@fitlab-ai/agent-infra 0.9.6 → 0.9.7

package/dist/lib/process-data/store.js

@@ -47,12 +47,39 @@ function canonicalJsonBytes(value) {
     return Buffer.from(canonicalString(value, new Set()), 'utf8');
 }
 function ensurePrivateDirectory(directory) {
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    if (process.platform !== 'win32')
-        fs.chmodSync(directory, 0o700);
+    const missing = [];
+    let current = path.resolve(directory);
+    while (!fs.existsSync(current)) {
+        missing.push(current);
+        const parent = path.dirname(current);
+        if (parent === current)
+            throw new Error(`cannot create directory tree: ${directory}`);
+        current = parent;
+    }
+    for (const target of missing.reverse()) {
+        fs.mkdirSync(target, { mode: 0o700 });
+        if (process.platform !== 'win32')
+            fs.chmodSync(target, 0o700);
+        fsyncDirectory(path.dirname(target));
+    }
+}
+function fsyncDirectory(directory) {
+    if (process.platform === 'win32')
+        return;
+    const fd = fs.openSync(directory, 'r');
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
 }
 function writeExclusive(filePath, bytes) {
-    ensurePrivateDirectory(path.dirname(filePath));
+    const directory = path.dirname(filePath);
+    const directoryExisted = fs.existsSync(directory);
+    ensurePrivateDirectory(directory);
+    if (!directoryExisted)
+        fsyncDirectory(path.dirname(directory));
     try {
         const fd = fs.openSync(filePath, 'wx', 0o600);
         try {
@@ -62,6 +89,7 @@ function writeExclusive(filePath, bytes) {
         finally {
             fs.closeSync(fd);
         }
+        fsyncDirectory(directory);
         return true;
     }
     catch (error) {
@@ -100,7 +128,14 @@ function jsonLine(value) {
     return `${canonicalJsonBytes(value).toString('utf8')}\n`;
 }
 function writePrivateFile(filePath, content) {
-    fs.writeFileSync(filePath, content, { mode: 0o600, flag: 'wx' });
+    const fd = fs.openSync(filePath, 'wx', 0o600);
+    try {
+        fs.writeFileSync(fd, content);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
     if (process.platform !== 'win32')
         fs.chmodSync(filePath, 0o600);
 }
@@ -153,9 +188,82 @@ function publishSnapshot(root, input) {
             if (existing !== jsonLine(manifest))
                 throw new Error(`snapshot collision: ${snapshotId}`);
             fs.rmSync(staging, { recursive: true, force: true });
+            fsyncDirectory(stagingRoot);
+            return { snapshotId, path: destination, created: false };
+        }
+        fsyncDirectory(staging);
+        fs.renameSync(staging, destination);
+        fsyncDirectory(stagingRoot);
+        fsyncDirectory(path.dirname(destination));
+        return { snapshotId, path: destination, created: true };
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        throw error;
+    }
+}
+function publishSnapshotV2(root, input) {
+    ensurePrivateDirectory(root);
+    ensurePrivateDirectory(path.join(root, 'repairs'));
+    const date = new Date(input.observedTo);
+    if (!Number.isFinite(date.getTime()))
+        throw new Error('observedTo must be an ISO timestamp');
+    const identity = {
+        scope: 'github',
+        repository: input.repository,
+        observedFrom: input.observedFrom,
+        observedTo: input.observedTo,
+        objects: input.objects,
+        endpoints: input.endpoints,
+        excerptsEnabled: false,
+        dispositionCounts: dispositionCounts(input.objects),
+        recordCount: input.records.length,
+        findingCount: input.quality.length,
+        repairCount: input.repairs.length,
+        snapshotKind: input.snapshotKind,
+        parentSnapshotId: input.parentSnapshotId,
+        checkpointBefore: input.checkpointBefore,
+        watermark: input.watermark,
+        window: input.window,
+        observation: input.observation,
+        coverage: input.coverage,
+        reconciliation: input.reconciliation,
+        operations: input.operations
+    };
+    const snapshotId = `${input.watermark.replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z')}-${sha256(canonicalJsonBytes(identity)).slice(0, 12)}`;
+    const partialManifest = {
+        schema: 'raw-manifest/v2',
+        snapshotId,
+        ...identity,
+        observedFrom: input.observedFrom,
+        observedTo: input.observedTo,
+        privacyPolicyVersion: 'process-data-privacy/v1'
+    };
+    const manifest = { ...partialManifest, manifestSha256: manifestDigest(partialManifest) };
+    const stagingRoot = path.join(root, '.staging');
+    ensurePrivateDirectory(stagingRoot);
