@fitlab-ai/agent-infra 0.11.6 → 0.11.8

package/dist/bin/internal-cli.js

@@ -15,6 +15,7 @@ const taskWorkflowCommand = command === 'task-artifact'
     || command === 'task-ledger'
     || command === 'task-invalidation'
     || command === 'task-warning';
+const taskPlatformRecoveryCommand = command === 'task-platform-recovery';
 const manualValidationWorkflowCommand = command === 'manual-validation';
 const taskControlMarkers = [
     'AGENT_INFRA_TASK_ID', 'AGENT_INFRA_CONTROL_TOKEN', 'AGENT_INFRA_CONTROL_GENERATION',
@@ -48,9 +49,9 @@ function taskControlTransportFailure(message, code = 'TASK_CONTROL_TRANSPORT_INV
     process.exit(1);
 }
 let controlRouted = false;
-if (!taskViewGuardFailed && !markerlessHelp && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand)) {
+if (!taskViewGuardFailed && !markerlessHelp && (taskControlCommand || taskWorkflowCommand || manualValidationWorkflowCommand || taskPlatformRecoveryCommand)) {
     const transport = resolveSandboxControlTransport(process.env, {
-        localWorkflow: command === 'task-orchestration' || command === 'task-finalization' || taskWorkflowCommand || manualValidationWorkflowCommand
+        localWorkflow: command === 'task-orchestration' || command === 'task-finalization' || taskWorkflowCommand || manualValidationWorkflowCommand || taskPlatformRecoveryCommand
     });
     switch (transport.kind) {
         case 'fail-closed': {
@@ -90,6 +91,11 @@ if (!controlRouted && !taskViewGuardFailed && internalRouteRegistered)
             await taskFinalization(process.argv.slice(3));
             break;
         }
+        case 'task-platform-recovery': {
+            const { taskPlatformRecovery } = await import('../lib/internal/task-platform-recovery.js');
+            await taskPlatformRecovery(process.argv.slice(3));
+            break;
+        }
         case 'task-create': {
             const { taskCreate } = await import('../lib/internal/task-create.js');
             await taskCreate(process.argv.slice(3));

package/dist/lib/agent-clients/adapters/codex.js

@@ -50,7 +50,7 @@ const codexAdapter = defineAgentClientAdapter({
             containerMount: '/home/devuser/.codex',
             versionCmd: 'codex --version',
             setupHint: 'Run codex once inside the container and choose Device Code login if needed.',
-            tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'] },
+            tmpfs: { size: '512m', seed: ['config.toml', 'model-catalogs'], exec: true },
             hostLiveMounts: [
                 {
                     hostPath: hostJoin(home, '.codex', 'auth.json'),

package/dist/lib/agent-clients/config.js

@@ -114,10 +114,18 @@ function normalizeAgentClients(input) {
     if (hasOwn(input, 'tuis'))
         fail('INVALID_AGENT_CLIENTS', 'tuis');
     const sandbox = isRecord(input.sandbox) ? input.sandbox : undefined;
-    if (Array.isArray(sandbox?.tools)) {
-        for (const [index, tool] of sandbox.tools.entries()) {
+    if (sandbox && hasOwn(sandbox, 'customTools')) {
+        fail('INVALID_AGENT_CLIENTS', 'sandbox.customTools');
+    }
+    if (sandbox && hasOwn(sandbox, 'tools')) {
+        if (!isRecord(sandbox.tools))
+            fail('INVALID_AGENT_CLIENTS', 'sandbox.tools');
+        const tools = sandbox.tools;
+        if (!Array.isArray(tools.ids))
+            fail('INVALID_AGENT_CLIENTS', 'sandbox.tools.ids');
+        for (const [index, tool] of tools.ids.entries()) {
             if (isAgentClientId(tool)) {
-                fail('INVALID_AGENT_CLIENTS', `sandbox.tools[${index}]`);
+                fail('INVALID_AGENT_CLIENTS', `sandbox.tools.ids[${index}]`);
             }
         }
     }

