@fitlab-ai/agent-infra 0.9.8 → 0.9.10

package/dist/lib/sandbox/control/lifecycle.js

@@ -82,7 +82,7 @@ function readStartupOwner(filePath) {
 async function waitForStartupTransition(root, timeoutMs, identityProbe = getProcessIdentityState) {
     const transitionPath = path.join(root, BROKER_STARTING_FILE);
     const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline) {
+    while (true) {
         const transition = readStartupOwner(transitionPath);
         if (!fs.existsSync(transitionPath))
             return;
@@ -96,6 +96,8 @@ async function waitForStartupTransition(root, timeoutMs, identityProbe = getProc
             }
             continue;
         }
+        if (Date.now() >= deadline)
+            break;
         await new Promise((resolve) => setTimeout(resolve, 25));
     }
     throw new Error('SANDBOX_CONTROL_BROKER_START_TRANSITION');

package/dist/lib/sandbox/control/protocol.js

@@ -1,10 +1,11 @@
 import { validateTaskCreateCandidate } from '../../task/create.js';
+import { normalizeAgentToken } from '../../agent-clients/tokens.js';
 export const SANDBOX_CONTROL_MAX_BYTES = 64 * 1024;
 export const SANDBOX_CONTROL_ADMISSION_WINDOW_MS = 2_000;
 export const SANDBOX_CONTROL_STATUS_INTERVAL_MS = 250;
 export const SANDBOX_CONTROL_STATUS_STALE_MS = 1_500;
 export const SANDBOX_CONTROL_FUTURE_SKEW_MS = 1_000;
-export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-orchestration', 'task-create'];
+export const SANDBOX_CONTROL_FAMILIES = ['task-lifecycle', 'task-orchestration', 'task-finalization', 'task-create', 'codex-controller'];
 export const DEFAULT_SANDBOX_CONTROL_TIMING = Object.freeze({
     controlTickMs: 250,
     parkedBindingInitialMs: 1_000,
@@ -33,7 +34,7 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request must be an object');
     }
     const request = value;
-    if (request.version !== 2 || typeof request.id !== 'string'
+    if (request.version !== 3 || typeof request.id !== 'string'
         || !/^[a-f0-9-]{16,64}$/.test(request.id) || request.token !== manifest.token
         || typeof request.family !== 'string' || !isSandboxControlFamily(request.family)
         || !Number.isSafeInteger(request.issuedAt) || !Number.isSafeInteger(request.expiresAt))
@@ -53,13 +54,47 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         fail('SANDBOX_CONTROL_REQUEST_TOO_LARGE', 'request exceeds the control limit');
     }
     if (request.family === 'task-create') {
-        const expected = ['candidate', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+        const expected = ['candidate', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
         if (Object.keys(request).sort().join(',') !== expected.sort().join(',')) {
             fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
         }
+        if (request.controllerProcess !== null || request.controllerProof !== null) {
+            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-create cannot carry controller authority');
+        }
         return { ...request, candidate: validateTaskCreateCandidate(request.candidate) };
     }
-    const expected = ['args', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+    if (request.family === 'codex-controller') {
+        const expected = ['args', 'command', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
+        if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
+            || !Array.isArray(request.args) || request.args.length !== 0
+            || !['open', 'close', 'verify'].includes(request.command)
+            || !validControllerProcess(request.controllerProcess)
+            || (request.command === 'open' && request.controllerProof !== null)
+            || (request.command !== 'open' && !validControllerProof(request.controllerProof))
+            || (request.command === 'verify'
+                && JSON.stringify(request.controllerProcess) !== JSON.stringify(request.controllerProof.controllerProcess))) {
+            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'controller request schema is invalid');
+        }
+        if (manifest.mode !== 'task-bound' || !manifest.taskId) {
+            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot register a Codex controller');
+        }
+        return request;
+    }
+    if (request.family === 'task-finalization') {
+        const expected = ['agent', 'args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'operation', 'token', 'version'];
+        if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
+            || request.operation !== 'complete'
+            || !Array.isArray(request.args) || request.args.length !== 0
+            || typeof request.agent !== 'string' || normalizeAgentToken(request.agent) !== request.agent
+            || request.controllerProcess !== null || request.controllerProof !== null) {
+            fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-finalization request schema or authorization is invalid');
+        }
+        if (manifest.mode !== 'task-bound' || !manifest.taskId) {
+            fail('SANDBOX_CONTROL_BRANCH_ONLY', 'branch-only sandboxes cannot finalize tasks');
+        }
+        return request;
+    }
+    const expected = ['args', 'controllerProcess', 'controllerProof', 'expiresAt', 'family', 'generation', 'id', 'issuedAt', 'token', 'version'];
     if (Object.keys(request).sort().join(',') !== expected.sort().join(',')
         || !Array.isArray(request.args) || !request.args.every((arg) => typeof arg === 'string')) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'request schema or authorization is invalid');
@@ -71,15 +106,41 @@ export function validateSandboxControlRequest(value, manifest, options = {}) {
         && request.args.some((arg) => arg === '--git-worktree-root' || arg.startsWith('--git-worktree-root='))) {
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'worktree binding is reserved for the control broker');
     }
+    if (request.controllerProcess !== null
+        || (request.controllerProof !== null && !validControllerProof(request.controllerProof))) {
+        fail('SANDBOX_CONTROL_REQUEST_INVALID', 'controller authority is invalid');
+    }
+    if (request.family !== 'task-orchestration' && request.controllerProof !== null) {
+        fail('SANDBOX_CONTROL_REQUEST_INVALID', 'controller proof is not allowed for this family');
+    }
     return request;
 }
 export function bindSandboxControlTask(request, taskId) {
-    if (request.family === 'task-create')
-        fail('SANDBOX_CONTROL_REQUEST_INVALID', 'task-create requests do not bind a current task');
+    if (request.family === 'task-create' || request.family === 'codex-controller' || request.family === 'task-finalization') {
+        fail('SANDBOX_CONTROL_REQUEST_INVALID', `${request.family} requests do not bind a current task`);
+    }
     if (request.args.length === 0)
         fail('SANDBOX_CONTROL_REQUEST_INVALID', 'command arguments are required');
     return [taskId, ...request.args.slice(1)];
 }
+function validControllerProcess(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const processValue = value;
+    return Object.keys(processValue).sort().join(',') === 'pid,startTime'
+        && Number.isSafeInteger(processValue.pid) && processValue.pid > 0
+        && Number.isSafeInteger(processValue.startTime) && processValue.startTime >= 0;
+}
+function validControllerProof(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const proof = value;
+    return Object.keys(proof).sort().join(',') === 'controllerProcess,leaseId,leaseSecret,version'
+        && proof.version === 1
+        && typeof proof.leaseId === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseId)
+        && typeof proof.leaseSecret === 'string' && /^[a-f0-9]{64}$/u.test(proof.leaseSecret)
+        && validControllerProcess(proof.controllerProcess);
+}
 export function controlError(error) {
     if (error instanceof SandboxControlProtocolError) {
         return { code: error.code, message: error.message, retryable: error.retryable };

