@fitlab-ai/agent-infra 0.11.2 → 0.11.4

package/templates/.agents/workflows/refactoring.en.yaml

@@ -9,6 +9,11 @@
 name: refactoring
 description: Safe and structured workflow for code refactoring.
 
+lifecycle_paths:
+  streamlined: [analysis, code, code-review]
+  standard: [analysis, design, code, code-review]
+  full: [analysis, analysis-review, design, design-review, code, code-review]
+
 steps:
   - name: analysis
     description: Analyze the current code and define the refactoring scope.
@@ -28,7 +33,7 @@ steps:
       outputs:
         - name: analysis
           pattern: "analysis.md | analysis-r{N}.md"
-          rule: "Scan existing analysis artifacts; create analysis.md for round 1 and analysis-r{N}.md for later revisions (N = current highest round + 1)"
+          rule: "Let the task-artifact selector decide: reuse a completed artifact when inputs and substantive results match; create the next round only for new inputs, rework evidence, or result changes"
     outputs:
       - Scope analysis with dependency map
       - Risk assessment
@@ -55,7 +60,7 @@ steps:
       outputs:
         - name: review-analysis
           pattern: "review-analysis.md | review-analysis-r{N}.md"
-          rule: "Scan existing requirement-analysis review artifacts; create review-analysis.md for round 1 and review-analysis-r{N}.md for later rounds (N = current highest round + 1)"
+          rule: "Let the task-artifact selector decide: reuse a completed artifact when inputs and substantive results match; create the next round only for new inputs, rework evidence, or result changes"
     outputs:
       - Requirement analysis review report
       - Findings to fix, if any
@@ -84,7 +89,7 @@ steps:
       outputs:
         - name: plan
           pattern: "plan.md | plan-r{N}.md"
-          rule: "Scan existing plan artifacts; create plan.md for round 1 and plan-r{N}.md for later revisions (N = current highest round + 1)"
+          rule: "Let the task-artifact selector decide: reuse a completed artifact when inputs and substantive results match; create the next round only for new inputs, rework evidence, or result changes"
     outputs:
       - Incremental refactoring plan
       - Prerequisite test list
@@ -111,7 +116,7 @@ steps:
       outputs:
         - name: review-plan
           pattern: "review-plan.md | review-plan-r{N}.md"
-          rule: "Scan existing plan review artifacts; create review-plan.md for round 1 and review-plan-r{N}.md for later rounds (N = current highest round + 1)"
+          rule: "Let the task-artifact selector decide: reuse a completed artifact when inputs and substantive results match; create the next round only for new inputs, rework evidence, or result changes"
     outputs:
       - Plan review report
       - Findings to fix, if any
@@ -148,7 +153,7 @@ steps:
       outputs:
         - name: code
           pattern: "code.md | code-r{N}.md"
-          rule: "Scan existing code artifacts; create code.md for round 1 and code-r{N}.md for later fixes or reimplementation (N = current highest round + 1)"
+          rule: "Let the task-artifact selector decide: reuse a completed artifact when inputs and substantive results match; create the next round only for new inputs, rework evidence, or result changes"
     outputs:
       - Refactoring branch with implementation or fixes
       - Updated or new test files
@@ -177,7 +182,7 @@ steps:
       outputs:
         - name: review-code
           pattern: "review-code.md | review-code-r{N}.md"
-          rule: "Scan existing code review artifacts; create review-code.md for round 1 and review-code-r{N}.md for later rounds (N = current highest round + 1)"
+          rule: "Let the task-artifact selector decide: reuse a completed artifact when inputs and substantive results match; create the next round only for new inputs, rework evidence, or result changes"
     outputs:
       - Code review report
       - Findings list, if any

