@fitlab-ai/agent-infra 0.9.7 → 0.9.9

package/dist/lib/sandbox/workspace-view.js

@@ -38,6 +38,7 @@ export function sandboxControlPaths(params) {
         channelDir: path.join(root, 'channel'),
         statusDir: path.join(root, 'public'),
         processingDir: path.join(root, 'processing'),
+        runtimeDir: path.join(root, 'runtime'),
         manifestPath: path.join(root, 'manifest.json')
     };
 }
@@ -50,6 +51,29 @@ function assertSafeDirectory(directory, expectedBase) {
         throw new Error(`Sandbox workspace view must not be a symbolic link: ${directory}`);
     }
 }
+function assertSafeMountTargetPath(target, worktreeRoot, canonicalWorktreeRoot) {
+    const relative = path.relative(worktreeRoot, target);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Sandbox workspace mount target escapes its worktree: ${target}`);
+    }
+    let current = worktreeRoot;
+    for (const segment of ['', ...relative.split(path.sep).filter(Boolean)]) {
+        current = segment ? path.join(current, segment) : current;
+        try {
+            if (fs.lstatSync(current).isSymbolicLink()) {
+                throw new Error(`Sandbox workspace mount target must not contain a symbolic link: ${current}`);
+            }
+            const canonicalRelative = path.relative(canonicalWorktreeRoot, fs.realpathSync.native(current));
+            if (canonicalRelative.startsWith('..') || path.isAbsolute(canonicalRelative)) {
+                throw new Error(`Sandbox workspace mount target escapes its real worktree: ${current}`);
+            }
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+}
 export function assertSandboxTaskSource(repoRoot, taskId) {
     if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
         throw new Error('SANDBOX_TASK_SOURCE_INVALID');
@@ -65,42 +89,22 @@ export function assertSandboxTaskSource(repoRoot, taskId) {
     }
     return canonical;
 }
-export function prepareSandboxWorkspaceMountTarget(worktreeRoot) {
-    const worktree = path.resolve(worktreeRoot);
-    const canonicalWorktree = fs.realpathSync.native(worktree);
-    const agentsRoot = path.join(worktree, '.agents');
-    if (fs.existsSync(agentsRoot)) {
-        const agentsStat = fs.lstatSync(agentsRoot);
-        if (!agentsStat.isDirectory() || agentsStat.isSymbolicLink()) {
-            throw new Error(`Sandbox workspace mount ancestor must be a real directory: ${agentsRoot}`);
-        }
-    }
-    else {
-        fs.mkdirSync(agentsRoot, { mode: 0o700 });
-    }
-    const canonicalAgents = fs.realpathSync.native(agentsRoot);
-    if (path.dirname(canonicalAgents) !== canonicalWorktree) {
-        throw new Error(`Sandbox workspace mount ancestor escapes the worktree: ${agentsRoot}`);
+export function prepareSandboxWorkspaceMountTargets(worktreeRoot) {
+    const resolvedWorktreeRoot = path.resolve(worktreeRoot);
+    const canonicalWorktreeRoot = fs.realpathSync.native(resolvedWorktreeRoot);
+    const workspaceRoot = path.resolve(resolvedWorktreeRoot, '.agents', 'workspace');
+    const statePaths = sandboxWorkspaceViewStatePaths(workspaceRoot);
+    const registryTarget = path.join(workspaceRoot, 'active', '.short-ids.json');
+    for (const target of [workspaceRoot, ...statePaths.map(({ hostPath }) => hostPath), registryTarget]) {
+        assertSafeMountTargetPath(target, resolvedWorktreeRoot, canonicalWorktreeRoot);
     }
-    const target = path.join(agentsRoot, 'workspace');
-    if (fs.existsSync(target)) {
-        const stat = fs.lstatSync(target);
-        if (stat.isSymbolicLink()) {
-            throw new Error(`Sandbox workspace mount target must not be a symbolic link: ${target}`);
-        }
-        if (!stat.isDirectory()) {
-            throw new Error(`Sandbox workspace mount target must be a directory: ${target}`);
-        }
-        if (path.dirname(fs.realpathSync.native(target)) !== canonicalAgents) {
-            throw new Error(`Sandbox workspace mount target escapes the worktree: ${target}`);
