@fitlab-ai/agent-infra 0.11.8 → 0.11.10

package/dist/lib/platform/github-provider.js

@@ -7,6 +7,32 @@ import semver from 'semver';
 import { createGitHubClient, MINIMUM_GITHUB_CLI_VERSION } from './github-client.js';
 import { resourceIdentityNumber, resourceIdentityString } from './resource-identity.js';
 import { extractPullRequestFileNames, syncLabelDelta } from './in-label-sync.js';
+function providerError(error) {
+    return { code: error.code, message: error.message };
+}
+function publicProviderErrors(provider) {
+    const sanitize = async (call) => {
+        const result = await call();
+        if (!result || typeof result !== 'object' || result.ok !== false)
+            return result;
+        const envelope = result;
+        return envelope.error ? { ...result, error: providerError(envelope.error) } : result;
+    };
+    const wrapped = { ...provider, context: { ...provider.context } };
+    wrapped.context.resolve = (input) => sanitize(() => provider.context.resolve(input));
+    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'securityAlerts', 'repositoryMetadata', 'verification']) {
+        const group = provider[groupName];
+        if (!group)
+            continue;
+        const target = { ...group };
+        for (const method of Object.keys(group)) {
+            const original = group[method];
+            target[method] = (input) => sanitize(() => original(input));
+        }
+        wrapped[groupName] = target;
+    }
+    return wrapped;
+}
 const CURRENT_USER_QUERY = 'query { viewer { login } }';
 const ISSUE_TYPES_QUERY = `query($owner:String!){organization(login:$owner){issueTypes(first:20){nodes{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}}}}}`;
 const CLOSING_ISSUES_QUERY = 'query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){closingIssuesReferences(first:100,after:$cursor){nodes{number} pageInfo{hasNextPage endCursor}}}}}';
@@ -57,7 +83,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: 'Pull request repository identity is inconsistent',
-                retryable: false
             }
         };
     }
@@ -80,7 +105,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: 'Pull request Git refs are invalid',
-                retryable: false
             }
         };
     }
@@ -97,7 +121,6 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
             error: {
                 code: 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE',
                 message: `No GitHub remote can provide evidence for ${repository}`,
-                retryable: false
             }
         };
     }
@@ -107,7 +130,7 @@ function resolveGitHubChangeRequestGitEvidence({ cwd, repository, number, baseRe
     };
 }
 function failure(error) {
-    return { ok: false, error };
+    return { ok: false, error: providerError(error) };
 }
 function resolveContext(client, input) {
     const cwd = input.workingDirectory;
@@ -118,19 +141,17 @@ function resolveContext(client, input) {
         return failure({
             code: 'GH_CLI_VERSION_UNSUPPORTED',
             message: 'GitHub CLI ' + version.value + ' is unsupported; install gh >= ' + MINIMUM_GITHUB_CLI_VERSION,
-            retryable: false
         });
     }
     const remote = input.gitRemote || defaultGitRemote(cwd);
     if (!remote) {
-        return failure({ code: 'REMOTE_MISSING', message: 'Git origin remote is not configured', retryable: false });
+        return failure({ code: 'REMOTE_MISSING', message: 'Git origin remote is not configured' });
     }
     const ownerRepo = parseGitHubRemote(remote);
     if (!ownerRepo) {
         return failure({
             code: /github\.com/i.test(remote) ? 'REMOTE_INVALID' : 'PLATFORM_UNSUPPORTED',
             message: 'Unable to parse GitHub owner/repo from configured remote',
-            retryable: false
         });
     }
     const repository = client.json(['api', 'repos/' + ownerRepo], { cwd });
@@ -142,7 +163,6 @@ function resolveContext(client, input) {
         return failure({
             code: 'UPSTREAM_UNRESOLVED',
             message: 'Unable to resolve the upstream repository',
-            retryable: false
         });
     const user = client.json(['api', 'graphql', '-f', 'query=' + CURRENT_USER_QUERY], { cwd });
     if (!user.ok)
@@ -193,7 +213,7 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
     if (!wanted.ref || !/^[A-Za-z0-9._/-]+$/.test(wanted.ref))
         return {
             ok: false,
-            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid', retryable: false }
+            error: { code: 'PR_HEAD_INVALID', message: 'Pull request head ref is invalid' }
         };
     const remotes = configuredGitRemotes(cwd);
     const remote = remotes.find((item) => item.repository.toLowerCase() === wanted.repository.toLowerCase())
@@ -201,7 +221,7 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
     if (!remote)
         return {
             ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}`, retryable: false }
+            error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `No configured remote can verify ${wanted.repository}:${wanted.ref}` }
         };
     try {
         const output = execFileSync('git', ['ls-remote', '--refs', remote.name, `refs/heads/${wanted.ref}`], {
@@ -212,19 +232,19 @@ function verifyRemoteBranch(cwd, repositoryName, head) {
         if (!sha || !/^[a-f0-9]{40}$/i.test(sha))
             return {
                 ok: false,
