    '--task-id',
+    '--task-ref',
+    '--context',
+    '--executor-model',
+    '--executor-reasoning-effort',
+    '--reviewer-model',
+    '--reviewer-reasoning-effort'
+  ]);
+  const values: Record<string, string> = {};
+  for (let index = 1; index < args.length; index += 1) {
+    const flag = args[index]!;
+    const value = args[++index];
+    if (!allowed.has(flag) || Object.hasOwn(values, flag) || !value || value.startsWith('--')) {
+      fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', `invalid option '${flag}'`, 2);
+      return null;
+    }
+    values[flag] = value;
+  }
+  return { operation, values };
+}
+
+async function codexSandboxController(args: string[] = []): Promise<void> {
+  const parsed = parse(args);
+  if (!parsed || process.exitCode) return;
+  const taskId = parsed.values['--task-id'];
+  if (!taskId) {
+    fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', '--task-id is required', 2);
+    return;
+  }
+  try {
+    if (parsed.operation === 'verify-context') {
+      const contextPath = parsed.values['--context']
+        ?? process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+      if (!contextPath) throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_MISSING');
+      const context = verifyCodexSandboxControllerContext(contextPath, taskId);
+      process.stdout.write(`${JSON.stringify({
+        status: 'ready',
+        changed: false,
+        context: {
+          taskId: context.taskId,
+          controlGeneration: context.controlGeneration,
+          controllerInstanceDigest: context.controllerInstanceDigest,
+          expiresAt: context.expiresAt,
+          buildIdentity: context.buildIdentity,
+          hookDefinitionHash: context.hookDefinitionHash,
+          lifecycleProfilesHash: context.lifecycleProfilesHash
+        },
+        error: null
+      })}\n`);
+      return;
+    }
+    const taskRef = parsed.values['--task-ref'];
+    if (!taskRef) throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_REF_REQUIRED');
+    const policy = [
+      '--executor-model',
+      '--executor-reasoning-effort',
+      '--reviewer-model',
+      '--reviewer-reasoning-effort'
+    ];
+    if (policy.some((flag) => parsed.values[flag] !== undefined)
+      && policy.some((flag) => parsed.values[flag] === undefined)) {
+      throw new Error('CODEX_SANDBOX_CONTROLLER_MODEL_POLICY_INVALID');
+    }
+    const exitCode = await runCodexSandboxController({
+      taskId,
+      taskRef,
+      executorModel: parsed.values['--executor-model'],
+      executorReasoningEffort: parsed.values['--executor-reasoning-effort'],
+      reviewerModel: parsed.values['--reviewer-model'],
+      reviewerReasoningEffort: parsed.values['--reviewer-reasoning-effort']
+    });
+    process.exitCode = exitCode;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const code = /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1]
+      ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+    fail(code, message);
+  }
+}
+
+export { codexSandboxController };

