@fitlab-ai/agent-infra 0.8.5 → 0.9.1

package/README.md

@@ -35,9 +35,14 @@ agent-infra standardizes that shared infrastructure. It gives every supported AI
 ## See it in Action
 
 <p align="center">
-  <img src="./assets/demo-init.gif" alt="CLI install and initialize demo" width="100%" style="max-width: 720px;">
+  <img src="./assets/demo-init.gif" alt="CLI install and initialize demo" width="720">
 </p>
 
+> The demo is stored with Git LFS. Install Git LFS and run `git lfs install`
+> before cloning, or run `git lfs pull` in an existing checkout. If the image
+> is a small text pointer or is missing, verify `git lfs ls-files`, then retry
+> `git lfs pull`.
+
 Once initialized, open the project in your AI TUI and install the latest skills:
 
 ```bash

package/README.zh-CN.md

@@ -35,9 +35,13 @@ agent-infra 的目标就是把这层共享基础设施标准化。它为所有
 ## 实战演示
 
 <p align="center">
-  <img src="./assets/demo-init.gif" alt="CLI 安装初始化演示" width="100%" style="max-width: 720px;">
+  <img src="./assets/demo-init.gif" alt="CLI 安装初始化演示" width="720">
 </p>
 
+> 演示动画通过 Git LFS 存储。克隆前请安装 Git LFS 并运行 `git lfs install`；
+> 已有检出可运行 `git lfs pull`。如果图片变成很小的文本指针或缺失，请先用
+> `git lfs ls-files` 核对跟踪状态，再重试 `git lfs pull`。
+
 完成初始化后，在你的 AI TUI 中打开项目并安装最新 skills：
 
 ```bash

package/bin/cli.ts

@@ -16,14 +16,14 @@ Usage: ai <command> [options]
 
 Commands:
   cp <ssh-alias>  Copy local clipboard image to a remote macOS clipboard or Linux sandbox over SSH
-  decide          Record a human decision for a task HD item
+  decide          Record a ruling; code-stage decisions require explicit implementation intent
   help            Show this help message
   init            Initialize a new project with update-agent-infra seed command
   merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
   run             Schedule a lifecycle skill in the task sandbox tmux session
   sandbox, s      Manage Docker-based AI sandboxes
   server          Run the local AI collaboration daemon (start/stop/status/logs)
-  task, t         Read-only views over .agents/workspace tasks (cat / files / grep / log / ls / show / status)
+  task, t         Read-only views of .agents/workspace tasks
   update          Update seed files and sync file registry for an existing project
   version         Show version
 

package/dist/bin/cli.js

@@ -20,14 +20,14 @@ Usage: ai <command> [options]
 
 Commands:
   cp <ssh-alias>  Copy local clipboard image to a remote macOS clipboard or Linux sandbox over SSH
-  decide          Record a human decision for a task HD item
+  decide          Record a ruling; code-stage decisions require explicit implementation intent
   help            Show this help message
   init            Initialize a new project with update-agent-infra seed command
   merge           Merge tasks from another workspace directory (active/blocked/completed/archive)
   run             Schedule a lifecycle skill in the task sandbox tmux session
   sandbox, s      Manage Docker-based AI sandboxes
   server          Run the local AI collaboration daemon (start/stop/status/logs)
-  task, t         Read-only views over .agents/workspace tasks (cat / files / grep / log / ls / show / status)
+  task, t         Read-only views of .agents/workspace tasks
   update          Update seed files and sync file registry for an existing project
   version         Show version
 

