@fitlab-ai/agent-infra 0.9.7 → 0.9.9

package/dist/lib/platform/pull-requests.js

@@ -11,15 +11,25 @@ import { inspectPlatformIssue } from './issues.js';
 import { planPullRequestMetadata } from './pull-request-metadata.js';
 import { platformResult } from './types.js';
 import { inspectCompletionArtifacts } from '../task/finalization-artifacts.js';
-import { inspectCreatePrCommitGate } from '../task/commit-finalization.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { mergeOperationWarnings } from '../task/operation-outcome.js';
+function warningResultForPrimary(primaryResult) {
+    if (primaryResult === 'pr_created')
+        return 'pr_created_with_warnings';
+    if (primaryResult === 'pr_reused')
+        return 'pr_reused_with_warnings';
+    return 'no_op_with_warnings';
+}
 function result(status, taskId, issueNumber, prNumber, overrides = {}) {
-    return {
+    const output = {
         ...platformResult(status),
         task: { id: taskId, issueNumber, prNumber },
         pullRequest: null,
+        result: null,
+        warnings: [],
         ...overrides
     };
+    return { ...output, warnings: mergeOperationWarnings(output.warnings) };
 }
 function externalResult(base, overrides = {}) {
     return {
@@ -202,7 +212,7 @@ function expectedHead(repository, head) {
     const repoName = repository.split('/')[1] || '';
     return { repository: `${head.slice(0, colon)}/${repoName}`, ref: head.slice(colon + 1) };
 }
-function selectPullRequest(remotes, repository, head, base) {
+function selectPullRequest(remotes, repository, head, base, expectedSha) {
     const wanted = expectedHead(repository, head);
     const matches = remotes.flatMap((remote) => {
         const normalized = normalizePullRequest(remote, repository);
@@ -210,10 +220,89 @@ function selectPullRequest(remotes, repository, head, base) {
             normalized.head.ref === wanted.ref && normalized.base.repository === repository && normalized.base.ref === base
             ? [normalized] : [];
     });
+    if (expectedSha && matches.some((match) => match.head.sha !== expectedSha)) {
+        return { status: 'head-mismatch', pullRequest: null };
+    }
     if (matches.length === 1)
         return { status: 'resolved', pullRequest: matches[0] };
     return { status: matches.length === 0 ? 'missing' : 'ambiguous', pullRequest: null };
 }
+function repositoryHead(cwd) {
+    return execFileSync('git', ['rev-parse', 'HEAD'], {
+        cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
+    }).trim();
+}
+function remoteBranchHead(cwd, repository, head) {
+    const wanted = expectedHead(repository, head);
+    if (!wanted.ref || !/^[A-Za-z0-9._/-]+$/.test(wanted.ref))
+        return {
+            ok: false,
+            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid', retryable: false }
+        };
+    const remotes = configuredGitRemotes(cwd);
+    const remote = remotes.find((item) => repositoryKey(item.repository) === repositoryKey(wanted.repository))
+        ?? remotes.find((item) => item.name === 'origin');
+    if (!remote)
+        return {
+            ok: false,
+            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}`, retryable: false }
+        };
+    try {
+        const output = execFileSync('git', ['ls-remote', '--refs', remote.name, `refs/heads/${wanted.ref}`], {
+            cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe']
+        }).trim();
+        const match = output.split(/\r?\n/).map((line) => line.trim()).find((line) => line.endsWith(`refs/heads/${wanted.ref}`));
+        const sha = match?.split(/\s+/)[0] || null;
+        if (!sha || !/^[a-f0-9]{40}$/i.test(sha))
+            return {
+                ok: false,
+                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist`, retryable: false }
+            };
+        return { ok: true, value: sha };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: true }
+        };
+    }
+}
+function verifyCreateHead(base, head) {
+    let localHead;
+    try {
+        localHead = repositoryHead(base.resolved.repoRoot);
+    }
+    catch (error) {
+        return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false } };
+    }
+    const remote = remoteBranchHead(base.resolved.repoRoot, base.context.platform.repository, head);
+    if (!remote.ok)
+        return remote;
+    if (remote.value !== localHead)
+        return {
+            ok: false,
+            error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}`, retryable: false }
+        };
+    return { ok: true, value: localHead };
+}
+function validateBoundPullRequest(base, pullRequest, head, baseRef, expectedSha) {
+    if (!pullRequest)
+        return {
+            ok: false,
+            error: { code: 'PR_BIND_RECHECK_FAILED', message: 'Bound pull request identity is unavailable', retryable: false }