+    const staging = fs.mkdtempSync(path.join(stagingRoot, `${snapshotId}-`));
+    if (process.platform !== 'win32')
+        fs.chmodSync(staging, 0o700);
+    try {
+        writePrivateFile(path.join(staging, 'manifest.json'), jsonLine(manifest));
+        writePrivateFile(path.join(staging, 'normalized.jsonl'), input.records.map((record) => jsonLine({ schema: 'normalized/v2', ...record })).join(''));
+        writePrivateFile(path.join(staging, 'quality.json'), jsonLine({ schema: 'quality/v1', findings: input.quality }));
+        writePrivateFile(path.join(staging, 'repair-manifest.jsonl'), input.repairs.map((repair) => jsonLine({ schema: 'repair/v1', ...repair })).join(''));
+        const destination = path.join(root, 'snapshots', String(date.getUTCFullYear()), String(date.getUTCMonth() + 1).padStart(2, '0'), String(date.getUTCDate()).padStart(2, '0'), snapshotId);
+        ensurePrivateDirectory(path.dirname(destination));
+        if (fs.existsSync(destination)) {
+            const existing = fs.readFileSync(path.join(destination, 'manifest.json'), 'utf8');
+            if (existing !== jsonLine(manifest))
+                throw new Error(`snapshot collision: ${snapshotId}`);
+            fs.rmSync(staging, { recursive: true, force: true });
+            fsyncDirectory(stagingRoot);
             return { snapshotId, path: destination, created: false };
         }
+        fsyncDirectory(staging);
         fs.renameSync(staging, destination);
+        fsyncDirectory(stagingRoot);
+        fsyncDirectory(path.dirname(destination));
         return { snapshotId, path: destination, created: true };
     }
     catch (error) {
@@ -181,7 +289,224 @@ function findSnapshot(root, snapshotId) {
     }
     return null;
 }
-function verifySnapshot(root, snapshotId) {
+function verifyV2Snapshot(root, snapshotId, snapshotPath, manifest, seen) {
+    const errors = [];
+    if (seen.has(snapshotId))
+        return { ok: false, snapshotId, snapshotPath, errors: ['snapshot lineage cycle detected'], manifest };
+    seen.add(snapshotId);
+    if (manifest.snapshotId !== snapshotId)
+        errors.push('snapshot identity mismatch');
+    if (manifest.scope !== 'github')
+        errors.push('v2 snapshot scope must be github');
+    if (manifest.snapshotKind === 'base' && manifest.parentSnapshotId !== null)
+        errors.push('base snapshot must not have a parent');
+    if (manifest.snapshotKind === 'delta' && !manifest.parentSnapshotId)
+        errors.push('delta snapshot must have a parent');
+    if (manifest.checkpointBefore !== manifest.parentSnapshotId)
+        errors.push('checkpoint and parent lineage mismatch');
+    if (manifest.parentSnapshotId) {
+        const parentPath = findSnapshot(root, manifest.parentSnapshotId);
+        if (!parentPath)
+            errors.push('parent snapshot is missing');
+        else {
+            const parentVerification = verifySnapshot(root, manifest.parentSnapshotId, seen);
+            if (!parentVerification.ok || !parentVerification.manifest) {
+                errors.push(`parent snapshot is invalid: ${parentVerification.errors.join('; ')}`);
+            }
+            else if (parentVerification.manifest.schema !== 'raw-manifest/v2') {
+                errors.push('v2 snapshot parent is not v2');
+            }
+            else {
+                const parent = parentVerification.manifest;
+                if (parent.repository !== manifest.repository)
+                    errors.push('parent repository mismatch');
+                if (new Date(parent.watermark).getTime() >= new Date(manifest.watermark).getTime())
+                    errors.push('snapshot watermark is not monotonic');
+            }
+        }
+    }
+    if (manifest.watermark !== manifest.window.toExclusive)
+        errors.push('watermark and window cutoff mismatch');
+    const watermark = new Date(manifest.watermark);
+    const from = manifest.window.fromInclusive ? new Date(manifest.window.fromInclusive) : null;
+    const queryAfter = manifest.window.queryAfter ? new Date(manifest.window.queryAfter) : null;
+    if (!Number.isFinite(watermark.getTime()) || (from && !Number.isFinite(from.getTime())) || (queryAfter && !Number.isFinite(queryAfter.getTime()))) {
+        errors.push('v2 observation window contains an invalid timestamp');
+    }
+    if (from && queryAfter && queryAfter.getTime() !== from.getTime() - 1000)
+        errors.push('queryAfter does not equal watermark minus one second');
+    if (!from && queryAfter)
+        errors.push('base/full window cannot have queryAfter without fromInclusive');
+    const strictSinceEndpoints = manifest.endpoints.filter((endpoint) => endpoint.queryMode === 'strict-since');