package/dist/lib/defaults.json

@@ -34,9 +34,12 @@
     "runtimes": [
       "node22"
     ],
-    "tools": [
-      "agent-infra"
-    ],
+    "tools": {
+      "ids": [
+        "agent-infra"
+      ],
+      "definitions": {}
+    },
     "refreshIntervalDays": 7,
     "dockerfile": null,
     "vm": {

package/dist/lib/git/primary-worktree.js

@@ -0,0 +1,58 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import { sameFilesystemEntry } from './worktree-identity.js';
+function gitText(repositoryRoot, args) {
+    return execFileSync('git', ['-C', repositoryRoot, ...args], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe']
+    }).replace(/\r?\n$/, '');
+}
+function isPrimaryWorktree(candidate, expectedCommonDirectory) {
+    try {
+        const root = fs.realpathSync.native(candidate);
+        if (!fs.statSync(root).isDirectory())
+            return false;
+        if (gitText(root, ['rev-parse', '--show-prefix']) !== '')
+            return false;
+        const commonDirectory = gitText(root, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+        const gitDirectory = gitText(root, ['rev-parse', '--absolute-git-dir']);
+        return sameFilesystemEntry(commonDirectory, expectedCommonDirectory) &&
+            sameFilesystemEntry(gitDirectory, expectedCommonDirectory);
+    }
+    catch {
+        return false;
+    }
+}
+function worktreePaths(repositoryRoot) {
+    const output = execFileSync('git', ['-C', repositoryRoot, 'worktree', 'list', '--porcelain', '-z'], {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe']
+    });
+    return output
+        .split('\0\0')
+        .flatMap((record) => record.split('\0'))
+        .filter((field) => field.startsWith('worktree '))
+        .map((field) => field.slice('worktree '.length));
+}
+export function resolvePrimaryWorktreeRoot(repositoryRoot) {
+    try {
+        const root = fs.realpathSync.native(repositoryRoot);
+        if (!fs.statSync(root).isDirectory() || gitText(root, ['rev-parse', '--show-prefix']) !== '') {
+            throw new Error('repository root is not a worktree root');
+        }
+        const commonDirectory = gitText(root, ['rev-parse', '--path-format=absolute', '--git-common-dir']);
+        const gitDirectory = gitText(root, ['rev-parse', '--absolute-git-dir']);
+        if (sameFilesystemEntry(gitDirectory, commonDirectory))
+            return root;
+        const matches = worktreePaths(root).filter((candidate) => isPrimaryWorktree(candidate, commonDirectory));
+        if (matches.length !== 1) {
+            throw new Error(matches.length === 0 ? 'primary worktree metadata was not found' : 'primary worktree metadata is ambiguous');
+        }
+        return fs.realpathSync.native(matches[0]);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`server: unable to locate primary worktree: ${detail}`);
+    }
+}
+//# sourceMappingURL=primary-worktree.js.map

package/dist/lib/internal/cli-route-inventory.js

@@ -60,6 +60,7 @@ export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
     'task-invalidation': ['reconcile'],
     'task-lifecycle': ['intent'],
     'task-finalization': ['complete'],
+    'task-platform-recovery': ['inspect', 'recover'],
     'task-short-id': ['list', 'list-verify', 'alloc', 'release', 'resolve'],
     'task-snapshot': ['snapshot'],
     'task-verify': ['event'],
@@ -88,6 +89,8 @@ export function internalRouteSelector(command, args) {
         return args[1] ? 'intent' : '';
     if (command === 'task-finalization')
         return args[1] === 'complete' ? 'complete' : '';
+    if (command === 'task-platform-recovery')
+        return args[1] ?? '';
     if (command === 'task-event')
         return args[1] ? 'event' : '';
     if (command === 'task-verify')