package/dist/lib/sandbox/index.js

@@ -15,9 +15,11 @@ Commands:
   rebuild [--quiet] [--refresh]
                                Rebuild the sandbox image (--refresh pulls base + tools)
   refresh                      Sync host Claude Code credentials to all sandbox copies
-  rm <branch> | --unbound | --purge
-                               Remove one sandbox, all sandboxes not bound to an
-                               active task (--unbound), or tear down everything (--purge)
+  rm <branch | TASK-id> | --unbound | --purge
+                               Remove one sandbox; use a full TASK-id for task-bound
+                               cleanup and a branch for branch-only cleanup. --unbound
+                               removes completed task-bound and branch-only sandboxes;
+                               active, blocked, and archive tasks are protected.
   start [--recreate] <branch | TASK-id | N>
                                Verify or recover an existing sandbox container;
                                optionally replace only the container on failure

package/dist/lib/sandbox/managed-fs.js

@@ -21,6 +21,11 @@ export function removeWorktreeDir(repoRoot, worktreeBase, dir, permit, { runFn =
         throw new Error(`Worktree permit target mismatch: ${dir}`);
     }
     verifyWorktreePermit(permit);
+    if (permit.snapshot.source === 'recovered') {
+        removeManagedDir(worktreeBase, dir);
+        runSafeFn('git', ['-C', repoRoot, 'worktree', 'prune']);
+        return;
+    }
     try {
         runFn('git', ['-C', repoRoot, 'worktree', 'remove', dir, '--force']);
     }

