@fitlab-ai/agent-infra 0.9.6 → 0.9.8

package/dist/lib/sandbox/commands/rm.js

@@ -11,7 +11,8 @@ import { assertManagedPath, removeManagedDir, removeWorktreeDir } from '../manag
 import { runEngine, runOk, runOkEngine, runSafe, runSafeEngine } from '../shell.js';
 import { resolveSandboxTarget } from '../workspace-identity.js';
 import { sandboxControlPaths, sandboxWorkspaceViewPaths } from '../workspace-view.js';
-import { quiesceSandboxControlRoot, readSandboxControlManifest } from '../control/lifecycle.js';
+import { removeSandboxControlRoot, readSandboxControlManifest } from '../control/lifecycle.js';
+import { inspectSandboxControlContainer } from '../control/container-identity.js';
 import { toolConfigDirCandidates, toolProjectDirCandidates } from '../tools.js';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
 import { fetchSandboxRows } from './list-running.js';
@@ -118,10 +119,39 @@ function removeEmptyManagedParent(base, directory) {
     }
     assertRemoved(parent, 'Empty sandbox container directory');
 }
-async function quiesceProjectControlRoots(config) {
+async function removeExactSandboxContainer(engine, manifest, timeoutMs) {
+    const deadlineAt = Date.now() + timeoutMs;
+    const remaining = () => Math.max(1, deadlineAt - Date.now());
+    const inspect = () => inspectSandboxControlContainer(manifest, { timeoutMs: remaining() });
+    const before = await inspect();
+    if (before.state === 'unknown')
+        throw new Error(`SANDBOX_CONTROL_CONTAINER_UNKNOWN: ${before.reason}`);
+    if (before.state === 'absent')
+        return;
+    if (before.running && !runOkEngine(engine, 'docker', ['stop', manifest.containerIdentity.id], { timeout: remaining() })) {
+        const afterStop = await inspect();
+        if (afterStop.state !== 'absent' && afterStop.state !== 'found') {
+            throw new Error(`SANDBOX_CONTROL_CONTAINER_UNKNOWN: ${afterStop.reason}`);
+        }
+        if (afterStop.state === 'found' && afterStop.running) {
+            throw new Error(`Failed to stop sandbox container: ${manifest.containerIdentity.id}`);
+        }
+    }
+    const afterStop = await inspect();
+    if (afterStop.state === 'unknown')
+        throw new Error(`SANDBOX_CONTROL_CONTAINER_UNKNOWN: ${afterStop.reason}`);
+    if (afterStop.state === 'found' && !runOkEngine(engine, 'docker', ['rm', manifest.containerIdentity.id], { timeout: remaining() })) {
+        const afterRemove = await inspect();
+        if (afterRemove.state !== 'absent') {
+            throw new Error(`Failed to remove sandbox container: ${manifest.containerIdentity.id}`);
+        }
+    }
+}
+async function removeProjectControlRoots(config, engine) {
+    const containers = new Set();
     const projectRoot = path.join(config.controlBase, config.project);
     if (!fs.existsSync(projectRoot))
-        return;
+        return containers;
     assertManagedPath(config.controlBase, projectRoot);
     const projectStat = fs.lstatSync(projectRoot);
     if (!projectStat.isDirectory() || projectStat.isSymbolicLink())
@@ -133,9 +163,19 @@ async function quiesceProjectControlRoots(config) {
         for (const identity of fs.readdirSync(containerRoot, { withFileTypes: true })) {
             if (!identity.isDirectory() || identity.isSymbolicLink())
                 continue;
-            await quiesceSandboxControlRoot(path.join(containerRoot, identity.name));
+            const root = path.join(containerRoot, identity.name);
+            const manifestPath = path.join(root, 'manifest.json');
+            if (!fs.existsSync(manifestPath))
+                throw new Error(`SANDBOX_CONTROL_TARGET_EVIDENCE_MISSING: ${root}`);
+            const manifest = readSandboxControlManifest(manifestPath);
+            containers.add(manifest.container);
+            await removeSandboxControlRoot(root, {
+                inspectContainer: (timeoutMs) => inspectSandboxControlContainer(manifest, { timeoutMs }),
+                removeContainer: (timeoutMs) => removeExactSandboxContainer(engine, manifest, timeoutMs)
+            });
         }
     }
+    return containers;
 }
 function inspectionBlockers(inspections) {
     return inspections.filter((inspection) => inspection.status !== 'clean');
@@ -211,25 +251,32 @@ async function rmOne(config, tools, branch, options = {}) {
