@fitlab-ai/agent-infra 0.9.0 → 0.9.1

package/dist/lib/platform/verification-required.js

@@ -3,6 +3,8 @@ import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { inspectRequiredChecks } from "./pr-checks.js";
 import { resolvePlatformContext } from "./context.js";
+import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.js";
+import { loadPostReviewConfig, resolvePostReviewGlobs } from "../task/review-fingerprint.js";
 const CHECK_TYPE = "required-checks";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 function validPrNumber(value) {
@@ -44,13 +46,28 @@ export function evaluateRequiredChecks(context, shared) {
     if (inspection.status === "failed") {
         return shared.failResult(CHECK_TYPE, inspection.error?.message || "Required checks are unavailable", "check_failed");
     }
-    const prHead = inspection.pullRequest?.headSha;
-    if (!prHead || localHead !== reviewedHead || localHead !== prHead) {
-        return shared.failResult(CHECK_TYPE, "Local HEAD, last reviewed commit, and PR head must match", "check_failed");
+    const prHead = inspection.pullRequest?.head?.sha || inspection.pullRequest?.headSha;
+    const relation = context.relation || (context.gitRoot && inspection.pullRequest?.head
+        ? resolveReviewedHeadRelation({
+            gitRoot: context.gitRoot,
+            localHead,
+            lastReviewedCommit: reviewedHead,
+            pullRequest: inspection.pullRequest,
+            pathspecs: context.pathspecs || [":/"]
+        })
+        : localHead === reviewedHead && localHead === prHead
+            ? { status: "strict" }
+            : { status: "failed" });
+    if (relation.status !== "strict" && relation.status !== "merged-equivalent") {
+        const message = relation.message || "Local HEAD, last reviewed commit, and PR head must match";
+        return relation.status === "blocked"
+            ? shared.blockedResult(CHECK_TYPE, message, "dependency_error")
+            : shared.failResult(CHECK_TYPE, message, "check_failed");
     }
     const state = inspection.checks?.state;
     if (state === "passed" || state === "no-required") {
-        return shared.passResult(CHECK_TYPE, `Required checks are ${state} for PR head ${prHead}`);
+        const suffix = relation.status === "merged-equivalent" ? " via verified squash merge equivalence" : "";
+        return shared.passResult(CHECK_TYPE, `Required checks are ${state} for PR head ${prHead}${suffix}`);
     }
     if (state === "pending") {
         return shared.blockedResult(CHECK_TYPE, inspection.error?.message || "Required checks are pending", "check_pending");
@@ -73,6 +90,13 @@ export function check({ taskDir }, shared) {
     if (!localHead)
         return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection: null, prFlow }, shared);
     const inspection = inspectRequiredChecks(task.metadata.id, { cwd: shared.repoRoot });
-    return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection, prFlow }, shared);
+    return evaluateRequiredChecks({
+        metadata: task.metadata,
+        localHead,
+        inspection,
+        prFlow,
+        gitRoot: shared.repoRoot,
+        pathspecs: resolvePostReviewGlobs({}, loadPostReviewConfig(shared.repoRoot))
+    }, shared);
 }
 //# sourceMappingURL=verification-required.js.map