package/dist/lib/sandbox/task-resolver.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { isRemovedHashShortIdInput } from '../task/short-id.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 const SHORT_ID_RE = /^\d+$/;
-const WORKSPACE_DIRS = ['active', 'completed', 'blocked', 'archive'];
+export const TASK_WORKSPACE_STATES = ['active', 'completed', 'blocked', 'archive'];
 function resolveShortIdStrict(arg, repoRoot) {
     const scriptPath = path.join(repoRoot, '.agents', 'scripts', 'task-short-id.js');
     if (!fs.existsSync(scriptPath)) {
@@ -20,14 +20,28 @@ function stripQuotes(value) {
     return value.replace(/^(["'])(.*)\1$/, '$2');
 }
 function readTaskContent(repoRoot, taskId) {
-    for (const dir of WORKSPACE_DIRS) {
-        const taskPath = path.join(repoRoot, '.agents', 'workspace', dir, taskId, 'task.md');
+    for (const state of TASK_WORKSPACE_STATES) {
+        const taskPath = path.join(repoRoot, '.agents', 'workspace', state, taskId, 'task.md');
         if (fs.existsSync(taskPath)) {
-            return fs.readFileSync(taskPath, 'utf8');
+            return { content: fs.readFileSync(taskPath, 'utf8'), state, taskMd: taskPath };
         }
     }
     throw new Error(`Task not found: ${taskId}`);
 }
+function taskWorkspaceCandidates(repoRoot, taskId) {
+    return TASK_WORKSPACE_STATES.flatMap((state) => {
+        const taskMd = path.join(repoRoot, '.agents', 'workspace', state, taskId, 'task.md');
+        if (!fs.existsSync(taskMd))
+            return [];
+        const content = fs.readFileSync(taskMd, 'utf8');
+        return [{
+                taskId,
+                branch: resolveBranchFromTaskContent(content, taskId),
+                state,
+                taskMd
+            }];
+    });
+}
 function resolveBranchFromTaskContent(content, taskId) {
     const frontmatterBranch = content.match(/^branch:\s*(.+)$/m);
     if (frontmatterBranch?.[1]?.trim()) {
@@ -45,13 +59,43 @@ export function resolveTaskBranch(arg, repoRoot) {
     }
     if (SHORT_ID_RE.test(arg)) {
         const taskId = resolveShortIdStrict(arg, repoRoot);
-        const content = readTaskContent(repoRoot, taskId);
+        const { content } = readTaskContent(repoRoot, taskId);
         return resolveBranchFromTaskContent(content, taskId);
     }
     if (!TASK_ID_RE.test(arg)) {
         return arg;
     }
-    const content = readTaskContent(repoRoot, arg);
+    const { content } = readTaskContent(repoRoot, arg);
     return resolveBranchFromTaskContent(content, arg);
 }
+export function resolveTaskWorkspace(taskId, repoRoot) {
+    if (!TASK_ID_RE.test(taskId))
+        throw new Error(`Invalid task id: ${taskId}`);
+    const matches = taskWorkspaceCandidates(repoRoot, taskId);
+    if (matches.length === 0)
+        throw new Error(`Task not found: ${taskId}`);
+    if (matches.length !== 1) {
+        throw new Error(`SANDBOX_TASK_STATE_AMBIGUOUS: task ${taskId} exists in ${matches.map((match) => match.state).join(', ')}`);
+    }
+    return matches[0];
+}
+export function listTaskWorkspaces(repoRoot, state) {
+    const stateRoot = path.join(repoRoot, '.agents', 'workspace', state);
+    if (!fs.existsSync(stateRoot))
+        return [];
+    return fs.readdirSync(stateRoot, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && TASK_ID_RE.test(entry.name))
+        .flatMap((entry) => {
+        const taskMd = path.join(stateRoot, entry.name, 'task.md');
+        if (!fs.existsSync(taskMd))
+            return [];
+        const content = fs.readFileSync(taskMd, 'utf8');
+        return [{
+                taskId: entry.name,
+                branch: resolveBranchFromTaskContent(content, entry.name),
+                state,
+                taskMd
+            }];
+    });
+}
 //# sourceMappingURL=task-resolver.js.map

