@fitlab-ai/agent-infra 0.8.4 → 0.9.0

package/{templates/.agents/scripts/platform-adapters/platform-sync.github.js → lib/platform/verification-sync.ts}

@@ -1,10 +1,17 @@
 import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
-import spawn from "cross-spawn";
+import { execFileSync } from "node:child_process";
+
+import { createGitHubClient } from "./github-client.ts";
+import { resolvePlatformContext } from "./context.ts";
+import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.ts";
+import { inspectGitHubIssueMetadata, requirementSectionAnchors } from "./issues.ts";
+import { listRemoteComments } from "./issue-comments.ts";
+import { taskTypeLabel } from "./metadata-labels.ts";
+import { inspectGitHubPullRequest } from "./pull-requests.ts";
 
 const CHECK_TYPE = "platform-sync";
-const DEFAULT_RETRY_DELAYS_MS = [3000, 10000];
 const VERSION_LINE_REGEX = /^[0-9]+\.[0-9]+\.x$/;
 const FRONTMATTER_FIELD_MAP = {
   priority: "Priority",
@@ -12,17 +19,18 @@ const FRONTMATTER_FIELD_MAP = {
   start_date: "Start date",
   target_date: "Target date"
 };
-const OPTION_LOCALIZATION = {
+const OPTION_LOCALIZATION: Record<string, string> = {
   "紧急": "Urgent",
   "高": "High",
   "中": "Medium",
   "低": "Low"
 };
 
-let activeShared = null;
+let activeShared: any = null;
 let repoRoot = "";
+const githubClient = createGitHubClient();
 
-export function getDefaults() {
+export function getDefaults(): any {
   return {
     statusLabels: {
       pendingDesignWork: "status: pending-design-work",
@@ -42,7 +50,7 @@ export function getDefaults() {
   };
 }
 
-function getShared() {
+function getShared(): any {
   if (!activeShared) {
     throw new Error("platform-sync adapter shared utilities are unavailable");
   }
@@ -50,51 +58,51 @@ function getShared() {
   return activeShared;
 }
 
-function loadTask(...args) {
+function loadTask(...args: any[]): any {
   return getShared().loadTask(...args);
 }
 
-function getCheckedRequirements(...args) {
+function getCheckedRequirements(...args: any[]): any {
   return getShared().getCheckedRequirements(...args);
 }
 
-function normalizeContent(...args) {
+function normalizeContent(...args: any[]): any {
   return getShared().normalizeContent(...args);
 }
 
-function isBlank(...args) {
+function isBlank(...args: any[]): any {
   return getShared().isBlank(...args);
 }
 
-function escapeRegExp(...args) {
+function escapeRegExp(...args: any[]): any {
   return getShared().escapeRegExp(...args);
 }
 
-function passResult(...args) {
+function passResult(...args: any[]): any {
   return getShared().passResult(...args);
 }
 
-function failResult(...args) {
+function failResult(...args: any[]): any {
   return getShared().failResult(...args);
 }
 
-function blockedResult(...args) {
+function blockedResult(...args: any[]): any {
   return getShared().blockedResult(...args);
 }
 
-function safeStat(...args) {
+function safeStat(...args: any[]): any {
   return getShared().safeStat(...args);
 }
 
-function parseIssueNumber(...args) {
+function parseIssueNumber(...args: any[]): any {
   return getShared().parseIssueNumber(...args);
 }
 
-function parsePrNumber(...args) {
+function parsePrNumber(...args: any[]): any {
   return getShared().parsePrNumber(...args);
 }
 
-export function check({ taskDir, config, artifactFile }, shared) {
+export function check({ taskDir, config, artifactFile }: any, shared: any): any {
   activeShared = shared;
   repoRoot = shared.repoRoot;
   const context = buildSyncContext({ taskDir, config, artifactFile });
@@ -108,6 +116,7 @@ export function check({ taskDir, config, artifactFile }, shared) {
   }
 
   const subChecks = [
+    checkClosedIssueStatusLabels,
     checkStatusLabel,
     checkCommentMarker,
     checkPrCommentMarker,
@@ -135,7 +144,7 @@ export function check({ taskDir, config, artifactFile }, shared) {
   return passResult(CHECK_TYPE, `GitHub sync checks passed for Issue #${context.issueNumber}`);
 }
 
-function buildSyncContext({ taskDir, config, artifactFile }) {
+function buildSyncContext({ taskDir, config, artifactFile }: any): any {
   const task = loadTask(taskDir);
   if (!task.ok) {
     return { earlyReturn: failResult(CHECK_TYPE, task.message) };
@@ -154,12 +163,20 @@ function buildSyncContext({ taskDir, config, artifactFile }) {
     return { earlyReturn: passResult(CHECK_TYPE, "Skipped: platform-sync not required for this task") };
   }
 