package/templates/.agents/workflows/refactoring.zh-CN.yaml

@@ -8,6 +8,11 @@
 name: refactoring
 description: 安全且结构化的代码重构工作流。
 
+lifecycle_paths:
+  streamlined: [analysis, code, code-review]
+  standard: [analysis, design, code, code-review]
+  full: [analysis, analysis-review, design, design-review, code, code-review]
+
 steps:
   - name: analysis
     description: 分析当前代码并确定重构范围。
@@ -27,7 +32,7 @@ steps:
       outputs:
         - name: analysis
           pattern: "analysis.md | analysis-r{N}.md"
-          rule: "扫描现有分析产物；首轮创建 analysis.md，后续修订创建 analysis-r{N}.md（N = 当前最高轮次 + 1）"
+          rule: "由 task-artifact 选择器决定：输入与实质结果未变化时复用已完成产物；仅在新输入、新返工证据或结果变化时创建下一轮"
     outputs:
       - 包含依赖关系图的范围分析
       - 风险评估
@@ -54,7 +59,7 @@ steps:
       outputs:
         - name: review-analysis
           pattern: "review-analysis.md | review-analysis-r{N}.md"
-          rule: "扫描现有需求分析审查产物；首轮创建 review-analysis.md，后续轮次创建 review-analysis-r{N}.md（N = 当前最高轮次 + 1）"
+          rule: "由 task-artifact 选择器决定：输入与实质结果未变化时复用已完成产物；仅在新输入、新返工证据或结果变化时创建下一轮"
     outputs:
       - 需求分析审查报告
       - 待修正问题列表（如有）
@@ -83,7 +88,7 @@ steps:
       outputs:
         - name: plan
           pattern: "plan.md | plan-r{N}.md"
-          rule: "扫描现有方案产物；首轮创建 plan.md，后续修订创建 plan-r{N}.md（N = 当前最高轮次 + 1）"
+          rule: "由 task-artifact 选择器决定：输入与实质结果未变化时复用已完成产物；仅在新输入、新返工证据或结果变化时创建下一轮"
     outputs:
       - 包含增量步骤的重构计划
       - 前置测试列表
@@ -110,7 +115,7 @@ steps:
       outputs:
         - name: review-plan
           pattern: "review-plan.md | review-plan-r{N}.md"
-          rule: "扫描现有方案审查产物；首轮创建 review-plan.md，后续轮次创建 review-plan-r{N}.md（N = 当前最高轮次 + 1）"
+          rule: "由 task-artifact 选择器决定：输入与实质结果未变化时复用已完成产物；仅在新输入、新返工证据或结果变化时创建下一轮"
     outputs:
       - 技术方案审查报告
       - 待修正问题列表（如有）
@@ -147,7 +152,7 @@ steps:
       outputs:
         - name: code
           pattern: "code.md | code-r{N}.md"
-          rule: "扫描现有实现产物；首轮创建 code.md，后续修复或重实现创建 code-r{N}.md（N = 当前最高轮次 + 1）"
+          rule: "由 task-artifact 选择器决定：输入与实质结果未变化时复用已完成产物；仅在新输入、新返工证据或结果变化时创建下一轮"
     outputs:
       - 包含变更的重构分支
       - 更新或新增的测试文件
@@ -176,7 +181,7 @@ steps:
       outputs:
         - name: review-code
           pattern: "review-code.md | review-code-r{N}.md"
-          rule: "扫描现有代码审查产物；首轮创建 review-code.md，后续轮次创建 review-code-r{N}.md（N = 当前最高轮次 + 1）"
+          rule: "由 task-artifact 选择器决定：输入与实质结果未变化时复用已完成产物；仅在新输入、新返工证据或结果变化时创建下一轮"
     outputs:
       - 代码审查报告
       - 问题列表（如有）

