@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/dist/lib/sandbox/control/controller-registration.js

@@ -126,10 +126,12 @@ function defaultProbe(manifest, identity) {
 function assertRegistrationBinding(registration, manifest, buildIdentity) {
     if (registration.taskId !== manifest.taskId
         || registration.controlGeneration !== manifest.generation
-        || registration.containerId !== manifest.containerIdentity.id
-        || JSON.stringify(registration.buildIdentity) !== JSON.stringify(buildIdentity)) {
+        || registration.containerId !== manifest.containerIdentity.id) {
         fail('CODEX_SANDBOX_CONTROLLER_REGISTRATION_INVALID', 'controller registration binding is invalid');
     }
+    if (registration.buildIdentity.protocolVersion !== buildIdentity.protocolVersion) {
+        fail('CODEX_LIFECYCLE_PROTOCOL_MISMATCH', 'Codex lifecycle protocol version does not match');
+    }
 }
 function atomicWrite(file, value) {
     const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomUUID()}.tmp`);

package/dist/lib/sandbox/control/executor.js

@@ -1,15 +1,32 @@
-import { spawn, spawnSync } from 'node:child_process';
+import { spawn } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getProcessStartTime } from '../../server/process-state.js';
 import { createTask } from '../../task/create-service.js';
 import { applyTaskFinalization } from '../../task/finalization.js';
-import { verifyTaskEvent } from '../../task/verification.js';
-import { bindSandboxControlTask } from './protocol.js';
-import { atomicWriteJson, executionPath, terminateSandboxControlExecution } from './state.js';
+import { bindSandboxControlTask, validateSandboxControlRequest } from './protocol.js';
+import { atomicWriteJson, executionPath, readActiveLease, terminateSandboxControlExecution } from './state.js';
+import { createSandboxExecutorExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../../task/control-authority.js';
+import { assertSandboxControlBrokerOwner, readSandboxControlManifest } from './lifecycle.js';
 import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
 import { closeCodexControllerRegistration, CodexControllerRegistrationError, openCodexControllerRegistration, resolveCodexControllerBinding } from './controller-registration.js';
+function sameBrokerOwner(left, right) {
+    return left.version === right.version
+        && left.pid === right.pid
+        && left.startTime === right.startTime
+        && left.brokerId === right.brokerId
+        && left.token === right.token
+        && left.generation === right.generation;
+}
+export function assertSandboxControlExecutorAuthority(manifest, gateOwner) {
+    const owner = assertSandboxControlBrokerOwner(manifest);
+    if (gateOwner && !sameBrokerOwner(owner, gateOwner)) {
+        throw new Error('SANDBOX_CONTROL_GATE_OWNER_MISMATCH');
+    }
+    if (readActiveLease(manifest))
+        throw new Error('SANDBOX_CONTROL_HANDOFF_ACTIVE');
+}
 function safeEnv(env) {
     return Object.fromEntries(Object.entries(env).filter(([key]) => !key.toUpperCase().startsWith('AGENT_INFRA_CONTROL_')));
 }
@@ -74,12 +91,15 @@ export async function prepareSandboxControlExecution(params) {
         start(canWrite = () => true) {
             if (!child.connected)
                 throw new Error('SANDBOX_CONTROL_EXECUTOR_GATE_CLOSED');
+            if (!canWrite())
+                throw new Error('SANDBOX_CONTROL_OWNER_LOST');
+            const gateOwner = assertSandboxControlBrokerOwner(params.manifest);
             if (!canWrite())
                 throw new Error('SANDBOX_CONTROL_OWNER_LOST');
             atomicWriteJson(executionPath(params.manifest, params.request.id), { ...execution, phase: 'running', updatedAt: Date.now() });
             if (!canWrite())
                 throw new Error('SANDBOX_CONTROL_OWNER_LOST');
-            child.send({ version: 1, nonce });
+            child.send({ version: 1, nonce, owner: gateOwner });
         },
         completion,
         terminate(updateState = true) {