-                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist`, retryable: false }
+                error: { code: 'PR_REMOTE_BRANCH_MISSING', message: `Remote branch ${wanted.repository}:${wanted.ref} does not exist` }
             };
         return { ok: true, value: sha };
     }
     catch (error) {
         return {
             ok: false,
-            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: true }
+            error: { code: 'PR_REMOTE_BRANCH_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) }
         };
     }
 }
 function invalid(code, message) {
-    return { ok: false, error: { code, message, retryable: false } };
+    return { ok: false, error: { code, message } };
 }
 function changeRequestSnapshot(value) {
     return {
@@ -292,7 +312,7 @@ function createReceipt(remoteId) {
     return { ok: true, value: { changed: true, remoteId } };
 }
 function partialFailure(response, value) {
-    return { ok: false, error: response.error, value };
+    return { ok: false, error: providerError(response.error), value };
 }
 function labelReconciliation(created, updated, removed, skipped) {
     return {
@@ -319,8 +339,8 @@ function syncLabels(client, repositoryName, number, cwd, current, target, prefix
                     status: 'blocked',
                     changed: true,
                     error: synced.error
-                        ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
-                        : { code: 'IN_LABEL_SYNC_PARTIAL', message: 'In-label synchronization is partial or unknown', retryable: true }
+                        ? { ...providerError(synced.error), code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
+                        : { code: 'IN_LABEL_SYNC_PARTIAL', message: 'In-label synchronization is partial or unknown' }
                 };
             return synced;
         }
@@ -599,7 +619,7 @@ function createGitHubOperations(client) {
                 localHead = repositoryHead(context.workingDirectory);
             }
             catch (error) {
-                return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error), retryable: false } };
+                return { ok: false, error: { code: 'PR_LOCAL_HEAD_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };
             }
             const remote = verifyRemoteBranch(context.workingDirectory, repository(context), head);
             if (!remote.ok)
@@ -607,7 +627,7 @@ function createGitHubOperations(client) {
             if (remote.value !== localHead)
                 return {
                     ok: false,
-                    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}`, retryable: false }
+                    error: { code: 'PR_REMOTE_HEAD_MISMATCH', message: `Remote head ${remote.value} does not match local HEAD ${localHead}` }
                 };
             return { ok: true, value: { sha: localHead } };
         },
@@ -904,7 +924,7 @@ function createGitHubOperations(client) {
                 const tag = resourceIdentityString(release) || '';
                 const result = module.publishGitHubReleaseNotes({ repository: repository(context), tag, title, notesFile }, { cwd: context.workingDirectory, client });
                 if (result.status === 'failed' || result.status === 'blocked')
-                    return { ok: false, error: result.error || { code: 'RELEASE_NOTES_PUBLISH_FAILED', message: 'Release notes publish failed', retryable: false } };
+                    return { ok: false, error: result.error ? providerError(result.error) : { code: 'RELEASE_NOTES_PUBLISH_FAILED', message: 'Release notes publish failed' } };
                 return { ok: true, value: { changed: result.changed, remoteId: tag } };
             }
             finally {
@@ -917,7 +937,7 @@ function createGitHubOperations(client) {
                 repository: repository(context), commitOids, branch, historyLimit, fromTime, toTime
             }, { cwd: context.workingDirectory, client });
             if (collected.status === 'failed' || collected.status === 'blocked' || !('pullRequests' in collected)) {
-                return { ok: false, error: collected.error || { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected', retryable: false } };
+                return { ok: false, error: collected.error ? providerError(collected.error) : { code: 'RELEASE_NOTES_COLLECTION_FAILED', message: 'Release notes could not be collected' } };
             }
             const mergedPullRequests = collected.pullRequests.map((item) => ({
                 id: String(item.number), identity: { kind: 'number', value: Number(item.number) }, number: Number(item.number),
@@ -1114,7 +1134,7 @@ function createGitHubOperations(client) {
     return { issues, comments, changeRequests, checks, reviews, releases, securityAlerts, repositoryMetadata, verification };
 }
 function createGitHubProvider(input, client = createGitHubClient()) {
-    return {
+    return publicProviderErrors({
         type: input.providerType,
         contractVersion: 2,
         identity: { issue: 'number', 'pull-request': 'number', comment: 'number', release: 'key' },
@@ -1124,7 +1144,7 @@ function createGitHubProvider(input, client = createGitHubClient()) {
                 return resolveContext(client, contextInput);
             }
         }
-    };
+    });
 }
 export { configuredGitRemotes, createGitHubProvider, defaultGitRemote, parseGitHubRemote, resolveGitHubChangeRequestGitEvidence };
 //# sourceMappingURL=github-provider.js.map