package/dist/lib/sandbox/control/finalization-response.js

@@ -1,35 +0,0 @@
-export function finalizationTerminalResponse(taskId, requestId, receipt) {
-    const pendingSteps = [
-        receipt.taskComment === 'pending' ? 'task-comment' : null,
-        receipt.verification === 'pending' ? 'verification' : null,
-        receipt.summary === 'pending' ? 'summary' : null,
-        receipt.postSummaryVerification === 'pending' ? 'post-summary-verification' : null
-    ].filter((step) => step !== null);
-    const completedSteps = [
-        'lifecycle', receipt.taskComment === 'pending' ? null : 'task-comment',
-        receipt.verification === 'pending' ? null : 'verification', receipt.summary === 'pending' ? null : 'summary',
-        receipt.postSummaryVerification === 'pending' ? null : 'post-summary-verification'
-    ]
-        .filter((step) => step !== null);
-    const warnings = receipt.warnings
-        .filter((warning) => warning.status === 'open')
-        .map(({ status: _status, resolvedAt: _resolvedAt, ...warning }) => warning);
-    const result = {
-        status: 'completed', changed: false, taskId,
-        lifecycle: { status: 'no-op', changed: false, error: null },
-        taskComment: receipt.taskComment === 'pending' ? null : { status: 'no-op', changed: false, error: null },
-        verification: receipt.verification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
-        summary: receipt.summary === 'pending' ? null : { status: 'no-op', changed: false, error: null },
-        postSummaryVerification: receipt.postSummaryVerification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
-        completedSteps, pendingSteps,
-        result: pendingSteps.length > 0 || receipt.warningProjection === 'pending' || warnings.length > 0
-            ? 'completed_with_warnings' : 'completed',
-        warnings, error: null
-    };
-    return {
-        version: 2, id: requestId, phase: 'completed', exitCode: 0,
-        stdout: `${JSON.stringify({ version: 1, status: 'completed', changed: false, accepted: true, result, error: null })}\n`,
-        stderr: '', error: null
-    };
-}
-//# sourceMappingURL=finalization-response.js.map

package/dist/lib/sandbox/control/task-workflow.js

@@ -1,74 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { readStableFile, SecureFileError, writeAtomicFile } from '../../task/secure-fs.js';
-import { TASK_WORKFLOW_COMMANDS, TASK_WORKFLOW_OPERATIONS } from '../../task/workflow-command.js';
-export function validateTaskWorkflowRequest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    const request = value;
-    if (Object.keys(request).sort().join(',') !== 'args,generation,id,operation,taskId,version'
-        || request.version !== 1 || typeof request.id !== 'string' || !/^[a-f0-9-]{16,64}$/u.test(request.id)
-        || typeof request.taskId !== 'string' || !/^TASK-\d{8}-\d{6}$/u.test(request.taskId)
-        || typeof request.generation !== 'string' || !request.generation
-        || !Object.hasOwn(TASK_WORKFLOW_COMMANDS, request.operation)
-        || !Array.isArray(request.args) || request.args.length < 2 || request.args.length > 128
-        || !request.args.every((arg) => typeof arg === 'string' && !/[\r\n]/u.test(arg))
-        || request.args[0] !== request.taskId)
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    const [, selector] = TASK_WORKFLOW_COMMANDS[request.operation];
-    if (selector !== null && request.args[1] !== selector)
-        throw new Error('TASK_WORKFLOW_REQUEST_INVALID');
-    return request;
-}
-/** Preserve argv verbatim; the domain command owns option parsing and validation. */
-export function createTaskWorkflowRequest(command, args, taskId, generation) {
-    const operation = TASK_WORKFLOW_OPERATIONS.find((key) => {
-        const [name, selector] = TASK_WORKFLOW_COMMANDS[key];
-        return name === command && (selector === null || selector === args[1]);
-    });
-    if (!operation)
-        throw new Error('TASK_WORKFLOW_OPERATION_UNSUPPORTED');
-    return validateTaskWorkflowRequest({ version: 1, id: randomUUID(), taskId, generation, operation, args: [...args] });
-}
-export function canonicalArtifactName(value) {
-    return /^(?:analysis|plan|code|review-analysis|review-plan|review-code)(?:-r[1-9]\d*)?\.md$/u.test(value)
-        && path.basename(value) === value;
-}
-function assertTaskArtifactDirectory(directory) {
-    const resolved = path.resolve(directory);
-    let stat;
-    try {
-        stat = fs.lstatSync(resolved);
-    }
-    catch {
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory is unavailable');
-    }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'task directory must be a real directory');
-    }
-    return resolved;
-}
-export async function readTaskArtifact(taskDir, input) {
-    if (!canonicalArtifactName(input.artifact))
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
-    const root = assertTaskArtifactDirectory(taskDir);
-    const candidate = path.join(root, input.artifact);
-    if (path.dirname(candidate) !== root)
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
-    const stable = await readStableFile(candidate, {
-        maxBytes: 1024 * 1024,
-        ...(input.expectedSha256 ? { expectedSha256: input.expectedSha256 } : {})
-    });
-    return { artifact: input.artifact, bytes: stable.bytes, sha256: stable.sha256 };
-}
-export async function writeTaskArtifact(taskDir, artifact) {
-    if (!canonicalArtifactName(artifact.artifact))
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact must be a canonical top-level basename');
-    const root = assertTaskArtifactDirectory(taskDir);
-    const target = path.join(root, artifact.artifact);
-    if (path.dirname(target) !== root)
-        throw new SecureFileError('TASK_ARTIFACT_WRITE_DENIED', 'artifact escapes task directory');
-    await writeAtomicFile(target, artifact.bytes, 0o600, artifact.expectedSha256);
-}
-//# sourceMappingURL=task-workflow.js.map