+        };
+    const wanted = expectedHead(base.context.platform.repository, head);
+    if (pullRequest.head.repository !== wanted.repository
+        || pullRequest.head.ref !== wanted.ref
+        || pullRequest.head.sha !== expectedSha
+        || pullRequest.base.repository !== base.context.platform.repository
+        || pullRequest.base.ref !== baseRef)
+        return {
+            ok: false,
+            error: { code: 'PR_BIND_IDENTITY_MISMATCH', message: 'Bound pull request identity does not match the current expected head/base', retryable: false }
+        };
+    return { ok: true };
+}
 function resolvedContext(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok)
@@ -338,19 +427,22 @@ registerPlatformCapabilities('github', {
         return resolveGitHubChangeRequestGitEvidence(context);
     }
 });
-function locatePullRequest(base, head, target) {
+function locatePullRequest(base, head, target, expectedSha) {
     const repository = base.context.platform.repository;
     const listed = base.client.json([
         'api', `repos/${repository}/pulls?state=open&base=${encodeURIComponent(target)}&per_page=100`
     ], { cwd: base.resolved.repoRoot });
     if (!listed.ok)
         return listed;
-    const selected = selectPullRequest(listed.value, repository, head, target);
+    const selected = selectPullRequest(listed.value, repository, head, target, expectedSha);
     return selected.status === 'resolved'
         ? { ok: true, value: selected.pullRequest }
         : { ok: false, error: {
-                code: selected.status === 'ambiguous' ? 'PR_IDENTITY_AMBIGUOUS' : 'PR_NOT_FOUND',
-                message: selected.status === 'ambiguous' ? 'Multiple pull requests match the exact head/base identity' : 'No pull request matches the exact head/base identity',
+                code: selected.status === 'ambiguous' ? 'PR_IDENTITY_AMBIGUOUS'
+                    : selected.status === 'head-mismatch' ? 'PR_HEAD_SHA_MISMATCH' : 'PR_NOT_FOUND',
+                message: selected.status === 'ambiguous' ? 'Multiple pull requests match the exact head/base identity'
+                    : selected.status === 'head-mismatch' ? 'A pull request matches head/base but not the expected head SHA'
+                        : 'No pull request matches the exact head/base identity',
                 retryable: false
             } };
 }
@@ -622,28 +714,47 @@ function createPlatformPullRequestUnlocked(taskRef, options) {
         return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
         });
-    if (base.prNumber)
-        return inspectPlatformPullRequest(taskRef, options);
-    const gate = inspectCreatePrCommitGate(base.resolved.taskDir, base.resolved.repoRoot, base.resolved.taskId);
-    if (!gate.allowed)
-        return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+    if (base.prNumber) {
+        const headCheck = verifyCreateHead(base, options.head);
+        if (!headCheck.ok)
+            return result(headCheck.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+                platform: base.context.platform,
+                capabilities: base.context.capabilities,
+                error: headCheck.error
+            });
+        const inspected = inspectPlatformPullRequest(taskRef, options);
+        const identity = validateBoundPullRequest(base, inspected.pullRequest, options.head, options.base, headCheck.value);
+        if (!identity.ok)
+            return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+                platform: base.context.platform,
+                capabilities: base.context.capabilities,
+                pullRequest: inspected.pullRequest,
+                error: identity.error
+            });
+        return { ...inspected, result: 'no_op' };
+    }
+    const headCheck = verifyCreateHead(base, options.head);
+    if (!headCheck.ok)
+        return result(headCheck.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, null, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
-            error: {
-                code: gate.code,
-                message: `${gate.message}; action=${gate.action}`,
-                retryable: gate.action === 'rerun-commit' || gate.action === 'rerun-review-code'
-            }
+            error: headCheck.error
         });
-    const located = locatePullRequest(base, options.head, options.base);
+    const expectedHeadSha = headCheck.value;
+    const located = locatePullRequest(base, options.head, options.base, expectedHeadSha);
     if (!located.ok && located.error.code === 'PR_IDENTITY_AMBIGUOUS')
         return result('failed', base.resolved.taskId, base.issueNumber, null, {
             platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
         });