package/dist/bin/internal-cli.js

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+const [major = 0, minor = 0] = process.versions.node.split('.').map((part) => parseInt(part, 10));
+if (major < 22 || (major === 22 && minor < 9)) {
+    process.stderr.write(`agent-infra-internal requires Node.js >= 22.9.0 (current: ${process.version})\n`);
+    process.exit(1);
+}
+const command = process.argv[2] || '';
+switch (command) {
+    case 'git-workflow': {
+        const { gitWorkflow } = await import('../lib/internal/git-workflow.js');
+        gitWorkflow(process.argv.slice(3));
+        break;
+    }
+    case 'release-workflow': {
+        const { releaseWorkflow } = await import('../lib/internal/release-workflow.js');
+        await releaseWorkflow(process.argv.slice(3));
+        break;
+    }
+    case 'platform-release-notes': {
+        const { platformReleaseNotes } = await import('../lib/internal/platform-release-notes.js');
+        platformReleaseNotes(process.argv.slice(3));
+        break;
+    }
+    case 'platform-context': {
+        const { platformContext } = await import('../lib/internal/platform-context.js');
+        platformContext(process.argv.slice(3));
+        break;
+    }
+    case 'platform-comment': {
+        const { platformComment } = await import('../lib/internal/platform-comment.js');
+        platformComment(process.argv.slice(3));
+        break;
+    }
+    case 'platform-issue': {
+        const { platformIssue } = await import('../lib/internal/platform-issue.js');
+        platformIssue(process.argv.slice(3));
+        break;
+    }
+    case 'platform-pr': {
+        const { platformPr } = await import('../lib/internal/platform-pr.js');
+        platformPr(process.argv.slice(3));
+        break;
+    }
+    case 'platform-checks': {
+        const { platformChecks } = await import('../lib/internal/platform-checks.js');
+        await platformChecks(process.argv.slice(3));
+        break;
+    }
+    case 'task-context': {
+        const { taskContext } = await import('../lib/internal/task-context.js');
+        taskContext(process.argv.slice(3));
+        break;
+    }
+    case 'task-ledger': {
+        const { taskLedger } = await import('../lib/internal/task-ledger.js');
+        taskLedger(process.argv.slice(3));
+        break;
+    }
+    case 'task-warning': {
+        const { taskWarning } = await import('../lib/internal/task-warning.js');
+        taskWarning(process.argv.slice(3));
+        break;
+    }
+    case 'task-artifact': {
+        const { taskArtifact } = await import('../lib/internal/task-artifact.js');
+        taskArtifact(process.argv.slice(3));
+        break;
+    }
+    case 'task-event': {
+        const { taskEvent } = await import('../lib/internal/task-event.js');
+        taskEvent(process.argv.slice(3));
+        break;
+    }
+    case 'task-lifecycle': {
+        const { taskLifecycle } = await import('../lib/internal/task-lifecycle.js');
+        taskLifecycle(process.argv.slice(3));
+        break;
+    }
+    case 'task-short-id': {
+        const { taskShortId } = await import('../lib/internal/task-short-id.js');
+        taskShortId(process.argv.slice(3));
+        break;
+    }
+    case 'task-snapshot': {
+        const { taskSnapshot } = await import('../lib/internal/task-snapshot.js');
+        taskSnapshot(process.argv.slice(3));
+        break;
+    }
+    case 'task-verify': {
+        const { taskVerify } = await import('../lib/internal/task-verify.js');
+        taskVerify(process.argv.slice(3));
+        break;
+    }
+    default:
+        process.stdout.write(`${JSON.stringify({
+            status: 'failed',
+            changed: false,
+            error: { code: 'INTERNAL_COMMAND_INVALID', message: `unknown internal command '${command}'` }
+        })}\n`);
+        process.exitCode = 1;
+}
+export {};
+//# sourceMappingURL=internal-cli.js.map

