@fitlab-ai/agent-infra 0.9.8 → 0.9.10

package/lib/internal/codex-sandbox-controller.ts

@@ -1,6 +1,6 @@
 import {
   runCodexSandboxController,
-  verifyCodexSandboxControllerContext
+  verifyCodexSandboxControllerContextWithWarnings
 } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
 
 const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
@@ -26,8 +26,6 @@ function parse(args: string[]): Readonly<{ operation: string; values: Readonly<R
     return null;
   }
   const allowed = new Set([
-    '--task-id',
-    '--task-ref',
     '--context',
     '--executor-model',
     '--executor-reasoning-effort',
@@ -37,6 +35,11 @@ function parse(args: string[]): Readonly<{ operation: string; values: Readonly<R
   const values: Record<string, string> = {};
   for (let index = 1; index < args.length; index += 1) {
     const flag = args[index]!;
+    if (flag === '--task-id' || flag.startsWith('--task-id=')
+      || flag === '--task-ref' || flag.startsWith('--task-ref=')) {
+      fail('CODEX_SANDBOX_CONTROLLER_IDENTITY_OPTION_UNSUPPORTED', 'controller task identity options are not supported', 2);
+      return null;
+    }
     const value = args[++index];
     if (!allowed.has(flag) || Object.hasOwn(values, flag) || !value || value.startsWith('--')) {
       fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', `invalid option '${flag}'`, 2);
@@ -50,17 +53,13 @@ function parse(args: string[]): Readonly<{ operation: string; values: Readonly<R
 async function codexSandboxController(args: string[] = []): Promise<void> {
   const parsed = parse(args);
   if (!parsed || process.exitCode) return;
-  const taskId = parsed.values['--task-id'];
-  if (!taskId) {
-    fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', '--task-id is required', 2);
-    return;
-  }
   try {
     if (parsed.operation === 'verify-context') {
       const contextPath = parsed.values['--context']
         ?? process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
       if (!contextPath) throw new Error('CODEX_SANDBOX_CONTROLLER_CONTEXT_MISSING');
-      const context = verifyCodexSandboxControllerContext(contextPath, taskId);
+      const verified = verifyCodexSandboxControllerContextWithWarnings(contextPath);
+      const context = verified.context;
       process.stdout.write(`${JSON.stringify({
         status: 'ready',
         changed: false,
@@ -71,14 +70,12 @@ async function codexSandboxController(args: string[] = []): Promise<void> {
           expiresAt: context.expiresAt,
           buildIdentity: context.buildIdentity,
           hookDefinitionHash: context.hookDefinitionHash,
-          lifecycleProfilesHash: context.lifecycleProfilesHash
         },
+        ...(verified.warnings.length > 0 ? { warnings: verified.warnings } : {}),
         error: null
       })}\n`);
       return;
     }
-    const taskRef = parsed.values['--task-ref'];
-    if (!taskRef) throw new Error('CODEX_SANDBOX_CONTROLLER_TASK_REF_REQUIRED');
     const policy = [
       '--executor-model',
       '--executor-reasoning-effort',
@@ -90,8 +87,6 @@ async function codexSandboxController(args: string[] = []): Promise<void> {
       throw new Error('CODEX_SANDBOX_CONTROLLER_MODEL_POLICY_INVALID');
     }
     const exitCode = await runCodexSandboxController({
-      taskId,
-      taskRef,
       executorModel: parsed.values['--executor-model'],
       executorReasoningEffort: parsed.values['--executor-reasoning-effort'],
       reviewerModel: parsed.values['--reviewer-model'],

package/lib/internal/git-workflow.ts

@@ -1,7 +1,8 @@
 import fs from 'node:fs';
-import { commitExplicitPaths, inspectGitWorkflow, pushGitRefs, pushRebasedBranch } from '../git/workflow.ts';
+import { inspectGitWorkflow, pushRebasedBranch } from '../git/workflow.ts';
 import { compareReviewTrees, snapshotReview } from '../git/review-snapshot.ts';
 import { resolvePostReviewGlobs } from '../task/review-fingerprint.ts';
+import { executeCommitOperation } from '../task/commit-operation.ts';
 
 function output(value: unknown): void { process.stdout.write(`${JSON.stringify(value)}\n`); }
 