package/dist/lib/internal/platform-pr-review.js

@@ -3,12 +3,13 @@ import path from 'node:path';
 import { inspectPlatformPullRequestByNumber } from '../platform/pull-requests.js';
 import { listPrReviews, publishPrReview } from '../platform/pr-review.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 const USAGE = `Usage: agent-infra-internal platform-pr-review inspect --pr <token> [--cwd <path>]
        agent-infra-internal platform-pr-review list --pr <token> [--cwd <path>]
-       agent-infra-internal platform-pr-review publish --pr <token> --scope <taskId|pr{N}> --round <N> --commit <sha> --event <COMMENT|APPROVE|REQUEST_CHANGES> --body-file <path|-> [--dry-run] [--cwd <path>]
+       agent-infra-internal platform-pr-review publish --pr <token> --scope <taskId|pr{N}> --round <N> --commit <sha> --event <COMMENT|APPROVE|REQUEST_CHANGES> --body-file <path|-> [--artifact <pr-review-artifact>] [--agent <agent>] [--dry-run] [--cwd <path>]
 `;
 const BOOLEAN_FLAGS = new Set(['--dry-run']);
-const VALUE_FLAGS = new Set(['--cwd', '--pr', '--scope', '--round', '--commit', '--event', '--body-file']);
+const VALUE_FLAGS = new Set(['--cwd', '--pr', '--scope', '--round', '--commit', '--event', '--body-file', '--artifact', '--agent']);
 function key(flag) {
     return flag.slice(2).replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
 }
@@ -74,7 +75,7 @@ async function platformPrReview(args = []) {
     const allowed = {
         inspect: ['cwd', 'pr'],
         list: ['cwd', 'pr'],
-        publish: ['cwd', 'pr', 'scope', 'round', 'commit', 'event', 'bodyFile', 'dryRun']
+        publish: ['cwd', 'pr', 'scope', 'round', 'commit', 'event', 'bodyFile', 'artifact', 'agent', 'dryRun']
     };
     const unexpected = Object.keys(values).find((name) => !allowed[operation].includes(name));
     if (unexpected) {
@@ -99,6 +100,8 @@ async function platformPrReview(args = []) {
     const round = Number(values.round);
     const commit = typeof values.commit === 'string' ? values.commit : '';
     const event = values.event;
+    const rawAgent = typeof values.agent === 'string' ? values.agent : '';
+    const agent = rawAgent ? normalizeAgentToken(rawAgent) : null;
     if (!scope || !/^(?:pr\d+|TASK-\d{8}-\d{6})$/.test(scope)) {
         fail('publish requires --scope <taskId|pr{N}>');
         return;
@@ -124,6 +127,18 @@ async function platformPrReview(args = []) {
         fail('publish requires --body-file');
         return;
     }
+    if (/^TASK-\d{8}-\d{6}$/u.test(scope) && typeof values.artifact !== 'string') {
+        fail('task-scoped publish requires --artifact <pr-review-artifact>');
+        return;
+    }
+    if (/^TASK-\d{8}-\d{6}$/u.test(scope) && !agent) {
+        fail(`task-scoped publish requires --agent <agent>${rawAgent ? `: invalid '${rawAgent}'` : ''}: ${AGENT_USAGE_HINT}`);
+        return;
+    }
+    if (rawAgent && !agent) {
+        fail(`invalid --agent '${rawAgent}': ${AGENT_USAGE_HINT}`);
+        return;
+    }
     let body;
     try {
         body = readBodyFile(values.bodyFile, cwd);
@@ -138,6 +153,8 @@ async function platformPrReview(args = []) {
         identity: { scope, round, commitSha: commit },
         event: event,
         body,
+        ...(typeof values.artifact === 'string' ? { recoveryArtifact: values.artifact } : {}),
+        ...(agent ? { agent } : {}),
         dryRun: values.dryRun === true
     }));
 }