@@ -104,11 +124,16 @@ function waitForGate(nonce, timeoutMs = 2_000) {
             clearTimeout(timer);
             process.off('disconnect', onDisconnect);
             const value = message;
-            if (!value || value.version !== 1 || value.nonce !== nonce) {
+            const owner = value?.owner;
+            if (!value || value.version !== 1 || value.nonce !== nonce
+                || !owner || owner.version !== 3 || !Number.isSafeInteger(owner.pid) || (owner.pid ?? 0) <= 0
+                || typeof owner.startTime !== 'number' || !Number.isSafeInteger(owner.startTime)
+                || typeof owner.brokerId !== 'string' || owner.brokerId.length === 0
+                || typeof owner.token !== 'string' || typeof owner.generation !== 'string') {
                 reject(new Error('SANDBOX_CONTROL_EXECUTOR_GATE_INVALID'));
                 return;
             }
-            resolve();
+            resolve(owner);
         });
     });
 }
@@ -117,12 +142,15 @@ function controllerFailure(error) {
         ? error.code
         : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
             ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+    const message = error instanceof CodexControllerRegistrationError
+        ? error.message
+        : `${code}: controller operation failed; inspect the sandbox controller and rebuild the sandbox if needed`;
     const payload = {
         version: 1,
         status: 'failed',
         changed: false,
         lease: null,
-        error: { code, message: `${code}: controller request failed`, retryable: false }
+        error: { code, message, retryable: false }
     };
     return { exitCode: 1, stdout: `${JSON.stringify(payload)}\n`, stderr: '' };
 }
@@ -136,6 +164,16 @@ function orchestrationFailure(code, message) {
         stderr: ''
     };
 }
+function lifecycleFailure(code, message) {
+    return {
+        exitCode: 1,
+        stdout: `${JSON.stringify({
+            status: 'failed', changed: false,
+            error: { code, message }
+        })}\n`,
+        stderr: ''
+    };
+}
 function finalizationResult(result) {
     const payload = {
         version: 1,
@@ -151,19 +189,7 @@ function finalizationResult(result) {
         stderr: ''
     };
 }
-function isCodexPrepare(args) {
-    if (args[1] !== 'prepare')
-        return false;
-    const values = [];
-    for (let index = 2; index < args.length; index += 1) {
-        if (args[index] === '--client')
-            values.push(args[index + 1] ?? '');
-        else if (args[index]?.startsWith('--client='))
-            values.push(args[index].slice('--client='.length));
-    }
-    return values.length === 1 && values[0] === 'codex';
-}
-export function executeRequest(manifest, manifestPath, request, options = {}) {
+export async function executeRequest(manifest, manifestPath, request, options = {}) {
     if (request.family === 'task-create') {
         const result = createTask(request.candidate, { repoRoot: manifest.repoRoot });
         return {
@@ -217,12 +243,41 @@ export function executeRequest(manifest, manifestPath, request, options = {}) {
         }
     }
     if (request.family === 'task-finalization') {
-        return finalizationResult(applyTaskFinalization({ taskRef: manifest.taskId, intent: 'complete', agent: request.agent }, { repoRoot: manifest.repoRoot, preflight: (input, options) => verifyTaskEvent({ ...input, event: 'complete-task.hard-preflight' }, options) }));
+        const operation = parseTaskControlOperation('task-finalization', [manifest.taskId, 'complete', '--agent', request.agent]);
+        if (operation.family !== 'task-finalization')
+            throw new Error('SANDBOX_CONTROL_FINALIZATION_OPERATION_INVALID');
+        const result = dispatchTaskControlOperation(createSandboxExecutorExecutionContext({
+            repoRoot: manifest.repoRoot,
+            worktreeRoot: manifest.worktreeRoot,
+            runtimeDir: manifest.runtimeDir,
+            taskId: manifest.taskId,
+            generation: manifest.generation,