package/dist/lib/sandbox/workspace-identity.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { isRemovedHashShortIdInput } from '../task/short-id.js';
+import { resolveTaskWorkspace } from './task-resolver.js';
 const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
 const SHORT_ID_RE = /^\d+$/;
 function stripQuotes(value) {
@@ -78,6 +79,32 @@ export function resolveSandboxTarget(requestedRef, repoRoot) {
     }
     return { requestedRef, branch: requestedRef, workspace: { mode: 'branch-only' } };
 }
+export function resolveSandboxCleanupTarget(requestedRef, repoRoot, options = {}) {
+    if (isRemovedHashShortIdInput(requestedRef)) {
+        throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
+    }
+    if (TASK_ID_RE.test(requestedRef)) {
+        const task = resolveTaskWorkspace(requestedRef, repoRoot);
+        if (!options.allowProtected && (task.state === 'blocked' || task.state === 'archive')) {
+            throw new Error(`SANDBOX_CLEANUP_STATE_UNSUPPORTED: task ${requestedRef} is ${task.state}`);
+        }
+        return {
+            requestedRef,
+            branch: task.branch,
+            workspace: { mode: 'task-bound', taskId: task.taskId },
+            taskState: task.state
+        };
+    }
+    const target = resolveSandboxTarget(requestedRef, repoRoot);
+    return {
+        requestedRef,
+        branch: target.branch,
+        workspace: target.workspace.mode === 'task-bound'
+            ? { mode: 'task-bound', taskId: target.workspace.taskId }
+            : { mode: 'branch-only' },
+        taskState: target.workspace.mode === 'task-bound' ? 'active' : 'branch-only'
+    };
+}
 export function parseSandboxWorkspaceIdentity(labels, keys) {
     const mode = labels[keys.mode];
     const taskId = labels[keys.taskId];