-  const upstreamRepo = resolveUpstreamRepo(taskDir);
-  if (!upstreamRepo.ok) {
-    return { earlyReturn: blockedResult(CHECK_TYPE, upstreamRepo.message, "network_error") };
+  const platformContext = resolvePlatformContext({ cwd: repoRoot, client: githubClient });
+  if (platformContext.status === "failed") {
+    return { earlyReturn: failResult(CHECK_TYPE, platformContext.error?.message || "Platform context failed", "check_failed") };
+  }
+  if (platformContext.status === "blocked") {
+    return { earlyReturn: blockedResult(CHECK_TYPE, platformContext.error?.message || "Platform context blocked", "network_error") };
   }
-  const permissions = detectPermissions(upstreamRepo.value, taskDir);
-  const repoOwnerType = detectRepoOwnerType(upstreamRepo.value, taskDir);
+  if (!platformContext.platform.repository) {
+    if (platformContext.error?.code === "REMOTE_MISSING" || platformContext.error?.code === "REMOTE_INVALID") {
+      return { earlyReturn: blockedResult(CHECK_TYPE, platformContext.error.message, "network_error") };
+    }
+    return { earlyReturn: passResult(CHECK_TYPE, `Skipped: ${platformContext.error?.message || "platform unavailable"}`) };
+  }
+  const repoOwnerType = detectRepoOwnerType(platformContext.platform.repository, taskDir);
   const expectedValues = resolveExpectedValues(config);
   if (!expectedValues.ok) {
     return { earlyReturn: failResult(CHECK_TYPE, expectedValues.message, "check_failed") };
@@ -181,17 +198,17 @@ function buildSyncContext({ taskDir, config, artifactFile }) {
     artifactPath,
     issueNumber,
     prNumber,
-    upstreamRepo: upstreamRepo.value,
+    upstreamRepo: platformContext.platform.repository,
     repoOwnerType,
-    hasTriage: permissions.hasTriage,
-    hasPush: permissions.hasPush,
+    hasTriage: platformContext.capabilities.triage,
+    hasPush: platformContext.capabilities.push,
     expectedStatusLabel: expectedValues.statusLabel,
     marker,
     prMarker
   };
 }
 
-function resolveExpectedValues(config) {
+function resolveExpectedValues(config: any): any {
   const defaults = getDefaults();
   const statusLabel = resolveDefaultValue({
     collection: defaults.statusLabels,
@@ -231,7 +248,7 @@ function resolveExpectedValues(config) {
   };
 }
 
-function resolveDefaultValue({ collection, key, value, configKey }) {
+function resolveDefaultValue({ collection, key, value, configKey }: any): any {
   if (!key) {
     return { ok: true, value: value || null };
   }
@@ -244,30 +261,28 @@ function resolveDefaultValue({ collection, key, value, configKey }) {
   return { ok: true, value: resolvedValue };
 }
 
-function fetchRemoteData(context) {
-  let issueResult = withRetry(() => ghJson([
-    "issue",
-    "view",
-    String(context.issueNumber),
-    "-R",
+function fetchRemoteData(context: any): any {
+  const sharedIssue = inspectGitHubIssueMetadata(
+    githubClient,
     context.upstreamRepo,
-    "--json",
-    "state,labels,body,milestone"
-  ], context.taskDir));
-  if (!issueResult.ok && issueResult.type !== "check_failed") {
-    const fallbackIssueResult = withRetry(() => ghJson([
-      "api",
-      `repos/${context.upstreamRepo}/issues/${context.issueNumber}`
-    ], context.taskDir));
-    if (fallbackIssueResult.ok) {
-      issueResult = {
+    context.issueNumber,
+    context.taskDir
+  );
+  const issueResult = sharedIssue.ok
+    ? {
         ok: true,
-        value: normalizeIssuePayload(fallbackIssueResult.value)
+        value: {
+          state: sharedIssue.value.state.toUpperCase(),
+          labels: sharedIssue.value.labels.map((name) => ({ name })),
+          body: sharedIssue.value.body,
+          milestone: sharedIssue.value.milestone ? { title: sharedIssue.value.milestone } : null
+        }
+      }
+    : {
+        ok: false,
+        type: sharedIssue.error.retryable ? "network_error" : "check_failed",
+        message: sharedIssue.error.message
       };
-    } else {
-      issueResult = fallbackIssueResult;
-    }
-  }
   if (!issueResult.ok) {
     return {
       earlyReturn: issueResult.type === "check_failed"
@@ -311,22 +326,22 @@ function fetchRemoteData(context) {
       };
     }
 
-    const prCommentsResult = withRetry(() => ghPaginatedJson([
-      "api",
-      "--paginate",
-      "--slurp",
-      `repos/${context.upstreamRepo}/issues/${context.prNumber}/comments?per_page=100`
-    ], context.taskDir));
+    const prCommentsResult = listRemoteComments(
+      githubClient,
+      context.upstreamRepo,
+      context.prNumber,
+      context.taskDir
+    );
 
     if (!prCommentsResult.ok) {
       return {
-        earlyReturn: prCommentsResult.type === "check_failed"
-          ? failResult(CHECK_TYPE, prCommentsResult.message, prCommentsResult.type)
-          : blockedResult(CHECK_TYPE, prCommentsResult.message, prCommentsResult.type)
+        earlyReturn: prCommentsResult.error.retryable
+          ? blockedResult(CHECK_TYPE, prCommentsResult.error.message, "network_error")
+          : failResult(CHECK_TYPE, prCommentsResult.error.message, "check_failed")
       };
     }
 