@@ -18,11 +19,9 @@ function gitWorkflow(args: string[] = []): void {
   else if (action === 'commit') {
     const inputIndex = rest.indexOf('--input');
     const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1]!, 'utf8')) : null;
-    result = input ? commitExplicitPaths({ cwd: cwd ?? process.cwd(), ...input }) : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
-  } else if (action === 'push') {
-    const inputIndex = rest.indexOf('--input');
-    const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1]!, 'utf8')) : null;
-    result = input ? pushGitRefs({ cwd: cwd ?? process.cwd(), ...input }) : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
+    result = input
+      ? executeCommitOperation({ cwd: cwd ?? process.cwd(), ...input })
+      : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
   } else if (action === 'push-rebased') {
     const inputIndex = rest.indexOf('--input');
     const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1]!, 'utf8')) : null;

package/lib/internal/platform-pr.ts

@@ -17,13 +17,13 @@ const USAGE = `Usage: agent-infra-internal platform-pr inspect <task-ref> [--cwd
        agent-infra-internal platform-pr resolve-external <task-ref> --agent <agent> [--pr <N>] [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr create <task-ref> --agent <agent> --base <branch> --head <branch> --title-file <path|-> --body-file <path|-> [--draft] [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr bind <task-ref> --pr <N> --agent <agent> [--dry-run] [--cwd <path>]
-       agent-infra-internal platform-pr sync <task-ref> --agent <agent> [--metadata] [--closing-issue] [--dry-run] [--cwd <path>]
+       agent-infra-internal platform-pr sync <task-ref> --agent <agent> [--metadata] [--closing-issue] --result <pr_created|pr_reused|no_op> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr summary-context <task-ref> [--cwd <path>]
-       agent-infra-internal platform-pr summary-sync <task-ref> --agent <agent> --body-file <path|-> [--dry-run] [--cwd <path>]
+       agent-infra-internal platform-pr summary-sync <task-ref> --agent <agent> --body-file <path|-> --result <pr_created|pr_reused|no_op> [--dry-run] [--cwd <path>]
 `;
 
 const BOOLEAN_FLAGS = new Set(['--draft', '--dry-run', '--metadata', '--closing-issue']);
-const VALUE_FLAGS = new Set(['--cwd', '--agent', '--base', '--head', '--title-file', '--body-file', '--pr']);
+const VALUE_FLAGS = new Set(['--cwd', '--agent', '--base', '--head', '--title-file', '--body-file', '--pr', '--result']);
 