package/dist/lib/sandbox/control/workflow-executor.js

@@ -1,142 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { TASK_WORKFLOW_COMMANDS } from '../../task/workflow-command.js';
-import { parseArtifactCommand, executeArtifactCommand } from '../../task/artifact-command.js';
-import { parseReviewCommand } from '../../task/review-command.js';
-import { prepareLocalArtifact, preflightLocalArtifact, commitLocalArtifactProvenance } from '../../task/local-artifact-finalization.js';
-import { prepareReviewSummaryCandidate, preflightReviewSummary } from '../../task/review-finalization.js';
-import { withTaskExecutionLock } from '../../task/task-execution-lock.js';
-import { dispatchWorkflowCommand } from '../../task/workflow-dispatch.js';
-import { assertSandboxTaskSource } from '../workspace-view.js';
-import { appendDiagnosticAudit } from './audit.js';
-import { readTaskArtifact } from './task-workflow.js';
-import { applyTaskEvent } from '../../task/events.js';
-import { parseTaskEventRequest } from '../../internal/task-event.js';
-function executionResult(result) {
-    return { exitCode: result.status === 'failed' || result.status === 'refused' ? 1 : 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
-}
-function replaceCurrentArtifactAtomically(file, content) {
-    const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
-    try {
-        fs.writeFileSync(temporary, content, { encoding: 'utf8', flag: 'wx' });
-        fs.renameSync(temporary, file);
-    }
-    finally {
-        try {
-            fs.unlinkSync(temporary);
-        }
-        catch (error) {
-            if (error.code !== 'ENOENT')
-                throw error;
-        }
-    }
-}
-/** The broker already authorized this host executor; domain operations own validation. */
-export async function executeTaskWorkflow(manifest, request, lifecycleRecoveryAttestation = null, options = {}) {
-    let publicationCommitted = false;
-    let faultTriggered = false;
-    const fault = (window) => {
-        if (faultTriggered || options.faultWindow !== window)
-            return;
-        faultTriggered = true;
-        throw new Error(`TASK_WORKFLOW_FAULT_INJECTED:${window}`);
-    };
-    const response = (result) => {
-        fault('before-result-return');
-        return executionResult(result);
-    };
-    try {
-        fault('before-call');
-        const taskDir = assertSandboxTaskSource(manifest.repoRoot, request.taskId);
-        const [command] = TASK_WORKFLOW_COMMANDS[request.operation];
-        if (request.operation === 'event') {
-            const eventRequest = parseTaskEventRequest(request.args);
-            const boundEventRequest = lifecycleRecoveryAttestation && eventRequest.requestId === undefined
-                ? { ...eventRequest, requestId: lifecycleRecoveryAttestation.lifecycleRequestId }
-                : eventRequest;
-            fault('before-domain-write');
-            const result = applyTaskEvent(boundEventRequest, {
-                repoRoot: manifest.repoRoot,
-                lifecycleRecoveryAttestation,
-                deferLifecycleRecoveryConsumption: true
-            });
-            publicationCommitted = result.changed;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        if (command !== 'task-artifact' && command !== 'task-review') {
-            // The broker owns this short-lived executor; no global service or worker
-            // credential participates in the command's authority or recovery path.
-            fault('before-domain-write');
-            const result = dispatchWorkflowCommand(manifest.repoRoot, request.operation, request.args);
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        const input = command === 'task-artifact' ? parseArtifactCommand(request.args) : parseReviewCommand(request.args);