+    const expectedQueryAfter = from && Number.isFinite(from.getTime()) ? new Date(from.getTime() - 1000).toISOString() : null;
+    if (manifest.snapshotKind === 'base' && from)
+        errors.push('base snapshot must not have fromInclusive');
+    if (queryAfter && strictSinceEndpoints.length === 0)
+        errors.push('queryAfter requires a strict-since endpoint');
+    if (strictSinceEndpoints.length > 0 && (manifest.snapshotKind !== 'delta' || manifest.reconciliation !== 'incremental')) {
+        errors.push('strict-since is only valid for incremental delta snapshots');
+    }
+    if (strictSinceEndpoints.length > 0 && manifest.window.queryAfter !== expectedQueryAfter) {
+        errors.push('incremental strict-since queryAfter proof is invalid');
+    }
+    if (manifest.coverage.mode !== 'boundary-reread-with-full-reconcile' || manifest.coverage.absoluteCompleteness !== false)
+        errors.push('coverage declaration is invalid');
+    const preflight = new Date(manifest.observation.preflightDate);
+    if (!Number.isFinite(preflight.getTime()))
+        errors.push('preflight Date is invalid');
+    for (const responseDate of manifest.observation.responseDates) {
+        const parsed = new Date(responseDate);
+        if (!Number.isFinite(parsed.getTime()) || parsed.getTime() < preflight.getTime())
+            errors.push('response Date evidence is invalid');
+    }
+    for (const endpoint of manifest.endpoints) {
+        if (!endpoint.queryMode)
+            errors.push(`endpoint query mode missing: ${endpoint.endpoint}`);
+        if (endpoint.queryMode !== 'strict-since' && endpoint.queryMode !== 'full-enumeration') {
+            errors.push(`endpoint query mode is invalid: ${endpoint.endpoint}`);
+        }
+        else if (endpoint.queryMode === 'strict-since') {
+            if (endpoint.requestedSince !== expectedQueryAfter)
+                errors.push(`endpoint since proof mismatch: ${endpoint.endpoint}`);
+        }
+        else if (endpoint.requestedSince !== undefined) {
+            errors.push(`full-enumeration endpoint has requestedSince: ${endpoint.endpoint}`);
+        }
+        for (const page of endpoint.pages) {
+            if (page.queryMode !== 'strict-since' && page.queryMode !== 'full-enumeration') {
+                errors.push(`page query mode is invalid: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (page.queryMode !== endpoint.queryMode)
+                errors.push(`page query mode mismatch: ${endpoint.endpoint}#${page.index}`);
+            if (endpoint.queryMode === 'strict-since') {
+                if (page.requestedSince !== expectedQueryAfter)
+                    errors.push(`page since proof mismatch: ${endpoint.endpoint}#${page.index}`);
+            }
+            else if (page.requestedSince !== undefined) {
+                errors.push(`full-enumeration page has requestedSince: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (page.responseDate && new Date(page.responseDate).getTime() < preflight.getTime())
+                errors.push(`page Date precedes preflight: ${endpoint.endpoint}#${page.index}`);
+        }
+    }
+    for (const endpoint of manifest.endpoints) {
+        for (const page of endpoint.pages) {
+            const matches = manifest.objects.filter((object) => object.role === 'page-evidence'
+                && object.endpoint === endpoint.endpoint
+                && object.page === page.index
+                && object.sha256 === page.canonicalSha256);
+            if (matches.length !== 1) {
+                errors.push(`page evidence CAS reference is missing or ambiguous: ${endpoint.endpoint}#${page.index}`);
+                continue;
+            }
+            const object = matches[0];
+            if (object.queryMode !== 'strict-since' && object.queryMode !== 'full-enumeration') {
+                errors.push(`page evidence query mode is invalid: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (object.queryMode !== page.queryMode
+                || object.requestedSince !== page.requestedSince
+                || object.responseDate !== page.responseDate) {
+                errors.push(`page evidence metadata mismatch: ${endpoint.endpoint}#${page.index}`);
+            }
+            if (endpoint.queryMode === 'strict-since' && object.requestedSince !== expectedQueryAfter) {
+                errors.push(`page evidence since proof mismatch: ${endpoint.endpoint}#${page.index}`);
+            }
+        }
+    }
+    const { manifestSha256, ...partial } = manifest;
+    if (manifestDigest(partial) !== manifestSha256)
+        errors.push('manifest hash mismatch');