-    prComments = flattenComments(prCommentsResult.value);
+    prComments = prCommentsResult.value;
   }
 
   let issueType;
@@ -367,46 +382,37 @@ function fetchRemoteData(context) {
   let prLabels = null;
   let prMilestone;
   let prAssignees;
+  let prHeadSha;
   if (((context.config.verify_in_labels_match_pr && context.hasTriage)
     || (context.config.verify_pr_type_label && context.hasTriage)
     || (context.config.verify_milestone && context.hasTriage)
-    || (context.config.verify_pr_assignee && context.hasPush)) && context.prNumber) {
-    const prFields = [];
-    if (context.config.verify_in_labels_match_pr || context.config.verify_pr_type_label) {
-      prFields.push("labels");
-    }
-    if (context.config.verify_milestone) {
-      prFields.push("milestone");
-    }
-    if (context.config.verify_pr_assignee) {
-      prFields.push("assignees");
-    }
-
-    const prResult = withRetry(() => ghJson([
-      "pr",
-      "view",
-      String(context.prNumber),
-      "--json",
-      prFields.join(",")
-    ], context.taskDir));
+    || (context.config.verify_pr_assignee && context.hasPush)
+    || context.config.verify_pr_comment_last_commit_matches_head) && context.prNumber) {
+    const prResult = inspectGitHubPullRequest(
+      githubClient,
+      context.upstreamRepo,
+      context.prNumber,
+      context.taskDir
+    );
 
     if (!prResult.ok) {
       return {
-        earlyReturn: prResult.type === "check_failed"
-          ? failResult(CHECK_TYPE, prResult.message, prResult.type)
-          : blockedResult(CHECK_TYPE, prResult.message, prResult.type)
+        earlyReturn: prResult.error.retryable
+          ? blockedResult(CHECK_TYPE, prResult.error.message, "network_error")
+          : failResult(CHECK_TYPE, prResult.error.message, "check_failed")
       };
     }
 
     prLabels = (context.config.verify_in_labels_match_pr || context.config.verify_pr_type_label)
-      ? extractLabelNames(prResult.value?.labels)
+      ? prResult.value.labels
       : null;
     prMilestone = context.config.verify_milestone
-      ? prResult.value?.milestone ?? null
+      ? prResult.value.milestone ? { title: prResult.value.milestone } : null
       : undefined;
     prAssignees = context.config.verify_pr_assignee
-      ? (prResult.value?.assignees || []).map((a) => a.login).filter(Boolean)
+      ? prResult.value.assignees
       : undefined;
+    prHeadSha = prResult.value.head.sha;
   }
 
   return {
@@ -417,27 +423,16 @@ function fetchRemoteData(context) {
     issueType,
     issueFields,
     prMilestone,
-    prAssignees
+    prAssignees,
+    prHeadSha
   };
 }
 
-function mapTaskTypeToLabel(taskType) {
-  const mapping = {
-    bug: "type: bug",
-    bugfix: "type: bug",
-    feature: "type: feature",
-    enhancement: "type: enhancement",
-    refactor: "type: enhancement",
-    refactoring: "type: enhancement",
-    documentation: "type: documentation",
-    "dependency-upgrade": "type: dependency-upgrade",
-    task: "type: task"
-  };
-
-  return mapping[taskType] || null;
+function mapTaskTypeToLabel(taskType: any): any {
+  return taskTypeLabel(taskType);
 }
 
-function shouldFetchComments(config) {
+function shouldFetchComments(config: any): any {
   return Boolean(
     config.expected_comment_marker
     || config.expected_comment_marker_key
@@ -449,7 +444,7 @@ function shouldFetchComments(config) {
   );
 }
 
-function flattenComments(value) {
+function flattenComments(value: any): any {
   if (!Array.isArray(value)) {
     return [];
   }
@@ -457,7 +452,7 @@ function flattenComments(value) {
   return value.flatMap((page) => Array.isArray(page) ? page : []);
 }
 
-function checkStatusLabel(context, remoteData) {
+function checkStatusLabel(context: any, remoteData: any): any {
   if (!context.expectedStatusLabel || !context.hasTriage) {
     return null;
   }
@@ -477,7 +472,28 @@ function checkStatusLabel(context, remoteData) {
   );
 }
 
-function checkCommentMarker(context, remoteData) {
+function checkClosedIssueStatusLabels(context: any, remoteData: any): any {
+  if (!context.config.verify_closed_issue_has_no_status_labels) {
+    return null;
+  }
+
+  if (String(remoteData.issue.state || "").toUpperCase() !== "CLOSED") {
+    return null;
+  }
+
+  const statusLabels = extractLabelNames(remoteData.issue.labels)
+    .filter((label: any) => label.startsWith("status:"));
+  if (statusLabels.length === 0) {
+    return null;
+  }
+
+  return failResult(CHECK_TYPE,
+    `Closed Issue #${context.issueNumber} retains status labels: ${statusLabels.join(", ")}`,
+    "check_failed"
+  );
+}
+
+function checkCommentMarker(context: any, remoteData: any): any {
   if (!context.marker) {
     return null;
   }
@@ -493,7 +509,7 @@ function checkCommentMarker(context, remoteData) {
   );
 }
 