package/lib/internal/task-orchestration.ts

@@ -4,12 +4,15 @@ import {
   activateMatchingOrchestrationDelegation,
   activateOrchestrationDelegation,
   advanceOrchestration,
+  awaitOrchestrationDelegationActivation,
   beginCommitIntent,
   beginOrResumeOrchestration,
   checkpointCommitIntent,
   completeCommitIntent,
+  dispatchOrchestrationDelegation,
   pauseOrchestration,
   recoverCommitIntent,
+  recoverPreparedOrchestrationDelegation,
   routeOrchestration,
   sealMatchingOrchestrationDelegation,
   sealOrchestrationDelegation,
@@ -22,7 +25,7 @@ import { prepareCodexOrchestrationDelegation } from '../task/codex-orchestration
 import { isAgentClientId } from '../agent-clients/types.ts';
 import type { AgentClientId } from '../agent-clients/types.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-start|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-terminate|commit-status> [options]\n';
+const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|dispatch|await-activation|recover-prepared|hook-start|hook-stop|advance|pause|status|commit-start|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-terminate|commit-status> [options]\n';
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({
@@ -44,7 +47,8 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
   }
   const [taskRef, intent] = args;
   if (![
-    'begin-or-resume', 'route', 'prepare', 'hook-start', 'hook-stop', 'advance', 'pause', 'status',
+    'begin-or-resume', 'route', 'prepare', 'dispatch', 'await-activation', 'recover-prepared',
+    'hook-start', 'hook-stop', 'advance', 'pause', 'status',
     'commit-start', 'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-terminate', 'commit-status'
   ].includes(intent!)) {
     usageFailure(`unknown intent '${intent}'`);
@@ -64,7 +68,9 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
     if (![
       '--max-steps', '--executor-model', '--executor-reasoning-effort',
       '--reviewer-model', '--reviewer-reasoning-effort',
-      '--client', '--requested-model', '--requested-reasoning-effort', '--parent-id', '--before-fingerprint',
+      '--client', '--requested-model', '--requested-reasoning-effort', '--capability-token',
+      '--parent-id', '--before-fingerprint',
+      '--stage', '--round', '--artifact', '--role',
       '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--actual-reasoning-effort',
       '--model-fallback-reason', '--reasoning-effort-fallback-reason',
       '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent',
@@ -215,8 +221,29 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
     result = await prepareCodexOrchestrationDelegation(taskRef!, {
       client: values['--client'] as AgentClientId,
       requestedModel: values['--requested-model'],
-      requestedReasoningEffort: values['--requested-reasoning-effort']
+      requestedReasoningEffort: values['--requested-reasoning-effort'],
+      capabilityToken: values['--capability-token']
     }, { orchestrationOptions: coreOptions });
+  } else if (intent === 'dispatch') {
+    result = dispatchOrchestrationDelegation(taskRef!, coreOptions);
+  } else if (intent === 'await-activation') {
+    const missing = requireValues(['--stage', '--round', '--artifact', '--role']);
+    if (missing) { usageFailure(`intent 'await-activation' requires '${missing}'`); return; }
+    const round = Number(values['--round']);
+    if (!Number.isSafeInteger(round) || round < 1) {
+      usageFailure('--round must be a positive integer'); return;
+    }
+    if (!['executor', 'reviewer'].includes(values['--role']!)) {
+      usageFailure('--role must be executor or reviewer'); return;
+    }
+    result = await awaitOrchestrationDelegationActivation(taskRef!, {
+      stage: values['--stage'] as Parameters<typeof awaitOrchestrationDelegationActivation>[1]['stage'],
+      round,
+      artifact: values['--artifact']!,
+      role: values['--role'] as 'executor' | 'reviewer'
+    }, coreOptions);
+  } else if (intent === 'recover-prepared') {
+    result = recoverPreparedOrchestrationDelegation(taskRef!, coreOptions);
   } else if (intent === 'hook-start') {
     const missing = requireValues([
       ...(taskRef === 'auto' ? ['--client'] : []),

package/lib/platform/context.ts

@@ -20,6 +20,8 @@ type ContextOptions = {
   platformType?: string;
 };
 
+const CURRENT_USER_QUERY = 'query { viewer { login } }';
+
 function findRepoRoot(cwd: string): string {
   try {
     return execFileSync('git', ['rev-parse', '--show-toplevel'], {
@@ -105,16 +107,17 @@ function resolveGitHubContext(options: ContextOptions & { cwd: string }): Platfo
       error: { code: 'UPSTREAM_UNRESOLVED', message: 'Unable to resolve the upstream repository', retryable: false }
     });
   }
-  const user = client.json(['api', 'user'], { cwd });
+  const user = client.json(['api', 'graphql', '-f', `query=${CURRENT_USER_QUERY}`], { cwd });
   if (!user.ok) return failure(user.error, upstream);
-  const userValue = user.value as { login?: string } | null;
+  const userValue = user.value as { data?: { viewer?: { login?: string } } } | null;
+  const currentUser = userValue?.data?.viewer?.login || null;
   const permissions = client.json(['api', `repos/${upstream}`], { cwd });
   if (!permissions.ok) return failure(permissions.error, upstream);
   const permissionValue = permissions.value as { permissions?: Record<string, boolean> } | null;
   const values = permissionValue?.permissions || {};
   const capabilities = {
-    authenticated: Boolean(userValue?.login),
-    comment: Boolean(userValue?.login),
+    authenticated: Boolean(currentUser),
+    comment: Boolean(currentUser),
     triage: Boolean(values.triage || values.push || values.admin),
     push: Boolean(values.push || values.admin),
     admin: Boolean(values.admin)
@@ -122,7 +125,7 @@ function resolveGitHubContext(options: ContextOptions & { cwd: string }): Platfo
   const status = Object.values(capabilities).every(Boolean) ? 'no-op' : 'degraded';
   return platformResult(status, {
     changed: false,
-    platform: { type: platform, repository: upstream, currentUser: userValue?.login || null },
+    platform: { type: platform, repository: upstream, currentUser },
     resource: { kind: 'repository', number: null },
     capabilities,
     operations: [{ name: 'resolve', status: 'no-op', reasonCode: null }]