+    const checkMode = (target, expected, label) => {
+        if (process.platform === 'win32' || !fs.existsSync(target))
+            return;
+        const actual = fs.statSync(target).mode & 0o777;
+        if (actual !== expected)
+            errors.push(`${label} permission mismatch: expected ${expected.toString(8)}, got ${actual.toString(8)}`);
+    };
+    checkMode(snapshotPath, 0o700, 'snapshot directory');
+    for (const file of ['manifest.json', 'normalized.jsonl', 'quality.json', 'repair-manifest.jsonl'])
+        checkMode(path.join(snapshotPath, file), 0o600, file);
+    const store = createObjectStore(root);
+    const normalizedEvidence = [];
+    try {
+        const lines = fs.readFileSync(path.join(snapshotPath, 'normalized.jsonl'), 'utf8').split('\n').filter(Boolean);
+        const ids = new Set();
+        const operationCounts = { upsert: 0, supersede: 0, tombstone: 0, unavailable: 0 };
+        for (const line of lines) {
+            const record = JSON.parse(line);
+            if (record.schema !== 'normalized/v2' || typeof record.recordId !== 'string')
+                errors.push('normalized v2 record schema is invalid');
+            if (typeof record.recordId === 'string' && ids.has(record.recordId))
+                errors.push(`duplicate normalized record: ${record.recordId}`);
+            if (typeof record.recordId === 'string')
+                ids.add(record.recordId);
+            if (!record.operation || !(record.operation in operationCounts))
+                errors.push('normalized v2 operation is invalid');
+            else
+                operationCounts[record.operation] += 1;
+            if ((record.operation === 'upsert' || record.operation === 'supersede')
+                && (!Array.isArray(record.evidence) || record.evidence.length !== 1)) {
+                errors.push(`resource evidence is required for ${record.operation}: ${record.recordId ?? 'unknown'}`);
+            }
+            for (const evidence of record.evidence ?? []) {
+                if (typeof evidence.resourceIdentity === 'string' && typeof evidence.resourceSha256 === 'string' && typeof evidence.pageSha256 === 'string') {
+                    if (record.resourceIdentity !== evidence.resourceIdentity || record.sourceSha256 !== evidence.resourceSha256) {
+                        errors.push(`normalized v2 evidence does not match record source: ${record.recordId ?? 'unknown'}`);
+                    }
+                    normalizedEvidence.push({ resourceIdentity: evidence.resourceIdentity, resourceSha256: evidence.resourceSha256, pageSha256: evidence.pageSha256 });
+                }
+                else {
+                    errors.push('normalized v2 evidence reference is invalid');
+                }
+            }
+        }
+        if (lines.length !== manifest.recordCount)
+            errors.push('normalized record count mismatch');
+        if (canonicalJsonBytes(operationCounts).toString('utf8') !== canonicalJsonBytes(manifest.operations).toString('utf8'))
+            errors.push('operation count mismatch');
+        const quality = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'quality.json'), 'utf8'));
+        if (quality.schema !== 'quality/v1' || !Array.isArray(quality.findings))
+            errors.push('quality schema is invalid');
+        else if (quality.findings.length !== manifest.findingCount)
+            errors.push('quality finding count mismatch');
+        const repairLines = fs.readFileSync(path.join(snapshotPath, 'repair-manifest.jsonl'), 'utf8').split('\n').filter(Boolean);
+        if (repairLines.length !== manifest.repairCount)
+            errors.push('repair manifest count mismatch');
+        for (const line of repairLines)
+            if (JSON.parse(line).schema !== 'repair/v1')
+                errors.push('repair manifest schema is invalid');
+    }
+    catch {
+        errors.push('snapshot derived files are missing or invalid');
+    }
+    for (const object of manifest.objects) {
+        if (object.role !== 'page-evidence' && object.role !== 'resource')
+            errors.push(`object role is invalid: ${object.sourceIdentity}`);
+        if (object.disposition?.state && object.disposition.state !== 'included')
+            continue;
+        try {
+            const objectPath = store.pathFor(object.sha256);
+            const bytes = fs.readFileSync(objectPath);
+            if (sha256(bytes) !== object.sha256 || bytes.length !== object.bytes)
+                errors.push(`object integrity mismatch: ${object.sourceIdentity}`);
+        }
+        catch {
+            errors.push(`object missing: ${object.sourceIdentity}`);
+        }