package/dist/lib/platform/github-release-notes.js

@@ -1,4 +1,5 @@
 import { createGitHubClient } from './github-client.js';
+import { providerErrorRetryable } from './provider-validation.js';
 function normalizeGitHubActor(actor) {
     const name = String(actor.name || '').trim();
     const email = actor.email ? String(actor.email).trim() : null;
@@ -26,12 +27,13 @@ function normalizePlatformAuthor(author) {
     };
 }
 function failure(error) {
+    const retryable = error.retryable ?? providerErrorRetryable(error.code);
     return {
-        status: error.retryable ? 'blocked' : 'failed',
+        status: retryable ? 'blocked' : 'failed',
         changed: false,
         operation: null,
         url: null,
-        error
+        error: { code: error.code, message: error.message }
     };
 }
 function publishGitHubReleaseNotes(input, options = {}) {

package/dist/lib/platform/in-label-sync.js

@@ -1,5 +1,6 @@
 import { computeInLabels } from './metadata-labels.js';
 import { createHash } from 'node:crypto';
+import { providerErrorRetryable } from './provider-validation.js';
 function inLabels(labels) {
     return [...new Set(labels.filter((label) => label.startsWith('in:')))].sort();
 }
@@ -96,7 +97,7 @@ function syncLabelDelta(client, repository, number, cwd, current, target, prefix
     const delta = labelDelta(current, target, prefix);
     let changed = false;
     const failure = (error) => {
-        if (changed || error.retryable) {
+        if (changed || error.retryable || providerErrorRetryable(error.code)) {
             return {
                 status: 'blocked',
                 changed,