         p.outro('Cancelled');
         return;
     }
+    const coordinatedContainers = new Set();
     for (const root of controlRoots.filter((candidate) => fs.existsSync(candidate))) {
         assertLegacyCandidateEvidence(root, config.controlBase, config, effectiveBranch, matchedContainers);
         assertControlRootMatchesTarget(root, effectiveBranch, workspace);
-        await quiesceSandboxControlRoot(root);
+        const manifest = readSandboxControlManifest(path.join(root, 'manifest.json'));
+        coordinatedContainers.add(manifest.container);
+        await removeSandboxControlRoot(root, {
+            inspectContainer: (timeoutMs) => inspectSandboxControlContainer(manifest, { timeoutMs }),
+            removeContainer: (timeoutMs) => removeExactSandboxContainer(engine, manifest, timeoutMs)
+        });
     }
-    if (matchedContainers.length > 0) {
+    const uncoordinatedContainers = matchedContainers.filter((name) => !coordinatedContainers.has(name));
+    if (uncoordinatedContainers.length > 0) {
         const spinner = p.spinner();
-        spinner.start(`Stopping container(s): ${matchedContainers.join(', ')}`);
-        for (const name of matchedContainers) {
+        spinner.start(`Stopping container(s): ${uncoordinatedContainers.join(', ')}`);
+        for (const name of uncoordinatedContainers) {
             if (!runOkEngine(engine, 'docker', ['stop', name]))
                 throw new Error(`Failed to stop sandbox container: ${name}`);
             if (!runOkEngine(engine, 'docker', ['rm', name]))
                 throw new Error(`Failed to remove sandbox container: ${name}`);
         }
         const remaining = runEngine(engine, 'docker', ['ps', '-a', '--format', '{{.Names}}']).split('\n').filter(Boolean);
-        const leftovers = matchedContainers.filter((name) => remaining.includes(name));
+        const leftovers = uncoordinatedContainers.filter((name) => remaining.includes(name));
         if (leftovers.length > 0)
             throw new Error(`Sandbox container(s) still exist after removal: ${leftovers.join(', ')}`);
-        spinner.stop(pc.green(`Removed container(s): ${matchedContainers.join(', ')}`));
+        spinner.stop(pc.green(`Removed container(s): ${uncoordinatedContainers.join(', ')}`));
     }
     else {
         p.log.warn(`No sandbox container found for '${branch}'`);
@@ -330,7 +377,7 @@ async function rmPurge(config, tools, prompt = {}) {
         throw new Error(`Refusing to purge because worktree preflight found blocker(s):\n${blockerMessage(blockers)}`);
     }
     const permits = cleanPermits(inspections);
-    await quiesceProjectControlRoots(config);
+    const coordinatedContainers = await removeProjectControlRoots(config, engine);
     const containers = runEngine(engine, 'docker', [
         'ps',
         '-a',
@@ -339,10 +386,11 @@ async function rmPurge(config, tools, prompt = {}) {
         '--format',
         '{{.Names}}'
     ]);
-    if (containers) {
+    const uncoordinatedContainers = containers.split('\n').filter((name) => name && !coordinatedContainers.has(name));
+    if (uncoordinatedContainers.length > 0) {
         const spinner = p.spinner();
         spinner.start('Stopping project sandbox containers...');
-        for (const name of containers.split('\n').filter(Boolean)) {
+        for (const name of uncoordinatedContainers) {
             if (!runOkEngine(engine, 'docker', ['stop', name]))
                 throw new Error(`Failed to stop sandbox container: ${name}`);
             if (!runOkEngine(engine, 'docker', ['rm', name]))
@@ -351,8 +399,9 @@ async function rmPurge(config, tools, prompt = {}) {
         const remaining = runEngine(engine, 'docker', [
             'ps', '-a', '--filter', `label=${sandboxLabel(config)}`, '--format', '{{.Names}}'
         ]);
-        if (remaining)
-            throw new Error(`Project sandbox container(s) still exist after removal: ${remaining.replaceAll('\n', ', ')}`);
+        const leftovers = remaining.split('\n').filter((name) => name && !coordinatedContainers.has(name));
+        if (leftovers.length > 0)
+            throw new Error(`Project sandbox container(s) still exist after removal: ${leftovers.join(', ')}`);
         spinner.stop(pc.green('Project sandbox containers removed'));
     }
     else {

