@fitlab-ai/agent-infra 0.9.9 → 0.9.11

package/dist/lib/sandbox/recovery.js

@@ -9,6 +9,7 @@ import { createSandboxCapabilityPlan } from './agent-client-reconciler.js';
 import { toEnginePath } from './engines/wsl2-paths.js';
 import { sandboxCoreBindMounts } from './mounts.js';
 import { assertSandboxTaskSource, sandboxControlPaths, sandboxWorkspaceViewPaths } from './workspace-view.js';
+import { resolveTaskWorkspace } from './task-resolver.js';
 import { parseSandboxWorkspaceIdentity, sameSandboxWorkspaceIdentity } from './workspace-identity.js';
 import { inspectWorktree } from './worktree-safety.js';
 import { commandForEngine, runEngine, runOkEngine, runProbe, runVerboseEngine } from './shell.js';
@@ -407,6 +408,66 @@ function sourceCandidates(engine, hostPath) {
     }
     return [...new Set(candidates.map((candidate) => normalizeMountSource(engine, candidate)))];
 }
+function recoveryTaskSources(repoRoot, taskId) {
+    const activePath = path.join(repoRoot, '.agents', 'workspace', 'active', taskId);
+    const completedPath = path.join(repoRoot, '.agents', 'workspace', 'completed', taskId);
+    if (fs.existsSync(activePath) && !fs.existsSync(completedPath)) {
+        const source = assertSandboxTaskSource(repoRoot, taskId);
+        return { mountPaths: [source], accessiblePaths: [source] };
+    }
+    const task = resolveTaskWorkspace(taskId, repoRoot);
+    if (task.state === 'active') {
+        const source = assertSandboxTaskSource(repoRoot, taskId);
+        return { mountPaths: [source], accessiblePaths: [source] };
+    }
+    if (task.state !== 'completed') {
+        throw new Error(`SANDBOX_TASK_SOURCE_STATE_UNSUPPORTED: task ${taskId} is ${task.state}`);
+    }
+    const completedRoot = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace', 'completed'));
+    const completedSource = fs.realpathSync.native(path.dirname(task.taskMd));
+    if (path.dirname(completedSource) !== completedRoot) {
+        throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${completedSource} is not under completed workspace`);
+    }
+    const historicalActivePath = path.join(repoRoot, '.agents', 'workspace', 'active', taskId);
+    const mountPaths = [completedSource, historicalActivePath];
+    if (fs.existsSync(historicalActivePath)) {
+        try {
+            mountPaths[1] = fs.realpathSync.native(historicalActivePath);
+        }
+        catch {
+            // Keep the exact historical path as a candidate; the current completed
+            // source remains the only source that must still be accessible.
+        }
+    }
+    return { mountPaths, accessiblePaths: [completedSource] };
+}
+function startCompletedSandboxContainer(params) {
+    const taskSources = recoveryTaskSources(params.config.repoRoot, params.taskId);
+    const completedSource = taskSources.accessiblePaths[0];
+    const activeRoot = path.join(params.config.repoRoot, '.agents', 'workspace', 'active');
+    const historicalSource = path.join(activeRoot, params.taskId);
+    fs.mkdirSync(activeRoot, { recursive: true });
+    try {
+        fs.lstatSync(historicalSource);
+        throw new Error(`SANDBOX_COMPLETED_SOURCE_CONFLICT: historical task source already exists at ${historicalSource}`);
+    }
+    catch (error) {
+        if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT'))
+            throw error;
+    }
+    fs.symlinkSync(completedSource, historicalSource, process.platform === 'win32' ? 'junction' : 'dir');
+    try {
+        params.start(params.engine, params.container);
+    }
+    finally {
+        const temporarySource = fs.lstatSync(historicalSource);
+        const resolvedSource = fs.realpathSync.native(historicalSource);
+        if (!temporarySource.isSymbolicLink() || resolvedSource !== completedSource) {