-function checkPrCommentMarker(context, remoteData) {
+function checkPrCommentMarker(context: any, remoteData: any): any {
   if (!context.prMarker) {
     return null;
   }
@@ -509,7 +525,7 @@ function checkPrCommentMarker(context, remoteData) {
   );
 }
 
-function checkPrCommentLastCommit(context, remoteData) {
+function checkPrCommentLastCommit(context: any, remoteData: any): any {
   if (!context.config.verify_pr_comment_last_commit_matches_head) {
     return null;
   }
@@ -537,15 +553,9 @@ function checkPrCommentLastCommit(context, remoteData) {
     );
   }
 
-  const headResult = resolvePrHeadSha(context);
-  if (!headResult.ok) {
-    return headResult.type === "check_failed"
-      ? failResult(CHECK_TYPE, headResult.message, headResult.type)
-      : blockedResult(CHECK_TYPE, headResult.message, headResult.type);
-  }
-
-  const expectedHead = String(headResult.value || "").trim();
-  const actualHead = match[1].trim();
+  const expectedHead = String(remoteData.prHeadSha || "").trim();
+  if (!expectedHead) return blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error");
+  const actualHead = match[1]!.trim();
   if (expectedHead === actualHead) {
     return null;
   }
@@ -556,7 +566,7 @@ function checkPrCommentLastCommit(context, remoteData) {
   );
 }
 
-function checkPrCommentRequiredPatterns(context, remoteData) {
+function checkPrCommentRequiredPatterns(context: any, remoteData: any): any {
   const patterns = context.config.expected_pr_comment_required_patterns || [];
   if (!Array.isArray(patterns) || patterns.length === 0) {
     return null;
@@ -591,7 +601,7 @@ function checkPrCommentRequiredPatterns(context, remoteData) {
   return null;
 }
 
-function checkCommentContent(context, remoteData) {
+function checkCommentContent(context: any, remoteData: any): any {
   if (!context.config.verify_comment_content) {
     return null;
   }
@@ -626,7 +636,7 @@ function checkCommentContent(context, remoteData) {
   );
 }
 
-function checkTaskCommentContent(context, remoteData) {
+function checkTaskCommentContent(context: any, remoteData: any): any {
   if (!context.config.verify_task_comment_content) {
     return null;
   }
@@ -653,7 +663,7 @@ function checkTaskCommentContent(context, remoteData) {
   );
 }
 
-function checkPrTypeLabel(context, remoteData) {
+function checkPrTypeLabel(context: any, remoteData: any): any {
   if (!context.config.verify_pr_type_label || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
     return null;
   }
@@ -673,16 +683,16 @@ function checkPrTypeLabel(context, remoteData) {
   );
 }
 
-function checkInLabelsMatchPr(context, remoteData) {
+function checkInLabelsMatchPr(context: any, remoteData: any): any {
   if (!context.config.verify_in_labels_match_pr || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
     return null;
   }
 
   const issueInLabels = extractLabelNames(remoteData.issue.labels)
-    .filter((label) => label.startsWith("in:"))
+    .filter((label: any) => label.startsWith("in:"))
     .sort();
   const prInLabels = remoteData.prLabels
-    .filter((label) => label.startsWith("in:"))
+    .filter((label: any) => label.startsWith("in:"))
     .sort();
 
   if (arraysEqual(issueInLabels, prInLabels)) {
@@ -695,7 +705,7 @@ function checkInLabelsMatchPr(context, remoteData) {
   );
 }
 
-function checkInLabelsComputed(context, remoteData) {
+function checkInLabelsComputed(context: any, remoteData: any): any {
   if (!context.config.verify_in_labels_computed || !context.hasTriage) {
     return null;
   }
@@ -712,7 +722,7 @@ function checkInLabelsComputed(context, remoteData) {
   }
 
   const actualInLabels = extractLabelNames(remoteData.issue.labels)
-    .filter((label) => label.startsWith("in:"))
+    .filter((label: any) => label.startsWith("in:"))
     .sort();
 
   if (arraysEqual(expectedInLabels.labels, actualInLabels)) {
@@ -726,7 +736,7 @@ function checkInLabelsComputed(context, remoteData) {
   );
 }
 
-function checkSyncedRequirements(context, remoteData) {
+function checkSyncedRequirements(context: any, remoteData: any): any {
   if (!context.config.sync_checked_requirements || !context.hasTriage) {
     return null;
   }
@@ -737,8 +747,22 @@ function checkSyncedRequirements(context, remoteData) {
   }
 
   const issueBody = remoteData.issue.body || "";
+  const resolution = resolveRequirementSection(
+    issueBody,
+    requirementSectionAnchors(repoRoot, context.task.metadata.type || "task")
+  );
+  if (resolution.status === "missing") {
+    return null;
+  }
+  if (resolution.status === "ambiguous") {
+    return failResult(CHECK_TYPE,
+      `Issue #${context.issueNumber} requirements section is ambiguous`,
+      "check_failed"
+    );
+  }
+  const requirementBody = issueBody.slice(resolution.bodyStart, resolution.bodyEnd);
   const missingRequirements = checkedRequirements.filter(
-    (item) => !new RegExp(`^- \\[x\\] ${escapeRegExp(item)}$`, "m").test(issueBody)
+    (item: any) => !hasCheckedRequirement(requirementBody, item)
   );
   if (missingRequirements.length === 0) {
     return null;
@@ -750,7 +774,7 @@ function checkSyncedRequirements(context, remoteData) {
   );
 }
 