package/dist/lib/platform/issue-comments.js

@@ -5,6 +5,7 @@ import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityNumber } from './resource-identity.js';
@@ -12,6 +13,9 @@ import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.js'
 import { recordForArtifact, recordForCancel, recordForSummary, recordForTask, renderActivityRecoveryMetadata } from './activity-recovery.js';
 import { projectTaskComment } from './task-comment-projection.js';
 import { canonicalizeCommentBody, escapeHtmlText, fenceRanges, renderSafeCodeFence } from './comment-safety.js';
+function isRetryable(error) {
+    return error.retryable ?? providerErrorRetryable(error.code);
+}
 function providerCommentId(id, provider) {
     return provider.identity?.comment === 'number' && /^\d+$/.test(id) ? Number(id) : id;
 }
@@ -482,7 +486,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
     const issue = resourceIdentityNumber(issueIdentityFromTask);
     const listed = await listedComments(loaded.value.provider, loaded.value, issueIdentityFromTask);
     if (!listed.ok) {
-        return platformResult(listed.error.retryable ? 'blocked' : 'failed', {
+        return platformResult(isRetryable(listed.error) ? 'blocked' : 'failed', {
             ...contextFields(context), resource: { kind: 'issue', number: issue }, error: listed.error
         });
     }
@@ -548,10 +552,10 @@ async function syncPlatformCommentImpl(taskRef, options) {
             })
             : unsupportedProviderOperation(loaded.value.provider, 'comments.write');
         if (!written.ok) {
-            if (!current && written.error.retryable) {
+            if (!current && isRetryable(written.error)) {
                 // A provider owns reconciliation because only it knows how to address the resource.
             }
-            return platformResult(written.error.retryable ? 'blocked' : 'failed', {
+            return platformResult(isRetryable(written.error) ? 'blocked' : 'failed', {
                 ...contextFields(context),
                 resource: { kind: 'issue', number: issue },
                 operations,
@@ -573,7 +577,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
             })
             : unsupportedProviderOperation(loaded.value.provider, 'comments.delete');
         if (!deleted.ok) {
-            return platformResult(deleted.error.retryable ? 'blocked' : 'failed', {
+            return platformResult(isRetryable(deleted.error) ? 'blocked' : 'failed', {
                 ...contextFields(context),
                 resource: { kind: 'issue', number: issue },
                 operations,
@@ -585,7 +589,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
     if (options.kind === 'summary') {
         const refreshed = await listedComments(loaded.value.provider, loaded.value, issueIdentityFromTask);
         if (!refreshed.ok) {
-            return platformResult(refreshed.error.retryable ? 'blocked' : 'failed', {
+            return platformResult(isRetryable(refreshed.error) ? 'blocked' : 'failed', {
                 ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error: refreshed.error
             });
         }
@@ -613,7 +617,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
                 })
                 : unsupportedProviderOperation(loaded.value.provider, 'comments.delete');
             if (!deleted.ok) {
-                return platformResult(deleted.error.retryable ? 'blocked' : 'failed', {
+                return platformResult(isRetryable(deleted.error) ? 'blocked' : 'failed', {
                     ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error: deleted.error
                 });
             }
@@ -624,7 +628,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
                 })
                 : unsupportedProviderOperation(loaded.value.provider, 'comments.write');
             if (!written.ok) {
-                return platformResult(written.error.retryable ? 'blocked' : 'failed', {
+                return platformResult(isRetryable(written.error) ? 'blocked' : 'failed', {
                     ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error: written.error
                 });
             }
@@ -635,7 +639,7 @@ async function syncPlatformCommentImpl(taskRef, options) {
                 const error = reconciled.ok
                     ? { code: 'SUMMARY_POSITION_UNVERIFIED', message: 'Summary comment is not provably last among task-managed comments', retryable: true }
                     : reconciled.error;
-                return platformResult(error.retryable ? 'blocked' : 'failed', {
+                return platformResult(isRetryable(error) ? 'blocked' : 'failed', {
                     ...contextFields(context), resource: { kind: 'issue', number: issue }, operations, error
                 });
             }
@@ -748,7 +752,7 @@ async function checkPlatformCommentOwner(taskRef, options = {}) {
             : response)
         : unsupportedProviderOperation(loaded.value.provider, 'comments.list');
     if (!listed.ok)
-        return platformResult(listed.error.retryable ? 'blocked' : 'failed', { ...contextFields(context), error: listed.error });
+        return platformResult(isRetryable(listed.error) ? 'blocked' : 'failed', { ...contextFields(context), error: listed.error });
     const matches = findMarkerComments(listed.value, MARKERS.task(resolved.taskId));
     if (matches.length > 1)
         return platformResult('failed', { ...contextFields(context), error: { code: 'COMMENT_MARKER_CONFLICT', message: 'Multiple task comments use the registered marker', retryable: false } });

package/dist/lib/platform/operation-coordinator.js

@@ -25,7 +25,7 @@ async function coordinatePlatformWrite(input) {
             excludeId: operationId
         });
     if (drained.status !== 'applied' && drained.status !== 'no-op') {
-        return input.block(drained.error ?? {
+        return input.block(drained.error ? { ...drained.error, retryable: true } : {
             code: 'PLATFORM_OPERATION_QUEUE_BLOCKED',
             message: 'A previous platform operation is still unresolved; the current write remains queued',
             retryable: true

package/dist/lib/platform/pr-review.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { coordinatePlatformWrite } from './operation-coordinator.js';
 import { resolvePlatformProviderContext } from './context.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
 import { isResourceIdentity, resourceIdentityEquals, resourceIdentityNumber, reviewMarker as resourceReviewMarker } from './resource-identity.js';
@@ -253,7 +254,7 @@ export async function publishPrReview(options) {
             })
             : unsupportedProviderOperation(loaded.value.provider, 'reviews.publish');
         if (!published.ok) {
-            if (published.error.retryable) {
+            if (published.error.retryable || providerErrorRetryable(published.error.code)) {
                 const reconciled = await listPrReviews(options.prNumber, { cwd: options.cwd, client: options.client });
                 const found = reconciled.reviews.find((review) => firstLine(review.body) === marker);
                 if (found)