+            manifestPath,
+            requestId: request.id
+        }), operation);
+        return finalizationResult(result);
     }
     const boundArgs = bindSandboxControlTask(request, manifest.taskId);
+    if (request.family === 'task-orchestration') {
+        boundArgs.push('--git-worktree-root', manifest.worktreeRoot);
+    }
+    let operation;
+    try {
+        operation = parseTaskControlOperation(request.family, boundArgs);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const code = /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_CONTROL_OPERATION_INVALID';
+        return request.family === 'task-lifecycle'
+            ? lifecycleFailure('LIFECYCLE_PAYLOAD_INVALID', message)
+            : orchestrationFailure(code, message);
+    }
     let controllerBinding = null;
     if (request.family === 'task-orchestration') {
-        if (isCodexPrepare(request.args)) {
+        const codexPrepare = operation.family === 'task-orchestration'
+            && operation.intent === 'prepare'
+            && operation.input.client === 'codex';
+        if (codexPrepare) {
             if (!request.controllerProof) {
                 return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_REQUIRED', 'Codex prepare requires a current controller lease proof');
             }
@@ -244,33 +299,73 @@ export function executeRequest(manifest, manifestPath, request, options = {}) {
         else if (request.controllerProof !== null) {
             return orchestrationFailure('CODEX_SANDBOX_CONTROLLER_PROOF_INVALID', 'Controller proof is only accepted for canonical Codex prepare');
         }
-        boundArgs.push('--git-worktree-root', manifest.worktreeRoot);
     }
-    const result = (options.spawnDomain ?? spawnSync)(process.execPath, nodeEntryArgs(process.argv[1], [request.family, ...boundArgs]), {
-        cwd: manifest.repoRoot,
-        encoding: 'utf8',
-        env: {
-            ...safeEnv(process.env),
-            AGENT_INFRA_RUNTIME_DIR: manifest.runtimeDir,
-            ...(controllerBinding
-                ? { AGENT_INFRA_CONTROL_CONTROLLER_BINDING: JSON.stringify(controllerBinding) }
-                : {})
-        }
+    const context = createSandboxExecutorExecutionContext({
+        repoRoot: manifest.repoRoot,
+        worktreeRoot: manifest.worktreeRoot,
+        runtimeDir: manifest.runtimeDir,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        manifestPath,
+        requestId: request.id,
+        ...(controllerBinding ? { controllerBinding } : {})
     });
-    return { exitCode: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+    const format = (value) => {
+        const result = value;
+        return {
+            exitCode: result.status === 'failed' ? 1 : 0,
+            stdout: `${JSON.stringify(value)}\n`,
+            stderr: ''
+        };
+    };
+    if (request.family === 'task-orchestration') {
+        if (operation.family !== 'task-orchestration')
+            throw new Error('SANDBOX_CONTROL_ORCHESTRATION_OPERATION_INVALID');
+        return format(await dispatchTaskControlOperation(context, operation));
+    }
+    if (operation.family !== 'task-lifecycle')
+        throw new Error('SANDBOX_CONTROL_LIFECYCLE_OPERATION_INVALID');
+    return format(dispatchTaskControlOperation(context, operation));
 }
 export async function runSandboxControlExecutor(requestPath, nonce) {
-    await waitForGate(nonce);
+    const gateOwner = await waitForGate(nonce);
     process.disconnect?.();
-    const root = fs.realpathSync.native(process.cwd());
-    const request = JSON.parse(fs.readFileSync(requestPath, 'utf8'));
     const manifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
     if (!manifestPath)
         throw new Error('SANDBOX_CONTROL_EXECUTOR_MANIFEST_MISSING');
-    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    const manifest = readSandboxControlManifest(manifestPath);
+    const root = fs.realpathSync.native(process.cwd());
     if (fs.realpathSync.native(manifest.repoRoot) !== root)