+            throw new Error(`SANDBOX_COMPLETED_SOURCE_CHANGED: refusing to remove unexpected path at ${historicalSource}`);
+        }
+        fs.unlinkSync(historicalSource);
+    }
+}
 function sameHostSource(left, right) {
     try {
         const leftStat = fs.statSync(left, { bigint: true });
@@ -440,21 +501,29 @@ function expectedMounts(params) {
         container: params.container,
         identity: params.workspace
     });
+    const taskSources = params.workspace.mode === 'task-bound'
+        ? recoveryTaskSources(config.repoRoot, params.workspace.taskId)
+        : null;
+    const taskId = params.workspace.mode === 'task-bound' ? params.workspace.taskId : null;
     const core = sandboxCoreBindMounts(config, branch, {
         workspaceViewRoot: view.root,
         controlDir: control.channelDir,
         controlStatusDir: control.statusDir,
-        ...(params.workspace.mode === 'task-bound'
-            ? {
+        ...(taskSources === null
+            ? {}
+            : {
                 runtimeDir: control.runtimeDir,
-                taskSource: assertSandboxTaskSource(config.repoRoot, params.workspace.taskId),
-                taskId: params.workspace.taskId
-            }
-            : {})
+                taskSources: taskSources.mountPaths,
+                taskId: taskId
+            })
     }).map((mount) => ({
         path: mount.containerPath,
         expectedType: 'bind',
         hostPaths: mount.hostPaths,
+        ...(taskSources !== null && taskId !== null
+            && mount.containerPath === `/workspace/.agents/workspace/active/${taskId}`
+            ? { sourceAccessiblePaths: taskSources.accessiblePaths }
+            : {}),
         expectedRW: !mount.readOnly
     }));
     const live = tools.flatMap((tool) => (tool.hostLiveMounts ?? []).flatMap(({ hostPath, containerSubpath }) => {
@@ -469,9 +538,7 @@ function expectedMounts(params) {
             }];
     }));
     const persistentTools = tools
-        .filter((tool) => !tool.tmpfs
-        && (config.agentClientSource === 'canonical'
-            || actualMounts.has(tool.containerMount)))
+        .filter((tool) => !tool.tmpfs)
         .map((tool) => ({
         path: tool.containerMount,
         expectedType: 'bind',
@@ -577,13 +644,10 @@ export function collectSandboxRecoverySnapshot(params) {
         taskId: sandboxTaskIdLabel(params.config)
     });
     const selectedToolIds = new Set(tools.map((tool) => tool.id));
-    const enforceCanonicalPlan = params.config.agentClientSource === 'canonical';
-    const unexpectedCapabilityMounts = enforceCanonicalPlan
-        ? capabilityPlan.cleanupInventory
-            .filter((tool) => isAgentClientId(tool.id) && !selectedToolIds.has(tool.id))
-            .map((tool) => tool.containerMount)
-            .filter((mountPath) => mountsByDestination.has(mountPath))
-        : [];
+    const unexpectedCapabilityMounts = capabilityPlan.cleanupInventory
+        .filter((tool) => isAgentClientId(tool.id) && !selectedToolIds.has(tool.id))
+        .map((tool) => tool.containerMount)
+        .filter((mountPath) => mountsByDestination.has(mountPath));
     const mountSnapshots = expectedMounts({
         config: params.config,
         branch: params.branch,
@@ -616,7 +680,7 @@ export function collectSandboxRecoverySnapshot(params) {
             sourceAccessible: expected.expectedType === 'tmpfs'
                 ? true
                 : matchedHostPath !== undefined
-                    && hostSourceAccessible(matchedHostPath, expected.expectedRW)
+                    && (expected.sourceAccessiblePaths ?? [matchedHostPath]).some((hostPath) => hostSourceAccessible(hostPath, expected.expectedRW))
         };
     });
     return {
@@ -636,9 +700,7 @@ export function collectSandboxRecoverySnapshot(params) {
