@fitlab-ai/agent-infra 0.9.7 → 0.9.9

package/dist/lib/sandbox/control/executor.js

@@ -4,8 +4,12 @@ import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getProcessStartTime } from '../../server/process-state.js';
 import { createTask } from '../../task/create-service.js';
+import { applyTaskFinalization } from '../../task/finalization.js';
+import { verifyTaskEvent } from '../../task/verification.js';
 import { bindSandboxControlTask } from './protocol.js';
 import { atomicWriteJson, executionPath, terminateSandboxControlExecution } from './state.js';
+import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
+import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
 function safeEnv(env) {
     return Object.fromEntries(Object.entries(env).filter(([key]) => !key.toUpperCase().startsWith('AGENT_INFRA_CONTROL_')));
 }
@@ -32,7 +36,11 @@ export async function prepareSandboxControlExecution(params) {
         cwd: params.manifest.repoRoot,
         detached: process.platform !== 'win32',
         stdio: ['ignore', 'pipe', 'pipe', 'ipc'],
-        env: { ...safeEnv(process.env), AGENT_INFRA_EXECUTOR_MANIFEST: params.manifestPath }
+        env: {
+            ...safeEnv(process.env),
+            AGENT_INFRA_EXECUTOR_MANIFEST: params.manifestPath,
+            AGENT_INFRA_RUNTIME_DIR: params.manifest.runtimeDir
+        }
     });
     if (typeof child.pid !== 'number')
         throw new Error('SANDBOX_CONTROL_EXECUTOR_SPAWN_FAILED');
@@ -104,7 +112,58 @@ function waitForGate(nonce, timeoutMs = 2_000) {
         });
     });
 }
-function executeRequest(manifest, request) {
+function controllerFailure(error) {
+    const code = error instanceof CodexControllerRegistrationError
+        ? error.code
+        : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
+            ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+    const payload = {
+        version: 1,
+        status: 'failed',
+        changed: false,
+        lease: null,
+        error: { code, message: `${code}: controller request failed`, retryable: false }
+    };
+    return { exitCode: 1, stdout: `${JSON.stringify(payload)}\n`, stderr: '' };
+}
+function orchestrationFailure(code, message) {
+    return {
+        exitCode: 1,
+        stdout: `${JSON.stringify({
+            status: 'failed', changed: false, taskId: null, run: null, next: null,
+            error: { code, message }
+        })}\n`,
+        stderr: ''
+    };
+}
+function finalizationResult(result) {
+    const payload = {
+        version: 1,
+        status: result.status,
+        changed: result.changed,
+        accepted: true,
+        result,
+        error: result.error
+    };
+    return {
+        exitCode: result.status === 'completed' ? 0 : result.status === 'blocked' ? 2 : 1,
+        stdout: `${JSON.stringify(payload)}\n`,
+        stderr: ''
+    };
+}
+function isCodexPrepare(args) {
+    if (args[1] !== 'prepare')
+        return false;
+    const values = [];
+    for (let index = 2; index < args.length; index += 1) {
+        if (args[index] === '--client')
+            values.push(args[index + 1] ?? '');
+        else if (args[index]?.startsWith('--client='))
+            values.push(args[index].slice('--client='.length));
+    }
+    return values.length === 1 && values[0] === 'codex';
+}
+export function executeRequest(manifest, manifestPath, request, options = {}) {
     if (request.family === 'task-create') {
         const result = createTask(request.candidate, { repoRoot: manifest.repoRoot });
         return {
@@ -113,10 +172,91 @@ function executeRequest(manifest, request) {
             stderr: ''
         };
     }
+    if (request.family === 'codex-controller') {
+        try {
+            if (request.command === 'verify') {
+                const binding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
+                    manifest,
+                    manifestPath,
+                    proof: request.controllerProof,
+                    buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
+                });
+                return {
+                    exitCode: 0,
+                    stdout: `${JSON.stringify({
+                        version: 1,
+                        status: 'verified',
+                        changed: false,
+                        lease: null,
+                        binding: {
+                            taskId: manifest.taskId,
+                            controlGeneration: binding.controlGeneration,
+                            controllerInstanceDigest: binding.instanceDigest
+                        },
+                        error: null
+                    })}\n`,
+                    stderr: ''
+                };
+            }
+            const result = request.command === 'open'
+                ? openCodexControllerRegistration({
+                    manifest,
+                    manifestPath,
+                    controllerProcess: request.controllerProcess,
+                    buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
+                })
+                : closeCodexControllerRegistration({
+                    manifest,
+                    manifestPath,
+                    proof: request.controllerProof
+                });
+            return { exitCode: 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
+        }
+        catch (error) {
+            return controllerFailure(error);
+        }
+    }
+    if (request.family === 'task-finalization') {
+        return finalizationResult(applyTaskFinalization({ taskRef: manifest.taskId, intent: 'complete', agent: request.agent }, { repoRoot: manifest.repoRoot, preflight: (input, options) => verifyTaskEvent({ ...input, event: 'complete-task.hard-preflight' }, options) }));
+    }
     const boundArgs = bindSandboxControlTask(request, manifest.taskId);
-    if (request.family === 'task-orchestration')
+    let controllerBinding = null;
+    if (request.family === 'task-orchestration') {
+        if (isCodexPrepare(request.args)) {
+            if (!request.controllerProof) {
+                return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_REQUIRED', 'Codex prepare requires a current controller lease proof');
+            }
+            try {
+                controllerBinding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
+                    manifest,
+                    manifestPath,
+                    proof: request.controllerProof,
+                    buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
+                });
+            }
+            catch (error) {
+                const code = error instanceof CodexControllerRegistrationError
+                    ? error.code
+                    : 'CODEX_SANDBOX_CONTROLLER_PROOF_INVALID';
+                return orchestrationFailure(code, `${code}: Codex controller proof was rejected`);
+            }
+        }
+        else if (request.controllerProof !== null) {
+            return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_INVALID', 'Controller proof is only accepted for canonical Codex prepare');
+        }
         boundArgs.push('--git-worktree-root', manifest.worktreeRoot);
-    const result = spawnSync(process.execPath, nodeEntryArgs(process.argv[1], [request.family, ...boundArgs]), { cwd: manifest.repoRoot, encoding: 'utf8', env: safeEnv(process.env) });
+    }
+    const result = (options.spawnDomain ?? spawnSync)(process.execPath, nodeEntryArgs(process.argv[1], [request.family, ...boundArgs]), {
+        cwd: manifest.repoRoot,
+        encoding: 'utf8',
+        env: {
+            ...safeEnv(process.env),
+            AGENT_INFRA_RUNTIME_DIR: manifest.runtimeDir,
+            ...(controllerBinding
+                ? { AGENT_INFRA_CONTROL_CONTROLLER_BINDING: JSON.stringify(controllerBinding) }
+                : {})
+        }
+    });
     return { exitCode: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
 }
 export async function runSandboxControlExecutor(requestPath, nonce) {
@@ -130,7 +270,7 @@ export async function runSandboxControlExecutor(requestPath, nonce) {
     const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
     if (fs.realpathSync.native(manifest.repoRoot) !== root)
         throw new Error('SANDBOX_CONTROL_EXECUTOR_ROOT_INVALID');
-    const result = executeRequest(manifest, request);
+    const result = executeRequest(manifest, manifestPath, request);
     process.stdout.write(result.stdout);
     process.stderr.write(result.stderr);
     process.exitCode = result.exitCode;