package/dist/lib/internal/task-operation-registry.js

@@ -105,6 +105,8 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-invalidation', 'reconcile', 'task-bound', 'progress'),
         descriptor('internal', 'task-lifecycle', 'intent', 'task-bound', 'progress'),
         descriptor('internal', 'task-finalization', 'complete', 'task-bound', 'progress'),
+        descriptor('internal', 'task-platform-recovery', 'inspect', 'task-bound', 'diagnostic'),
+        descriptor('internal', 'task-platform-recovery', 'recover', 'task-bound', 'recovery'),
         descriptor('internal', 'task-short-id', 'list', 'conditional', 'diagnostic'),
         descriptor('internal', 'task-short-id', 'list-verify', 'conditional', 'diagnostic'),
         descriptor('internal', 'task-short-id', 'alloc', 'task-bound', 'progress'),
@@ -178,7 +180,7 @@ export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
     'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
     'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
     'task-orchestration', 'task-review', 'task-event', 'task-invalidation', 'task-lifecycle',
-    'task-finalization', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
+    'task-finalization', 'task-platform-recovery', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);
 export const PUBLIC_DISPATCHER_ROUTES = Object.freeze([
     'agent-client', 'cp', 'data', 'decide', 'help', 'init', 'merge', 'run', 'sandbox', 'server', 'task', 'sync', 'update', 'version'

package/dist/lib/internal/task-platform-recovery.js

@@ -0,0 +1,56 @@
+import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
+import { readPlatformOperationJournal } from '../task/platform-operation-journal.js';
+import { recoverPlatformOperations } from '../task/platform-operation-recovery.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+const USAGE = 'Usage: agent-infra-internal task-platform-recovery <N | TASK-id> <inspect | recover> [--agent <agent>] [--selection required|deferred|all]\n';
+function option(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+async function taskPlatformRecovery(args = []) {
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    if (!ensureInternalHandlerRoute('task-platform-recovery', args))
+        return;
+    const action = args[1];
+    const registered = action === 'inspect'
+        ? internalHandlerRoute('task-platform-recovery', 'inspect', action)
+        : action === 'recover' && internalHandlerRoute('task-platform-recovery', 'recover', action);
+    if (!registered)
+        return;
+    const repoRoot = detectRepoRoot();
+    const task = resolveTaskRef(args[0] ?? '', { repoRoot });
+    if (!task.ok) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: task.code, message: task.message } })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    if (action === 'inspect') {
+        try {
+            const journal = readPlatformOperationJournal(task.taskId, repoRoot);
+            process.stdout.write(`${JSON.stringify({ status: 'ready', changed: false, taskId: task.taskId, journal })}\n`);
+        }
+        catch (error) {
+            const value = error;
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: value.code || 'PLATFORM_OPERATION_JOURNAL_INVALID', message: value.message || String(error) } })}\n`);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    const agent = option(args, '--agent');
+    const selection = option(args, '--selection') ?? 'all';
+    if (!agent || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u.test(agent)
+        || !['required', 'deferred', 'all'].includes(selection)) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'PLATFORM_OPERATION_RECOVERY_PAYLOAD_INVALID', message: 'recover requires a valid --agent and --selection' } })}\n`);
+        process.stderr.write(USAGE);
+        process.exitCode = 1;
+        return;
+    }
+    const result = await recoverPlatformOperations(task.taskId, selection, { agent, cwd: repoRoot });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    process.exitCode = result.status === 'applied' || result.status === 'no-op' ? 0 : result.status === 'blocked' ? 2 : 1;
+}
+export { taskPlatformRecovery };
+//# sourceMappingURL=task-platform-recovery.js.map