-        }
-    }
-    else {
-        fs.mkdirSync(target, { mode: 0o700 });
+    fs.mkdirSync(workspaceRoot, { recursive: true, mode: 0o700 });
+    for (const { hostPath } of statePaths) {
+        fs.mkdirSync(hostPath, { recursive: true, mode: 0o700 });
+        fs.chmodSync(hostPath, 0o700);
     }
-    fs.chmodSync(target, 0o700);
-    fs.accessSync(target, fs.constants.W_OK);
-    return target;
+    fs.chmodSync(workspaceRoot, 0o700);
+    fs.closeSync(fs.openSync(registryTarget, 'a', 0o600));
 }
 export function materializeSandboxWorkspaceView(params) {
     const projectRoot = path.resolve(params.base, params.project);
@@ -131,15 +135,32 @@ export function materializeSandboxWorkspaceView(params) {
     return { root, taskMountPath };
 }
 export function materializeSandboxControl(params) {
-    const { root, channelDir, statusDir, processingDir, manifestPath } = sandboxControlPaths(params);
+    const { root, channelDir, statusDir, processingDir, runtimeDir, manifestPath } = sandboxControlPaths(params);
     assertSafeDirectory(root, path.resolve(params.base));
+    if (fs.existsSync(root)) {
+        if (!params.replacementLease || path.resolve(params.replacementLease.root) !== root) {
+            throw new Error('SANDBOX_CONTROL_REPLACEMENT_REQUIRED');
+        }
+        params.replacementLease.assertOwned();
+    }
     const consumedDir = path.join(root, 'consumed');
     assertSafeDirectory(consumedDir, root);
     fs.rmSync(consumedDir, { recursive: true, force: true });
     fs.mkdirSync(consumedDir, { recursive: true, mode: 0o700 });
-    for (const directory of [statusDir, processingDir]) {
+    for (const directory of [statusDir, processingDir, runtimeDir]) {
         assertSafeDirectory(directory, root);
+        if (directory === runtimeDir)
+            fs.rmSync(directory, { recursive: true, force: true });
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    }
+    for (const directory of [
+        path.join(runtimeDir, 'clients'),
+        path.join(runtimeDir, 'clients', 'codex', 'capabilities'),
+        path.join(runtimeDir, 'clients', 'codex', 'lifecycle')
+    ]) {
+        assertSafeDirectory(directory, runtimeDir);
         fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        fs.chmodSync(directory, 0o700);
     }
     for (const queue of ['requests', 'responses']) {
         const directory = path.join(channelDir, queue);
@@ -151,7 +172,7 @@ export function materializeSandboxControl(params) {
     const generation = randomBytes(16).toString('hex');
     const repoRoot = fs.realpathSync.native(params.repoRoot);
     const manifest = {
-        version: 4,
+        version: 5,
         engine: params.engine ?? 'docker',
         repoRoot,
         worktreeRoot: fs.realpathSync.native(params.worktreeRoot),
@@ -165,16 +186,17 @@ export function materializeSandboxControl(params) {
         generation,
         channelDir,
         publicStatusDir: statusDir,
-        processingDir
+        processingDir,
+        runtimeDir
     };
     fs.writeFileSync(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
-    return { root, channelDir, statusDir, manifestPath, token, generation };
+    return { root, channelDir, statusDir, runtimeDir, manifestPath, token, generation };
 }
 export function finalizeSandboxControlManifest(setup, identity) {
     if (!identity.engine || !identity.id)
         throw new Error('SANDBOX_CONTROL_CONTAINER_ID_INVALID');
     const manifest = JSON.parse(fs.readFileSync(setup.manifestPath, 'utf8'));
-    manifest.version = 4;
+    manifest.version = 5;
     manifest.engine = identity.engine;
     manifest.containerIdentity = { id: identity.id, labels: { ...identity.labels } };
     const temporary = `${setup.manifestPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;

package/dist/lib/sandbox/worktree-safety.js

@@ -1,7 +1,9 @@
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { runProbe } from './shell.js';