package/dist/lib/sandbox/worktree-safety.js

@@ -1,7 +1,9 @@
 import { createHash } from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { runProbe } from './shell.js';
+import { resolveSandboxTarget } from './workspace-identity.js';
 function probeText(probe, cwd, args) {
     const result = probe('git', ['-C', cwd, ...args], { encoding: 'utf8' });
     if (result.error)
@@ -138,6 +140,197 @@ function captureOnce(worktree, probe) {
     }
     return { worktree: resolvedWorktree, branch, head, changes, identity: hash.digest('hex') };
 }
+function probeTextWithEnv(probe, repoRoot, args, env) {
+    const result = probe('git', args, { cwd: repoRoot, encoding: 'utf8', env });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : result.stderr.toString('utf8').trim();
+        throw new Error(stderr || `git ${args[0] ?? 'command'} failed with exit code ${result.status ?? 'unknown'}`);
+    }
+    return typeof result.stdout === 'string' ? result.stdout : result.stdout.toString('utf8');
+}
+function probeMetadataCommand(probe, repoRoot, args, env) {
+    const result = probe('git', args, { cwd: repoRoot, encoding: 'utf8', env });
+    if (result.error)
+        throw result.error;
+    return result.status === 0;
+}
+function hasValidHeadContent(content) {
+    return /^(?:ref:\s+refs\/\S+|[0-9a-f]{40}|[0-9a-f]{64})$/i.test(content.trim());
+}
+function assertRecoverableMetadata(worktree, repoRoot, probe) {
+    const dotGit = path.join(worktree, '.git');
+    let dotGitStat;
+    try {
+        dotGitStat = fs.lstatSync(dotGit);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return;
+        throw error;
+    }
+    if (dotGitStat.isSymbolicLink() || dotGitStat.isDirectory()) {
+        throw new Error('WORKTREE_RECOVERY_METADATA_NOT_ELIGIBLE');
+    }
+    if (!dotGitStat.isFile())
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    const content = fs.readFileSync(dotGit, 'utf8').trim();
+    const match = /^gitdir:\s*(.+)$/i.exec(content);
+    if (!match)
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    const commonDir = fs.realpathSync.native(path.resolve(repoRoot, probeText(probe, repoRoot, [
+        'rev-parse', '--git-common-dir'
+    ]).trim()));
+    const adminRoot = path.join(commonDir, 'worktrees');
+    const adminPath = path.resolve(path.dirname(dotGit), match[1]);
+    const relative = path.relative(adminRoot, adminPath);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative) || relative.includes(path.sep)) {
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    }
+    if (!fs.existsSync(adminPath))
+        return;
+    const adminStat = fs.lstatSync(adminPath);
+    if (adminStat.isSymbolicLink())
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    if (!adminStat.isDirectory())
+        return;
+    const requiredFiles = ['HEAD', 'gitdir', 'commondir', 'index'];
+    if (requiredFiles.some((name) => !fs.existsSync(path.join(adminPath, name))))
+        return;
+    for (const name of requiredFiles) {
+        const filePath = path.join(adminPath, name);
+        const stat = fs.lstatSync(filePath);
+        if (stat.isSymbolicLink() || !stat.isFile())
+            throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    }
+    const adminGitdir = fs.readFileSync(path.join(adminPath, 'gitdir'), 'utf8').trim();
+    const adminCommonDir = fs.readFileSync(path.join(adminPath, 'commondir'), 'utf8').trim();
+    const adminGitdirPath = adminGitdir
+        ? fs.realpathSync.native(path.resolve(adminPath, adminGitdir))
+        : '';
+    const canonicalDotGit = fs.realpathSync.native(dotGit);
+    const adminCommonDirPath = adminCommonDir
+        ? fs.realpathSync.native(path.resolve(adminPath, adminCommonDir))
+        : '';
+    if (!adminGitdir || adminGitdirPath !== canonicalDotGit
+        || !adminCommonDir || adminCommonDirPath !== commonDir) {
+        throw new Error('WORKTREE_RECOVERY_METADATA_INVALID');
+    }
+    const headContent = fs.readFileSync(path.join(adminPath, 'HEAD'), 'utf8');
+    const indexContent = fs.readFileSync(path.join(adminPath, 'index'));
+    if (!hasValidHeadContent(headContent) || indexContent.subarray(0, 4).toString('ascii') !== 'DIRC')
+        return;
+    const validationEnv = { ...process.env };
+    for (const key of ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_INDEX_FILE', 'GIT_WORK_TREE', 'GIT_PREFIX']) {
+        delete validationEnv[key];
+    }
+    validationEnv.GIT_DIR = adminPath;
+    validationEnv.GIT_WORK_TREE = path.resolve(worktree);
+    if (!probeMetadataCommand(probe, repoRoot, ['rev-parse', '--verify', 'HEAD^{commit}'], validationEnv))
+        return;
+    if (!probeMetadataCommand(probe, repoRoot, ['ls-files', '--stage', '-z'], validationEnv))
+        return;
+    throw new Error('WORKTREE_RECOVERY_METADATA_REGISTERED');
+}
+function parseRecoveredStatus(raw) {
+    const records = raw.split('\0');
+    const changes = [];
+    for (let index = 0; index < records.length;) {
+        const status = records[index++] ?? '';
+        if (!status)
+            continue;
+        const code = status[0] ?? '';
+        if (code === 'R' || code === 'C') {
+            const originalPath = records[index++];
+            const nextPath = records[index++];
+            if (!originalPath || !nextPath)
+                throw new Error('Unable to parse recovered Git rename record');
+            changes.push({ indexStatus: code, worktreeStatus: ' ', path: nextPath, originalPath });
+            continue;
+        }
+        const filePath = records[index++];
+        if (!filePath)
+            throw new Error('Unable to parse recovered Git status record');
+        changes.push({
+            indexStatus: code === 'D' ? ' ' : code,
+            worktreeStatus: code === 'D' ? 'D' : ' ',
+            path: filePath
+        });
+    }
+    return changes;
+}