package/dist/lib/sandbox/build-proxy.js

@@ -0,0 +1,63 @@
+import semver from 'semver';
+import { engineDisplayName } from './engine.js';
+import { runSafeEngine } from './shell.js';
+export const BUILD_PROXY_ENV_KEYS = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY'];
+export const MIN_BUILD_PROXY_DOCKER_VERSION = '20.10.0';
+export const MIN_BUILD_PROXY_BUILDKIT_VERSION = '0.9.0';
+export function prepareBuildProxy(enabled, hostEnv, engine) {
+    const env = { ...hostEnv };
+    if (!enabled) {
+        return { args: [], env, redactionValues: [] };
+    }
+    const entries = BUILD_PROXY_ENV_KEYS.flatMap((key) => {
+        const value = hostEnv[key]?.trim();
+        return value ? [[key, value]] : [];
+    });
+    if (entries.length === 0) {
+        throw new Error(`No non-empty build proxy variables are set. Configure one of: ${BUILD_PROXY_ENV_KEYS.join(', ')}.`);
+    }
+    for (const [key, value] of entries)
+        env[key] = value;
+    if (engine === 'wsl2') {
+        const existing = (env.WSLENV ?? '').split(':').filter(Boolean);
+        env.WSLENV = [...new Set([...existing, ...entries.map(([key]) => key)])].join(':');
+    }
+    return {
+        args: entries.flatMap(([key]) => ['--secret', `id=${key},env=${key}`]),
+        env,
+        redactionValues: entries.map(([, value]) => value)
+    };
+}
+function parsedVersion(raw) {
+    return semver.coerce(raw.trim())?.version ?? null;
+}
+export function assertBuildProxyCompatibility(engine, runSafeEngineFn = runSafeEngine) {
+    const dockerRaw = runSafeEngineFn(engine, 'docker', ['version', '--format', '{{.Server.Version}}']);
+    const dockerVersion = parsedVersion(dockerRaw);
+    if (!dockerVersion || !semver.gte(dockerVersion, MIN_BUILD_PROXY_DOCKER_VERSION)) {
+        throw new Error(`Build proxy requires Docker Engine ${MIN_BUILD_PROXY_DOCKER_VERSION} or newer; `
+            + `observed ${dockerVersion ?? 'an unparseable version'}.`);
+    }
+    const buildxRaw = runSafeEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap']);
+    const versions = [...buildxRaw.matchAll(/BuildKit(?:\s+version)?:\s*v?(\d+\.\d+\.\d+(?:[-+][^\s]+)?)/gi)]
+        .map((match) => parsedVersion(match[1] ?? ''))
+        .filter((version) => version !== null);
+    if (versions.length === 0) {
+        throw new Error(`Build proxy requires BuildKit ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer, `
+            + 'but the active builder version could not be determined.');
+    }
+    const oldVersion = versions.find((version) => !semver.gte(version, MIN_BUILD_PROXY_BUILDKIT_VERSION));
+    if (oldVersion) {
+        throw new Error(`Build proxy observed BuildKit ${oldVersion}; version ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer is required.`);
+    }
+}
+export function redactBuildProxyValues(text, values) {
+    return [...new Set(values.filter(Boolean))]
+        .sort((left, right) => right.length - left.length)
+        .reduce((result, value) => result.replaceAll(value, '[REDACTED_BUILD_PROXY]'), text);
+}
+export function buildProxyFailureHint(engine) {
+    return `Build-step proxy inheritance is enabled for ${engineDisplayName(engine)}. `
+        + 'Image pulls and Dockerfile FROM resolution use the Docker daemon or builder proxy configuration.';
+}
+//# sourceMappingURL=build-proxy.js.map

package/dist/lib/sandbox/commands/create.js

@@ -10,6 +10,7 @@ import * as toml from 'smol-toml';
 import { loadConfig } from '../config.js';
 import { assertValidBranchName, containerName, containerNameCandidates, parsePositiveIntegerOption, sandboxBranchLabel, sandboxImageConfigLabel, sandboxImageRefreshLabel, sandboxLabel, shareBranchDir, shareCommonDir, shellConfigDir, worktreeDirCandidates } from '../constants.js';
 import { prepareDockerfile } from '../dockerfile.js';
+import { assertBuildProxyCompatibility, buildProxyFailureHint, prepareBuildProxy, redactBuildProxyValues } from '../build-proxy.js';
 import { detectEngine, ensureDocker } from '../engine.js';
 import { commandForEngine, execEngine, run, runEngine, runOk, runOkEngine, runSafe, runSafeEngine, runVerboseEngine } from '../shell.js';
 import { resolveTaskBranch } from '../task-resolver.js';
@@ -49,7 +50,7 @@ alias gy='gemini --yolo; tput ed'
 `;
 const CONTAINER_HOME = '/home/devuser';
 const CONTAINER_SHELL_CONFIG_MOUNT = `${CONTAINER_HOME}/.host-shell-config`;
-const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P]
+const USAGE = `Usage: ai sandbox create <branch> [base] [--cpu <n>] [--memory <n>] [--no-refresh] [--inherit-proxy|-P] [--inherit-build-proxy|-B]
 