+import { resolveSandboxTarget } from './workspace-identity.js';
 function probeText(probe, cwd, args) {
     const result = probe('git', ['-C', cwd, ...args], { encoding: 'utf8' });
     if (result.error)
@@ -138,6 +140,197 @@ function captureOnce(worktree, probe) {
     }
     return { worktree: resolvedWorktree, branch, head, changes, identity: hash.digest('hex') };
 }
+function probeTextWithEnv(probe, repoRoot, args, env) {
+    const result = probe('git', args, { cwd: repoRoot, encoding: 'utf8', env });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : result.stderr.toString('utf8').trim();
+        throw new Error(stderr || `git ${args[0] ?? 'command'} failed with exit code ${result.status ?? 'unknown'}`);
+    }
+    return typeof result.stdout === 'string' ? result.stdout : result.stdout.toString('utf8');
+}
+function probeMetadataCommand(probe, repoRoot, args, env) {
+    const result = probe('git', args, { cwd: repoRoot, encoding: 'utf8', env });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
+function hasValidHeadContent(content) {
+    return /^(?:ref:\s+refs\/\S+|[0-9a-f]{40}|[0-9a-f]{64})$/i.test(content.trim());
+}
+function assertRecoverableMetadata(worktree, repoRoot, probe) {
+    const dotGit = path.join(worktree, '.git');
+    let dotGitStat;
+    try {
+        dotGitStat = fs.lstatSync(dotGit);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    if (dotGitStat.isSymbolicLink() || dotGitStat.isDirectory()) {
+        throw new Error('WORKTREE_RECOVERY_METADATA_NOT_ELIGIBLE');
+    }
+    if (!dotGitStat.isFile())
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    const content = fs.readFileSync(dotGit, 'utf8').trim();
+    const match = /^gitdir:\s*(.+)$/i.exec(content);
+    if (!match)
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    const commonDir = fs.realpathSync.native(path.resolve(repoRoot, probeText(probe, repoRoot, [
+        'rev-parse', '--git-common-dir'
+    ]).trim()));
+    const adminRoot = path.join(commonDir, 'worktrees');
+    const adminPath = path.resolve(path.dirname(dotGit), match[1]);
+    const relative = path.relative(adminRoot, adminPath);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative) || relative.includes(path.sep)) {
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    }
+    if (!fs.existsSync(adminPath))
+        return;
+    const adminStat = fs.lstatSync(adminPath);
+    if (adminStat.isSymbolicLink())
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    if (!adminStat.isDirectory())
+        return;
+    const requiredFiles = ['HEAD', 'gitdir', 'commondir', 'index'];
+    if (requiredFiles.some((name) => !fs.existsSync(path.join(adminPath, name))))
+        return;
+    for (const name of requiredFiles) {
+        const filePath = path.join(adminPath, name);
+        const stat = fs.lstatSync(filePath);
+        if (stat.isSymbolicLink() || !stat.isFile())
+            throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    }
+    const adminGitdir = fs.readFileSync(path.join(adminPath, 'gitdir'), 'utf8').trim();
+    const adminCommonDir = fs.readFileSync(path.join(adminPath, 'commondir'), 'utf8').trim();
+    const adminGitdirPath = adminGitdir
+        ? fs.realpathSync.native(path.resolve(adminPath, adminGitdir))
+        : '';
+    const canonicalDotGit = fs.realpathSync.native(dotGit);
+    const adminCommonDirPath = adminCommonDir
+        ? fs.realpathSync.native(path.resolve(adminPath, adminCommonDir))
+        : '';
+    if (!adminGitdir || adminGitdirPath !== canonicalDotGit
+        || !adminCommonDir || adminCommonDirPath !== commonDir) {
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    }
+    const headContent = fs.readFileSync(path.join(adminPath, 'HEAD'), 'utf8');
+    const indexContent = fs.readFileSync(path.join(adminPath, 'index'));
+    if (!hasValidHeadContent(headContent) || indexContent.subarray(0, 4).toString('ascii') !== 'DIRC')
+        return;
+    const validationEnv = { ...process.env };