+    }
+    for (const evidence of normalizedEvidence) {
+        const resources = manifest.objects.filter((object) => object.role === 'resource'
+            && object.resourceIdentity === evidence.resourceIdentity
+            && object.sha256 === evidence.resourceSha256);
+        const pages = manifest.objects.filter((object) => object.role === 'page-evidence' && object.sha256 === evidence.pageSha256);
+        if (resources.length !== 1)
+            errors.push(`resource evidence reference is missing or ambiguous: ${evidence.resourceIdentity}`);
+        if (pages.length === 0)
+            errors.push(`resource page evidence reference is missing: ${evidence.resourceIdentity}`);
+    }
+    return { ok: errors.length === 0, snapshotId, snapshotPath, errors, manifest };
+}
+function verifySnapshot(root, snapshotId, seen = new Set()) {
     const snapshotPath = findSnapshot(root, snapshotId);
     if (!snapshotPath)
         return { ok: false, snapshotId, snapshotPath: null, errors: ['snapshot not found'] };
@@ -197,15 +522,20 @@ function verifySnapshot(root, snapshotId) {
     for (const file of ['manifest.json', 'normalized.jsonl', 'quality.json', 'repair-manifest.jsonl']) {
         checkMode(path.join(snapshotPath, file), 0o600, file);
     }
-    let manifest;
+    let rawManifest;
     try {
-        manifest = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'manifest.json'), 'utf8'));
+        rawManifest = JSON.parse(fs.readFileSync(path.join(snapshotPath, 'manifest.json'), 'utf8'));
     }
     catch {
         return { ok: false, snapshotId, snapshotPath, errors: ['manifest is invalid JSON'] };
     }
-    if (manifest.schema !== 'raw-manifest/v1')
-        errors.push(`unsupported manifest schema: ${manifest.schema}`);
+    if (rawManifest.schema === 'raw-manifest/v2') {
+        return verifyV2Snapshot(root, snapshotId, snapshotPath, rawManifest, seen);
+    }
+    if (rawManifest.schema !== 'raw-manifest/v1') {
+        return { ok: false, snapshotId, snapshotPath, errors: [`unsupported manifest schema: ${String(rawManifest.schema)}`] };
+    }
+    const manifest = rawManifest;
     if (manifest.snapshotId !== snapshotId)
         errors.push('snapshot identity mismatch');
     if (typeof manifest.excerptsEnabled !== 'boolean')
@@ -278,5 +608,5 @@ function verifySnapshot(root, snapshotId) {
     }
     return { ok: errors.length === 0, snapshotId, snapshotPath, errors, manifest };
 }
-export { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshot, sha256, verifySnapshot };
+export { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshot, publishSnapshotV2, sha256, verifySnapshot };
 //# sourceMappingURL=store.js.map

package/dist/lib/sandbox/commands/create.js

@@ -19,7 +19,7 @@ import { resolveTools, tmpfsSeedStagingPath, tmpfsSeedTargetPath, toolConfigDirC
 import { assertFreshSandboxReady, hydrateTmpfsSeedEntries, prepareTmpfsMounts, startSandboxControlBroker } from '../recovery.js';
 import { hostJoin, toEnginePath, volumeArg } from '../engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from '../mounts.js';
-import { assertSandboxTaskSource, materializeSandboxControl, materializeSandboxWorkspaceView, prepareSandboxWorkspaceMountTargets } from '../workspace-view.js';
+import { assertSandboxTaskSource, finalizeSandboxControlManifest, materializeSandboxControl, materializeSandboxWorkspaceView, prepareSandboxWorkspaceMountTarget, } from '../workspace-view.js';
 import { clipboardHostDir, CONTAINER_CLIPBOARD_MOUNT } from '../clipboard/paths.js';
 import { validateSelinuxDisableEnv } from '../engines/selinux.js';
 import { dotfilesCacheDir, materializeDotfiles } from '../dotfiles.js';
@@ -960,7 +960,7 @@ export async function create(args) {
                             container,
                             identity: target.workspace
                         });
-                        prepareSandboxWorkspaceMountTargets(worktree);
+                        prepareSandboxWorkspaceMountTarget(worktree);
                         const control = materializeSandboxControl({
                             base: effectiveConfig.controlBase,
                             repoRoot: effectiveConfig.repoRoot,
@@ -968,7 +968,8 @@ export async function create(args) {
                             project: effectiveConfig.project,
                             container,
                             branch,
-                            identity: target.workspace
+                            identity: target.workspace,
+                            engine
                         });
                         hostShellConfig = prepareHostShellConfig({
                             home: effectiveConfig.home,