package/dist/lib/merge.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { removeDirRecursive } from './remove-dir.js';
@@ -305,6 +306,23 @@ function formatBackupTimestamp(date) {
         String(date.getDate()).padStart(2, '0')
     ].join('') + `-${String(date.getHours()).padStart(2, '0')}${String(date.getMinutes()).padStart(2, '0')}${String(date.getSeconds()).padStart(2, '0')}`;
 }
+function resolveRecoveryProjectKey(repoRoot) {
+    let projectKey;
+    try {
+        const config = JSON.parse(fs.readFileSync(path.join(repoRoot, '.agents', '.airc.json'), 'utf8'));
+        if (typeof config.project === 'string' && config.project.trim() !== '') {
+            projectKey = config.project.trim();
+        }
+    }
+    catch {
+        // Fall back to the repository directory when project config is unavailable.
+    }
+    projectKey ??= path.basename(repoRoot);
+    if (!/^[A-Za-z0-9_.@-]+$/.test(projectKey) || projectKey === '.' || projectKey === '..') {
+        throw new Error(`Invalid project name for recovery backups: ${projectKey}`);
+    }
+    return projectKey;
+}
 function toPosixPath(relativePath) {
     return relativePath.split(path.sep).join('/');
 }
@@ -400,7 +418,7 @@ function buildWorkspaceIndex(workspaceDir) {
 function backupTaskDir(backupRoot, section, taskDir, taskId) {
     const backupDir = path.join(backupRoot, section, taskId);
     fs.mkdirSync(path.dirname(backupDir), { recursive: true });
-    fs.cpSync(taskDir, backupDir, { recursive: true });
+    fs.cpSync(taskDir, backupDir, { recursive: true, verbatimSymlinks: true });
     return backupDir;
 }
 function copyTaskToSection(sourceTask, workspaceDir) {
@@ -872,12 +890,14 @@ async function cmdMerge(args) {
     if (!fs.lstatSync(resolvedSource).isDirectory()) {
         throw new Error(`Source path is not a directory: ${sourcePath}`);
     }
-    const workspaceDir = path.join(process.cwd(), '.agents', 'workspace');
+    const repoRoot = process.cwd();
+    const workspaceDir = path.join(repoRoot, '.agents', 'workspace');
     const archiveDir = path.join(workspaceDir, 'archive');
     const backupStamp = formatBackupTimestamp(new Date());
-    const backupRootRelative = `.agents/workspace/.merge-backup/${backupStamp}/`;
-    const backupRoot = path.join(workspaceDir, '.merge-backup', backupStamp);
-    const report = createReport(resolvedSource, backupRootRelative);
+    const projectKey = resolveRecoveryProjectKey(repoRoot);
+    const recoveryRoot = path.join(os.homedir(), '.agent-infra', 'recovery-backups', projectKey, 'workspace-merge');
+    const backupRoot = path.join(recoveryRoot, backupStamp);
+    const report = createReport(resolvedSource, backupRoot);
     detectSourceMode(resolvedSource);
     validateSourceWorkspace(resolvedSource);
     validateArchiveSection(workspaceDir, new Map());

package/dist/lib/platform/completion-backfill.js

@@ -19,7 +19,7 @@ function referencedBackfillArtifact(taskDir, message) {
     if (names.length !== 1)
         return { status: 'ignored', artifact: null, error: null };
     const parsed = parseArtifactName(names[0]);
-    if (!parsed || (parsed.family !== 'pr-review' && !COMPLETION_BACKFILL_FAMILIES.includes(parsed.family))) {
+    if (!parsed || !COMPLETION_BACKFILL_FAMILIES.includes(parsed.family)) {
         return { status: 'ignored', artifact: null, error: null };
     }
     const artifactPath = path.join(taskDir, parsed.name);
@@ -112,6 +112,7 @@ async function backfillCompletionComments(taskRef, options) {
             artifact: artifact.name,
             agent: options.agent,
             backfill: true,
+            dependency: 'required',
             cwd: resolved.repoRoot,
             client: options.client
         });