package/dist/lib/sandbox/commands/start.js

@@ -8,9 +8,9 @@ const USAGE = `Usage: ai sandbox start [--recreate] <branch | TASK-id | N>
 
 Start an existing sandbox container that has stopped (for example after the
 Docker daemon was restarted or replaced). The container must already exist:
-if none is found, run 'ai sandbox create <branch>' first. A container that is
-already running is checked without modifying healthy runtime state. --recreate
-allows container-only replacement after in-place recovery fails.`;
+if none is found, run 'ai sandbox create <branch>' first. Without --recreate, a
+container that is already running is checked without modifying healthy runtime
+state. --recreate replaces the existing container even when it is healthy.`;
 export function parseStartArgs(args) {
     let recreate = false;
     let help = false;
@@ -62,6 +62,7 @@ export async function start(args) {
         workspace: target.workspace,
         row: found,
         allowRecreate: parsed.recreate,
+        forceRecreate: parsed.recreate,
         recreate: async () => {
             const { create } = await import('./create.js');
             await create([target.requestedRef, '--no-refresh']);

package/dist/lib/sandbox/control/container-identity.js

@@ -0,0 +1,64 @@
+import { commandForEngine, runEngine, runProbe } from '../shell.js';
+function isAuthoritativeNotFound(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return /(?:no such (?:container|object)|container .* not found|cannot find container)/i.test(message);
+}
+export function classifySandboxContainerInspection(expected, inspection) {
+    if ('notFound' in inspection)
+        return { state: 'absent', id: expected.id };
+    if ('error' in inspection) {
+        return isAuthoritativeNotFound(inspection.error)
+            ? { state: 'absent', id: expected.id }
+            : { state: 'unknown', reason: `container inspection failed: ${inspection.error instanceof Error ? inspection.error.message : String(inspection.error)}` };
+    }
+    const response = inspection;
+    if (typeof response.id !== 'string' || response.id !== expected.id
+        || typeof response.running !== 'boolean' || !response.labels
+        || typeof response.labels !== 'object' || Array.isArray(response.labels)) {
+        return { state: 'unknown', reason: 'container inspection response is incomplete' };
+    }
+    const labels = response.labels;
+    for (const [key, value] of Object.entries(expected.labels)) {
+        if (labels[key] !== value)
+            return { state: 'unknown', reason: 'container labels do not match the manifest' };
+    }
+    return {
+        state: 'found',
+        id: response.id,
+        running: response.running,
+        labels: Object.fromEntries(Object.entries(labels).flatMap(([key, value]) => typeof value === 'string' ? [[key, value]] : []))
+    };
+}
+export async function inspectSandboxControlContainer(manifest, options = {}) {
+    try {
+        const args = ['inspect', '--format', '{{json .}}', manifest.containerIdentity.id];
+        let raw;
+        if (options.run) {
+            raw = options.run(manifest.engine, 'docker', args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
+        }
+        else {
+            const command = commandForEngine(manifest.engine, 'docker', args);
+            const result = (options.probe ?? runProbe)(command.cmd, command.args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
+            if (result.status !== 0) {
+                const stderr = typeof result.stderr === 'string' ? result.stderr : result.stderr?.toString('utf8') ?? '';
+                return classifySandboxContainerInspection(manifest.containerIdentity, {
+                    error: new Error(stderr || `container inspection exited with ${result.status ?? 'unknown'}`)
+                });
+            }
+            raw = typeof result.stdout === 'string' ? result.stdout : result.stdout?.toString('utf8') ?? '';
+        }
+        const parsed = JSON.parse(raw);
+        const value = Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
+        if (!value || Array.isArray(value))
+            return { state: 'unknown', reason: 'container inspection response is incomplete' };
+        return classifySandboxContainerInspection(manifest.containerIdentity, {
+            id: value.Id,
+            running: value.State?.Running,
+            labels: value.Config?.Labels
+        });
+    }
+    catch (error) {
+        return classifySandboxContainerInspection(manifest.containerIdentity, { error });
+    }
+}
+//# sourceMappingURL=container-identity.js.map