package/dist/lib/decide.js

@@ -1,102 +1,93 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { execFileSync } from 'node:child_process';
 import { VERSION } from './version.js';
-import { resolveTaskRef } from './task/resolve-ref.js';
-const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
-function detectRepoRoot() {
-    return execFileSync('git', ['rev-parse', '--show-toplevel'], {
-        encoding: 'utf8',
-        stdio: ['pipe', 'pipe', 'pipe']
-    }).trim();
-}
-function defaultNow() {
-    return new Intl.DateTimeFormat('sv-SE', {
-        timeZoneName: 'longOffset',
-        year: 'numeric',
-        month: '2-digit',
-        day: '2-digit',
-        hour: '2-digit',
-        minute: '2-digit',
-        second: '2-digit',
-        hour12: false
-    })
-        .format(new Date())
-        .replace(' GMT', '');
-}
-function taskPath(repoRoot, ref) {
-    if (!TASK_ID_RE.test(ref)) {
-        const resolved = resolveTaskRef(ref);
-        if (!resolved.ok)
-            throw new Error(resolved.message);
-        if (!resolved.taskDir.includes(`${path.join('.agents', 'workspace', 'active')}${path.sep}`)) {
-            throw new Error(`task ${resolved.taskId} is not active`);
+import { parseTaskScope } from './task/command-options.js';
+import { applyHumanDecision } from './task/decision-intents.js';
+import { canonicalTimestamp } from './task/write.js';
+function parseDecisionParts(parts) {
+    const decision = [];
+    let needsImplementation;
+    for (let index = 0; index < parts.length; index += 1) {
+        if (parts[index] !== '--needs-implementation') {
+            decision.push(parts[index]);
+            continue;
         }
-        return resolved.taskMdPath;
+        if (needsImplementation !== undefined)
+            throw new Error("duplicate option '--needs-implementation'");
+        const value = parts[++index];
+        if (value !== 'true' && value !== 'false') {
+            throw new Error("--needs-implementation must be 'true' or 'false'");
+        }
+        needsImplementation = value === 'true';
     }
-    const candidate = path.join(repoRoot, '.agents', 'workspace', 'active', ref, 'task.md');
-    if (!fs.existsSync(candidate))
-        throw new Error(`active task not found: ${ref}`);
-    return candidate;
-}
-function replaceFrontmatterField(content, field, value) {
-    const re = new RegExp(`^${field}:.*$`, 'm');
-    if (re.test(content))
-        return content.replace(re, `${field}: ${value}`);
-    return content.replace(/^---\n/, `---\n${field}: ${value}\n`);
+    if (decision.length === 0)
+        throw new Error('decision content is required');
+    return { decision: decision.join(' '), needsImplementation };
 }
-function replaceLedgerRow(content, hdId) {
-    const lines = content.split('\n');
-    let found = false;
-    let pending = false;
-    for (let i = 0; i < lines.length; i += 1) {
-        const line = lines[i];
-        if (!line.trim().startsWith(`| ${hdId} |`))
-            continue;
-        found = true;
-        const cells = line.split('|').slice(1, -1).map((cell) => cell.trim());
-        if (cells[4] !== 'needs-human-decision')
-            break;
-        pending = true;
-        cells[4] = 'human-decided';
-        cells[5] = `task.md#${hdId}`;
-        lines[i] = `| ${cells.join(' | ')} |`;
-        break;
+export async function decide(args, options = {}) {
+    let scope;
+    try {
+        scope = parseTaskScope(args);
     }
-    return { content: lines.join('\n'), found, pending };
-}
-function appendUnderHeading(content, heading, block) {
-    if (!content.includes(`${heading}\n`)) {
-        return `${content.trimEnd()}\n\n${heading}\n\n${block}\n`;
+    catch (error) {
+        process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+        return 1;