         throw new Error('SANDBOX_CONTROL_EXECUTOR_ROOT_INVALID');
-    const result = executeRequest(manifest, manifestPath, request);
+    const raw = JSON.parse(fs.readFileSync(requestPath, 'utf8'));
+    const request = validateSandboxControlRequest(raw, manifest);
+    const requestDirectory = path.resolve(path.dirname(requestPath));
+    const processingDirectory = path.resolve(path.join(manifest.processingDir, request.id));
+    const channelRequestDirectory = path.resolve(path.join(manifest.channelDir, 'requests'));
+    if (requestDirectory !== processingDirectory && requestDirectory !== channelRequestDirectory) {
+        throw new Error('SANDBOX_CONTROL_EXECUTOR_REQUEST_INVALID');
+    }
+    let result;
+    try {
+        assertSandboxControlExecutorAuthority(manifest, gateOwner);
+        result = await executeRequest(manifest, manifestPath, request);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        const code = /^([A-Z][A-Z0-9_]+)/u.exec(detail)?.[1] ?? 'SANDBOX_CONTROL_EXECUTOR_FAILED';
+        result = request.family === 'task-finalization'
+            ? {
+                exitCode: 1,
+                stdout: `${JSON.stringify({
+                    version: 1, status: 'failed', changed: false, accepted: true, result: null,
+                    error: { code, message: detail, retryable: false }
+                })}\n`,
+                stderr: ''
+            }
+            : request.family === 'task-lifecycle'
+                ? lifecycleFailure(code, detail)
+                : orchestrationFailure(code, detail);
+    }
     process.stdout.write(result.stdout);
     process.stderr.write(result.stderr);
     process.exitCode = result.exitCode;

package/dist/lib/sandbox/control/lifecycle.js

@@ -414,8 +414,6 @@ function readProcessingSnapshot(root) {
 export function captureSandboxControlCutoverSnapshot(root) {
     const resolvedRoot = path.resolve(root);
     const manifestPath = path.join(resolvedRoot, 'manifest.json');
-    if (fs.existsSync(manifestPath))
-        readSandboxControlManifestForTransition(manifestPath);
     return {
         root: resolvedRoot,
         manifestRaw: readOptionalRaw(manifestPath),
@@ -430,7 +428,7 @@ export function assertSandboxControlCutoverSnapshot(snapshot) {
         throw new Error('SANDBOX_CONTROL_OWNER_TRANSITION');
     }
 }
-function readSandboxControlManifestValue(manifestPath, allowLegacy) {
+function readSandboxControlManifestValue(manifestPath) {
     if (!regularFile(manifestPath))
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     let manifest;
@@ -445,8 +443,14 @@ function readSandboxControlManifestValue(manifestPath, allowLegacy) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
     const candidate = manifest;
-    if (candidate.version !== 4 && candidate.version !== 5) {
-        throw new Error('SANDBOX_CONTROL_MANIFEST_VERSION_INVALID: expected version 5; container-only recreation is required');
+    const expectedKeys = [
+        'branch', 'channelDir', 'container', 'containerIdentity', 'engine', 'generation',
+        'mode', 'processingDir', 'project', 'publicStatusDir', 'repoRoot', 'runtimeDir',
+        'taskId', 'token', 'worktreeRoot'
+    ];
+    if ('version' in candidate || typeof candidate.runtimeDir !== 'string'
+        || Object.keys(manifest).sort().join(',') !== expectedKeys.sort().join(',')) {
+        throw new Error('SANDBOX_CONTROL_MANIFEST_REBUILD_REQUIRED: container-only recreation/rebuild is required');
     }
     if (typeof candidate.containerIdentity !== 'object' || candidate.containerIdentity === null
         || Array.isArray(candidate.containerIdentity))
@@ -463,7 +467,9 @@ function readSandboxControlManifestValue(manifestPath, allowLegacy) {
         || (candidate.taskId !== null && typeof candidate.taskId !== 'string')
         || typeof candidate.channelDir !== 'string' || typeof candidate.publicStatusDir !== 'string'
         || typeof candidate.processingDir !== 'string' || typeof candidate.token !== 'string'
-        || typeof candidate.generation !== 'string')