+    for (const key of ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE', 'GIT_WORK_TREE', 'GIT_PREFIX']) {
+        delete validationEnv[key];
+    }
+    validationEnv.GIT_DIR = adminPath;
+    validationEnv.GIT_WORK_TREE = path.resolve(worktree);
+    if (!probeMetadataCommand(probe, repoRoot, ['rev-parse', '--verify', 'HEAD^{commit}'], validationEnv))
+        return;
+    if (!probeMetadataCommand(probe, repoRoot, ['ls-files', '--stage', '-z'], validationEnv))
+        return;
+    throw new Error('WORKTREE_RECOVERY_METADATA_REGISTERED');
+}
+function parseRecoveredStatus(raw) {
+    const records = raw.split('\0');
+    const changes = [];
+    for (let index = 0; index < records.length;) {
+        const status = records[index++] ?? '';
+        if (!status)
+            continue;
+        const code = status[0] ?? '';
+        if (code === 'R' || code === 'C') {
+            const originalPath = records[index++];
+            const nextPath = records[index++];
+            if (!originalPath || !nextPath)
+                throw new Error('Unable to parse recovered Git rename record');
+            changes.push({ indexStatus: code, worktreeStatus: ' ', path: nextPath, originalPath });
+            continue;
+        }
+        const filePath = records[index++];
+        if (!filePath)
+            throw new Error('Unable to parse recovered Git status record');
+        changes.push({
+            indexStatus: code === 'D' ? ' ' : code,
+            worktreeStatus: code === 'D' ? 'D' : ' ',
+            path: filePath
+        });
+    }
+    return changes;
+}
+function captureRecoveredOnce(worktree, recovery, probe) {
+    const resolvedWorktree = path.resolve(worktree);
+    const resolvedBase = path.resolve(recovery.worktreeBase);
+    const relative = path.relative(resolvedBase, resolvedWorktree);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`WORKTREE_RECOVERY_PATH_INVALID: ${resolvedWorktree}`);
+    }
+    const stat = fs.lstatSync(resolvedWorktree);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('WORKTREE_RECOVERY_PATH_INVALID');
+    const canonicalBase = fs.realpathSync.native(resolvedBase);
+    const canonicalWorktree = fs.realpathSync.native(resolvedWorktree);
+    const canonicalRelative = path.relative(canonicalBase, canonicalWorktree);
+    if (!canonicalRelative || canonicalRelative.startsWith('..') || path.isAbsolute(canonicalRelative)) {
+        throw new Error('WORKTREE_RECOVERY_PATH_INVALID');
+    }
+    const resolvedWorkspace = resolveSandboxTarget(recovery.branch, recovery.repoRoot).workspace;
+    if (recovery.identitySource === 'branch-only' && resolvedWorkspace.mode !== 'branch-only') {
+        throw new Error('WORKTREE_RECOVERY_IDENTITY_CHANGED');
+    }
+    if (recovery.identitySource === 'task-bound'
+        && (resolvedWorkspace.mode !== 'task-bound' || resolvedWorkspace.taskId !== recovery.taskId)) {
+        throw new Error('WORKTREE_RECOVERY_IDENTITY_CHANGED');
+    }
+    assertRecoverableMetadata(resolvedWorktree, recovery.repoRoot, probe);
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-infra-recovered-index-'));
+    const env = { ...process.env };
+    for (const key of ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_PREFIX'])
+        delete env[key];
+    env.GIT_INDEX_FILE = path.join(tempDir, 'index');
+    env.GIT_WORK_TREE = resolvedWorktree;
+    try {
+        const baseline = probeTextWithEnv(probe, recovery.repoRoot, [
+            'rev-parse', '--verify', `refs/heads/${recovery.branch}^{commit}`
+        ], env).trim();
+        if (!baseline)
+            throw new Error(`WORKTREE_RECOVERY_BRANCH_INVALID: ${recovery.branch}`);
+        probeTextWithEnv(probe, recovery.repoRoot, ['read-tree', baseline], env);
+        probeTextWithEnv(probe, recovery.repoRoot, ['add', '-A', '--', '.'], env);
+        const status = probeTextWithEnv(probe, recovery.repoRoot, [
+            'diff', '--cached', '--name-status', '--find-renames', '-z', '--', '.'