 Host aliases:
   ${'~'}/.agent-infra/aliases/sandbox.sh is auto-created on first run and exposed
@@ -59,7 +60,9 @@ Host aliases:
 
 Proxy:
   --inherit-proxy, -P  Copy non-empty standard host proxy variables into the
-                       container environment through the private env file.`;
+                       container environment through the private env file.
+  --inherit-build-proxy, -B  Pass uppercase HTTP_PROXY, HTTPS_PROXY, and NO_PROXY
+                             to managed image build steps for this invocation.`;
 const HOST_PROXY_ENV_KEYS = [
     'http_proxy',
     'HTTP_PROXY',
@@ -70,6 +73,15 @@ const HOST_PROXY_ENV_KEYS = [
     'no_proxy',
     'NO_PROXY'
 ];
+const MANAGED_GITHUB_GIT_CONFIG = [
+    '[credential]',
+    '\thelper = !gh auth git-credential',
+    '[credential "https://github.com"]',
+    '\thelper =',
+    '\thelper = !gh auth git-credential',
+    '[url "https://github.com/"]',
+    '\tinsteadOf = git@github.com:'
+];
 function resolveToolDirs(config, tools, branch) {
     return tools.map((tool) => {
         const candidates = toolConfigDirCandidates(tool, config.project, branch);
@@ -158,6 +170,14 @@ function normalizeContainerHomeSeparators(content) {
     const containerHomePattern = new RegExp(`${escapeRegExp(CONTAINER_HOME)}\\S*`, 'g');
     return content.replace(containerHomePattern, (value) => value.replaceAll('\\', '/'));
 }
+function isGitHubCliCredentialHelper(line) {
+    const helperMatch = line.match(/^\s*helper\s*=\s*(.+?)\s*$/i);
+    if (!helperMatch) {
+        return false;
+    }
+    const helper = (helperMatch[1] ?? '').trim().replace(/^"(.*)"$/, '$1');
+    return /^!\s*(?:"[^"]*[\\/]+gh"|(?:\S*[\\/]+)?gh)\s+auth\s+git-credential(?:\s|$)/i.test(helper);
+}
 export function sanitizeGitConfig(gitconfig, home, { stripGpg = false, repoRoot = '' } = {}) {
     const posixHome = home.replaceAll('\\', '/');
     const normalizedGitconfig = gitconfig
@@ -170,10 +190,12 @@ export function sanitizeGitConfig(gitconfig, home, { stripGpg = false, repoRoot
     const sanitized = [];
     let inGpgSection = false;
     let currentSection = '';
+    let currentSectionName = '';
     for (const line of lines) {
         const sectionMatch = line.match(/^\s*\[([^\]]+)\]\s*$/);
         if (sectionMatch) {
             const sectionName = (sectionMatch[1] ?? '').trim();
+            currentSectionName = sectionName;
             currentSection = ((sectionName.match(/^([^\s"]+)/)?.[1]) ?? '').toLowerCase();
             inGpgSection = /^gpg(?:\s+"[^"]+")?$/i.test(sectionName);
             if (stripGpg && inGpgSection) {
@@ -199,9 +221,19 @@ export function sanitizeGitConfig(gitconfig, home, { stripGpg = false, repoRoot
         if (stripGpg && currentSection === 'user' && /^\s*signingKey\s*=.*$/i.test(line)) {
             continue;
         }
+        if (currentSection === 'credential' && isGitHubCliCredentialHelper(line)) {
+            continue;
+        }
+        if (/^url\s+"https:\/\/github\.com\/"$/i.test(currentSectionName)
+            && /^\s*insteadOf\s*=\s*git@github\.com:\s*$/i.test(line)) {
+            continue;
+        }
         sanitized.push(line);
     }
-    return appendSafeDirectories(sanitized, repoRoot).join('\n');
+    return [
+        ...appendSafeDirectories(sanitized, repoRoot),
+        ...MANAGED_GITHUB_GIT_CONFIG
+    ].join('\n');
 }
 export function hostHasGpgKeys(home, execFn = execFileSync) {
     return currentKeyringFingerprint(home, execFn) !== null;
@@ -928,7 +960,7 @@ export function buildTmpfsRunArgs(containerMount, tmpfs) {
     const size = tmpfs.size ?? '512m';
     return ['--tmpfs', `${containerMount}:rw,size=${size}`];
 }
