@fitlab-ai/agent-infra 0.9.0 → 0.9.1

package/dist/lib/task/verification-engine.js

@@ -4,9 +4,11 @@ import path from "node:path";
 import process from "node:process";
 import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { extractReviewBaseline, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
+import { extractReviewBaseline, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from "./verification-review.js";
 import { check as checkPlatformSync } from "../platform/verification-sync.js";
 import { check as checkRequiredChecks } from "../platform/verification-required.js";
+import { inspectPlatformPullRequest } from "../platform/pull-requests.js";
+import { resolveReviewedHeadRelation } from "../platform/merged-pr-equivalence.js";
 import { parseTypedTaskFrontmatter } from "./frontmatter.js";
 import { parseLedger } from "./ledger.js";
 import { loadVerificationConfig } from "./verification-config.js";
@@ -210,19 +212,6 @@ function loadProjectName() {
         return "";
     }
 }
-function loadReviewConfig() {
-    const configPath = path.join(repoRoot, ".agents", ".airc.json");
-    if (!fs.existsSync(configPath)) {
-        return {};
-    }
-    try {
-        const config = JSON.parse(fs.readFileSync(configPath, "utf8"));
-        return config.review && typeof config.review === "object" ? config.review : {};
-    }
-    catch {
-        return {};
-    }
-}
 function checkArtifact({ taskDir, config, artifactFile }) {
     const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
     if (!resolvedArtifact.ok) {
@@ -495,7 +484,7 @@ function resolveReviewSetting(config, key, fallback) {
     if (config && config[key] !== undefined && config[key] !== null) {
         return config[key];
     }
-    const reviewConfig = loadReviewConfig();
+    const reviewConfig = loadPostReviewConfig(repoRoot);
     if (reviewConfig[key] !== undefined && reviewConfig[key] !== null) {
         return reviewConfig[key];
     }
@@ -590,7 +579,7 @@ function checkPostReviewCommit({ taskDir, config }) {
         return baselineSource.result;
     }
     const sha = baselineSource.sha;
-    const globs = resolvePostReviewGlobs(config, loadReviewConfig());
+    const globs = resolvePostReviewGlobs(config, loadPostReviewConfig(repoRoot));
     let commits;
     try {
         const out = execFileSync("git", ["-C", gitRoot, "rev-list", `${sha}..HEAD`, "--", ...globs], { encoding: "utf8" });
@@ -602,6 +591,34 @@ function checkPostReviewCommit({ taskDir, config }) {
     if (commits.length === 0) {
         return passResult("post-review-commit", `No post-review commits to code/rule paths since ${sha.slice(0, 8)}`);
     }
+    if (task.ok && Number(task.metadata.pr_number) > 0) {
+        const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+        if (inspected.pullRequest) {
+            let localHead = "";
+            try {
+                localHead = execFileSync("git", ["-C", gitRoot, "rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+            }
+            catch {
+                return blockedResult("post-review-commit", "Unable to resolve the local HEAD");
+            }
+            const relation = resolveReviewedHeadRelation({
+                gitRoot,
+                localHead,
+                lastReviewedCommit: sha,
+                pullRequest: inspected.pullRequest,
+                pathspecs: globs
+            });
+            if (relation.status === "merged-equivalent") {
+                return passResult("post-review-commit", `Reviewed PR head is content-equivalent to squash merge ${relation.mergeCommit.slice(0, 8)}`);
+            }
+            if (relation.status === "blocked") {
+                return blockedResult("post-review-commit", relation.message);
+            }
+        }
+        else if (inspected.status === "blocked") {
+            return blockedResult("post-review-commit", inspected.error?.message || "PR merge snapshot is unavailable");
+        }
+    }
     let exempt = false;
     try {
         exempt = task.ok && parseLedger(task.content).some((row) => row.stage === POST_REVIEW_COMMIT_STAGE && row.status === "human-decided");
@@ -647,7 +664,7 @@ function checkReviewFact({ taskDir, artifactFile }) {
     }
     let actualSnapshot;
     try {
-        actualSnapshot = snapshotReview({ cwd: gitRoot, mode: "worktree", baseline, globs: resolvePostReviewGlobs({}, loadReviewConfig()) });
+        actualSnapshot = snapshotReview({ cwd: gitRoot, mode: "worktree", baseline, globs: resolvePostReviewGlobs({}, loadPostReviewConfig(repoRoot)) });
     }
     catch {
         return blockedResult("review-fact", `Unable to recompute reviewed diff fingerprint from baseline ${baseline.slice(0, 8)}; re-run review-code`);