+        ], env);
+        const changes = parseRecoveredStatus(status);
+        const hash = createHash('sha256');
+        updatePart(hash, 'source', 'recovered');
+        updatePart(hash, 'worktree', resolvedWorktree);
+        updatePart(hash, 'repo-root', path.resolve(recovery.repoRoot));
+        updatePart(hash, 'branch', recovery.branch);
+        updatePart(hash, 'baseline', baseline);
+        updatePart(hash, 'identity-source', recovery.identitySource);
+        updatePart(hash, 'task-id', recovery.taskId ?? '');
+        updatePart(hash, 'status', status);
+        for (const change of changes) {
+            hashPath(hash, resolvedWorktree, change.path, probe);
+            if (change.originalPath)
+                hashPath(hash, resolvedWorktree, change.originalPath, probe);
+        }
+        return {
+            worktree: resolvedWorktree,
+            branch: recovery.branch,
+            head: baseline,
+            changes,
+            identity: hash.digest('hex'),
+            source: 'recovered',
+            recovery: { ...recovery }
+        };
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+}
 function inspectWorktree(worktree, { probe = runProbe } = {}) {
     const resolvedWorktree = path.resolve(worktree);
     try {
@@ -156,6 +349,24 @@ function inspectWorktree(worktree, { probe = runProbe } = {}) {
         };
     }
 }
+function inspectRecoveredWorktree(worktree, recovery, { probe = runProbe } = {}) {
+    const resolvedWorktree = path.resolve(worktree);
+    try {
+        const first = captureRecoveredOnce(resolvedWorktree, recovery, probe);
+        const second = captureRecoveredOnce(resolvedWorktree, recovery, probe);
+        if (first.identity !== second.identity) {
+            return { status: 'failed', worktree: resolvedWorktree, message: 'Snapshot changed while recovering worktree' };
+        }
+        return { status: second.changes.length === 0 ? 'clean' : 'dirty', snapshot: second };
+    }
+    catch (error) {
+        return {
+            status: 'failed',
+            worktree: resolvedWorktree,
+            message: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
 function inspectWorktrees(worktrees) {
     return [...new Set(worktrees.map((worktree) => path.resolve(worktree)))].sort()
         .map((worktree) => inspectWorktree(worktree));
@@ -171,7 +382,9 @@ function createDiscardPermit(snapshot) {
     return { mode: 'discard', snapshot };
 }
 function verifyWorktreePermit(permit, options = {}) {
-    const current = inspectWorktree(permit.snapshot.worktree, options);
+    const current = permit.snapshot.source === 'recovered' && permit.snapshot.recovery
+        ? inspectRecoveredWorktree(permit.snapshot.worktree, permit.snapshot.recovery, options)
+        : inspectWorktree(permit.snapshot.worktree, options);
     if (current.status === 'failed')
         throw new Error(`Unable to verify worktree permit: ${current.message}`);
     if (current.snapshot.identity !== permit.snapshot.identity || (permit.mode === 'clean' && current.status !== 'clean')) {
@@ -192,5 +405,5 @@ function formatWorktreeSnapshot(snapshot) {
         `Snapshot identity: ${snapshot.identity}`
     ].join('\n');
 }
-export { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectWorktree, inspectWorktrees, verifyWorktreePermit };
+export { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectRecoveredWorktree, inspectWorktree, inspectWorktrees, verifyWorktreePermit };
 //# sourceMappingURL=worktree-safety.js.map

package/dist/lib/server/process-state.js

@@ -97,6 +97,56 @@ export function getProcessStartTime(pid, platform = process.platform) {