         identityOk: typeof inspection.Id === 'string' && inspection.Id.length > 0
             && branchLabel === params.branch
             && sameSandboxWorkspaceIdentity(containerWorkspace, workspace),
-        runtimeCapabilityOk: enforceCanonicalPlan
-            ? labels[sandboxRuntimeCapabilityLabel(params.config)] === capabilityPlan.runtimeSignature
-            : undefined,
+        runtimeCapabilityOk: labels[sandboxRuntimeCapabilityLabel(params.config)] === capabilityPlan.runtimeSignature,
         unexpectedCapabilityMounts,
         mounts: mountSnapshots,
         tmpfs,
@@ -813,11 +875,22 @@ export async function ensureSandboxReady(params) {
                 workspace: params.workspace ?? { mode: 'branch-only' }
             });
         }
-        if (params.forceRecreate) {
+        if (params.forceRecreate || (params.reentry === 'completed' && params.allowRecreate)) {
             throw new Error('Explicit container recreation requested.');
         }
         if (!params.row.running) {
-            startFn(params.engine, params.row.name);
+            if (params.reentry === 'completed' && params.workspace?.mode === 'task-bound') {
+                startCompletedSandboxContainer({
+                    config: params.config,
+                    engine: params.engine,
+                    container: params.row.name,
+                    taskId: params.workspace.taskId,
+                    start: startFn
+                });
+            }
+            else {
+                startFn(params.engine, params.row.name);
+            }
             const initial = assess({
                 config: params.config,
                 engine: params.engine,
@@ -930,6 +1003,34 @@ export async function ensureSandboxReady(params) {
     catch (error) {
         failure = error instanceof Error ? error : new Error(String(error));
     }
+    if (params.reentry === 'completed') {
+        if (params.workspace?.mode !== 'task-bound') {
+            throw new Error('SANDBOX_COMPLETED_REENTRY_INVALID: completed re-entry requires a task-bound workspace');
+        }
+        const taskId = params.workspace.taskId;
+        const commandChain = [
+            `docker exec -it ${params.row.name} bash /usr/local/bin/sandbox-tmux-entry`,
+            `ai sandbox rm ${taskId}`,
+            `ai sandbox create ${params.branch}`
+        ];
+        const code = params.allowRecreate || params.forceRecreate
+            ? 'SANDBOX_COMPLETED_RECREATE_UNSUPPORTED'
+            : 'SANDBOX_COMPLETED_REENTRY_FAILED';
+        const lead = code === 'SANDBOX_COMPLETED_RECREATE_UNSUPPORTED'
+            ? 'Completed sandbox replacement is unsupported; the existing container was not replaced.'
+            : 'Completed sandbox recovery failed; the existing container was not replaced.';
+        throw new Error([
+            `${code}: ${lead}`,
+            `Task: ${taskId}; container: ${params.row.name}; branch: ${params.branch}.`,
+            'To preserve the current container state, enter it manually with:',
+            `  ${commandChain[0]}`,
+            'If you intentionally want a replacement, the following is the full interactive sandbox cleanup, not a container-only delete.',
+            'It may remove the worktree, local branch, tool/shell state, and branch share:',
+            `  ${commandChain[1]}`,
+            `  ${commandChain[2]}`,
+            `Details: ${failure.message}`
+        ].join('\n'));
+    }
     const dataBoundary = 'The existing container writable layer, ordinary /tmp data, processes, tmux sessions, and RAM state may be lost by replacement; worktree and host-managed sandbox data are preserved.';
     const recoveryTarget = params.workspace?.mode === 'task-bound'
         ? params.workspace.taskId