package/dist/lib/platform/provider-bridge.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { identityFromRemoteValue, parseResourceIdentity, parseResourceToken, resourceIdentityNumber } from './resource-identity.js';
+import { providerErrorRetryable } from './provider-validation.js';
 function providerOperationContext(loaded, workingDirectory = loaded.workingDirectory, scopeId = loaded.snapshot.scope.id) {
     return {
         repositoryRoot: loaded.repositoryRoot,
@@ -12,11 +13,11 @@ function providerError(error, fallbackCode) {
     return {
         code: error.code || fallbackCode,
         message: error.message || 'Platform provider operation failed',
-        retryable: error.retryable
+        retryable: 'retryable' in error ? error.retryable : providerErrorRetryable(error.code)
     };
 }
 function providerStatus(error) {
-    return error.retryable ? 'blocked' : 'failed';
+    return ('retryable' in error ? error.retryable : providerErrorRetryable(error.code)) ? 'blocked' : 'failed';
 }
 function unsupportedProviderOperation(provider, operation) {
     return {
@@ -24,9 +25,7 @@ function unsupportedProviderOperation(provider, operation) {
         error: {
             code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
             message: `Platform '${provider.type}' does not provide ${operation}`,
-            retryable: false,
-            providerType: provider.type,
-            phase: 'operation'
+            retryable: false
         }
     };
 }

package/dist/lib/platform/provider-contract.d.ts

@@ -2,19 +2,16 @@ import type { ProviderIdentityDeclaration, ResourceIdentity } from './resource-i
 type JsonValue = string | number | boolean | null | JsonValue[] | {
     [key: string]: JsonValue;
 };
-type PlatformError = {
+type ProviderError = {
     code: string;
     message: string;
-    retryable: boolean;
-    providerType?: string;
-    phase?: string;
 };
 type ProviderResult<T> = {
     ok: true;
     value: T;
 } | {
     ok: false;
-    error: PlatformError;
+    error: ProviderError;
     value?: T;
 };
 type ProviderOperationContext = {
@@ -575,4 +572,4 @@ declare const PLATFORM_PROVIDER_CONTRACT_VERSION: 2;
 declare function isPlatformProviderFactory(value: unknown): value is PlatformProviderFactory;
 declare function validatePlatformProvider(value: unknown, providerType: string): ProviderResult<PlatformProvider>;
 export { PLATFORM_PROVIDER_CONTRACT_VERSION, isPlatformProviderFactory, validatePlatformProvider };
-export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MilestoneDefinition, MilestoneInitialization, LabelDefinition, LabelReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, PlatformError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ReleaseNoteAuthor, ReleaseNoteIssue, ReleaseNotePullRequest, ResourceIdentity, SecurityAlertKind, SecurityAlertSnapshot, ReviewSnapshot, VerificationRemoteFacts };
+export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MilestoneDefinition, MilestoneInitialization, LabelDefinition, LabelReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, ProviderError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ReleaseNoteAuthor, ReleaseNoteIssue, ReleaseNotePullRequest, ResourceIdentity, SecurityAlertKind, SecurityAlertSnapshot, ReviewSnapshot, VerificationRemoteFacts };

package/dist/lib/platform/provider-contract.js

@@ -37,10 +37,7 @@ function validatePlatformProvider(value, providerType) {
             ok: false,
             error: {
                 code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
-                message: 'Provider must expose matching type, contractVersion, and context.resolve',
-                retryable: false,
-                providerType,
-                phase: 'provider-validation'
+                message: 'Provider must expose matching type, contractVersion, and context.resolve'
             }
         };
     }
@@ -51,10 +48,7 @@ function validatePlatformProvider(value, providerType) {
                 ok: false,
                 error: {
                     code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
-                    message: 'Provider identity declaration is invalid',
-                    retryable: false,
-                    providerType,
-                    phase: 'provider-validation'
+                    message: 'Provider identity declaration is invalid'
                 }
             };
         }
@@ -68,10 +62,7 @@ function validatePlatformProvider(value, providerType) {
                 ok: false,
                 error: {
                     code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
-                    message: `Provider operation group ${groupName} is incomplete`,
-                    retryable: false,
-                    providerType,
-                    phase: 'provider-validation'
+                    message: `Provider operation group ${groupName} is incomplete`
                 }
             };
         }
@@ -84,9 +75,6 @@ function validatePlatformProvider(value, providerType) {
                         error: {
                             code: 'PLATFORM_PROVIDER_CONTRACT_INVALID',
                             message: `Provider operation group ${groupName} requires an identity declaration for ${resourceKind}`,
-                            retryable: false,
-                            providerType,
-                            phase: 'provider-validation'
                         }
                     };
                 }