 function key(flag: string): string {
   return flag.slice(2).replace(/-([a-z])/g, (_, letter: string) => letter.toUpperCase());
@@ -76,9 +76,9 @@ function platformPr(args: string[] = []): void {
     'resolve-external': ['cwd', 'agent', 'pr', 'dryRun'],
     create: ['cwd', 'agent', 'base', 'head', 'titleFile', 'bodyFile', 'draft', 'dryRun'],
     bind: ['cwd', 'agent', 'pr', 'dryRun'],
-    sync: ['cwd', 'agent', 'metadata', 'closingIssue', 'dryRun'],
+    sync: ['cwd', 'agent', 'metadata', 'closingIssue', 'result', 'dryRun'],
     'summary-context': ['cwd'],
-    'summary-sync': ['cwd', 'agent', 'bodyFile', 'dryRun']
+    'summary-sync': ['cwd', 'agent', 'bodyFile', 'result', 'dryRun']
   };
   const unexpected = Object.keys(values).find((name) => !allowed[operation]!.includes(name));
   if (unexpected) { fail(`${operation} does not accept --${unexpected}`); return; }
@@ -88,6 +88,11 @@ function platformPr(args: string[] = []): void {
   const agent = normalizeAgentToken(values.agent);
   if (!agent) { fail(`invalid --agent '${values.agent}': ${AGENT_USAGE_HINT}`); return; }
   values.agent = agent;
+  const primaryResult = values.result === undefined ? undefined : values.result;
+  if (primaryResult !== undefined && !['pr_created', 'pr_reused', 'no_op'].includes(primaryResult as string)) {
+    fail('--result must be pr_created, pr_reused, or no_op');
+    return;
+  }
   if (operation === 'resolve-external') {
     const pr = values.pr === undefined ? undefined : Number(values.pr);
     if (pr !== undefined && (!Number.isInteger(pr) || pr <= 0)) { fail('resolve-external requires a positive --pr'); return; }
@@ -102,13 +107,15 @@ function platformPr(args: string[] = []): void {
   }
   if (operation === 'sync') {
     if (values.metadata !== true && values.closingIssue !== true) { fail('sync requires --metadata or --closing-issue'); return; }
-    finish(syncPlatformPullRequest(taskRef, { cwd, agent: values.agent, metadata: values.metadata === true, closingIssue: values.closingIssue === true, dryRun: values.dryRun === true }));
+    if (!primaryResult) { fail('sync requires --result pr_created, pr_reused, or no_op'); return; }
+    finish(syncPlatformPullRequest(taskRef, { cwd, agent: values.agent, metadata: values.metadata === true, closingIssue: values.closingIssue === true, primaryResult: primaryResult as 'pr_created' | 'pr_reused' | 'no_op', dryRun: values.dryRun === true }));
     return;
   }
   if (operation === 'summary-sync') {
     if (typeof values.bodyFile !== 'string') { fail('summary-sync requires --body-file'); return; }
+    if (!primaryResult) { fail('summary-sync requires --result pr_created, pr_reused, or no_op'); return; }
     try {
-      finish(syncPullRequestSummary(taskRef, { cwd, agent: values.agent, body: readFile(values.bodyFile, cwd), dryRun: values.dryRun === true }));
+      finish(syncPullRequestSummary(taskRef, { cwd, agent: values.agent, body: readFile(values.bodyFile, cwd), primaryResult: primaryResult as 'pr_created' | 'pr_reused' | 'no_op', dryRun: values.dryRun === true }));
     } catch (error) {
       fail(`unable to read body file: ${error instanceof Error ? error.message : String(error)}`);
     }

package/lib/internal/release-workflow.ts

@@ -25,12 +25,13 @@ type DemoResult = {
   outputPath: string | null;
 };
 
+// The tape is the canonical init interaction contract. Do not hash all of
+// lib/init.ts: non-visual config serialization changes must not re-record it.
 const DEMO_INPUT_PATHS = [
   'assets/demo-init.tape',
   'scripts/demo-regen.sh',
   'scripts/normalize-gif-duration.py',
   'bin/cli.ts',
-  'lib/init.ts',
   'lib/log.ts',
   'lib/prompt.ts',
   'lib/paths.ts',