package/dist/lib/sandbox/workspace-identity.js

@@ -79,6 +79,20 @@ export function resolveSandboxTarget(requestedRef, repoRoot) {
     }
     return { requestedRef, branch: requestedRef, workspace: { mode: 'branch-only' } };
 }
+export function resolveSandboxReentryContext(params) {
+    if (params.target.workspace.mode !== 'branch-only'
+        || params.containerWorkspace.mode !== 'task-bound') {
+        return { workspace: params.target.workspace, reentry: 'standard' };
+    }
+    const task = resolveTaskWorkspace(params.containerWorkspace.taskId, params.repoRoot);
+    if (task.state !== 'completed' || task.branch !== params.target.branch) {
+        return { workspace: params.target.workspace, reentry: 'standard' };
+    }
+    return {
+        workspace: { mode: 'task-bound', taskId: task.taskId },
+        reentry: 'completed'
+    };
+}
 export function resolveSandboxCleanupTarget(requestedRef, repoRoot, options = {}) {
     if (isRemovedHashShortIdInput(requestedRef)) {
         throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);

package/dist/lib/sandbox/workspace-view.js

@@ -171,14 +171,12 @@ export function materializeSandboxControl(params) {
     const token = randomBytes(32).toString('hex');
     const generation = randomBytes(16).toString('hex');
     const repoRoot = fs.realpathSync.native(params.repoRoot);
-    const manifest = {
-        version: 5,
+    const manifestDraft = {
         engine: params.engine ?? 'docker',
         repoRoot,
         worktreeRoot: fs.realpathSync.native(params.worktreeRoot),
         project: params.project,
         container: params.container,
-        containerIdentity: { id: '', labels: {} },
         branch: params.branch,
         mode: params.identity.mode,
         taskId: params.identity.mode === 'task-bound' ? params.identity.taskId : null,
@@ -189,16 +187,16 @@ export function materializeSandboxControl(params) {
         processingDir,
         runtimeDir
     };
-    fs.writeFileSync(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
-    return { root, channelDir, statusDir, runtimeDir, manifestPath, token, generation };
+    return { root, channelDir, statusDir, runtimeDir, manifestPath, manifestDraft, token, generation };
 }
 export function finalizeSandboxControlManifest(setup, identity) {
     if (!identity.engine || !identity.id)
         throw new Error('SANDBOX_CONTROL_CONTAINER_ID_INVALID');
-    const manifest = JSON.parse(fs.readFileSync(setup.manifestPath, 'utf8'));
-    manifest.version = 5;
-    manifest.engine = identity.engine;
-    manifest.containerIdentity = { id: identity.id, labels: { ...identity.labels } };
+    const manifest = {
+        ...setup.manifestDraft,
+        engine: identity.engine,
+        containerIdentity: { id: identity.id, labels: { ...identity.labels } }
+    };
     const temporary = `${setup.manifestPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
     try {
         fs.writeFileSync(temporary, `${JSON.stringify(manifest)}\n`, { mode: 0o600, flag: 'wx' });
@@ -207,5 +205,6 @@ export function finalizeSandboxControlManifest(setup, identity) {
     finally {
         fs.rmSync(temporary, { force: true });
     }
+    return manifest;
 }
 //# sourceMappingURL=workspace-view.js.map