-function checkIssueType(context, remoteData) {
+function checkIssueType(context: any, remoteData: any): any {
   if (!context.config.verify_issue_type || !context.hasPush) {
     return null;
   }
@@ -781,7 +805,7 @@ function checkIssueType(context, remoteData) {
   return null;
 }
 
-function checkIssueFields(context, remoteData) {
+function checkIssueFields(context: any, remoteData: any): any {
   if (!context.config.verify_issue_fields || !context.hasPush) {
     return null;
   }
@@ -820,7 +844,7 @@ function checkIssueFields(context, remoteData) {
   return null;
 }
 
-function checkPrAssignee(context, remoteData) {
+function checkPrAssignee(context: any, remoteData: any): any {
   if (!context.config.verify_pr_assignee || !context.hasPush || !context.prNumber) {
     return null;
   }
@@ -835,7 +859,7 @@ function checkPrAssignee(context, remoteData) {
   return null;
 }
 
-function checkMilestone(context, remoteData) {
+function checkMilestone(context: any, remoteData: any): any {
   if (!context.config.verify_milestone || !context.hasTriage) {
     return null;
   }
@@ -873,44 +897,48 @@ function checkMilestone(context, remoteData) {
   return null;
 }
 
-function findCommentByMarker(comments, marker) {
-  return (comments || []).find((comment) => typeof comment.body === "string" && comment.body.includes(marker)) || null;
+function findCommentByMarker(comments: any, marker: any): any {
+  return (comments || []).find((comment: any) => typeof comment.body === "string" && comment.body.includes(marker)) || null;
+}
+
+function isGeneratedMarkerLine(line: any): any {
+  return line.startsWith("<!--") && line.endsWith("-->");
 }
 
-function extractCommentBody(commentBody) {
+function extractCommentBody(commentBody: any): any {
   const lines = String(commentBody || "").split(/\r?\n/);
 
   let start = 0;
-  while (start < lines.length && (lines[start].trim() === "" || /^<!--.*-->$/.test(lines[start].trim()))) {
+  while (start < lines.length && (lines[start]!.trim() === "" || isGeneratedMarkerLine(lines[start]!.trim()))) {
     start += 1;
   }
 
-  if (start < lines.length && lines[start].startsWith("## ")) {
+  if (start < lines.length && lines[start]!.startsWith("## ")) {
     start += 1;
   }
 
-  while (start < lines.length && lines[start].trim() === "") {
+  while (start < lines.length && lines[start]!.trim() === "") {
     start += 1;
   }
 
-  if (start < lines.length && /^> \*\*.+\*\* · .+$/.test(lines[start].trim())) {
+  if (start < lines.length && /^> \*\*.+\*\* · .+$/.test(lines[start]!.trim())) {
     start += 1;
   }
 
-  while (start < lines.length && lines[start].trim() === "") {
+  while (start < lines.length && lines[start]!.trim() === "") {
     start += 1;
   }
 
   let end = lines.length;
   for (let index = lines.length - 1; index >= start; index -= 1) {
-    const trimmed = lines[index].trim();
+    const trimmed = lines[index]!.trim();
     if (trimmed === "") {
       continue;
     }
 
     if (/^\*.*\*$/.test(trimmed)) {
       end = index;
-      if (end > start && lines[end - 1].trim() === "---") {
+      if (end > start && lines[end - 1]!.trim() === "---") {
         end -= 1;
       }
     }
@@ -920,7 +948,7 @@ function extractCommentBody(commentBody) {
   return lines.slice(start, end).join("\n");
 }
 
-function buildExpectedTaskBody(taskContent) {
+function buildExpectedTaskBody(taskContent: any): any {
   const frontmatterMatch = taskContent.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
   if (!frontmatterMatch) {
     return taskContent.trim();
@@ -940,7 +968,7 @@ function buildExpectedTaskBody(taskContent) {
   ].join("\n").trim();
 }
 
-function buildTaskFrontmatterSummary() {
+function buildTaskFrontmatterSummary(): any {
   const language = loadProjectLanguage();
   if (language === "en" || language === "en-US") {
     return "<details><summary>Metadata (frontmatter)</summary>";
@@ -949,7 +977,7 @@ function buildTaskFrontmatterSummary() {
   return "<details><summary>元数据 (frontmatter)</summary>";
 }
 
-function loadProjectLanguage() {
+function loadProjectLanguage(): any {
   const override = process.env.VALIDATE_ARTIFACT_LANGUAGE;
   if (!isBlank(override)) {
     return String(override).trim();
@@ -968,14 +996,14 @@ function loadProjectLanguage() {
   }
 }
 
-function buildCommentContentMismatchMessage(fileStem, issueNumber, localContent, commentContent) {
+function buildCommentContentMismatchMessage(fileStem: any, issueNumber: any, localContent: any, commentContent: any): any {
   const diffIndex = firstDifferenceIndex(localContent, commentContent);
   const position = indexToLineColumn(localContent, diffIndex);
 
   return `Comment content mismatch for '${fileStem}' on Issue #${issueNumber}: local file has ${localContent.length} chars, comment body has ${commentContent.length} chars (first difference near char ${diffIndex + 1}, line ${position.line}, column ${position.column})`;
 }
 