package/dist/lib/task/verification-review.js

@@ -1,3 +1,3 @@
-export { extractReviewBaseline, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, parseReviewVerdict, resolvePostReviewGlobs } from './review-fingerprint.js';
+export { extractReviewBaseline, extractReviewDiffFingerprint, extractReviewedSnapshotTree, findAuthoritativeReviewCodeArtifact, loadPostReviewConfig, parseReviewVerdict, resolvePostReviewGlobs } from './review-fingerprint.js';
 export { parseLedger, summarizeLedgerStage, validateLedgerRows } from './ledger.js';
 //# sourceMappingURL=verification-review.js.map

package/dist/lib/task/verification.js

@@ -19,7 +19,7 @@ const VERIFICATION_CATALOG = {
     'block-task.completed': gate('block-task', 'blocked'),
     'cancel-task.completed': gate('cancel-task', 'completed'),
     'commit.completed': gate('commit', 'active'),
-    'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'post-review-commit', 'required-checks', 'platform-sync-preflight'] },
+    'complete-task.preflight': { skill: 'complete-task', expectedState: 'active', mode: 'checks', checks: ['review-ledger', 'post-review-commit', 'platform-sync-preflight'] },
     'complete-task.completed': gate('complete-task', 'completed'),
     'create-pr.completed': gate('create-pr', 'active'),
     'create-task.completed': gate('create-task', 'active'),

package/lib/internal/platform-release-notes.ts

@@ -0,0 +1,55 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { publishReleaseNotes, releaseNoteContext } from '../platform/release-notes.ts';
+
+function option(args: string[], name: string): string | null {
+  const index = args.indexOf(name);
+  return index >= 0 && args[index + 1] ? args[index + 1]! : null;
+}
+
+function finish(result: { status: string; [key: string]: unknown }): void {
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  process.exitCode = result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+}
+
+function platformReleaseNotes(args: string[] = []): void {
+  const [action, ...rest] = args;
+  const cwd = path.resolve(option(rest, '--cwd') || process.cwd());
+  if (action === 'context') {
+    const historyRaw = option(rest, '--history-limit');
+    finish(releaseNoteContext({
+      fromTag: option(rest, '--from-tag') || '',
+      toTag: option(rest, '--to-tag') || '',
+      branch: option(rest, '--branch') || '',
+      historyLimit: historyRaw === null ? undefined : Number(historyRaw)
+    }, { cwd }));
+    return;
+  }
+  if (action === 'publish') {
+    const notesPath = option(rest, '--notes-file');
+    if (!notesPath) {
+      finish({ status: 'failed', changed: false, error: { code: 'RELEASE_NOTES_INPUT_INVALID', message: 'notes-file is required', retryable: false } });
+      return;
+    }
+    let resolvedNotesPath = notesPath;
+    if (notesPath === '-') {
+      resolvedNotesPath = path.join(process.env.TMPDIR || '/tmp', `agent-infra-release-notes-${process.pid}.md`);
+      fs.writeFileSync(resolvedNotesPath, fs.readFileSync(0));
+    }
+    try {
+      finish(publishReleaseNotes({
+        tag: option(rest, '--tag') || '',
+        title: option(rest, '--title') || option(rest, '--tag') || '',
+        notesFile: resolvedNotesPath,
+        dryRun: rest.includes('--dry-run')
+      }, { cwd }));
+    } finally {
+      if (notesPath === '-') fs.rmSync(resolvedNotesPath, { force: true });
+    }
+    return;
+  }
+  finish({ status: 'failed', changed: false, error: { code: 'RELEASE_NOTES_INPUT_INVALID', message: 'Usage: platform-release-notes context|publish', retryable: false } });
+}
+
+export { platformReleaseNotes };

package/lib/internal/release-workflow.ts

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
 import semver from 'semver';
 