         return null;
     }
 }
+export function getProcessIdentityState(identity, platform = process.platform) {
+    if (!Number.isInteger(identity.pid) || identity.pid <= 0 || !Number.isSafeInteger(identity.startTime)) {
+        return 'dead';
+    }
+    if (platform === 'linux') {
+        try {
+            const stat = parseLinuxProcessStat(fs.readFileSync(`/proc/${identity.pid}/stat`, 'utf8'));
+            if (stat === null)
+                return 'unknown';
+            if (stat.state === 'Z')
+                return 'dead';
+            return stat.startTime === identity.startTime ? 'alive' : 'dead';
+        }
+        catch (error) {
+            return error.code === 'ENOENT' ? 'dead' : 'unknown';
+        }
+    }
+    try {
+        process.kill(identity.pid, 0);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === 'ESRCH')
+            return 'dead';
+        if (code !== 'EPERM')
+            return 'unknown';
+    }
+    const query = buildProcessStartTimeQuery(identity.pid, platform);
+    if (query === null)
+        return 'unknown';
+    try {
+        const output = execFileSync(query.command, query.args, {
+            encoding: 'utf8',
+            env: platform === 'darwin' ? { ...process.env, LC_ALL: 'C', LANG: 'C', TZ: 'UTC' } : process.env
+        }).trim();
+        if (output.length === 0)
+            return 'unknown';
+        const startTime = platform === 'win32'
+            ? new Date(output).getTime()
+            : platform === 'darwin'
+                ? parseDarwinStartTime(output)
+                : null;
+        if (startTime === null || Number.isNaN(startTime))
+            return 'unknown';
+        return startTime === identity.startTime ? 'alive' : 'dead';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 function parsePidRecord(raw) {
     const trimmed = raw.trim();
     if (/^[1-9]\d*$/.test(trimmed)) {
@@ -200,6 +250,6 @@ export function removePidRecordIfMatches(pidFile, expected) {
     return removePidFileIfMatches(pidFile, state.snapshot);
 }
 export function processIdentityMatches(identity) {
-    return getProcessStartTime(identity.pid) === identity.startTime;
+    return getProcessIdentityState(identity) === 'alive';
 }
 //# sourceMappingURL=process-state.js.map

package/dist/lib/task/activity-intent.js

@@ -5,6 +5,7 @@ import { locateActivityLog, appendActivityEntry } from './activity-log.js';
 import { assertWritableInventory, buildArtifactLinkSection, inspectTaskArtifacts, parseArtifactName } from './artifact-lifecycle.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
+import { allowsManualOverride } from './guard-override.js';
 const HEAD_RE = /^[0-9a-f]{40}$/;
 const REVIEW_ACTION_RE = /^Review PR \(Round ([1-9]\d*)\)( \[started\])?$/;
 const VERDICTS = new Set(['approved', 'changes-requested', 'commented']);
@@ -292,9 +293,11 @@ export function applyPrReviewActivityIntent(intent, options = {}) {
     const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
     if (!resolved.ok)
         return failed(intent, resolved.code, resolved.message, resolved.taskId);
-    if (resolved.state !== 'active') {
+    if (resolved.state !== 'active' && !allowsManualOverride(options.manualOverride, 'activity-intent', 'TASK_STATE_MISMATCH')) {
         return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
     }
+    if (options.lockAlreadyHeld)
+        return applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot });
     try {
         return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-activity:${intent.kind}`, () => applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot }), options.lockOptions);
     }