package/lib/internal/sandbox-control.ts

@@ -1,6 +1,84 @@
-import { requestSandboxControl, SandboxControlClientError } from '../sandbox/control/client.ts';
+import {
+  requestSandboxControl,
+  requestSandboxTaskFinalization,
+  requestSandboxTaskControl,
+  SandboxControlClientError
+} from '../sandbox/control/client.ts';
+import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.ts';
 import { serveSandboxControl } from '../sandbox/control/server.ts';
 import { runSandboxControlExecutor } from '../sandbox/control/executor.ts';
+import {
+  controllerProofFromContext,
+  verifyCodexSandboxControllerContextWithWarnings
+} from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.ts';
+
+function isCanonicalCodexPrepare(args: readonly string[]): boolean {
+  if (args[1] !== 'prepare') return false;
+  const clients: string[] = [];
+  for (let index = 2; index < args.length; index += 1) {
+    if (args[index] === '--client') clients.push(args[index + 1] ?? '');
+    else if (args[index]?.startsWith('--client=')) clients.push(args[index]!.slice('--client='.length));
+  }
+  return clients.length === 1 && clients[0] === 'codex';
+}
+
+type FinalizationStatus = 'completed' | 'failed' | 'blocked' | 'unknown';
+
+function writeFinalizationEnvelope(
+  status: FinalizationStatus,
+  accepted: boolean,
+  error: { code: string; message: string; retryable: boolean },
+  changed = false,
+  result: unknown = null
+): void {
+  process.stdout.write(`${JSON.stringify({ version: 1, status, changed, accepted, result, error })}\n`);
+}
+
+function finalizationErrorStatus(error: { retryable: boolean; code: string }): FinalizationStatus {
+  if (error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') return 'unknown';
+  return error.retryable ? 'blocked' : 'failed';
+}
+
+function sandboxFinalizationClient(args: string[]): void {
+  if (args.length !== 4 || !args[0] || args[1] !== 'complete' || args[2] !== '--agent' || !args[3]) {
+    const error = { code: 'TASK_FINALIZATION_PAYLOAD_INVALID', message: 'task ref, complete intent, and --agent are required', retryable: false };
+    writeFinalizationEnvelope('failed', false, error);
+    process.stderr.write('Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n');
+    process.exitCode = 1;
+    return;
+  }
+  const agent = normalizeAgentToken(args[3]);
+  if (!agent) {
+    const error = { code: 'TASK_FINALIZATION_PAYLOAD_INVALID', message: `invalid --agent: ${AGENT_USAGE_HINT}`, retryable: false };
+    writeFinalizationEnvelope('failed', false, error);
+    process.exitCode = 1;
+    return;
+  }
+  let response;
+  try {
+    response = requestSandboxTaskFinalization({ agent });
+  } catch (error) {
+    if (!(error instanceof SandboxControlClientError)) throw error;
+    writeFinalizationEnvelope(finalizationErrorStatus(error.detail), error.accepted, error.detail);
+    process.stderr.write(`${error.detail.message}\n`);
+    process.exitCode = error.detail.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 1 : error.detail.retryable ? 2 : 1;
+    return;
+  }
+  if (response.phase === 'rejected') {
+    const error = response.error ?? {
+      code: 'SANDBOX_CONTROL_REJECTED',
+      message: 'sandbox control rejected the finalization request',
+      retryable: false
+    };
+    writeFinalizationEnvelope(finalizationErrorStatus(error), error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN', error);
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = error.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN' ? 1 : error.retryable ? 2 : 1;
+    return;
+  }
+  process.stdout.write(response.stdout);
+  process.stderr.write(response.stderr);
+  process.exitCode = response.exitCode ?? 1;
+}
 
 async function sandboxControl(args: string[]): Promise<void> {
   const [operation, ...rest] = args;
@@ -31,9 +109,21 @@ async function sandboxControl(args: string[]): Promise<void> {
   }
   if (operation === 'client') {
     const [family = '', ...commandArgs] = rest;
+    if (family === 'task-finalization') {
+      sandboxFinalizationClient(commandArgs);
+      return;
+    }
     let response;
     try {
-      response = requestSandboxControl({ family, args: commandArgs });
+      if (family === 'task-orchestration' && isCanonicalCodexPrepare(commandArgs)) {
+        const contextPath = process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
+        const proof = contextPath
+          ? controllerProofFromContext(verifyCodexSandboxControllerContextWithWarnings(contextPath).context)
+          : null;
+        response = requestSandboxTaskControl({ family, args: commandArgs, controllerProof: proof });
+      } else {
+        response = requestSandboxControl({ family, args: commandArgs });
+      }
     } catch (error) {
       if (!(error instanceof SandboxControlClientError)) throw error;
       process.stderr.write(`${error.detail.message}\n`);