-        if (command === 'task-artifact' && 'operation' in input && input.operation === 'inspect') {
-            fault('before-domain-write');
-            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot });
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        if ('operation' in input && input.operation === 'init') {
-            fault('before-domain-write');
-            const result = executeArtifactCommand(input, { repoRoot: manifest.repoRoot, artifactDir: taskDir });
-            publicationCommitted = result.changed === true;
-            fault('after-atomic-rename');
-            return response(result);
-        }
-        return await withTaskExecutionLock(manifest.repoRoot, request.taskId, `sandbox-control.${request.operation}`, async () => {
-            const artifact = await readTaskArtifact(taskDir, { artifact: input.artifact });
-            const content = artifact.bytes.toString('utf8');
-            fault('before-domain-write');
-            let result;
-            if ('operation' in input) {
-                const { family } = input;
-                if (family !== 'analysis' && family !== 'plan' && family !== 'code')
-                    throw new Error('ARTIFACT_IDENTITY_INVALID');
-                const local = { taskRef: request.taskId, family, artifact: input.artifact, repoRoot: manifest.repoRoot, lockAlreadyHeld: true };
-                if (input.operation === 'preflight') {
-                    const result = preflightLocalArtifact(local);
-                    return response(result);
-                }
-                const prepared = prepareLocalArtifact(local, content);
-                result = commitLocalArtifactProvenance(prepared);
-            }
-            else {
-                if (input.overrideTicket)
-                    throw new Error('TASK_WORKFLOW_OVERRIDE_UNSUPPORTED');
-                const family = `review-${input.stage}`;
-                if (request.operation === 'review-preflight') {
-                    const result = preflightReviewSummary(input, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
-                    return response(result);
-                }
-                const prepared = prepareReviewSummaryCandidate(input, content, { repoRoot: manifest.repoRoot, lockAlreadyHeld: true });
-                if (input.dryRun || prepared.result.status === 'planned')
-                    return executionResult(prepared.result);
-                if (prepared.result.status === 'failed')
-                    return executionResult(prepared.result);
-                if (prepared.result.changed)
-                    replaceCurrentArtifactAtomically(path.join(taskDir, input.artifact), prepared.content);
-                result = prepared.result;
-            }
-            publicationCommitted ||= result.changed === true;
-            if (result.status !== 'failed')
-                appendDiagnosticAudit(manifest, 'task-workflow-artifact-finalized', {
-                    requestId: request.id, sandboxTaskId: request.taskId, workflowOperation: request.operation,
-                    artifact: input.artifact, sha256: result.artifactSha256, semanticDigest: result.semanticDigest
-                });
-            fault('after-atomic-rename');
-            return response(result);
-        });
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        const code = error?.code ?? /^([A-Z][A-Z0-9_]+)/u.exec(message)?.[1] ?? 'TASK_WORKFLOW_REQUEST_INVALID';
-        return executionResult({ status: 'failed', changed: publicationCommitted ? null : false, error: { code, message } });
-    }
-}
-//# sourceMappingURL=workflow-executor.js.map