@@ -1028,54 +1029,105 @@ export async function create(args) {
                             : [];
                         const hostTz = detectHostTimezone();
                         const tzFlags = hostTz ? ['-e', `TZ=${hostTz}`] : [];
-                        runEngineTaskCommand(engine, 'docker', [
-                            'run',
-                            '-d',
-                            '--name',
-                            container,
-                            '--hostname',
-                            `${effectiveConfig.project}-sandbox`,
-                            '--label',
-                            sandboxLabel(effectiveConfig),
-                            '--label',
-                            `${sandboxBranchLabel(effectiveConfig)}=${branch}`,
-                            '--label',
-                            `${sandboxWorkspaceModeLabel(effectiveConfig)}=${target.workspace.mode}`,
-                            ...(target.workspace.mode === 'task-bound'
-                                ? [
-                                    '--label',
-                                    `${sandboxTaskIdLabel(effectiveConfig)}=${target.workspace.taskId}`,
-                                    '-e',
-                                    `AGENT_INFRA_TASK_ID=${target.workspace.taskId}`
-                                ]
-                                : []),
-                            '-e',
-                            `AGENT_INFRA_CONTROL_TOKEN=${control.token}`,
-                            '-e',
-                            `AGENT_INFRA_CONTROL_GENERATION=${control.generation}`,
-                            '-e',
-                            'AGENT_INFRA_CONTROL_DIR=/run/agent-infra/control',
-                            '-e',
-                            'AGENT_INFRA_CONTROL_STATUS_DIR=/run/agent-infra/control-status',
-                            '--label',
-                            `${sandboxRuntimeCapabilityLabel(effectiveConfig)}=${capabilityPlan.runtimeSignature}`,
-                            ...coreVolumes,
-                            ...buildClipboardVolumeArgs(engine, effectiveConfig.home),
-                            '-v',
-                            volumeArg(engine, path.join(effectiveConfig.repoRoot, '.git'), `${toEnginePath(engine, effectiveConfig.repoRoot)}/.git`),
-                            ...dotfilesMount,
-                            ...toolVolumes,
-                            ...tmpfsArgs,
-                            ...tmpfsSeedPlan.flatMap(({ volumeArgs }) => volumeArgs),
-                            ...liveMountVolumes,
-                            ...envFile.dockerArgs,
-                            ...tzFlags,
-                            '-w',
-                            '/workspace',
-                            effectiveConfig.imageName
-                        ]);
-                        await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
-                        createdTmpfsSeedPlan = tmpfsSeedPlan;
+                        let createdContainerRef = null;
+                        try {
+                            const dockerRunId = runEngineTaskCommand(engine, 'docker', [
+                                'run',
+                                '-d',
+                                '--init',
+                                '--name',
+                                container,
+                                '--hostname',
+                                `${effectiveConfig.project}-sandbox`,
+                                '--label',
+                                sandboxLabel(effectiveConfig),
+                                '--label',
+                                `${sandboxBranchLabel(effectiveConfig)}=${branch}`,
+                                '--label',
+                                `${sandboxWorkspaceModeLabel(effectiveConfig)}=${target.workspace.mode}`,
+                                ...(target.workspace.mode === 'task-bound'
+                                    ? [
+                                        '--label',
+                                        `${sandboxTaskIdLabel(effectiveConfig)}=${target.workspace.taskId}`,
+                                        '-e',
+                                        `AGENT_INFRA_TASK_ID=${target.workspace.taskId}`
+                                    ]
+                                    : []),
+                                '-e',
+                                `AGENT_INFRA_CONTROL_TOKEN=${control.token}`,
+                                '-e',
+                                `AGENT_INFRA_CONTROL_GENERATION=${control.generation}`,