package/lib/internal/task-finalization.ts

@@ -0,0 +1,68 @@
+import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.ts';
+import { applyTaskFinalization } from '../task/finalization.ts';
+import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.ts';
+import { verifyTaskEvent } from '../task/verification.ts';
+
+const USAGE = 'Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n';
+
+type FinalizationError = Readonly<{ code: string; message: string; retryable: boolean }>;
+
+function envelope(
+  status: 'completed' | 'failed' | 'blocked' | 'unknown',
+  changed: boolean,
+  accepted: boolean,
+  result: ReturnType<typeof applyTaskFinalization> | null,
+  error: FinalizationError | null
+): string {
+  return `${JSON.stringify({ version: 1, status, changed, accepted, result, error })}\n`;
+}
+
+function exitCode(status: 'completed' | 'failed' | 'blocked' | 'unknown'): number {
+  return status === 'completed' ? 0 : status === 'blocked' ? 2 : 1;
+}
+
+function fail(message: string): void {
+  const error = { code: 'TASK_FINALIZATION_PAYLOAD_INVALID', message, retryable: false };
+  process.stdout.write(envelope('failed', false, false, null, error));
+  process.stderr.write(USAGE);
+  process.exitCode = 1;
+}
+
+function taskFinalization(args: string[] = []): void {
+  if (args[0] === '--help' || args[0] === '-h') { process.stdout.write(USAGE); return; }
+  if (args.length !== 4 || !args[0] || args[1] !== 'complete' || args[2] !== '--agent' || !args[3]) {
+    fail('task ref, complete intent, and --agent are required');
+    return;
+  }
+  const agent = normalizeAgentToken(args[3]);
+  if (!agent) {
+    fail(`invalid --agent: ${AGENT_USAGE_HINT}`);
+    return;
+  }
+  let repoRoot: string;
+  try {
+    repoRoot = detectRepoRoot();
+  } catch (error) {
+    const detail = { code: 'REPO_ROOT_NOT_FOUND', message: error instanceof Error ? error.message : String(error), retryable: false };
+    process.stdout.write(envelope('failed', false, true, null, detail));
+    process.exitCode = 1;
+    return;
+  }
+  const resolved = resolveTaskRef(args[0], { repoRoot });
+  if (!resolved.ok) {
+    const detail = { code: resolved.code, message: resolved.message, retryable: false };
+    process.stdout.write(envelope('failed', false, true, null, detail));
+    process.exitCode = 1;
+    return;
+  }
+  const result = applyTaskFinalization(
+    { taskRef: resolved.taskId, intent: 'complete', agent },
+    { repoRoot, preflight: (request, options) => verifyTaskEvent(
+      { ...request, event: 'complete-task.hard-preflight' }, options
+    ) }
+  );
+  process.stdout.write(envelope(result.status, result.changed, true, result, result.error));
+  process.exitCode = exitCode(result.status);
+}
+
+export { taskFinalization };

package/lib/internal/task-orchestration.ts

@@ -1,31 +1,23 @@
-import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.ts';
 import {
-  abortCommitIntent,
   activateMatchingOrchestrationDelegation,
   activateOrchestrationDelegation,
   advanceOrchestration,
   awaitOrchestrationDelegationActivation,
-  beginCommitIntent,
   beginOrResumeOrchestration,
-  checkpointCommitIntent,
-  completeCommitIntent,
   dispatchOrchestrationDelegation,
+  OrchestrationStateError,
   pauseOrchestration,
-  recoverCommitIntent,
   recoverPreparedOrchestrationDelegation,
   routeOrchestration,
   sealMatchingOrchestrationDelegation,
   sealOrchestrationDelegation,
-  startCommitAttempt,
-  statusCommitIntent,
-  statusOrchestration,
-  terminateCommitAttempt
+  statusOrchestration
 } from '../task/orchestration.ts';
 import { prepareCodexOrchestrationDelegation } from '../task/codex-orchestration.ts';
 import { isAgentClientId } from '../agent-clients/types.ts';
 import type { AgentClientId } from '../agent-clients/types.ts';
 