package/dist/lib/platform/provider-validation.js

@@ -462,9 +462,11 @@ const PROVIDER_ERROR_CATALOG = {
     REMOTE_INVALID: { message: 'The platform remote is invalid', retryable: false },
     UPSTREAM_UNRESOLVED: { message: 'The platform upstream repository could not be resolved', retryable: false },
     RESOURCE_NOT_FOUND: { message: 'The platform resource was not found', retryable: false },
+    COMMENT_LIST_FAILED: { message: 'Comments could not be listed', retryable: true },
     PR_NOT_FOUND: { message: 'The pull request was not found', retryable: false },
     ISSUE_NOT_FOUND: { message: 'The issue was not found', retryable: false },
     REMOTE_BUSY: { message: 'Platform provider is temporarily busy', retryable: true },
+    IN_LABEL_SYNC_PARTIAL: { message: 'In-label synchronization is partial or unknown', retryable: true },
     NETWORK_TRANSIENT: { message: 'The platform request failed temporarily', retryable: true },
     NETWORK_RETRY: { message: 'The platform request failed temporarily', retryable: true },
     NETWORK_RETRY_EXHAUSTED: { message: 'The platform request retries were exhausted', retryable: true },
@@ -505,11 +507,14 @@ function safeProviderError(providerType, operation, value) {
     return {
         code: definition ? item.code : 'PLATFORM_PROVIDER_OPERATION_FAILED',
         message: definition?.message || PROVIDER_ERROR_CATALOG.PLATFORM_PROVIDER_OPERATION_FAILED.message,
-        retryable: definition?.retryable || false,
+        retryable: definition?.retryable ?? false,
         providerType,
         phase: operation
     };
 }
+function providerErrorRetryable(code) {
+    return PROVIDER_ERROR_CATALOG[code]?.retryable ?? false;
+}
 function validators(providerType, declaration) {
     return {
         'context.resolve': (value) => validateContext(value, providerType),
@@ -608,8 +613,8 @@ async function invokeProviderOperation(providerType, operation, call, validate)
             try {
                 exactKeys(envelope, Object.hasOwn(envelope, 'value') ? ['ok', 'error', 'value'] : ['ok', 'error'], `${operation} result`);
                 const error = envelope.error;
-                exactKeys(error, ['code', 'message', 'retryable'], `${operation} error`);
-                if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message || typeof error.retryable !== 'boolean')
+                exactKeys(error, ['code', 'message'], `${operation} error`);
+                if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message)
                     throw new Error('invalid provider error');
                 return {
                     ok: false,
@@ -648,5 +653,5 @@ function wrapProviderOperations(provider) {
     }
     return wrapped;
 }
-export { invokeProviderOperation, validationError, wrapProviderOperations };
+export { invokeProviderOperation, providerErrorRetryable, validationError, wrapProviderOperations };
 //# sourceMappingURL=provider-validation.js.map

package/dist/lib/platform/pull-requests.js

@@ -9,6 +9,7 @@ import { extractSection } from '../task/sections.js';
 import { captureTaskWriteMetadata, writeTask } from '../task/write.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { inspectPlatformIssue } from './issues.js';
+import { providerErrorRetryable } from './provider-validation.js';
 import { planPullRequestMetadata } from './pull-request-metadata.js';
 import { planInLabelUpdate, validateInLabelMapping } from './in-label-sync.js';
 import { platformResult } from './types.js';
@@ -582,9 +583,10 @@ async function syncPlatformPullRequestInLabels(prNumber, options = {}) {
                 : unsupportedProviderOperation(provider, 'changeRequests.update');
         if (!synced.ok) {
             const state = resourcesState.find((resource) => resource.kind === item.kind && resourceIdentityEquals(resource.identity, item.identity));
-            state.effect = synced.error.retryable ? 'unknown' : 'no-op';
+            const retryable = synced.error.retryable || providerErrorRetryable(synced.error.code);
+            state.effect = retryable ? 'unknown' : 'no-op';
             state.after = state.effect === 'unknown' ? null : item.snapshot.labels;
-            const partial = successfulWrites > 0 || synced.error.retryable;
+            const partial = successfulWrites > 0 || retryable;
             const error = partial
                 ? { ...synced.error, code: 'IN_LABEL_SYNC_PARTIAL', message: `In-label synchronization is partial or unknown: ${synced.error.message}` }
                 : synced.error;