+                                '-e',
+                                'AGENT_INFRA_CONTROL_DIR=/run/agent-infra/control',
+                                '-e',
+                                'AGENT_INFRA_CONTROL_STATUS_DIR=/run/agent-infra/control-status',
+                                '--label',
+                                `${sandboxRuntimeCapabilityLabel(effectiveConfig)}=${capabilityPlan.runtimeSignature}`,
+                                ...coreVolumes,
+                                ...buildClipboardVolumeArgs(engine, effectiveConfig.home),
+                                '-v',
+                                volumeArg(engine, path.join(effectiveConfig.repoRoot, '.git'), `${toEnginePath(engine, effectiveConfig.repoRoot)}/.git`),
+                                ...dotfilesMount,
+                                ...toolVolumes,
+                                ...tmpfsArgs,
+                                ...tmpfsSeedPlan.flatMap(({ volumeArgs }) => volumeArgs),
+                                ...liveMountVolumes,
+                                ...envFile.dockerArgs,
+                                ...tzFlags,
+                                '-w',
+                                '/workspace',
+                                effectiveConfig.imageName
+                            ]);
+                            createdContainerRef = dockerRunId.trim();
+                            const containerId = runEngineTaskCommand(engine, 'docker', [
+                                'inspect', '--format', '{{.Id}}', dockerRunId.trim()
+                            ]).trim();
+                            if (!containerId)
+                                throw new Error('SANDBOX_CONTROL_CONTAINER_ID_INVALID');
+                            const rawContainerLabels = runEngineTaskCommand(engine, 'docker', [
+                                'inspect', '--format', '{{json .Config.Labels}}', containerId
+                            ]).trim();
+                            let inspectedLabels;
+                            try {
+                                inspectedLabels = JSON.parse(rawContainerLabels);
+                            }
+                            catch {
+                                throw new Error('SANDBOX_CONTROL_CONTAINER_LABELS_INVALID');
+                            }
+                            if (!inspectedLabels || typeof inspectedLabels !== 'object' || Array.isArray(inspectedLabels)) {
+                                throw new Error('SANDBOX_CONTROL_CONTAINER_LABELS_INVALID');
+                            }
+                            const expectedLabels = {
+                                [sandboxLabel(effectiveConfig)]: '',
+                                [sandboxBranchLabel(effectiveConfig)]: branch,
+                                [sandboxWorkspaceModeLabel(effectiveConfig)]: target.workspace.mode,
+                                [sandboxRuntimeCapabilityLabel(effectiveConfig)]: capabilityPlan.runtimeSignature,
+                                ...(target.workspace.mode === 'task-bound'
+                                    ? { [sandboxTaskIdLabel(effectiveConfig)]: target.workspace.taskId }
+                                    : {})
+                            };
+                            const labels = inspectedLabels;
+                            for (const [key, expected] of Object.entries(expectedLabels)) {
+                                if (labels[key] !== expected)
+                                    throw new Error('SANDBOX_CONTROL_CONTAINER_IDENTITY_MISMATCH');
+                            }
+                            finalizeSandboxControlManifest(control, {
+                                engine,
+                                id: containerId,
+                                labels: expectedLabels
+                            });
+                            await startSandboxControlBroker(effectiveConfig.repoRoot, control.manifestPath);
+                            createdTmpfsSeedPlan = tmpfsSeedPlan;
+                        }
+                        catch (error) {
+                            if (createdContainerRef) {
+                                runSafeEngine(engine, 'docker', ['stop', createdContainerRef]);
+                                runSafeEngine(engine, 'docker', ['rm', createdContainerRef]);
+                            }
+                            removeDirRecursive(control.root);
+                            removeDirRecursive(workspaceView.root);
+                            throw error;
+                        }
                     }
                     finally {
                         envFile.cleanup();