-export function buildImage(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, runVerboseFn = runVerboseEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+export function buildImage(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, runVerboseFn = runVerboseEngine, env = process.env, refresh = false, lastRefresh, buildProxyArgs = [], buildEnv } = {}) {
     const selectedEngine = engine ?? detectEngine({ engine: config.engine });
     runVerboseFn(selectedEngine, 'docker', buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
         engine: selectedEngine,
@@ -936,8 +968,9 @@ export function buildImage(config, tools, dockerfilePath, imageSignature, { engi
         runSafeFn,
         env,
         refresh,
-        lastRefresh
-    }), { cwd: config.repoRoot });
+        lastRefresh,
+        buildProxyArgs
+    }), { cwd: config.repoRoot, env: buildEnv });
 }
 function readImageLabels(config, engine) {
     return parseImageLabels(runSafeEngine(engine, 'docker', [
@@ -958,6 +991,7 @@ export async function create(args) {
             memory: { type: 'string' },
             'no-refresh': { type: 'boolean' },
             'inherit-proxy': { type: 'boolean', short: 'P' },
+            'inherit-build-proxy': { type: 'boolean', short: 'B' },
             help: { type: 'boolean', short: 'h' }
         }
     });
@@ -1027,6 +1061,12 @@ export async function create(args) {
             && isRefreshDue(currentLastRefresh, now, effectiveConfig.refreshIntervalDays);
         const needsImageBuild = signatureStale || refreshDue;
         if (needsImageBuild) {
+            if (values['inherit-build-proxy'] && effectiveConfig.dockerfile) {
+                throw new Error('Build proxy inheritance is unavailable with a custom sandbox Dockerfile.');
+            }
+            const buildProxy = prepareBuildProxy(values['inherit-build-proxy'] ?? false, process.env, engine);
+            if (values['inherit-build-proxy'])
+                assertBuildProxyCompatibility(engine);
             const buildRefresh = !imageExists || refreshDue;
             const buildLastRefresh = buildRefresh ? now : currentLastRefresh || 0;
             p.log.step(refreshDue
@@ -1035,7 +1075,13 @@ export async function create(args) {
                     ? 'Rebuilding stale image...'
                     : 'Building image for first use...');
             try {
-                buildImage(effectiveConfig, tools, preparedDockerfile.path, expectedImageSignature, { engine, refresh: buildRefresh, lastRefresh: buildLastRefresh });
+                buildImage(effectiveConfig, tools, preparedDockerfile.path, expectedImageSignature, {
+                    engine,
+                    refresh: buildRefresh,
+                    lastRefresh: buildLastRefresh,
+                    buildProxyArgs: buildProxy.args,
+                    buildEnv: buildProxy.env
+                });
                 p.log.success(refreshDue
                     ? 'Image refreshed'
                     : imageExists
@@ -1045,10 +1091,12 @@ export async function create(args) {
             catch (error) {
                 if (refreshDue && !signatureStale && imageExists) {
                     p.log.warn('Scheduled sandbox image refresh failed; continuing with the existing image. ' +
-                        commandErrorMessage(error));
+                        redactBuildProxyValues(commandErrorMessage(error), buildProxy.redactionValues)
+                        + (values['inherit-build-proxy'] ? ` ${buildProxyFailureHint(engine)}` : ''));
                 }
                 else {
-                    throw error;
+                    const hint = values['inherit-build-proxy'] ? `\n${buildProxyFailureHint(engine)}` : '';
+                    throw new Error(`${redactBuildProxyValues(commandErrorMessage(error), buildProxy.redactionValues)}${hint}`);
                 }
             }
         }