     }
-    const idx = content.indexOf(`${heading}\n`) + heading.length + 1;
-    const before = content.slice(0, idx);
-    const after = content.slice(idx);
-    return `${before}\n${block}\n${after.replace(/^\n/, '')}`;
-}
-export async function decide(args, options = {}) {
-    const [taskRef, hdId, ...decisionParts] = args;
-    if (!taskRef || !hdId || decisionParts.length === 0) {
-        process.stderr.write('Usage: ai decide <task-ref> <HD-id> <decision>\n');
+    let item;
+    const operands = [];
+    for (let index = 0; index < scope.positionals.length; index += 1) {
+        const arg = scope.positionals[index];
+        if (arg === '--item' || arg === '-i') {
+            if (item !== undefined) {
+                process.stderr.write("Error: duplicate option '--item'\n");
+                return 1;
+            }
+            item = scope.positionals[++index];
+            if (!item) {
+                process.stderr.write(`Error: ${arg} requires a value\n`);
+                return 1;
+            }
+        }
+        else if (arg.startsWith('--item=')) {
+            if (item !== undefined) {
+                process.stderr.write("Error: duplicate option '--item'\n");
+                return 1;
+            }
+            item = arg.slice('--item='.length);
+            if (item === '') {
+                process.stderr.write('Error: --item requires a value\n');
+                return 1;
+            }
+        }
+        else
+            operands.push(arg);
+    }
+    let taskRef = scope.taskRef;
+    let selector = item;
+    let decisionParts;
+    if (item !== undefined) {
+        decisionParts = operands;
+    }
+    else if (!scope.explicit) {
+        [taskRef, selector, ...decisionParts] = operands;
+    }
+    else {
+        decisionParts = [];
+    }
+    if (!selector || decisionParts.length === 0) {
+        process.stderr.write('Usage: ai decide [--task <ref>] --item <ordinal|ledger-id> [--needs-implementation true|false] <decision>\n       ai decide <task-ref> <ordinal|ledger-id> [--needs-implementation true|false] <decision>\n');
         return 1;
     }
     try {
-        const repoRoot = options.repoRoot ?? detectRepoRoot();
-        const file = taskPath(repoRoot, taskRef);
-        let content = fs.readFileSync(file, 'utf8');
-        const replaced = replaceLedgerRow(content, hdId);
-        if (!replaced.found)
-            throw new Error(`${hdId} not found in review ledger`);
-        if (!replaced.pending)
-            throw new Error(`${hdId} is not needs-human-decision`);
-        content = replaced.content;
-        const now = (options.now ?? defaultNow)();
-        content = replaceFrontmatterField(content, 'updated_at', now);
-        content = replaceFrontmatterField(content, 'agent_infra_version', options.version ?? VERSION);
-        const decision = decisionParts.join(' ');
-        content = appendUnderHeading(content, '## 人工裁决', `### ${hdId}\n\n- **裁决时间**：${now}\n- **裁决结果**：${decision}`);
-        content = appendUnderHeading(content, '## 活动日志', `- ${now} — **Human Decision** by human — ${hdId} decided`);
-        fs.writeFileSync(file, content);
+        const parsedDecision = parseDecisionParts(decisionParts);
+        const now = (options.now ?? canonicalTimestamp)();
+        const result = applyHumanDecision({
+            taskRef, selector, decision: parsedDecision.decision,
+            needsImplementation: parsedDecision.needsImplementation
+        }, {
+            repoRoot: options.repoRoot,
+            metadataProvider: () => ({ timestamp: now, agentInfraVersion: options.version ?? VERSION })
+        });
+        if (result.error)
+            throw new Error(result.error.message);
         return 0;
     }
     catch (error) {