-function firstDifferenceIndex(left, right) {
+function firstDifferenceIndex(left: any, right: any): any {
   const limit = Math.max(left.length, right.length);
   for (let index = 0; index < limit; index += 1) {
     if (left[index] !== right[index]) {
@@ -986,7 +1014,7 @@ function firstDifferenceIndex(left, right) {
   return limit;
 }
 
-function indexToLineColumn(text, index) {
+function indexToLineColumn(text: any, index: any): any {
   const prefix = text.slice(0, Math.min(index, text.length));
   const lines = prefix.split("\n");
   return {
@@ -995,14 +1023,14 @@ function indexToLineColumn(text, index) {
   };
 }
 
-function extractLabelNames(labels) {
+function extractLabelNames(labels: any): any {
   return (labels || [])
-    .map((label) => typeof label === "string" ? label : label?.name)
-    .filter((label) => typeof label === "string" && label.length > 0);
+    .map((label: any) => typeof label === "string" ? label : label?.name)
+    .filter((label: any) => typeof label === "string" && label.length > 0);
 }
 
-function mapTaskTypeToIssueType(taskType) {
-  const mapping = {
+function mapTaskTypeToIssueType(taskType: any): any {
+  const mapping: Record<string, string> = {
     bug: "Bug",
     bugfix: "Bug",
     enhancement: "Feature",
@@ -1021,7 +1049,7 @@ function mapTaskTypeToIssueType(taskType) {
 
 const ISSUE_FIELDS_QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){issueType{name pinnedFields{__typename ... on IssueFieldSingleSelect{id name} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}} issueFieldValues(first:50){nodes{__typename ... on IssueFieldSingleSelectValue{name optionId field{... on IssueFieldSingleSelect{name}}} ... on IssueFieldDateValue{value field{... on IssueFieldDate{name}}} ... on IssueFieldTextValue{value field{... on IssueFieldText{name}}} ... on IssueFieldNumberValue{value field{... on IssueFieldNumber{name}}}}}}}}`;
 
-function normalizeIssueFields(payload) {
+function normalizeIssueFields(payload: any): any {
   const issue = payload?.data?.repository?.issue;
   const pinnedFields = Array.isArray(issue?.issueType?.pinnedFields)
     ? issue.issueType.pinnedFields
@@ -1031,7 +1059,7 @@ function normalizeIssueFields(payload) {
     : [];
   const pinnedNames = new Set(
     pinnedFields
-      .map((field) => typeof field?.name === "string" ? field.name : "")
+      .map((field: any) => typeof field?.name === "string" ? field.name : "")
       .filter(Boolean)
   );
   const normalizedValues = new Map();
@@ -1058,7 +1086,7 @@ function normalizeIssueFields(payload) {
   return { pinnedNames, values: normalizedValues };
 }
 
-function normalizeExpectedIssueField(metadataKey, rawValue) {
+function normalizeExpectedIssueField(metadataKey: any, rawValue: any): any {
   const value = String(rawValue || "").trim();
   if (!value) {
     return null;
@@ -1071,30 +1099,30 @@ function normalizeExpectedIssueField(metadataKey, rawValue) {
   return { kind: "single-select", value: normalizeOptionName(value) };
 }
 
-function normalizeOptionName(value) {
+function normalizeOptionName(value: any): any {
   const normalized = String(value || "").trim();
   return OPTION_LOCALIZATION[normalized] || normalized;
 }
 
-function normalizeDateValue(value) {
+function normalizeDateValue(value: any): any {
   const normalized = String(value || "").trim();
   const match = normalized.match(/^\d{4}-\d{2}-\d{2}/);
   return match ? match[0] : normalized;
 }
 
-function arraysEqual(left, right) {
+function arraysEqual(left: any, right: any): any {
   if (left.length !== right.length) {
     return false;
   }
 
-  return left.every((value, index) => value === right[index]);
+  return left.every((value: any, index: any) => value === right[index]);
 }
 
-function formatLabelList(labels) {
+function formatLabelList(labels: any): any {
   return labels.length > 0 ? labels.join(", ") : "none";
 }
 
-function computeExpectedInLabels(taskDir) {
+function computeExpectedInLabels(taskDir: any): any {
   const changedFilesResult = gitText(["diff", "main...HEAD", "--name-only"], taskDir);
   if (!changedFilesResult.ok) {
     return changedFilesResult;
@@ -1110,12 +1138,12 @@ function computeExpectedInLabels(taskDir) {
     return mapping;
   }
 