package/dist/lib/self-update.js

@@ -0,0 +1,278 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { err, info, ok } from './log.js';
+import { needsShell, resolveCommandFromAbsolutePath } from './run/host.js';
+function canonicalPath(target) {
+    try {
+        return fs.realpathSync.native(target);
+    }
+    catch {
+        return null;
+    }
+}
+function comparable(target, platform) {
+    const resolved = path.resolve(target).replaceAll('\\', '/');
+    return platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+function samePath(left, right, platform) {
+    return comparable(left, platform) === comparable(right, platform);
+}
+function isWithin(root, target, platform) {
+    const normalizedRoot = comparable(root, platform).replace(/\/$/, '');
+    const normalizedTarget = comparable(target, platform).replace(/\/$/, '');
+    return normalizedTarget === normalizedRoot
+        || normalizedTarget.startsWith(`${normalizedRoot}/`);
+}
+function packageInfoFromRoot(root) {
+    try {
+        const packageJson = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+        return typeof packageJson.name === 'string'
+            ? { root, name: packageJson.name }
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+function findPackageInfo(entry, platform) {
+    const canonicalEntry = canonicalPath(entry);
+    if (!canonicalEntry)
+        return null;
+    let current = path.dirname(canonicalEntry);
+    while (true) {
+        const canonicalRoot = canonicalPath(current);
+        const info = canonicalRoot ? packageInfoFromRoot(canonicalRoot) : null;
+        if (info && isWithin(info.root, canonicalEntry, platform))
+            return info;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+function packageInfoFromCommand(commandPath, platform) {
+    const direct = findPackageInfo(commandPath, platform);
+    if (direct)
+        return direct;
+    if (!/\.(?:cmd|bat)$/i.test(commandPath))
+        return null;
+    const globalPackageRoot = canonicalPath(path.join(path.dirname(commandPath), 'node_modules', '@fitlab-ai', 'agent-infra'));
+    return globalPackageRoot ? packageInfoFromRoot(globalPackageRoot) : null;
+}
+function visibleAliasError(packageRoot, platform, env) {
+    for (const alias of ['ai', 'agent-infra']) {
+        const absolute = resolveCommandFromAbsolutePath(alias, platform, env);
+        if (!absolute)
+            continue;
+        if (!canonicalPath(absolute))
+            continue;
+        const info = packageInfoFromCommand(absolute, platform);
+        if (info && !samePath(info.root, packageRoot, platform)) {
+            return `PATH shadowing detected: ${alias} resolves to ${info.root}, not ${packageRoot}.`;
+        }
+    }
+    return null;
+}
+function resolveManager(name, expectedBasenames, platform, env) {
+    const absolute = resolveCommandFromAbsolutePath(name, platform, env);
+    if (!absolute) {
+        return { error: `${name} manager was not found on PATH.` };
+    }
+    let stat;
+    try {
+        stat = fs.statSync(absolute);
+    }
+    catch {
+        return { error: `Cannot inspect manager executable: ${absolute}.` };
+    }
+    if (!stat.isFile())
+        return { error: `Manager executable is not a regular file: ${absolute}.` };
+    if (!expectedBasenames.includes(path.basename(absolute).toLowerCase())) {
+        return { error: `Unexpected manager executable: ${absolute}.` };
+    }
+    const canonical = canonicalPath(absolute);
+    return canonical ? { path: canonical } : null;
+}
+function defaultRun(command, platform) {
+    const [file, ...args] = command;
+    if (!file)
+        return { status: null, error: new Error('run: missing command') };
+    const result = spawnSync(file, args, {
+        encoding: 'utf8',
+        shell: needsShell(file, platform),
+        stdio: ['ignore', 'pipe', 'pipe']
+    });
+    return {
+        status: result.status,
+        signal: result.signal,
+        stdout: result.stdout || '',
+        stderr: result.stderr || '',
+        error: result.error
+    };
+}
+function runCommand(command, options, platform) {
+    return options.run ? options.run(command) : defaultRun(command, platform);
+}
+function probe(command, options, platform, label) {
+    const result = runCommand(command, options, platform);
+    if (result.error)
+        return { error: `${label} failed: ${result.error.message}` };
+    if (result.signal)
+        return { error: `${label} terminated by ${result.signal}.` };
+    if (result.status !== 0) {
+        const detail = result.stderr?.trim();
+        return { error: `${label} exited with ${result.status ?? 1}${detail ? `: ${detail}` : '.'}` };
+    }
+    const output = result.stdout?.trim() || '';
+    return output ? output : { error: `${label} returned no path.` };
+}
+function npmSource(packageInfo, options, platform, env) {
+    const manager = resolveManager('npm', platform === 'win32' ? ['npm.cmd', 'npm.bat'] : ['npm'], platform, env);
+    if (!manager)
+        return null;
+    if ('error' in manager)
+        return manager;
+    const prefixOutput = probe([manager.path, 'prefix', '--global'], options, platform, 'npm prefix --global');
+    if (typeof prefixOutput !== 'string')
+        return prefixOutput;
+    const rootOutput = probe([manager.path, 'root', '--global'], options, platform, 'npm root --global');
+    if (typeof rootOutput !== 'string')
+        return rootOutput;
+    const prefix = canonicalPath(prefixOutput);
+    const globalRoot = canonicalPath(rootOutput);
+    if (!prefix || !globalRoot)
+        return { error: 'npm global prefix or root is not an existing directory.' };
+    if (!isWithin(prefix, globalRoot, platform)) {