package/dist/lib/defaults.json

@@ -42,6 +42,7 @@
       ".claude/commands/",
       ".codex/hooks.json",
       ".gemini/commands/",
+      ".git-hooks/check-large-files.cjs",
       ".git-hooks/check-version-format.sh",
       ".github/scripts/",
       ".github/workflows/metadata-sync.yml",

package/dist/lib/git/review-snapshot.js

@@ -0,0 +1,79 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+function git(repoRoot, args, options = {}) {
+    return execFileSync('git', args, { cwd: repoRoot, encoding: options.encoding ?? 'utf8', env: options.env ?? process.env });
+}
+function splitNull(output) { return output.split('\0').filter(Boolean); }
+function exists(filePath) { try {
+    fs.lstatSync(filePath);
+    return true;
+}
+catch {
+    return false;
+} }
+function withTemporaryIndex(repoRoot, baseline, callback) {
+    const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-infra-review-index-'));
+    const env = { ...process.env, GIT_INDEX_FILE: path.join(tempDir, 'index') };
+    try {
+        execFileSync('git', ['read-tree', baseline], { cwd: repoRoot, env });
+        return callback(env);
+    }
+    finally {
+        fs.rmSync(tempDir, { recursive: true, force: true });
+    }
+}
+function projectWorktree(repoRoot, baseline, globs, env) {
+    const tracked = splitNull(String(git(repoRoot, ['diff', '--name-only', '-z', baseline, '--', ...globs])));
+    const untracked = splitNull(String(git(repoRoot, ['ls-files', '-o', '--exclude-standard', '-z', '--', ...globs])));
+    for (const filePath of new Set([...tracked, ...untracked])) {
+        const args = exists(path.join(repoRoot, filePath)) ? ['update-index', '--add', '--', filePath] : ['update-index', '--remove', '--', filePath];
+        execFileSync('git', args, { cwd: repoRoot, env });
+    }
+}
+function projectStaged(repoRoot, baseline, globs, env) {
+    for (const filePath of splitNull(String(git(repoRoot, ['diff', '--cached', '--name-only', '-z', baseline, '--', ...globs])))) {
+        const entry = execFileSync('git', ['--literal-pathspecs', 'ls-files', '--stage', '-z', '--', filePath], { cwd: repoRoot, encoding: 'buffer' });
+        execFileSync('git', ['update-index', '-z', '--index-info'], {
+            cwd: repoRoot, env, input: entry.length > 0 ? entry : Buffer.from(`0 ${'0'.repeat(40)}\t${filePath}\0`)
+        });
+    }
+}
+function snapshotReview(input) {
+    const repoRoot = String(git(input.cwd, ['rev-parse', '--show-toplevel'])).trim();
+    const resolvedBaseline = String(git(repoRoot, ['rev-parse', '--verify', `${input.baseline}^{commit}`])).trim();
+    return withTemporaryIndex(repoRoot, resolvedBaseline, (env) => {
+        if (input.mode === 'worktree')
+            projectWorktree(repoRoot, resolvedBaseline, input.globs, env);
+        else
+            projectStaged(repoRoot, resolvedBaseline, input.globs, env);
+        const diff = execFileSync('git', ['diff', '--cached', '--binary', resolvedBaseline, '--', ...input.globs], { cwd: repoRoot, encoding: 'buffer', env });
+        return {
+            baseline: resolvedBaseline,
+            fingerprint: `sha256:${crypto.createHash('sha256').update(diff).digest('hex')}`,
+            tree: String(git(repoRoot, ['write-tree'], { env })).trim()
+        };
+    });
+}
+function compareReviewTrees(input) {
+    const repoRoot = String(git(input.cwd, ['rev-parse', '--show-toplevel'])).trim();
+    git(repoRoot, ['rev-parse', '--verify', `${input.expected}^{tree}`]);
+    git(repoRoot, ['rev-parse', '--verify', `${input.actual}^{tree}`]);
+    const fields = splitNull(String(git(repoRoot, ['diff', '--name-status', '-z', '--no-renames', input.expected, input.actual])));
+    const result = { equal: fields.length === 0, added: [], missing: [], different: [] };
+    for (let index = 0; index < fields.length; index += 2) {
+        const status = fields[index];
+        const filePath = fields[index + 1];
+        if (status === 'A')
+            result.added.push(filePath);
+        else if (status === 'D')
+            result.missing.push(filePath);
+        else
+            result.different.push(filePath);
+    }
+    return result;
+}
+export { compareReviewTrees, snapshotReview };
+//# sourceMappingURL=review-snapshot.js.map