-  if (Object.keys(mapping.value).length > 0) {
+  if (Object.keys(mapping.value ?? {}).length > 0) {
     const labels = new Set();
 
     for (const file of changedFiles) {
-      for (const [label, prefixes] of Object.entries(mapping.value)) {
-        if (prefixes.some((prefix) => file.startsWith(prefix))) {
+      for (const [label, prefixes] of Object.entries(mapping.value ?? {}) as Array<[string, string[]]>) {
+        if (prefixes.some((prefix: any) => file.startsWith(prefix))) {
           labels.add(`in: ${label}`);
         }
       }
@@ -1138,7 +1166,7 @@ function computeExpectedInLabels(taskDir) {
 
   const repoInLabels = new Set(
     extractLabelNames(repoLabelsResult.value)
-      .filter((label) => label.startsWith("in:"))
+      .filter((label: any) => label.startsWith("in:"))
   );
 
   if (repoInLabels.size === 0) {
@@ -1161,7 +1189,7 @@ function computeExpectedInLabels(taskDir) {
   return { ok: true, labels: Array.from(labels).sort(), mode: "fallback" };
 }
 
-function loadInLabelMapping() {
+function loadInLabelMapping(): any {
   const configPath = path.join(repoRoot, ".agents", ".airc.json");
   if (!fs.existsSync(configPath)) {
     return { ok: true, value: {} };
@@ -1174,7 +1202,7 @@ function loadInLabelMapping() {
       return { ok: true, value: {} };
     }
 
-    const normalized = {};
+    const normalized: Record<string, string[]> = {};
     for (const [label, prefixes] of Object.entries(mapping)) {
       if (!Array.isArray(prefixes)) {
         continue;
@@ -1189,88 +1217,14 @@ function loadInLabelMapping() {
     }
 
     return { ok: true, value: normalized };
-  } catch (error) {
+  } catch (error: any) {
     return { ok: false, type: "check_failed", message: `Unable to parse .agents/.airc.json: ${error.message}` };
   }
 }
 
 // === GitHub API ===
 
-function normalizeIssuePayload(payload) {
-  return {
-    state: String(payload?.state || "").toUpperCase(),
-    labels: Array.isArray(payload?.labels) ? payload.labels : [],
-    body: typeof payload?.body === "string" ? payload.body : "",
-    milestone: payload?.milestone ?? null
-  };
-}
-
-function resolveUpstreamRepo(taskDir) {
-  const ownerRepo = resolveOwnerRepo(taskDir);
-  if (!ownerRepo.ok) {
-    return ownerRepo;
-  }
-
-  const repoResult = withRetry(() => ghJson([
-    "api",
-    `repos/${ownerRepo.value}`
-  ], taskDir));
-
-  if (!repoResult.ok) {
-    return repoResult;
-  }
-
-  const repo = repoResult.value && typeof repoResult.value === "object" ? repoResult.value : {};
-  const upstreamRepo = repo.fork ? repo.parent?.full_name : repo.full_name;
-  if (isBlank(upstreamRepo)) {
-    return { ok: false, message: "Unable to resolve upstream repository" };
-  }
-
-  return { ok: true, value: upstreamRepo };
-}
-
-function resolveOwnerRepo(taskDir) {
-  const gitResult = spawn.sync("git", ["remote", "get-url", "origin"], {
-    cwd: taskDir,
-    encoding: "utf8"
-  });
-
-  if (gitResult.status !== 0) {
-    return { ok: false, message: `Unable to resolve git remote: ${gitResult.stderr.trim() || gitResult.stdout.trim()}` };
-  }
-
-  const remote = gitResult.stdout.trim();
-  const sshMatch = remote.match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
-  if (!sshMatch) {
-    return { ok: false, message: `Unable to parse owner/repo from remote '${remote}'` };
-  }
-
-  return { ok: true, value: sshMatch[1] };
-}
-
-function detectPermissions(upstreamRepo, taskDir) {
-  const permissionsResult = withRetry(() => ghJson([
-    "api",
-    `repos/${upstreamRepo}`,
-    "--jq",
-    ".permissions"
-  ], taskDir));
-
-  if (!permissionsResult.ok) {
-    return { hasTriage: false, hasPush: false };
-  }
-
-  const permissions = permissionsResult.value && typeof permissionsResult.value === "object"
-    ? permissionsResult.value
-    : {};
-
-  return {
-    hasTriage: permissions.triage === true,
-    hasPush: permissions.push === true
-  };
-}
-
-function detectRepoOwnerType(upstreamRepo, taskDir) {
+function detectRepoOwnerType(upstreamRepo: any, taskDir: any): any {
   const ownerTypeResult = withRetry(() => ghText([
     "api",
     `repos/${upstreamRepo}`,
@@ -1285,88 +1239,43 @@ function detectRepoOwnerType(upstreamRepo, taskDir) {
   return ownerTypeResult.value || "unknown";
 }
 
-function ghJson(args, cwd) {
-  const result = ghCommand(args, cwd);
-  if (!result.ok) {
-    return result;
-  }
-
-  try {
-    return { ok: true, value: JSON.parse(result.value || "null") };
-  } catch (error) {
-    return { ok: false, type: "network_error", message: `Invalid JSON from gh: ${error.message}` };
-  }
+function ghJson(args: any, cwd: any): any {
+  return mapClientResult(githubClient.json(args, { cwd }));
 }
 