package/dist/lib/platform/in-label-sync.js

@@ -1,4 +1,5 @@
 import { computeInLabels } from './metadata-labels.js';
+import { createHash } from 'node:crypto';
 function inLabels(labels) {
     return [...new Set(labels.filter((label) => label.startsWith('in:')))].sort();
 }
@@ -26,6 +27,16 @@ function validateInLabelMapping(value) {
     }
     return { ok: true, value: normalized };
 }
+function inLabelMappingDigest(value) {
+    const mapping = validateInLabelMapping(value);
+    if (!mapping.ok)
+        return mapping;
+    const canonical = Object.fromEntries(Object.keys(mapping.value).sort().map((name) => [
+        name,
+        [...new Set(mapping.value[name])].sort()
+    ]));
+    return { ok: true, digest: createHash('sha256').update(JSON.stringify(canonical)).digest('hex') };
+}
 function repositoryLabelPages(value) {
     if (!Array.isArray(value))
         return null;
@@ -139,5 +150,5 @@ function extractPullRequestFileNames(value) {
 function resourceSnapshot(kind, number, labels) {
     return { kind, number, labels: [...labels].sort() };
 }
-export { extractPullRequestFileNames, extractRepositoryLabelNames, flattenPages, inLabels, labelDelta, mergeInLabels, planInLabelUpdate, resourceSnapshot, syncLabelDelta, validateInLabelMapping, validateRepositoryLabelPayload };
+export { extractPullRequestFileNames, extractRepositoryLabelNames, flattenPages, inLabels, inLabelMappingDigest, labelDelta, mergeInLabels, planInLabelUpdate, resourceSnapshot, syncLabelDelta, validateInLabelMapping, validateRepositoryLabelPayload };
 //# sourceMappingURL=in-label-sync.js.map