@@ -17,12 +18,101 @@ type CommandResult = ReturnType<typeof command>;
 type CommandRunner = (cwd: string, executable: string, args: string[]) => CommandResult;
 type DemoResult = {
   status: 'recorded' | 'skipped' | 'failed';
-  reasonCode: 'VHS_MISSING' | 'FFMPEG_MISSING' | 'DEMO_COMMAND_FAILED' | 'DEMO_OUTPUT_MISSING' | null;
+  reasonCode: 'DEMO_INPUTS_UNCHANGED' | 'GIT_LFS_MISSING' | 'VHS_MISSING' | 'FFMPEG_MISSING'
+    | 'DEMO_COMMAND_FAILED' | 'DEMO_OUTPUT_MISSING' | 'DEMO_OUTPUT_INVALID'
+    | 'DEMO_OUTPUT_TOO_LARGE' | 'DEMO_DIGEST_FAILED' | null;
   message: string | null;
   outputPath: string | null;
 };
 
+const DEMO_INPUT_PATHS = [
+  'assets/demo-init.tape',
+  'scripts/demo-regen.sh',
+  'scripts/normalize-gif-duration.py',
+  'bin/cli.ts',
+  'lib/init.ts',
+  'lib/log.ts',
+  'lib/prompt.ts',
+  'lib/paths.ts',
+  'lib/render.ts',
+  'lib/builtin-tuis.ts',
+  'lib/sandbox/engines/',
+  'src/sync-templates.js',
+  'templates/'
+] as const;
+const DEMO_DIGEST_PATH = 'assets/demo-init.inputs.sha256';
+const DEMO_OUTPUT_PATH = 'assets/demo-init.gif';
+const DEMO_MAX_BYTES = 4 * 1024 * 1024;
+
+function demoInputFiles(cwd: string): string[] {
+  const files = new Set<string>();
+  for (const input of DEMO_INPUT_PATHS) {
+    if (input.endsWith('/')) {
+      const listed = command(cwd, 'git', ['ls-files', '--', input]);
+      if (listed.status !== 0) throw new Error(String(listed.stderr || `Unable to list ${input}`));
+      const directoryFiles = String(listed.stdout).split('\n').filter(Boolean);
+      if (!directoryFiles.length) throw new Error(`Canonical demo input directory is empty: ${input}`);
+      for (const file of directoryFiles) files.add(file.replaceAll('\\', '/'));
+    } else {
+      files.add(input);
+    }
+  }
+  const sorted = [...files].sort((left, right) => Buffer.from(left).compare(Buffer.from(right)));
+  if (!sorted.length) throw new Error('Canonical demo input set is empty');
+  for (const file of sorted) {
+    const absolute = path.join(cwd, file);
+    if (!fs.statSync(absolute).isFile()) throw new Error(`Canonical demo input is not a file: ${file}`);
+  }
+  return sorted;
+}
+
+function computeDemoInputDigest(cwd: string): string {
+  const hash = crypto.createHash('sha256');
+  for (const file of demoInputFiles(cwd)) {
+    const bytes = fs.readFileSync(path.join(cwd, file));
+    hash.update(file);
+    hash.update('\0');
+    hash.update(String(bytes.byteLength));
+    hash.update('\0');
+    hash.update(bytes);
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
+function validGif(filePath: string): boolean {
+  if (!fs.existsSync(filePath)) return false;
+  const header = fs.readFileSync(filePath).subarray(0, 6).toString('ascii');
+  return header === 'GIF87a' || header === 'GIF89a';
+}
+
+function writeDigestAtomically(cwd: string, digest: string): void {
+  const target = path.join(cwd, DEMO_DIGEST_PATH);
+  const temporary = `${target}.tmp-${process.pid}`;
+  fs.writeFileSync(temporary, `${digest}\n`);
+  fs.renameSync(temporary, target);
+}
+
 function runOptionalDemo(cwd: string, run: CommandRunner = command): DemoResult {
+  let digest: string;
+  try {
+    digest = computeDemoInputDigest(cwd);
+  } catch (error) {
+    return { status: 'failed', reasonCode: 'DEMO_DIGEST_FAILED', message: String(error), outputPath: null };
+  }
+  const digestPath = path.join(cwd, DEMO_DIGEST_PATH);
+  const priorDigest = fs.existsSync(digestPath) ? fs.readFileSync(digestPath, 'utf8').trim() : '';
+  if (/^[0-9a-f]{64}$/.test(priorDigest) && priorDigest === digest) {
+    return { status: 'skipped', reasonCode: 'DEMO_INPUTS_UNCHANGED', message: null, outputPath: null };
+  }
+  const lfs = run(cwd, 'git', ['lfs', 'version']);
+  if (lfs.status !== 0) {
+    return { status: 'failed', reasonCode: 'GIT_LFS_MISSING', message: String(lfs.stderr || lfs.stdout), outputPath: null };
+  }
+  const lfsAttribute = run(cwd, 'git', ['check-attr', 'filter', '--', DEMO_OUTPUT_PATH]);
+  if (lfsAttribute.status !== 0 || !String(lfsAttribute.stdout).trim().endsWith(': lfs')) {
+    return { status: 'failed', reasonCode: 'GIT_LFS_MISSING', message: `${DEMO_OUTPUT_PATH} is not tracked by Git LFS`, outputPath: null };
+  }
   const vhs = run(cwd, 'vhs', ['--version']);
   if (vhs.status !== 0) return { status: 'skipped', reasonCode: 'VHS_MISSING', message: null, outputPath: null };
   const ffmpeg = run(cwd, 'ffmpeg', ['-version']);
@@ -36,7 +126,7 @@ function runOptionalDemo(cwd: string, run: CommandRunner = command): DemoResult
       outputPath: null
     };
   }
-  const outputPath = 'assets/demo-init.gif';
+  const outputPath = DEMO_OUTPUT_PATH;
   if (!fs.existsSync(path.join(cwd, outputPath))) {
     return {
       status: 'failed',
@@ -45,6 +135,18 @@ function runOptionalDemo(cwd: string, run: CommandRunner = command): DemoResult
       outputPath: null
     };
   }
+  const absoluteOutput = path.join(cwd, outputPath);
+  if (!validGif(absoluteOutput)) {
+    return { status: 'failed', reasonCode: 'DEMO_OUTPUT_INVALID', message: `${outputPath} is not a GIF`, outputPath: null };
+  }
+  if (fs.statSync(absoluteOutput).size > DEMO_MAX_BYTES) {
+    return { status: 'failed', reasonCode: 'DEMO_OUTPUT_TOO_LARGE', message: `${outputPath} exceeds 4 MiB`, outputPath: null };
+  }
+  const pointer = run(cwd, 'git', ['lfs', 'pointer', `--file=${outputPath}`]);
+  if (pointer.status !== 0 || !String(pointer.stdout).includes(`size ${fs.statSync(absoluteOutput).size}`)) {
+    return { status: 'failed', reasonCode: 'DEMO_OUTPUT_INVALID', message: 'Git LFS could not produce a matching pointer', outputPath: null };
+  }
+  writeDigestAtomically(cwd, digest);
   return { status: 'recorded', reasonCode: null, message: null, outputPath };
 }
 