+        || typeof candidate.generation !== 'string'
+        || (candidate.mode === 'task-bound' && (typeof candidate.taskId !== 'string' || candidate.taskId.length === 0))
+        || (candidate.mode === 'branch-only' && candidate.taskId !== null))
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     const root = path.dirname(path.resolve(manifestPath));
     if (path.resolve(candidate.channelDir) !== path.join(root, 'channel')
@@ -471,22 +477,13 @@ function readSandboxControlManifestValue(manifestPath, allowLegacy) {
         || path.resolve(candidate.processingDir) !== path.join(root, 'processing')) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
-    if (candidate.version === 4) {
-        if (!allowLegacy) {
-            throw new Error('SANDBOX_CONTROL_MANIFEST_VERSION_INVALID: expected version 5; container-only recreation is required');
-        }
-        return candidate;
-    }
-    if (typeof candidate.runtimeDir !== 'string' || path.resolve(candidate.runtimeDir) !== path.join(root, 'runtime')) {
+    if (path.resolve(candidate.runtimeDir) !== path.join(root, 'runtime')) {
         throw new Error('SANDBOX_CONTROL_MANIFEST_INVALID');
     }
     return candidate;
 }
 export function readSandboxControlManifest(manifestPath) {
-    return readSandboxControlManifestValue(manifestPath, false);
-}
-export function readSandboxControlManifestForTransition(manifestPath) {
-    return readSandboxControlManifestValue(manifestPath, true);
+    return readSandboxControlManifestValue(manifestPath);
 }
 function readBrokerOwner(filePath) {
     if (!fs.existsSync(filePath))
@@ -507,6 +504,18 @@ function readBrokerOwner(filePath) {
         throw new Error('SANDBOX_CONTROL_OWNER_MISMATCH');
     return owner;
 }
+export function assertSandboxControlBrokerOwner(manifest, options = {}) {
+    const root = path.dirname(path.resolve(manifest.publicStatusDir));
+    const owner = readBrokerOwner(path.join(root, 'broker.json'));
+    if (!owner)
+        throw new Error('SANDBOX_CONTROL_OWNER_EVIDENCE_MISSING');
+    if (owner.token !== manifest.token || owner.generation !== manifest.generation) {
+        throw new Error('SANDBOX_CONTROL_OWNER_MISMATCH');
+    }
+    if (!ownerLive(owner, options.identityProbe))
+        throw new Error('SANDBOX_CONTROL_OWNER_LOST');
+    return owner;
+}
 function readStatusOwner(filePath) {
     if (!fs.existsSync(filePath))
         return null;
@@ -641,7 +650,7 @@ export async function quiesceSandboxControlRoot(root, options = {}) {
     markSandboxControlRootQuiescing(resolvedRoot);
     await waitForStartupTransition(resolvedRoot, Math.max(0, forceAt - Date.now()), identityProbe);
     const manifestPath = path.join(resolvedRoot, 'manifest.json');
-    const manifest = fs.existsSync(manifestPath) ? readSandboxControlManifestForTransition(manifestPath) : null;
+    const manifest = fs.existsSync(manifestPath) ? readSandboxControlManifest(manifestPath) : null;
     const broker = readBrokerOwner(path.join(resolvedRoot, 'broker.json'));
     const status = readStatusOwner(path.join(resolvedRoot, 'public', 'status.json'));
     const statusOwner = status ? status.broker : null;
@@ -730,7 +739,7 @@ export async function removeSandboxControlRoot(root, options) {
     if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error('SANDBOX_CONTROL_CHANNEL_INVALID');
     const manifestPath = path.join(resolvedRoot, 'manifest.json');
-    const manifest = readSandboxControlManifestForTransition(manifestPath);
+    const manifest = readSandboxControlManifest(manifestPath);
     const inspectContainer = options.inspectContainer
         ?? ((timeoutMs) => inspectSandboxControlContainer(manifest, { timeoutMs }));
     const timeoutMs = options.timeoutMs ?? options.timing?.quiesceDeadlineMs ?? DEFAULT_QUIESCE_TIMEOUT_MS;
@@ -792,7 +801,7 @@ export async function removeSandboxControlRoot(root, options) {
                 : 'SANDBOX_CONTROL_CONTAINER_STILL_EXISTS');
         }
     }
-    const currentManifest = readSandboxControlManifestForTransition(manifestPath);