+    if (!located.ok && located.error.code === 'PR_HEAD_SHA_MISMATCH')
+        return result('failed', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform, capabilities: base.context.capabilities, error: located.error
+        });
     if (options.dryRun)
         return result('planned', base.resolved.taskId, base.issueNumber, null, {
             platform: base.context.platform, capabilities: base.context.capabilities,
-            operations: [{ name: located.ok ? 'pr:reuse' : 'pr:create', status: 'planned', reasonCode: null }], error: null
+            operations: [{ name: located.ok ? 'pr:reuse' : 'pr:create', status: 'planned', reasonCode: null }],
+            result: located.ok ? 'pr_reused' : 'pr_created', error: null
         });
     const started = writeCreateStarted(base, options.agent);
     if (started.status === 'failed')
@@ -662,7 +773,7 @@ function createPlatformPullRequestUnlocked(taskRef, options) {
         if (response.ok)
             pullRequest = normalizePullRequest(response.value, repository);
         else if (response.error.retryable) {
-            const recovered = locatePullRequest(base, options.head, options.base);
+            const recovered = locatePullRequest(base, options.head, options.base, expectedHeadSha);
             if (recovered.ok)
                 pullRequest = recovered.value;
             else
@@ -681,8 +792,44 @@ function createPlatformPullRequestUnlocked(taskRef, options) {
             return result('failed', base.resolved.taskId, base.issueNumber, null, {
                 error: { code: 'PR_CREATE_RESPONSE_INVALID', message: 'PR create response lacks validated identity', retryable: false }
             });
+        if (pullRequest.head.sha !== expectedHeadSha)
+            return result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+                platform: base.context.platform, capabilities: base.context.capabilities,
+                resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
+                error: { code: 'PR_HEAD_SHA_MISMATCH', message: 'Created pull request head does not match the expected local HEAD', retryable: false }
+            });
         created = true;
     }
+    const bindHeadCheck = verifyCreateHead(base, options.head);
+    if (!bindHeadCheck.ok || bindHeadCheck.value !== expectedHeadSha) {
+        const error = bindHeadCheck.ok
+            ? { code: 'PR_REMOTE_HEAD_MISMATCH', message: 'Remote head changed before task binding', retryable: false }
+            : bindHeadCheck.error;
+        return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest, error
+        });
+    }
+    const beforeBind = inspectGitHubPullRequest(base.client, base.context.platform.repository, pullRequest.number, base.resolved.repoRoot);
+    if (!beforeBind.ok || !beforeBind.value) {
+        const error = beforeBind.ok
+            ? { code: 'PR_BIND_RECHECK_FAILED', message: 'Pull request recheck returned no identity', retryable: false }
+            : beforeBind.error;
+        return result(error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest, error
+        });
+    }
+    if (beforeBind.value.head.sha !== expectedHeadSha
+        || beforeBind.value.head.ref !== expectedHead(base.context.platform.repository, options.head).ref
+        || beforeBind.value.base.ref !== options.base
+        || beforeBind.value.base.repository !== base.context.platform.repository)
+        return result('failed', base.resolved.taskId, base.issueNumber, pullRequest.number, {
+            platform: base.context.platform, capabilities: base.context.capabilities,
+            resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest: beforeBind.value,
+            error: { code: 'PR_BIND_IDENTITY_MISMATCH', message: 'Pull request identity changed before task binding', retryable: false }
+        });
+    pullRequest = beforeBind.value;
     const refreshed = resolvedContext(taskRef, options);
     if (!refreshed.ok)
         return result('failed', base.resolved.taskId, base.issueNumber, null, {
@@ -699,7 +846,8 @@ function createPlatformPullRequestUnlocked(taskRef, options) {
     return result('applied', base.resolved.taskId, base.issueNumber, pullRequest.number, {
         changed: true, platform: base.context.platform, capabilities: base.context.capabilities,
         resource: { kind: 'pull-request', number: pullRequest.number }, pullRequest,
-        operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: created ? 'applied' : 'no-op', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }], error: null
+        operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: created ? 'applied' : 'no-op', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }],
+        result: created ? 'pr_created' : 'pr_reused', error: null
     });
 }
 function createPlatformPullRequest(taskRef, options) {