package/dist/lib/sandbox/commands/rebuild.js

@@ -9,15 +9,17 @@ import { runEngine, runOkEngine, runSafeEngine, runVerboseEngine } from '../shel
 import { pruneSandboxDanglingImages } from '../image-prune.js';
 import { resolveTools } from '../tools.js';
 import { buildImageSignature, buildSandboxImageArgs, parseImageLabels, parseRefreshTimestamp } from '../image-build.js';
-const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh]`;
-export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+import { assertBuildProxyCompatibility, buildProxyFailureHint, prepareBuildProxy, redactBuildProxyValues } from '../build-proxy.js';
+const USAGE = `Usage: ai sandbox rebuild [--quiet] [--refresh] [--inherit-build-proxy|-B]`;
+export function buildArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh, buildProxyArgs = [] } = {}) {
     return buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, {
         engine: engine ?? detectEngine(config),
         runFn,
         runSafeFn,
         env,
         refresh,
-        lastRefresh
+        lastRefresh,
+        buildProxyArgs
     });
 }
 function readExistingLastRefresh(config, engine) {
@@ -41,6 +43,7 @@ export async function rebuild(args) {
         options: {
             refresh: { type: 'boolean' },
             quiet: { type: 'boolean', short: 'q' },
+            'inherit-build-proxy': { type: 'boolean', short: 'B' },
             help: { type: 'boolean', short: 'h' }
         }
     });
@@ -56,6 +59,12 @@ export async function rebuild(args) {
     const refresh = values.refresh ?? false;
     const engine = detectEngine(config);
     await ensureDocker(config, undefined);
+    if (values['inherit-build-proxy'] && config.dockerfile) {
+        throw new Error('Build proxy inheritance is unavailable with a custom sandbox Dockerfile.');
+    }
+    const buildProxy = prepareBuildProxy(values['inherit-build-proxy'] ?? false, process.env, engine);
+    if (values['inherit-build-proxy'])
+        assertBuildProxyCompatibility(engine);
     const lastRefresh = refresh ? Date.now() : readExistingLastRefresh(config, engine);
     p.intro(pc.cyan('Rebuilding sandbox image'));
     try {
@@ -65,9 +74,11 @@ export async function rebuild(args) {
             runEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
                 engine,
                 refresh,
-                lastRefresh
+                lastRefresh,
+                buildProxyArgs: buildProxy.args
             }), {
-                cwd: config.repoRoot
+                cwd: config.repoRoot,
+                env: buildProxy.env
             });
             spinner.stop(pc.green('Sandbox image rebuilt'));
         }
@@ -76,12 +87,18 @@ export async function rebuild(args) {
             runVerboseEngine(engine, 'docker', buildArgs(config, tools, preparedDockerfile.path, imageSignature, {
                 engine,
                 refresh,
-                lastRefresh
-            }), { cwd: config.repoRoot });
+                lastRefresh,
+                buildProxyArgs: buildProxy.args
+            }), { cwd: config.repoRoot, env: buildProxy.env });
             p.log.success(pc.green('Sandbox image rebuilt'));
         }
         pruneSandboxDanglingImages(config, engine);
     }
+    catch (error) {
+        const message = redactBuildProxyValues(error instanceof Error ? error.message : String(error), buildProxy.redactionValues);
+        const hint = values['inherit-build-proxy'] ? `\n${buildProxyFailureHint(engine)}` : '';
+        throw new Error(`${message}${hint}`);
+    }
     finally {
         preparedDockerfile.cleanup();
     }

package/dist/lib/sandbox/image-build.js

@@ -14,7 +14,7 @@ export function buildImageSignature(preparedDockerfile, tools) {
         .digest('hex')
         .slice(0, 12);
 }
-export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh } = {}) {
+export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignature, { engine, runFn = runEngine, runSafeFn = runSafeEngine, env = process.env, refresh = false, lastRefresh, buildProxyArgs = [] } = {}) {
     const selectedEngine = engine ?? detectEngine({ engine: config.engine });
     const { uid: hostUid, gid: hostGid } = resolveBuildUid({
         engine: selectedEngine,
@@ -39,6 +39,7 @@ export function buildSandboxImageArgs(config, tools, dockerfilePath, imageSignat
         '--label',
         `${sandboxImageConfigLabel(config)}=${imageSignature}`
     ];
+    args.push(...buildProxyArgs);
     if (lastRefresh !== undefined) {
         args.push('--label', `${sandboxImageRefreshLabel(config)}=${lastRefresh}`);
     }

package/dist/lib/sandbox/runtimes/ai-tools.dockerfile

@@ -5,20 +5,41 @@ ENV NPM_CONFIG_PREFIX=/home/devuser/.npm-global
 ENV PATH="/home/devuser/.npm-global/bin:${PATH}"
 