package/dist/lib/sandbox/control/client.js

@@ -9,6 +9,7 @@ import { accessSandboxTaskView, taskViewFromStatus } from './task-view.js';
 import { readSandboxControlIdentitySentinel } from './identity-sentinel.js';
 import { configuredShortIdLength, resolveShortIdReadOnly } from '../../task/short-id.js';
 const SANDBOX_CONTROL_RESPONSE_SETTLE_MS = 250;
+const SANDBOX_TASK_FINALIZATION_RECOVERY_BUDGET_MS = 5 * 60_000;
 export class SandboxControlClientError extends Error {
     detail;
     accepted;
@@ -79,8 +80,10 @@ function preflight(statusDir, generation, taskViewEffect = null, now = Date.now(
     }
 }
 function taskViewEffectForRequest(request) {
-    if (request.family === 'task-lifecycle' || request.family === 'task-finalization')
+    if (request.family === 'task-lifecycle')
         return 'progress';
+    if (request.family === 'task-finalization')
+        return 'recovery';
     return null;
 }
 function parseResponse(raw, id, accepted = false) {
@@ -298,15 +301,24 @@ export function recoverSandboxControl(requestId, params = {}) {
                 else if (now - malformedResponseObservedAt >= SANDBOX_CONTROL_RESPONSE_SETTLE_MS) {
                     clientError('SANDBOX_CONTROL_RESPONSE_INVALID', 'broker response remained malformed', false, accepted, requestId);
                 }
-                sleep(25);
+                const remainingMs = deadline - Date.now();
+                if (remainingMs > 0)
+                    sleep(Math.min(25, Math.ceil(remainingMs)));
                 continue;
             }
-            if (response.phase === 'accepted')
+            if (response.phase === 'accepted') {
+                accepted = true;
+            }
+            else if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') {
                 accepted = true;
-            else
+            }
+            else {
                 return response;
+            }
         }
-        sleep(25);
+        const remainingMs = deadline - Date.now();
+        if (remainingMs > 0)
+            sleep(Math.min(25, Math.ceil(remainingMs)));
     }
     clientError('SANDBOX_CONTROL_RESULT_UNKNOWN', 'request did not produce a final result; inspect domain state before retrying', false, accepted, requestId);
 }
@@ -356,7 +368,43 @@ export function requestSandboxTaskFinalization(params) {
         controllerProcess: null,
         controllerProof: null
     };
-    return exchangeSandboxControl(request, params);
+    let response;
+    try {
+        response = exchangeSandboxControl(request, params);
+    }
+    catch (error) {
+        if (!(error instanceof SandboxControlClientError)
+            || error.detail.code !== 'SANDBOX_CONTROL_RESULT_UNKNOWN'
+            || !error.accepted || !error.requestId)
+            throw error;
+        return recoverAcceptedTaskFinalization(error.requestId, params);
+    }
+    if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN') {
+        return recoverAcceptedTaskFinalization(response.id, params);
+    }
+    return response;
+}
+export function recoverAcceptedTaskFinalization(requestId, params, recover = recoverSandboxControl) {
+    const deadline = Date.now() + (params.recoveryBudgetMs ?? SANDBOX_TASK_FINALIZATION_RECOVERY_BUDGET_MS);
+    while (Date.now() < deadline) {
+        const timeoutMs = Math.min(30_000, deadline - Date.now());
+        if (timeoutMs <= 0)
+            break;
+        try {
+            const response = recover(requestId, { channelDir: params.channelDir, timeoutMs });
+            if (response.phase === 'rejected' && response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN')
+                continue;
+            return response;
+        }
+        catch (error) {
+            if (error instanceof SandboxControlClientError
+                && error.detail.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN'
+                && error.requestId === requestId)
+                continue;
+            throw error;
+        }
+    }
+    clientError('SANDBOX_CONTROL_RESULT_UNKNOWN', 'accepted finalization request remained unknown after the automatic recovery budget; inspect the receipt and resume by request id', false, true, requestId);
 }
 function exactKeys(value, keys) {
     return Object.keys(value).sort().join(',') === [...keys].sort().join(',');