@@ -711,8 +859,6 @@ function createPlatformPullRequest(taskRef, options) {
             error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
         });
     }
-    if (base.prNumber)
-        return inspectPlatformPullRequest(taskRef, options);
     try {
         return withTaskExecutionLock(base.resolved.repoRoot, base.resolved.taskId, 'platform-pr.create', () => createPlatformPullRequestUnlocked(taskRef, options));
     }
@@ -736,29 +882,46 @@ function createPlatformPullRequest(taskRef, options) {
     }
 }
 function syncPlatformPullRequest(taskRef, options) {
+    const warningResult = warningResultForPrimary(options.primaryResult);
+    const softenFailure = (output) => {
+        const warning = output.error && output.task.prNumber !== null
+            && !['PR_NOT_LINKED', 'PR_BIND_CONFLICT'].includes(output.error.code)
+            ? {
+                code: output.error.code,
+                message: output.error.message,
+                retryable: output.error.retryable,
+                step: 'pr-metadata',
+                target: `pull-request:${output.task.prNumber}`,
+                severity: 'ACTION_REQUIRED'
+            }
+            : null;
+        return warning
+            ? { ...output, status: 'applied', changed: false, error: null, result: warningResult, warnings: mergeOperationWarnings([warning]) }
+            : output;
+    };
     const base = resolvedContext(taskRef, options);
     if (!base.ok)
-        return base.output;
+        return softenFailure(base.output);
     if (!base.prNumber)
-        return result('failed', base.resolved.taskId, base.issueNumber, null, {
+        return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, null, {
             error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false }
-        });
+        }));
     const fetched = inspectGitHubPullRequest(base.client, base.context.platform.repository, base.prNumber, base.resolved.repoRoot);
     if (!fetched.ok)
-        return result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: fetched.error });
+        return softenFailure(result(fetched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { error: fetched.error }));
     if (!options.metadata && !options.closingIssue)
-        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        return softenFailure(result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
             error: { code: 'PR_PAYLOAD_INVALID', message: 'sync requires a desired-state option', retryable: false }
-        });
+        }));
     if (!base.issueNumber)
-        return result('degraded', base.resolved.taskId, null, base.prNumber, {
+        return softenFailure(result('degraded', base.resolved.taskId, null, base.prNumber, {
             pullRequest: fetched.value, error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no linked Issue to copy metadata from', retryable: false }
-        });
+        }));
     const issue = inspectPlatformIssue(taskRef, { cwd: base.resolved.repoRoot, client: base.client });
     if (!issue.issue)
-        return result(issue.status, base.resolved.taskId, base.issueNumber, base.prNumber, {
+        return softenFailure(result(issue.status, base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: fetched.value, error: issue.error
-        });
+        }));
     const planned = planPullRequestMetadata({
         pullRequest: fetched.value,
         issue: issue.issue,
@@ -769,9 +932,9 @@ function syncPlatformPullRequest(taskRef, options) {
         .filter((operation) => options.closingIssue || operation.name !== 'closing-issue');
     const operations = planned.map(({ name, status, reasonCode }) => ({ name, status, reasonCode }));
     if (options.dryRun)
-        return result(planned.some((operation) => operation.status === 'planned') ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        return softenFailure(result(planned.some((operation) => operation.status === 'planned') ? 'planned' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: fetched.value, operations, error: null
-        });
+        }));
     const payload = {};
     for (const operation of planned) {
         if (operation.status !== 'planned')
@@ -785,27 +948,28 @@ function syncPlatformPullRequest(taskRef, options) {
         if (operation.name === 'milestone') {
             const milestones = base.client.json(['api', '--paginate', '--slurp', `repos/${base.context.platform.repository}/milestones?state=open&per_page=100`], { cwd: base.resolved.repoRoot });
             if (!milestones.ok)
-                return result(milestones.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: milestones.error });
+                return softenFailure(result(milestones.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: milestones.error }));