 ARG AI_TOOL_PACKAGES=
-RUN set -e && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    set -e && \
     for pkg in ${AI_TOOL_PACKAGES}; do \
       npm install -g "$pkg"; \
     done
 
 ARG AI_TOOLS_SHELL_INSTALL_B64=
-RUN if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    if [ -n "${AI_TOOLS_SHELL_INSTALL_B64}" ]; then \
       set -e && \
       echo "${AI_TOOLS_SHELL_INSTALL_B64}" | base64 -d > /tmp/ai-tools-install.sh && \
       bash /tmp/ai-tools-install.sh && \
       rm /tmp/ai-tools-install.sh; \
     fi
 
-RUN npm install -g pyright
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    npm install -g pyright
 
 RUN mkdir -p /home/devuser/.local/share /home/devuser/.local/state
 

package/dist/lib/sandbox/runtimes/base.dockerfile

@@ -19,7 +19,14 @@ RUN if [ "${HOST_UID}" = "0" ]; then \
         useradd -u ${HOST_UID} -g ${HOST_GID} -m -s /bin/bash devuser; \
     fi
 
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     curl wget git vim file jq \
     build-essential ca-certificates gnupg lsb-release \
     libevent-core-2.1-7 libncursesw6 libtinfo6 \

package/dist/lib/sandbox/runtimes/java17.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-17-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/java21.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     openjdk-21-jdk maven \
     && rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/node20.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_20.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/node22.dockerfile

@@ -1,3 +1,10 @@
-RUN bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    bash -o pipefail -c 'curl -fsSL --retry 5 --retry-delay 2 --retry-all-errors https://deb.nodesource.com/setup_22.x | bash -' && \
     apt-get install -y nodejs && \
     rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/runtimes/python3.dockerfile

@@ -1,3 +1,10 @@
-RUN apt-get update && apt-get install -y \
+RUN --mount=type=secret,id=HTTP_PROXY \
+    --mount=type=secret,id=HTTPS_PROXY \
+    --mount=type=secret,id=NO_PROXY \
+    export HTTP_PROXY="$(cat /run/secrets/HTTP_PROXY 2>/dev/null || true)" && \
+    export HTTPS_PROXY="$(cat /run/secrets/HTTPS_PROXY 2>/dev/null || true)" && \
+    export NO_PROXY="$(cat /run/secrets/NO_PROXY 2>/dev/null || true)" && \
+    export http_proxy="${HTTP_PROXY}" https_proxy="${HTTPS_PROXY}" no_proxy="${NO_PROXY}" && \
+    apt-get update && apt-get install -y \
     python3 python3-pip python3-venv \
     && rm -rf /var/lib/apt/lists/*

package/dist/lib/sandbox/shell.js

@@ -8,7 +8,8 @@ function normalizeOptions(opts = {}, stdio) {
         cwd: opts.cwd,
         encoding: opts.encoding,
         stdio,
-        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS
+        timeout: opts.timeout ?? DEFAULT_TIMEOUT_MS,
+        env: opts.env
     };
 }
 function resolveCommand(cmd) {

package/dist/lib/task/commands/issue-body.js

@@ -10,11 +10,12 @@ Print a deterministic Issue body extracted from a task's task.md.
   Omit <ref>           Resolve the unique active task for the current branch.
   <ref>               Bare numeric short id, or a full TASK-YYYYMMDD-HHMMSS id.
   --template <path>   Render the final body for the given GitHub Issue Form (scenario A);
-                      without it, print the default '描述 + 需求' body (scenario B).
+                      without it, print the default '任务输入 + 描述 + 需求' body (scenario B).
 