-const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|dispatch|await-activation|recover-prepared|hook-start|hook-stop|advance|pause|status|commit-start|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-terminate|commit-status> [options]\n';
+const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|dispatch|await-activation|recover-prepared|hook-start|hook-stop|advance|pause|status> [options]\n';
 
 function usageFailure(message: string): void {
   process.stdout.write(`${JSON.stringify({
@@ -48,23 +40,15 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
   const [taskRef, intent] = args;
   if (![
     'begin-or-resume', 'route', 'prepare', 'dispatch', 'await-activation', 'recover-prepared',
-    'hook-start', 'hook-stop', 'advance', 'pause', 'status',
-    'commit-start', 'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-terminate', 'commit-status'
+    'hook-start', 'hook-stop', 'advance', 'pause', 'status'
   ].includes(intent!)) {
     usageFailure(`unknown intent '${intent}'`);
     return;
   }
   const values: Record<string, string> = {};
   const seen = new Set<string>();
-  let orchestrated = false;
   for (let index = 2; index < args.length; index += 1) {
     const flag = args[index]!;
-    if (flag === '--orchestrated') {
-      if (seen.has(flag)) { usageFailure(`duplicate option '${flag}'`); return; }
-      seen.add(flag);
-      orchestrated = true;
-      continue;
-    }
     if (![
       '--max-steps', '--executor-model', '--executor-reasoning-effort',
       '--reviewer-model', '--reviewer-reasoning-effort',
@@ -74,8 +58,7 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
       '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--actual-reasoning-effort',
       '--model-fallback-reason', '--reasoning-effort-fallback-reason',
       '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent',
-      '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
-      , '--attempt', '--git-worktree-root'
+      '--git-worktree-root'
     ].includes(flag)) {
       usageFailure(`unknown option '${flag}'`);
       return;
@@ -92,26 +75,6 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
     }
     values[flag] = value;
   }
-  const commitIntentFlags: Record<string, readonly string[]> = {
-    'commit-start': ['--agent', '--git-worktree-root'],
-    'commit-begin': ['--agent', '--baseline-head', '--attempt', '--orchestrated', '--git-worktree-root'],
-    'commit-checkpoint': ['--token', '--kind', '--head', '--remote', '--ref', '--git-worktree-root'],
-    'commit-complete': ['--token', '--agent', '--git-worktree-root'],
-    'commit-recover': ['--agent', '--git-worktree-root'],
-    'commit-abort': ['--token', '--expected-head', '--git-worktree-root'],
-    'commit-terminate': ['--attempt', '--agent', '--code', '--git-worktree-root'],
-    'commit-status': ['--git-worktree-root']
-  };
-  if (intent! in commitIntentFlags) {
-    const allowed = commitIntentFlags[intent!]!;
-    const invalid = [...seen].find((flag) => !allowed.includes(flag));
-    if (invalid) { usageFailure(`intent '${intent}' does not accept '${invalid}'`); return; }
-  } else {
-    const commitOnly = [...seen].find((flag) => [
-      '--orchestrated', '--baseline-head', '--attempt', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
-    ].includes(flag));
-    if (commitOnly) { usageFailure(`intent '${intent}' does not accept '${commitOnly}'`); return; }
-  }
   const requireValues = (flags: string[]) => flags.find((flag) => values[flag] === undefined);
   const coreOptions = values['--git-worktree-root'] === undefined
     ? {}
@@ -121,66 +84,8 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
     return;
   }
   let result;
-  if (intent === 'commit-start') {
-    const missing = requireValues(['--agent']);
-    if (missing) { usageFailure(`intent 'commit-start' requires '${missing}'`); return; }
-    const agent = normalizeAgentToken(values['--agent']!);
-    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    result = startCommitAttempt(taskRef!, { agent }, coreOptions);
-  } else if (intent === 'commit-begin') {
-    const missing = requireValues(['--agent', '--baseline-head', '--attempt']);
-    if (missing) { usageFailure(`intent 'commit-begin' requires '${missing}'`); return; }