             const flat = milestones.value.flatMap((entry) => Array.isArray(entry) ? entry : [entry]);
             payload.milestone = flat.find((entry) => entry.title === operation.value)?.number ?? null;
         }
     }
     if (Object.keys(payload).length === 0) {
         const degraded = planned.some((operation) => operation.status === 'skipped');
-        return result(degraded ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        return softenFailure(result(degraded ? 'degraded' : 'no-op', base.resolved.taskId, base.issueNumber, base.prNumber, {
             platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value, operations, error: null
-        });
+        }));
     }
     const patched = base.client.json(['api', `repos/${base.context.platform.repository}/issues/${base.prNumber}`, '-X', 'PATCH', '--input', '-'], {
         cwd: base.resolved.repoRoot, method: 'PATCH', input: JSON.stringify(payload)
     });
     if (!patched.ok)
-        return result(patched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: patched.error });
-    return result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, base.prNumber, {
+        return softenFailure(result(patched.error.retryable ? 'blocked' : 'failed', base.resolved.taskId, base.issueNumber, base.prNumber, { pullRequest: fetched.value, operations, error: patched.error }));
+    return softenFailure(result(planned.some((operation) => operation.status === 'skipped') ? 'degraded' : 'applied', base.resolved.taskId, base.issueNumber, base.prNumber, {
         changed: true, platform: base.context.platform, capabilities: base.context.capabilities,
         resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: fetched.value,
         operations: operations.map((operation) => operation.status === 'planned' ? { ...operation, status: 'applied' } : operation), error: null
-    });
+    }));
 }
 export { bindPlatformPullRequest, createPlatformPullRequest, inspectGitHubPullRequest, inspectGitHubIssueClosingChangeRequests, inspectPlatformPullRequest, inspectPlatformPullRequestByNumber, normalizePullRequest, resolveGitHubChangeRequestGitEvidence, resolveExternalPullRequest, selectExternalPullRequest, selectPullRequest, syncPlatformPullRequest };
+export { warningResultForPrimary };
 //# sourceMappingURL=pull-requests.js.map

package/dist/lib/runtime/agent-runtime.js

@@ -0,0 +1,56 @@
+import path from 'node:path';
+const CLIENT_NAMESPACE = /^[a-z][a-z0-9-]{0,31}$/u;
+function runtimeError(code, message) {
+    const error = new Error(`${code}: ${message}`);
+    error.name = code;
+    return error;
+}
+function boundControlContext(env) {
+    return [
+        'AGENT_INFRA_CONTROL_TOKEN',
+        'AGENT_INFRA_CONTROL_GENERATION',
+        'AGENT_INFRA_EXECUTOR_MANIFEST',
+        'AGENT_INFRA_CODEX_CONTROLLER_CONTEXT'
+    ].some((key) => typeof env[key] === 'string' && env[key].length > 0);
+}
+function clientNamespace(client) {
+    if (!CLIENT_NAMESPACE.test(client)) {
+        throw runtimeError('AGENT_INFRA_RUNTIME_CLIENT_INVALID', `invalid runtime client namespace '${client}'`);
+    }
+    return client;
+}
+export function resolveAgentRuntimeRoot(options = {}) {
+    const env = options.env ?? process.env;
+    const configured = env.AGENT_INFRA_RUNTIME_DIR;
+    if (configured !== undefined && configured.length > 0) {
+        if (!path.isAbsolute(configured)) {
+            throw runtimeError('AGENT_INFRA_RUNTIME_DIR_INVALID', 'runtime directory must be absolute');
+        }
+        return path.resolve(configured);
+    }
+    if (boundControlContext(env)) {
+        throw runtimeError('AGENT_INFRA_RUNTIME_DIR_REQUIRED', 'task-bound control context requires AGENT_INFRA_RUNTIME_DIR');
+    }
+    return path.join(path.resolve(options.repoRoot ?? process.cwd()), '.agents', 'workspace', '.runtime');
+}
+export function resolveAgentRuntimeStoreRoot(options = {}) {
+    const client = clientNamespace(options.client ?? 'codex');
+    if (options.explicitRoot)
+        return path.resolve(options.explicitRoot);
+    const env = options.env ?? process.env;
+    const runtimeRoot = resolveAgentRuntimeRoot({ repoRoot: options.repoRoot, env });
+    if (env.AGENT_INFRA_RUNTIME_DIR) {
+        if (!options.store) {
+            throw runtimeError('AGENT_INFRA_RUNTIME_STORE_INVALID', 'store kind is required for task-bound runtime');
+        }
+        return path.join(runtimeRoot, 'clients', client, options.store);
+    }
+    if (client === 'codex' && options.store) {
+        return path.join(runtimeRoot, `codex-${options.store}`);
+    }
+    if (!options.store) {
+        throw runtimeError('AGENT_INFRA_RUNTIME_STORE_INVALID', 'store kind is required');
+    }
+    return path.join(runtimeRoot, 'clients', client, options.store);
+}
+//# sourceMappingURL=agent-runtime.js.map