-Only the task title, '## 描述' and '## 需求' sections are ever emitted; the rest of
-task.md (scaffolding sections, placeholders) is never written to the body.
+Only the task title, '## 任务输入', '## 描述' and '## 需求' sections are ever
+emitted; the rest of task.md is never written to the body.
 `;
+const TASK_INPUT_ALIASES = ['任务输入', 'Task Input'];
 const DESCRIPTION_ALIASES = ['描述', 'Description'];
 const REQUIREMENTS_ALIASES = ['需求', 'Requirements'];
 /**
@@ -22,17 +23,21 @@ const REQUIREMENTS_ALIASES = ['需求', 'Requirements'];
  * task.md actually uses, with empty sections falling back to `N/A`.
  */
 function buildDefaultBody(content) {
+    const taskInputHeading = findSectionHeading(content, TASK_INPUT_ALIASES);
     const descHeading = findSectionHeading(content, DESCRIPTION_ALIASES);
     const reqHeading = findSectionHeading(content, REQUIREMENTS_ALIASES);
+    const taskInput = extractSection(content, TASK_INPUT_ALIASES) || PLACEHOLDER;
     const description = extractSection(content, DESCRIPTION_ALIASES) || PLACEHOLDER;
     const requirements = extractSection(content, REQUIREMENTS_ALIASES) || PLACEHOLDER;
-    return `## ${descHeading}\n\n${description}\n\n## ${reqHeading}\n\n${requirements}\n`;
+    return `## ${taskInputHeading}\n\n${taskInput}\n\n## ${descHeading}\n\n${description}\n\n## ${reqHeading}\n\n${requirements}\n`;
 }
 function readTaskFields(content) {
     return {
         title: extractTitle(content),
         description: extractSection(content, DESCRIPTION_ALIASES),
-        requirements: extractSection(content, REQUIREMENTS_ALIASES)
+        requirements: extractSection(content, REQUIREMENTS_ALIASES),
+        taskInput: extractSection(content, TASK_INPUT_ALIASES),
+        taskInputHeading: findSectionHeading(content, TASK_INPUT_ALIASES)
     };
 }
 function issueBody(args = []) {

package/dist/lib/task/events.js

@@ -79,7 +79,7 @@ const FAMILY = {
     'review-plan': { artifact: 'review-plan', started: ['technical-design', 'technical-design-review'], completed: ['technical-design', 'technical-design-review'], target: 'technical-design-review', label: 'Review Plan' },
     code: { artifact: 'code', started: ['technical-design-review', 'code-review'], completed: ['technical-design-review', 'code-review'], target: 'code', label: 'Code Task' },
     'review-code': { artifact: 'review-code', started: ['code', 'code-review', 'commit'], completed: ['code', 'code-review', 'commit'], target: 'code-review', label: 'Review Code' },
-    'manual-validation': { artifact: 'manual-validation', started: ['code-review'], completed: ['code-review'], target: null, label: 'Complete Manual Validation' }
+    'manual-validation': { artifact: 'manual-validation', started: ['code-review', 'commit'], completed: ['code-review', 'commit'], target: null, label: 'Complete Manual Validation' }
 };
 function eventParts(event) {
     const [family, suffix] = event.split('.');

package/dist/lib/task/issue-form.js

@@ -73,6 +73,8 @@ function renderTemplateBody(formText, fields) {
         const value = mapped.trim() === '' ? PLACEHOLDER : mapped;
         sections.push(`### ${label}\n\n${value}`);
     }
+    const taskInput = fields.taskInput.trim() === '' ? PLACEHOLDER : fields.taskInput;
+    sections.push(`### ${fields.taskInputHeading}\n\n${taskInput}`);
     return `${sections.join('\n\n')}\n`;
 }
 export { requirementFieldLabels, renderTemplateBody, mapFieldValue, PLACEHOLDER };

package/dist/lib/task/review-fingerprint.js

@@ -5,6 +5,15 @@ import { artifactName, maxRound } from "./review-artifacts.js";
 // covers ALL tracked changes by default. This default denylist is EMPTY —
 // projects opt into exclusions explicitly via review.post_review_exclude_globs.
 export const DEFAULT_POST_REVIEW_EXCLUDES = [];
+export function loadPostReviewConfig(repoRoot) {
+    try {
+        const config = JSON.parse(fs.readFileSync(path.join(repoRoot, ".agents", ".airc.json"), "utf8"));
+        return config.review && typeof config.review === "object" ? config.review : {};
+    }
+    catch {
+        return {};
+    }
+}
 export function resolvePostReviewGlobs(config = {}, reviewConfig = {}) {
     const projectExcludes = [
         ...(Array.isArray(reviewConfig.post_review_exclude_globs) ? reviewConfig.post_review_exclude_globs : []),