package/dist/lib/sandbox/control/executor.js

@@ -18,7 +18,7 @@ async function waitForStartTime(pid, timeoutMs = 2_000) {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
         const startTime = getProcessStartTime(pid);
-        if (startTime)
+        if (startTime !== null)
             return startTime;
         await new Promise((resolve) => setTimeout(resolve, 10));
     }
@@ -32,7 +32,11 @@ export async function prepareSandboxControlExecution(params) {
         cwd: params.manifest.repoRoot,
         detached: process.platform !== 'win32',
         stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-        env: { ...safeEnv(process.env), AGENT_INFRA_EXECUTOR_MANIFEST: params.manifestPath }
+        env: {
+            ...safeEnv(process.env),
+            AGENT_INFRA_EXECUTOR_MANIFEST: params.manifestPath,
+            AGENT_INFRA_RUNTIME_DIR: params.manifest.runtimeDir
+        }
     });
     if (typeof child.pid !== 'number')
         throw new Error('SANDBOX_CONTROL_EXECUTOR_SPAWN_FAILED');
@@ -48,7 +52,7 @@ export async function prepareSandboxControlExecution(params) {
     });
     const startTime = await waitForStartTime(child.pid);
     const execution = {
-        version: 1,
+        version: 2,
         generation: params.manifest.generation,
         requestId: params.request.id,
         nonce,
@@ -63,17 +67,23 @@ export async function prepareSandboxControlExecution(params) {
     atomicWriteJson(executionPath(params.manifest, params.request.id), execution);
     return {
         execution,
-        start() {
+        start(canWrite = () => true) {
             if (!child.connected)
                 throw new Error('SANDBOX_CONTROL_EXECUTOR_GATE_CLOSED');
+            if (!canWrite())
+                throw new Error('SANDBOX_CONTROL_OWNER_LOST');
             atomicWriteJson(executionPath(params.manifest, params.request.id), { ...execution, phase: 'running', updatedAt: Date.now() });
+            if (!canWrite())
+                throw new Error('SANDBOX_CONTROL_OWNER_LOST');
             child.send({ version: 1, nonce });
         },
         completion,
-        terminate() {
-            atomicWriteJson(executionPath(params.manifest, params.request.id), {
-                ...execution, phase: 'terminating', updatedAt: Date.now()
-            });
+        terminate(updateState = true) {
+            if (updateState) {
+                atomicWriteJson(executionPath(params.manifest, params.request.id), {
+                    ...execution, phase: 'terminating', updatedAt: Date.now()
+                });
+            }
             return terminateSandboxControlExecution(execution);
         }
     };
@@ -110,7 +120,11 @@ function executeRequest(manifest, request) {
     const boundArgs = bindSandboxControlTask(request, manifest.taskId);
     if (request.family === 'task-orchestration')
         boundArgs.push('--git-worktree-root', manifest.worktreeRoot);
-    const result = spawnSync(process.execPath, nodeEntryArgs(process.argv[1], [request.family, ...boundArgs]), { cwd: manifest.repoRoot, encoding: 'utf8', env: safeEnv(process.env) });
+    const result = spawnSync(process.execPath, nodeEntryArgs(process.argv[1], [request.family, ...boundArgs]), {
+        cwd: manifest.repoRoot,
+        encoding: 'utf8',
+        env: { ...safeEnv(process.env), AGENT_INFRA_RUNTIME_DIR: manifest.runtimeDir }
+    });
     return { exitCode: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
 }
 export async function runSandboxControlExecutor(requestPath, nonce) {