-function ghText(args, cwd) {
-  const result = ghCommand(args, cwd);
-  if (!result.ok) {
-    return result;
-  }
-
-  return { ok: true, value: String(result.value || "").trim() };
-}
-
-function ghCommand(args, cwd) {
-  const gh = resolveGhCommand();
-  const result = spawn.sync(gh.command, [...gh.preArgs, ...args], {
-    cwd,
-    encoding: "utf8",
-    env: process.env
-  });
-
-  if (result.status !== 0) {
-    const stderr = `${result.stderr || ""}${result.stdout || ""}`.trim();
-    const classified = classifyGhFailure(stderr, args);
-    return { ok: false, type: classified.type, message: classified.message };
-  }
-
-  return { ok: true, value: result.stdout };
-}
-
-function resolveGhCommand() {
-  const command = process.env.AGENT_INFRA_GH_BIN || "gh";
-  const rawPreArgs = process.env.AGENT_INFRA_GH_ARGS_JSON;
-  if (!rawPreArgs) {
-    return { command, preArgs: [] };
-  }
-
-  try {
-    const preArgs = JSON.parse(rawPreArgs);
-    if (Array.isArray(preArgs) && preArgs.every((arg) => typeof arg === "string")) {
-      return { command, preArgs };
-    }
-  } catch {
-    return { command, preArgs: [] };
-  }
-
-  return { command, preArgs: [] };
+function ghText(args: any, cwd: any): any {
+  return mapClientResult(githubClient.text(args, { cwd }));
 }
 
-function ghPaginatedJson(args, cwd) {
+function ghPaginatedJson(args: any, cwd: any): any {
   return ghJson(args, cwd);
 }
 
-function gitText(args, cwd) {
-  const result = spawn.sync("git", args, {
-    cwd,
-    encoding: "utf8",
-    env: process.env
-  });
+function mapClientResult(result: any): any {
+  if (result.ok) return result;
+  const checkFailed = ["RESOURCE_NOT_FOUND", "PERMISSION_DENIED", "PLATFORM_REQUEST_INVALID"].includes(result.error.code);
+  return {
+    ok: false,
+    type: checkFailed ? "check_failed" : "network_error",
+    message: result.error.message
+  };
+}
 
-  if (result.status !== 0) {
-    const stderr = `${result.stderr || ""}${result.stdout || ""}`.trim();
+function gitText(args: any, cwd: any): any {
+  try {
+    const value = execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
+    return { ok: true, value: String(value || "").trim() };
+  } catch (error: any) {
+    const stderr = `${error?.stderr || ""}${error?.stdout || ""}`.trim();
     return {
       ok: false,
       type: "check_failed",
       message: stderr || `git ${args.join(" ")} failed`
     };
   }
-
-  return { ok: true, value: String(result.stdout || "").trim() };
 }
 
-function resolvePrHeadSha(context) {
+function resolvePrHeadSha(context: any): any {
   const fallback = () => withRetry(() => gitText(["rev-parse", "HEAD"], context.taskDir));
   const branch = String(context.task?.metadata?.branch || "").trim();
   if (!branch) {
@@ -1391,7 +1300,7 @@ function resolvePrHeadSha(context) {
   return headInWorktree;
 }
 
-function findWorktreeForBranch(porcelainOutput, branch) {
+function findWorktreeForBranch(porcelainOutput: any, branch: any): any {
   let currentWorktree = "";
   for (const rawLine of String(porcelainOutput || "").split("\n")) {
     const line = rawLine.trimEnd();
@@ -1411,62 +1320,11 @@ function findWorktreeForBranch(porcelainOutput, branch) {
   return null;
 }
 
-function withRetry(operation) {
-  const delays = getRetryDelays();
-  let lastFailure = null;
-
-  for (let attempt = 0; attempt <= delays.length; attempt += 1) {
-    const result = operation();
-    if (result.ok) {
-      return result;
-    }
-
-    lastFailure = result;
-    if (result.type === "check_failed") {
-      return result;
-    }
-
-    if (attempt < delays.length) {
-      sleep(delays[attempt]);
-    }
-  }
-
-  return lastFailure || { ok: false, type: "network_error", message: "Unknown GitHub sync failure" };
-}
-
-function classifyGhFailure(stderr, args) {
-  const message = stderr || `gh ${args.join(" ")} failed`;
-
-  if (/not found|could not resolve to an issue|http 404/i.test(message)) {
-    return { type: "check_failed", message };
-  }
-
-  return { type: "network_error", message };
-}
-
-function getRetryDelays() {
-  const override = process.env.VALIDATE_ARTIFACT_RETRY_DELAYS_MS;
-  if (!override) {
-    return DEFAULT_RETRY_DELAYS_MS;
-  }
-
-  const parsed = override
-    .split(",")
-    .map((value) => Number(value.trim()))
-    .filter((value) => Number.isFinite(value) && value >= 0);
-
-  return parsed.length > 0 ? parsed : DEFAULT_RETRY_DELAYS_MS;
-}
-
-function sleep(delayMs) {
-  if (delayMs <= 0) {
-    return;
-  }
-
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
+function withRetry(operation: any): any {
+  return operation();
 }
 
-function interpolate(template, taskDir, artifactFile) {
+function interpolate(template: any, taskDir: any, artifactFile: any): any {
   const artifactStem = artifactFile ? path.basename(artifactFile, path.extname(artifactFile)) : "";
   return template
     .replace(/\{task-id\}/g, path.basename(taskDir))