package/dist/lib/git/workflow.js

@@ -0,0 +1,101 @@
+import { spawnSync } from 'node:child_process';
+const defaultRunner = (args, cwd) => {
+    const result = spawnSync('git', [...args], { cwd, encoding: 'utf8' });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+};
+function run(runner, cwd, args) {
+    return runner(args, cwd);
+}
+function value(runner, cwd, args, trim = true) {
+    const result = run(runner, cwd, args);
+    return result.status === 0 ? (trim ? result.stdout.trim() : result.stdout.replace(/\n$/, '')) : null;
+}
+function inspectGitWorkflow(cwd, runner = defaultRunner, remoteInput) {
+    const head = value(runner, cwd, ['rev-parse', 'HEAD']);
+    const branch = value(runner, cwd, ['branch', '--show-current']);
+    const upstream = value(runner, cwd, ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{upstream}']);
+    const porcelain = value(runner, cwd, ['status', '--porcelain=v1'], false);
+    if (!head || branch === null || porcelain === null) {
+        return { status: 'failed', changed: false, snapshot: null, operations: [], error: { code: 'GIT_INSPECT_FAILED', message: 'Unable to inspect Git repository' } };
+    }
+    const lines = porcelain ? porcelain.split('\n') : [];
+    const remoteRefs = remoteInput ? Object.fromEntries(remoteInput.refs.map((ref) => {
+        const canonical = ref.startsWith('refs/') ? ref : `refs/heads/${ref}`;
+        const remote = run(runner, cwd, ['ls-remote', '--exit-code', remoteInput.remote, canonical]);
+        return [ref, remote.status === 0 ? remote.stdout.trim().split(/\s+/)[0] ?? null : null];
+    })) : {};
+    return {
+        status: 'no-op', changed: false,
+        snapshot: {
+            head, branch, upstream,
+            worktree: lines.filter((line) => line.startsWith('??') || line[1] !== ' ').map((line) => line.slice(3)),
+            staged: lines.filter((line) => !line.startsWith('??') && line[0] !== ' ').map((line) => line.slice(3)),
+            remoteRefs
+        },
+        operations: [], error: null
+    };
+}
+function validatePaths(paths) {
+    if (paths.length === 0)
+        return 'At least one explicit path is required';
+    for (const candidate of paths) {
+        if (!candidate || candidate.startsWith('/') || candidate.split(/[\\/]/).includes('..'))
+            return `Path escapes repository: ${candidate}`;
+        if (/(^|\/)(?:\.env|credentials\.json|id_rsa)(?:$|\/)/i.test(candidate))
+            return `Sensitive path is not allowed: ${candidate}`;
+    }
+    return null;
+}
+function commitExplicitPaths(input, runner = defaultRunner) {
+    const invalid = validatePaths(input.paths);
+    if (invalid || !input.message.trim())
+        return { status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [], error: { code: 'GIT_COMMIT_INPUT_INVALID', message: invalid ?? 'Commit message is required' } };
+    const before = inspectGitWorkflow(input.cwd, runner);
+    if (!before.snapshot)
+        return before;
+    if (input.expectedHead && before.snapshot.head !== input.expectedHead)
+        return { status: 'failed', changed: false, snapshot: before.snapshot, operations: [], error: { code: 'GIT_HEAD_MISMATCH', message: `Expected HEAD ${input.expectedHead}, received ${before.snapshot.head}` } };
+    const selected = new Set(input.paths);
+    const unrelatedStaged = before.snapshot.staged.filter((candidate) => !selected.has(candidate));
+    if (unrelatedStaged.length > 0)
+        return { status: 'failed', changed: false, snapshot: before.snapshot, operations: [], error: { code: 'GIT_STAGED_SCOPE_MISMATCH', message: `Unrelated staged paths: ${unrelatedStaged.join(', ')}` } };
+    const add = run(runner, input.cwd, ['add', '--', ...input.paths]);
+    if (add.status !== 0)
+        return { status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'failed', message: add.stderr.trim() }], error: { code: 'GIT_STAGE_FAILED', message: add.stderr.trim() } };
+    const staged = run(runner, input.cwd, ['diff', '--cached', '--quiet', '--']);
+    if (staged.status === 0)
+        return { status: 'no-op', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'no-op' }], error: null };
+    if (input.expectedTree) {
+        const tree = value(runner, input.cwd, ['write-tree']);
+        if (tree !== input.expectedTree)
+            return { status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'stage', status: 'applied' }], error: { code: 'GIT_TREE_MISMATCH', message: `Expected staged tree ${input.expectedTree}, received ${tree ?? 'unavailable'}` } };
+    }
+    const commit = run(runner, input.cwd, ['commit', '-m', input.message]);
+    const after = inspectGitWorkflow(input.cwd, runner);
+    if (commit.status !== 0)
+        return { status: 'failed', changed: false, snapshot: after.snapshot, operations: [{ name: 'commit', status: 'failed', message: commit.stderr.trim() }], error: { code: 'GIT_COMMIT_FAILED', message: commit.stderr.trim() } };
+    return { status: 'applied', changed: true, snapshot: after.snapshot, operations: [{ name: 'stage', status: 'applied' }, { name: 'commit', status: 'applied' }], error: null };
+}
+function pushGitRefs(input, runner = defaultRunner) {
+    if (!input.remote || input.refs.length === 0)
+        return { status: 'failed', changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [], error: { code: 'GIT_PUSH_INPUT_INVALID', message: 'Remote and refs are required' } };
+    const operations = [];
+    for (const ref of input.refs) {
+        if (!/^(?:refs\/(?:heads|tags)\/)?[A-Za-z0-9._/-]+$/.test(ref) || ref.startsWith('-')) {
+            operations.push({ name: 'push', ref, status: 'failed', message: 'Invalid ref' });
+            continue;
+        }
+        const pushed = run(runner, input.cwd, ['push', input.remote, ref]);
+        if (pushed.status !== 0) {
+            operations.push({ name: 'push', ref, status: 'failed', message: pushed.stderr.trim() });
+            continue;
+        }
+        const canonical = ref.startsWith('refs/') ? ref : `refs/heads/${ref}`;
+        const remoteFact = run(runner, input.cwd, ['ls-remote', '--exit-code', input.remote, canonical]);
+        operations.push({ name: 'push', ref, status: remoteFact.status === 0 ? 'applied' : 'failed', message: remoteFact.status === 0 ? undefined : 'Remote ref verification failed' });
+    }
+    const failures = operations.filter((item) => item.status === 'failed').length;
+    return { status: failures === 0 ? 'applied' : failures === operations.length ? 'failed' : 'degraded', changed: failures < operations.length, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations, error: failures ? { code: 'GIT_PUSH_PARTIAL', message: `${failures} ref push operation(s) failed` } : null };
+}
+export { commitExplicitPaths, inspectGitWorkflow, pushGitRefs };
+//# sourceMappingURL=workflow.js.map