+        return { error: `npm global root ${globalRoot} is outside prefix ${prefix}.` };
+    }
+    const expectedPackageRoot = canonicalPath(path.join(globalRoot, '@fitlab-ai', 'agent-infra'));
+    if (!expectedPackageRoot || !samePath(expectedPackageRoot, packageInfo.root, platform)) {
+        return { error: `Current CLI package is not owned by npm global root ${globalRoot}.` };
+    }
+    if (packageInfo.name !== '@fitlab-ai/agent-infra') {
+        return { error: `Unexpected package name at ${packageInfo.root}: ${packageInfo.name}.` };
+    }
+    if (platform !== 'win32' && !isWithin(prefix, manager.path, platform)) {
+        return { error: `npm manager ${manager.path} is outside global prefix ${prefix}.` };
+    }
+    return {
+        kind: 'npm',
+        managerPath: manager.path,
+        packageRoot: packageInfo.root,
+        updateArgs: ['update', '--global', '@fitlab-ai/agent-infra']
+    };
+}
+function brewSource(packageInfo, options, platform, env) {
+    const manager = resolveManager('brew', ['brew', 'brew.exe', 'brew.cmd'], platform, env);
+    if (!manager)
+        return null;
+    if ('error' in manager)
+        return manager;
+    const homebrewOutput = probe([manager.path, '--prefix'], options, platform, 'brew --prefix');
+    if (typeof homebrewOutput !== 'string')
+        return homebrewOutput;
+    const formulaOutput = probe([manager.path, '--prefix', 'agent-infra'], options, platform, 'brew --prefix agent-infra');
+    if (typeof formulaOutput !== 'string')
+        return formulaOutput;
+    const homebrewRoot = canonicalPath(homebrewOutput);
+    const formulaRoot = canonicalPath(formulaOutput);
+    if (!homebrewRoot || !formulaRoot)
+        return { error: 'Homebrew prefix is not an existing directory.' };
+    if (!isWithin(homebrewRoot, manager.path, platform)) {
+        return { error: `brew manager ${manager.path} is outside Homebrew prefix ${homebrewRoot}.` };
+    }
+    if (!isWithin(homebrewRoot, formulaRoot, platform)) {
+        return { error: `agent-infra formula prefix ${formulaRoot} is outside Homebrew prefix ${homebrewRoot}.` };
+    }
+    if (!isWithin(formulaRoot, packageInfo.root, platform)) {
+        return { error: `Current CLI package is outside agent-infra formula prefix ${formulaRoot}.` };
+    }
+    if (packageInfo.name !== '@fitlab-ai/agent-infra') {
+        return { error: `Unexpected package name at ${packageInfo.root}: ${packageInfo.name}.` };
+    }
+    return {
+        kind: 'brew',
+        managerPath: manager.path,
+        packageRoot: packageInfo.root,
+        updateArgs: ['upgrade', 'agent-infra']
+    };
+}
+export function detectUpdateSource(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const entry = options.argv?.[1] ?? process.argv[1];
+    if (!entry)
+        return { source: null, error: 'Cannot determine the running CLI entry.' };
+    const packageInfo = findPackageInfo(entry, platform);
+    if (!packageInfo || packageInfo.name !== '@fitlab-ai/agent-infra') {
+        return { source: null, error: 'Running CLI is not a persistent @fitlab-ai/agent-infra package installation.' };
+    }
+    const aliasError = visibleAliasError(packageInfo.root, platform, env);
+    if (aliasError)
+        return { source: null, error: aliasError };
+    const candidates = [];
+    const errors = [];
+    for (const candidate of [
+        npmSource(packageInfo, options, platform, env),
+        brewSource(packageInfo, options, platform, env)
+    ]) {
+        if (!candidate)
+            continue;
+        if ('error' in candidate)
+            errors.push(candidate.error);
+        else
+            candidates.push(candidate);
+    }
+    if (candidates.length === 1) {
+        const [source] = candidates;
+        if (source)
+            return { source };
+    }
+    if (candidates.length > 1)
+        return { source: null, error: 'Multiple package managers claim the running CLI; refusing to choose.' };
+    return {
+        source: null,
+        error: errors.length > 0
+            ? errors.join(' ')
+            : 'No supported persistent npm or Homebrew installation owns the running CLI.'
+    };
+}
+function managerStable(source, platform) {
+    const current = canonicalPath(source.managerPath);
+    return current !== null && samePath(current, source.managerPath, platform);
+}
+export async function cmdUpdate(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const detected = detectUpdateSource(options);
+    if (!detected.source) {
+        err(`Cannot update agent-infra CLI: ${detected.error ?? 'unknown source'}`);
+        err('Install persistently with "npm install -g @fitlab-ai/agent-infra" or "brew install fitlab-ai/tap/agent-infra".');
+        return 1;
+    }
+    const source = detected.source;
+    if (!managerStable(source, platform)) {
+        err(`Cannot update agent-infra CLI: manager path changed: ${source.managerPath}.`);
+        return 1;
+    }
+    info(`Updating agent-infra CLI via ${source.kind}.`);
+    const result = runCommand([source.managerPath, ...source.updateArgs], options, platform);
+    if (result.error) {
+        err(`agent-infra CLI update failed: ${result.error.message}`);
+        return 1;
+    }
+    if (result.signal) {
+        err(`agent-infra CLI update terminated by ${result.signal}.`);
+        return 1;
+    }
+    if (result.status !== 0) {
+        err(`agent-infra CLI update failed with exit code ${result.status ?? 1}.`);
+        const detail = result.stderr?.trim();
+        if (detail)
+            err(detail);
+        return result.status && result.status > 0 ? result.status : 1;
+    }
+    ok('agent-infra CLI updated successfully!');
+    return 0;
+}
+//# sourceMappingURL=self-update.js.map