+function captureRecoveredOnce(worktree, recovery, probe) {
+    const resolvedWorktree = path.resolve(worktree);
+    const resolvedBase = path.resolve(recovery.worktreeBase);
+    const relative = path.relative(resolvedBase, resolvedWorktree);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`WORKTREE_RECOVERY_PATH_INVALID: ${resolvedWorktree}`);
+    }
+    const stat = fs.lstatSync(resolvedWorktree);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('WORKTREE_RECOVERY_PATH_INVALID');
+    const canonicalBase = fs.realpathSync.native(resolvedBase);
+    const canonicalWorktree = fs.realpathSync.native(resolvedWorktree);
+    const canonicalRelative = path.relative(canonicalBase, canonicalWorktree);
+    if (!canonicalRelative || canonicalRelative.startsWith('..') || path.isAbsolute(canonicalRelative)) {
+        throw new Error('WORKTREE_RECOVERY_PATH_INVALID');
+    }
+    const resolvedWorkspace = resolveSandboxTarget(recovery.branch, recovery.repoRoot).workspace;
+    if (recovery.identitySource === 'branch-only' && resolvedWorkspace.mode !== 'branch-only') {
+        throw new Error('WORKTREE_RECOVERY_IDENTITY_CHANGED');
+    }
+    if (recovery.identitySource === 'task-bound'
+        && (resolvedWorkspace.mode !== 'task-bound' || resolvedWorkspace.taskId !== recovery.taskId)) {
+        throw new Error('WORKTREE_RECOVERY_IDENTITY_CHANGED');
+    }
+    assertRecoverableMetadata(resolvedWorktree, recovery.repoRoot, probe);
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-infra-recovered-index-'));
+    const env = { ...process.env };
+    for (const key of ['GIT_DIR', 'GIT_COMMON_DIR', 'GIT_PREFIX'])
+        delete env[key];
+    env.GIT_INDEX_FILE = path.join(tempDir, 'index');
+    env.GIT_WORK_TREE = resolvedWorktree;
+    try {
+        const baseline = probeTextWithEnv(probe, recovery.repoRoot, [
+            'rev-parse', '--verify', `refs/heads/${recovery.branch}^{commit}`
+        ], env).trim();
+        if (!baseline)
+            throw new Error(`WORKTREE_RECOVERY_BRANCH_INVALID: ${recovery.branch}`);
+        probeTextWithEnv(probe, recovery.repoRoot, ['read-tree', baseline], env);
+        probeTextWithEnv(probe, recovery.repoRoot, ['add', '-A', '--', '.'], env);
+        const status = probeTextWithEnv(probe, recovery.repoRoot, [
+            'diff', '--cached', '--name-status', '--find-renames', '-z', '--', '.'
+        ], env);
+        const changes = parseRecoveredStatus(status);
+        const hash = createHash('sha256');
+        updatePart(hash, 'source', 'recovered');
+        updatePart(hash, 'worktree', resolvedWorktree);
+        updatePart(hash, 'repo-root', path.resolve(recovery.repoRoot));
+        updatePart(hash, 'branch', recovery.branch);
+        updatePart(hash, 'baseline', baseline);
+        updatePart(hash, 'identity-source', recovery.identitySource);
+        updatePart(hash, 'task-id', recovery.taskId ?? '');
+        updatePart(hash, 'status', status);
+        for (const change of changes) {
+            hashPath(hash, resolvedWorktree, change.path, probe);
+            if (change.originalPath)
+                hashPath(hash, resolvedWorktree, change.originalPath, probe);
+        }
+        return {
+            worktree: resolvedWorktree,
+            branch: recovery.branch,
+            head: baseline,
+            changes,
+            identity: hash.digest('hex'),
+            source: 'recovered',
+            recovery: { ...recovery }
+        };
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+}
 function inspectWorktree(worktree, { probe = runProbe } = {}) {
     const resolvedWorktree = path.resolve(worktree);
     try {
@@ -156,6 +349,24 @@ function inspectWorktree(worktree, { probe = runProbe } = {}) {
         };
     }
 }
+function inspectRecoveredWorktree(worktree, recovery, { probe = runProbe } = {}) {
+    const resolvedWorktree = path.resolve(worktree);
+    try {
+        const first = captureRecoveredOnce(resolvedWorktree, recovery, probe);
+        const second = captureRecoveredOnce(resolvedWorktree, recovery, probe);
+        if (first.identity !== second.identity) {
+            return { status: 'failed', worktree: resolvedWorktree, message: 'Snapshot changed while recovering worktree' };
+        }
+        return { status: second.changes.length === 0 ? 'clean' : 'dirty', snapshot: second };
+    }
+    catch (error) {
+        return {
+            status: 'failed',
+            worktree: resolvedWorktree,
+            message: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
 function inspectWorktrees(worktrees) {
     return [...new Set(worktrees.map((worktree) => path.resolve(worktree)))].sort()
         .map((worktree) => inspectWorktree(worktree));
@@ -171,7 +382,9 @@ function createDiscardPermit(snapshot) {
     return { mode: 'discard', snapshot };
 }
 function verifyWorktreePermit(permit, options = {}) {
-    const current = inspectWorktree(permit.snapshot.worktree, options);
+    const current = permit.snapshot.source === 'recovered' && permit.snapshot.recovery
+        ? inspectRecoveredWorktree(permit.snapshot.worktree, permit.snapshot.recovery, options)
+        : inspectWorktree(permit.snapshot.worktree, options);
     if (current.status === 'failed')
         throw new Error(`Unable to verify worktree permit: ${current.message}`);
     if (current.snapshot.identity !== permit.snapshot.identity || (permit.mode === 'clean' && current.status !== 'clean')) {
@@ -192,5 +405,5 @@ function formatWorktreeSnapshot(snapshot) {
         `Snapshot identity: ${snapshot.identity}`
     ].join('\n');
 }
-export { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectWorktree, inspectWorktrees, verifyWorktreePermit };
+export { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectRecoveredWorktree, inspectWorktree, inspectWorktrees, verifyWorktreePermit };
 //# sourceMappingURL=worktree-safety.js.map