package/dist/lib/internal/git-workflow.js

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import { commitExplicitPaths, inspectGitWorkflow, pushGitRefs } from '../git/workflow.js';
+import { compareReviewTrees, snapshotReview } from '../git/review-snapshot.js';
+import { resolvePostReviewGlobs } from '../task/review-fingerprint.js';
+function output(value) { process.stdout.write(`${JSON.stringify(value)}\n`); }
+function gitWorkflow(args = []) {
+    const [action, ...rest] = args;
+    const cwdIndex = rest.indexOf('--cwd');
+    const cwd = cwdIndex >= 0 ? rest[cwdIndex + 1] : process.cwd();
+    let result;
+    if (action === 'inspect') {
+        const inputIndex = rest.indexOf('--input');
+        const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
+        result = inspectGitWorkflow(cwd ?? process.cwd(), undefined, input?.remote && input.refs ? { remote: input.remote, refs: input.refs } : undefined);
+    }
+    else if (action === 'commit') {
+        const inputIndex = rest.indexOf('--input');
+        const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
+        result = input ? commitExplicitPaths({ cwd: cwd ?? process.cwd(), ...input }) : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
+    }
+    else if (action === 'push') {
+        const inputIndex = rest.indexOf('--input');
+        const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
+        result = input ? pushGitRefs({ cwd: cwd ?? process.cwd(), ...input }) : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
+    }
+    else if (action === 'snapshot' || action === 'compare-trees') {
+        const inputIndex = rest.indexOf('--input');
+        const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
+        if (!input)
+            result = { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
+        else if (action === 'snapshot')
+            result = { status: 'no-op', changed: false, snapshot: snapshotReview({ cwd: cwd ?? process.cwd(), mode: input.mode, baseline: input.baseline, globs: input.globs ?? resolvePostReviewGlobs({}, {}) }), error: null };
+        else
+            result = { status: 'no-op', changed: false, comparison: compareReviewTrees({ cwd: cwd ?? process.cwd(), expected: input.expected, actual: input.actual }), error: null };
+    }
+    else
+        result = { status: 'failed', changed: false, error: { code: 'GIT_ACTION_INVALID', message: `Unknown git-workflow action '${action ?? ''}'` } };
+    output(result);
+    process.exitCode = result.status === 'failed' ? 1 : result.status === 'blocked' ? 2 : 0;
+}
+export { gitWorkflow };
+//# sourceMappingURL=git-workflow.js.map