package/lib/platform/github-client.ts

@@ -10,10 +10,18 @@ type RunOptions = { cwd?: string; input?: string };
 type Runner = (args: string[], options: RunOptions) => RunResult;
 type RequestOptions = RunOptions & { method?: 'GET' | 'PATCH' | 'POST' | 'DELETE' };
 type ClientResult<T> = { ok: true; value: T } | { ok: false; error: PlatformError };
+type ResponseMetadata = {
+  status: number;
+  requestUrl: string;
+  date?: string;
+  links: string[];
+};
+type JsonResponse<T> = { value: T; metadata: ResponseMetadata };
 
 type GitHubClient = {
   version(options?: RunOptions): ClientResult<string>;
   json<T = unknown>(args: string[], options?: RequestOptions): ClientResult<T>;
+  jsonWithMetadata?<T = unknown>(args: string[], options?: RequestOptions): ClientResult<JsonResponse<T>>;
   text(args: string[], options?: RequestOptions): ClientResult<string>;
 };
 
@@ -23,7 +31,9 @@ type ClientOptions = {
   sleep?: (delayMs: number) => void;
 };
 
-const MINIMUM_GITHUB_CLI_VERSION = '2.16.0';
+// closingIssuesReferences (introduced in gh 2.72.0) is the highest-versioned gh feature
+// the platform layer depends on; see github-release-notes.ts:102.
+const MINIMUM_GITHUB_CLI_VERSION = '2.72.0';
 const GITHUB_CLI_MAX_BUFFER = 64 * 1024 * 1024;
 const ERROR_DETAIL_LIMIT = 4096;
 
@@ -101,6 +111,39 @@ function classifyGitHubFailure(result: RunResult): PlatformError {
   return { code: 'PLATFORM_REQUEST_FAILED', message: detail || 'GitHub request failed', retryable: false };
 }
 
+function responseUrl(args: string[]): string {
+  const endpoint = args.find((arg, index) => index > 0 && !arg.startsWith('-')) || '';
+  return endpoint.startsWith('http') ? endpoint : `https://api.github.com/${endpoint.replace(/^\//, '')}`;
+}
+
+function parseIncludedResponse<T>(stdout: string, args: string[]): JsonResponse<T> | null {
+  const statusBlocks = [...stdout.matchAll(/^HTTP\/[^\r\n]+/gim)];
+  const headerStart = statusBlocks.at(-1)?.index;
+  if (headerStart === undefined) return null;
+  const response = stdout.slice(headerStart);
+  const separator = response.match(/\r?\n\r?\n/);
+  if (!separator || separator.index === undefined) return null;
+  const header = response.slice(0, separator.index);
+  const body = response.slice(separator.index + separator[0].length);
+  const status = header.match(/^HTTP\/[^ ]+\s+(\d{3})/mi)?.[1];
+  if (!status) return null;
+  const date = header.match(/^Date:\s*(.+)$/mi)?.[1]?.trim();
+  const links = [...header.matchAll(/^Link:\s*(.+)$/gim)].flatMap((match) => match[1]!.split(',').map((value) => value.trim()));
+  try {
+    return {
+      value: JSON.parse(body || 'null') as T,
+      metadata: {
+        status: Number(status),
+        requestUrl: responseUrl(args),
+        ...(date ? { date } : {}),
+        links
+      }
+    };
+  } catch {
+    return null;
+  }
+}
+
 function createGitHubClient(options: ClientOptions = {}): GitHubClient {
   const runner = options.runner || defaultRunner;
   const delays = options.retryDelaysMs || retryDelaysFromEnvironment();
@@ -156,9 +199,24 @@ function createGitHubClient(options: ClientOptions = {}): GitHubClient {
           error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub returned invalid JSON', retryable: true }
         };
       }
+    },
+    jsonWithMetadata<T>(args: string[], request: RequestOptions = {}): ClientResult<JsonResponse<T>> {
+      const includeArgs = args[0] === 'api' && args[1] !== '--include'
+        ? [args[0], '--include', ...args.slice(1)]
+        : args;
+      const result = run(includeArgs, request);
+      if (!result.ok) return result;
+      const parsed = parseIncludedResponse<T>(result.value, args);
+      if (!parsed) {
+        return {
+          ok: false,
+          error: { code: 'INVALID_PLATFORM_RESPONSE', message: 'GitHub response metadata or JSON is invalid', retryable: true }
+        };
+      }
+      return { ok: true, value: parsed };
     }
   };
 }
 
-export { classifyGitHubFailure, createGitHubClient, MINIMUM_GITHUB_CLI_VERSION };
-export type { ClientResult, GitHubClient, RequestOptions, RunOptions, RunResult, Runner };
+export { classifyGitHubFailure, createGitHubClient, MINIMUM_GITHUB_CLI_VERSION, parseIncludedResponse };
+export type { ClientResult, GitHubClient, JsonResponse, RequestOptions, ResponseMetadata, RunOptions, RunResult, Runner };