-    const agent = normalizeAgentToken(values['--agent']!);
-    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    result = beginCommitIntent(taskRef!, {
-      agent, orchestrated, baselineHead: values['--baseline-head']!, attempt: values['--attempt']!
-    }, coreOptions);
-  } else if (intent === 'commit-checkpoint') {
-    const missing = requireValues(['--token', '--kind', '--head']);
-    if (missing) { usageFailure(`intent 'commit-checkpoint' requires '${missing}'`); return; }
-    if (!['committed', 'pushed'].includes(values['--kind']!)) {
-      usageFailure('--kind must be committed or pushed'); return;
-    }
-    if (values['--kind'] === 'pushed') {
-      const pushedMissing = requireValues(['--remote', '--ref']);
-      if (pushedMissing) { usageFailure(`pushed checkpoint requires '${pushedMissing}'`); return; }
-    } else if (values['--remote'] !== undefined || values['--ref'] !== undefined) {
-      usageFailure('committed checkpoint does not accept --remote or --ref'); return;
-    }
-    result = checkpointCommitIntent(taskRef!, {
-      token: values['--token']!, kind: values['--kind'] as 'committed' | 'pushed',
-      head: values['--head']!, remote: values['--remote'], ref: values['--ref']
-    }, coreOptions);
-  } else if (intent === 'commit-complete') {
-    const missing = requireValues(['--token', '--agent']);
-    if (missing) { usageFailure(`intent 'commit-complete' requires '${missing}'`); return; }
-    const agent = normalizeAgentToken(values['--agent']!);
-    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    result = completeCommitIntent(taskRef!, { token: values['--token']!, agent }, coreOptions);
-  } else if (intent === 'commit-recover') {
-    const missing = requireValues(['--agent']);
-    if (missing) { usageFailure(`intent 'commit-recover' requires '${missing}'`); return; }
-    const agent = normalizeAgentToken(values['--agent']!);
-    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    result = recoverCommitIntent(taskRef!, { agent }, coreOptions);
-  } else if (intent === 'commit-abort') {
-    const missing = requireValues(['--token', '--expected-head']);
-    if (missing) { usageFailure(`intent 'commit-abort' requires '${missing}'`); return; }
-    result = abortCommitIntent(taskRef!, { token: values['--token']!, expectedHead: values['--expected-head']! }, coreOptions);
-  } else if (intent === 'commit-terminate') {
-    const missing = requireValues(['--attempt', '--agent', '--code']);
-    if (missing) { usageFailure(`intent 'commit-terminate' requires '${missing}'`); return; }
-    const agent = normalizeAgentToken(values['--agent']!);
-    if (!agent) { usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`); return; }
-    if (!/^[A-Z][A-Z0-9_]{2,63}$/.test(values['--code']!)) {
-      usageFailure('--code must be a stable uppercase identifier'); return;
-    }
-    result = terminateCommitAttempt(taskRef!, {
-      attempt: values['--attempt']!, agent, code: values['--code']!
-    }, coreOptions);
-  } else if (intent === 'commit-status') {
-    result = statusCommitIntent(taskRef!, coreOptions);
-  } else if (intent === 'begin-or-resume') {
+  try {
+  if (intent === 'begin-or-resume') {
     const missing = requireValues(['--client']);
     if (missing) { usageFailure(`intent 'begin-or-resume' requires '${missing}'`); return; }
     const maxSteps = values['--max-steps'] === undefined ? undefined : Number(values['--max-steps']);
@@ -295,7 +200,19 @@ async function taskOrchestration(args: string[] = []): Promise<void> {
     if (!['true', 'false'].includes(values['--recoverable']!)) { usageFailure('--recoverable must be true or false'); return; }
     result = pauseOrchestration(taskRef!, values['--code']!, values['--message']!, values['--recoverable'] === 'true', coreOptions);
   }
-  process.stdout.write(`${JSON.stringify(result)}\n`);
+  } catch (error) {
+    if (!(error instanceof OrchestrationStateError)) throw error;
+    result = {
+      status: 'failed' as const,
+      changed: false,
+      taskId: error.taskId,
+      run: null,
+      next: null,
+      error: { code: error.code, message: error.message }
+    };
+  }
+  const output = result;
+  process.stdout.write(`${JSON.stringify(output)}\n`);
   if (result.status === 'failed') process.exitCode = 1;
 }