package/dist/lib/platform/issue-comments.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
+import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
@@ -29,6 +30,8 @@ const ARTIFACT_TITLES = {
     'review-plan': '技术方案审查',
     code: '实现报告',
     'review-code': '代码审查',
+    'manual-validation': '人工验证',
+    'validation-run': '验证运行证据',
     'pr-review': 'PR 审查报告'
 };
 function normalizeCommentContent(content) {
@@ -98,7 +101,7 @@ function taskCommentLanguage(repoRoot) {
 }
 function artifactIdentity(artifact) {
     const stem = path.basename(artifact, '.md');
-    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|pr-review)(?:-r(\d+))?$/);
+    const match = stem.match(/^(analysis|review-analysis|plan|review-plan|code|review-code|manual-validation|validation-run|pr-review)(?:-r(\d+))?$/);
     if (!match)
         throw new Error(`unsupported artifact '${artifact}'`);
     const base = ARTIFACT_TITLES[match[1]];
@@ -430,7 +433,7 @@ function writeComment(client, repo, issue, cwd, body, id) {
     const endpoint = id ? `repos/${repo}/issues/comments/${id}` : `repos/${repo}/issues/${issue}/comments`;
     return client.json(['api', endpoint, '-X', id ? 'PATCH' : 'POST', '--input', '-'], { cwd, method: id ? 'PATCH' : 'POST', input: JSON.stringify({ body }) });
 }
-async function syncPlatformComment(taskRef, options) {
+async function syncPlatformCommentImpl(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok) {
         return platformResult('failed', {
@@ -452,7 +455,12 @@ async function syncPlatformComment(taskRef, options) {
     }
     let desired;
     try {
-        desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, resolved.repoRoot, options);
+        const projectedContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+        if (options.kind === 'task' && options.taskProjection
+            && createHash('sha256').update(projectedContent).digest('hex') !== options.taskProjection.sha256) {
+            throw Object.assign(new Error('finalization task projection digest does not match content'), { code: 'FINALIZATION_PROJECTION_INVALID' });
+        }
+        desired = expectedComments(resolved.taskId, projectedContent, resolved.taskDir, resolved.repoRoot, options);
     }
     catch (error) {
         return platformResult('failed', {
@@ -644,6 +652,52 @@ async function syncPlatformComment(taskRef, options) {
     });
     return result;
 }
+async function syncPlatformComment(taskRef, options) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return syncPlatformCommentImpl(taskRef, options);
+    const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    if (!taskIssueIdentity(parseTaskFrontmatter(taskContent)))
+        return syncPlatformCommentImpl(taskRef, options);
+    let operation;
+    try {
+        const sourceContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+        const desired = expectedComments(resolved.taskId, sourceContent, resolved.taskDir, resolved.repoRoot, options);
+        const content = desired.map((chunk) => chunk.content).join('\0');
+        const kind = options.kind === 'task' ? 'task-comment' : options.kind === 'summary' ? 'summary-comment'
+            : options.kind === 'cancel' ? 'cancel-comment' : 'artifact-comment';
+        const target = options.kind === 'artifact' ? options.artifact : options.kind;
+        operation = { kind, target, expectedDigest: createHash('sha256').update(content).digest('hex') };
+    }
+    catch {
+        return syncPlatformCommentImpl(taskRef, options);
+    }
+    const execute = () => syncPlatformCommentImpl(taskRef, options);
+    if (options.skipQueue)
+        return execute();
+    return coordinatePlatformWrite({
+        operation: { taskRef: resolved.taskId, cwd: resolved.repoRoot, ...operation, dependency: options.dependency ?? 'deferred' },
+        agent: options.agent,
+        execute,
+        block: (error) => platformResult('blocked', { error }),
+        persistenceFailure: (error) => platformResult('failed', { error })
+    });
+}
+function inspectPlatformCommentOperation(taskRef, options) {
+    const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
+    if (!resolved.ok)
+        return null;
+    const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    if (!taskIssueIdentity(parseTaskFrontmatter(taskContent)))
+        return null;
+    const sourceContent = options.kind === 'task' && options.taskProjection ? options.taskProjection.content : taskContent;
+    const desired = expectedComments(resolved.taskId, sourceContent, resolved.taskDir, resolved.repoRoot, options);
+    const kind = options.kind === 'task' ? 'task-comment' : options.kind === 'summary' ? 'summary-comment'
+        : options.kind === 'cancel' ? 'cancel-comment' : 'artifact-comment';
+    const target = options.kind === 'artifact' ? options.artifact : options.kind;
+    const expectedDigest = createHash('sha256').update(desired.map((chunk) => chunk.content).join('\0')).digest('hex');
+    return { kind, target, expectedDigest, id: createHash('sha256').update(`${kind}\0${target}\0${expectedDigest}`).digest('hex') };
+}
 async function listPlatformComments(issue, cwd = process.cwd(), client) {
     const loaded = await resolvePlatformProviderContext({ cwd, client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
@@ -708,5 +762,5 @@ async function checkPlatformCommentOwner(taskRef, options = {}) {
     }
     return platformResult('no-op', { ...contextFields(context), resource: { kind: 'issue', number: resourceIdentityNumber(issueIdentity), identity: issueIdentity }, error: null });
 }
-export { COMMENT_BYTE_LIMIT, MARKERS, chunkArtifactComment, findMarkerComments, listRemoteComments, checkPlatformCommentOwner, listPlatformComments, normalizeCommentContent, renderTaskComment, renderTaskCommentResult, isTaskCommentTooLarge, syncPlatformComment, validateRelatedMarkerSet, writeComment };
+export { COMMENT_BYTE_LIMIT, MARKERS, chunkArtifactComment, inspectPlatformCommentOperation, findMarkerComments, listRemoteComments, checkPlatformCommentOwner, listPlatformComments, normalizeCommentContent, renderTaskComment, renderTaskCommentResult, isTaskCommentTooLarge, syncPlatformComment, validateRelatedMarkerSet, writeComment };
 //# sourceMappingURL=issue-comments.js.map