+    const currentManifest = readSandboxControlManifest(manifestPath);
     if (currentManifest.token !== manifest.token || currentManifest.generation !== manifest.generation
         || !isSandboxControlRootQuiescing(resolvedRoot)) {
         throw new Error('SANDBOX_CONTROL_OWNER_TRANSITION');

package/dist/lib/sandbox/control/server.js

@@ -197,6 +197,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
         if (!recoverProcessing(manifest, brokerOwns))
             return;
         while (!signal.aborted) {
+            let settledExecution = null;
             if (!brokerOwns())
                 break;
             let current;
@@ -255,22 +256,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
             if (active?.settled) {
                 if (!brokerOwns())
                     break;
-                if (active.result) {
-                    if (!brokerOwns())
-                        break;
-                    writeResponse(manifest, {
-                        version: 2, id: active.request.id, phase: 'completed', exitCode: active.result.exitCode,
-                        stdout: active.result.stdout, stderr: active.result.stderr, error: null
-                    });
-                }
-                else {
-                    if (!brokerOwns())
-                        break;
-                    writeResponse(manifest, unknown(active.request.id));
-                }
-                if (!brokerOwns())
-                    break;
-                fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
+                settledExecution = active;
                 active = null;
             }
             let reasonCode = null;
@@ -313,6 +299,22 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 appendSandboxControlAudit(manifest, 'broker-state', { state, reasonCode, requestId: active?.request.id ?? null });
                 lastState = stateKey;
             }
+            if (settledExecution) {
+                if (!brokerOwns())
+                    break;
+                if (settledExecution.result) {
+                    writeResponse(manifest, {
+                        version: 2, id: settledExecution.request.id, phase: 'completed', exitCode: settledExecution.result.exitCode,
+                        stdout: settledExecution.result.stdout, stderr: settledExecution.result.stderr, error: null
+                    });
+                }
+                else {
+                    writeResponse(manifest, unknown(settledExecution.request.id));
+                }
+                if (!brokerOwns())
+                    break;
+                fs.rmSync(path.join(manifest.processingDir, settledExecution.request.id), { recursive: true, force: true });
+            }
             let retiring = false;
             for (const name of fs.readdirSync(requestsDir).sort()) {
                 if (!/^[a-f0-9-]{16,64}\.json$/.test(name))

package/dist/lib/sandbox/mounts.js

@@ -2,7 +2,8 @@ import path from 'node:path';
 import { shareBranchDir, shareCommonDir, shellConfigDirCandidates, worktreeDirCandidates } from './constants.js';
 import { sandboxWorkspaceViewStatePaths } from './workspace-view.js';
 export function sandboxCoreBindMounts(config, branch, overrides) {
-    const taskBound = Boolean(overrides.taskSource && overrides.taskId);
+    const taskSources = overrides.taskSources ?? [];
+    const taskBound = Boolean(taskSources.length > 0 && overrides.taskId);
     const workspaceMounts = sandboxWorkspaceViewStatePaths(overrides.workspaceViewRoot).map(({ state, hostPath }) => taskBound && state === 'active'
         ? {
             hostPaths: [path.join(hostPath, '.short-ids.json')],
@@ -26,7 +27,7 @@ export function sandboxCoreBindMounts(config, branch, overrides) {
     ];
     if (taskBound) {
         mounts.push({
-            hostPaths: [overrides.taskSource],
+            hostPaths: taskSources,
             containerPath: path.posix.join('/workspace/.agents/workspace/active', overrides.taskId),
             readOnly: false
         });