package/dist/lib/server/protocol.js

@@ -20,16 +20,16 @@ export function commandHelp() {
         '/sandbox ls',
         '/sandbox show {ref}',
         '/sandbox vm status',
-        '/task decisions [--task {ref}] [--item {selector}]',
-        '/task log [--task {ref}]',
+        '/task decisions [--task {ref} | -t {ref}] [--item {selector} | -i {selector}]',
+        '/task log [--task {ref} | -t {ref}]',
         '/task ls',
-        '/task show [--task {ref}]',
-        '/task status [--task {ref}]',
+        '/task show [--task {ref} | -t {ref}]',
+        '/task status [--task {ref} | -t {ref}]',
         'Write:',
         '/sandbox create {ref}',
         '/sandbox start {ref}',
         'Exec:',
-        '/decide [--task {ref}] --item {ordinal|ledger-id} [--needs-implementation true|false] {decision}',
+        '/decide [--task {ref} | -t {ref}] (--item {ordinal|ledger-id} | -i {ordinal|ledger-id}) [--needs-implementation true|false] {decision}',
         '/run create-task {description}',
         '/run {skill} {task-ref}'
     ].join('\n');

package/dist/lib/task/activity-log.js

@@ -84,5 +84,8 @@ function pairEntries(entries) {
     }
     return rows;
 }
-export { activityAttempt, appendActivityEntry, commitAttemptStartedNote, locateActivityLog, pairEntries, parseActivityLog, parseCommitAttemptStarted };
+function startedBackedRows(rows) {
+    return rows.filter((row) => row.started !== '');
+}
+export { activityAttempt, appendActivityEntry, commitAttemptStartedNote, locateActivityLog, pairEntries, parseActivityLog, parseCommitAttemptStarted, startedBackedRows };
 //# sourceMappingURL=activity-log.js.map

package/dist/lib/task/artifact-lifecycle.js

@@ -305,7 +305,7 @@ function resolveCodeContext(inventory, options) {
         }
         const verdict = parseVerdict(reviewPlan.latest.path);
         if (!verdict.ok)
-            return contextFailure(inventory, 'ARTIFACT_REFERENCE_INVALID', verdict.message, reviewPlan.latest.name);
+            return contextFailure(inventory, 'ARTIFACT_VERDICT_INVALID', `${verdict.code}: ${verdict.message}`, reviewPlan.latest.name);
         if (verdict.verdict !== 'Approved') {
             return contextFailure(inventory, 'ARTIFACT_REFERENCE_INVALID', `latest ${reviewPlan.latest.name} is not approved`, reviewPlan.latest.name);
         }
@@ -320,6 +320,8 @@ function resolveCodeContext(inventory, options) {
     }
     if (reviewPlan.latest && reviewPlan.reviewedInput?.name === plan.latest.name) {
         const verdict = parseVerdict(reviewPlan.latest.path);
+        if (!verdict.ok)
+            return contextFailure(inventory, 'ARTIFACT_VERDICT_INVALID', `${verdict.code}: ${verdict.message}`, reviewPlan.latest.name);
         const reviewedPlanSha256 = sha256File(reviewPlan.reviewedInput.path);
         if (verdict.ok && verdict.verdict === 'Approved' && (codePlanInput.input.name !== plan.latest.name || codePlanInput.inputSha256 !== reviewedPlanSha256)) {
             return withCodeMode(inventory, inputs, 'ready', 'init', codeMax, reviewMax, verdict.verdict, reviewPlan.latest.name, `Latest ${reviewPlan.latest.name} approves plan content not captured by the latest code input receipt. Entering replan-driven init.`);
@@ -334,7 +336,7 @@ function resolveCodeContext(inventory, options) {
         return contextFailure(inventory, 'ARTIFACT_INPUT_MISSING', 'latest review-code artifact is required');
     const verdict = parseVerdict(review.path);
     if (!verdict.ok)
-        return contextFailure(inventory, 'ARTIFACT_REFERENCE_INVALID', verdict.message);
+        return contextFailure(inventory, 'ARTIFACT_VERDICT_INVALID', `${verdict.code}: ${verdict.message}`, review.name);
     if (verdict.verdict === 'Approved') {
         const decision = resolveDecisionImplementationInput(inventory, review);
         if ('error' in decision)