@@ -182,5 +284,5 @@ async function releaseWorkflow(args: string[] = []): Promise<void> {
   process.stdout.write(`${JSON.stringify({ ...pushed, demo, snapshot: releaseSnapshot(version, await inspectFacts(cwd, version)) })}\n`); process.exitCode = pushed.status === 'failed' ? 1 : pushed.status === 'degraded' ? 2 : 0;
 }
 
-export { inspectFacts, releaseWorkflow, runOptionalDemo };
+export { computeDemoInputDigest, inspectFacts, releaseWorkflow, runOptionalDemo };
 export type { CommandRunner, DemoResult };

package/lib/platform/github-release-notes.ts

@@ -0,0 +1,132 @@
+import type { GitHubClient } from './github-client.ts';
+import { createGitHubClient } from './github-client.ts';
+
+type GitHubActorInput = {
+  name?: string | null;
+  email?: string | null;
+  user?: { login?: string | null } | null;
+};
+
+type ReleaseNoteActor = {
+  name: string;
+  email: string | null;
+  login: string | null;
+  bot: boolean;
+  resolution: 'platform-user' | 'platform-noreply' | 'unresolved';
+};
+
+type GitHubReleaseNoteOptions = { cwd?: string; client?: GitHubClient };
+
+function normalizeGitHubActor(actor: GitHubActorInput): ReleaseNoteActor {
+  const name = String(actor.name || '').trim();
+  const email = actor.email ? String(actor.email).trim() : null;
+  const platformLogin = actor.user?.login?.trim().toLowerCase() || null;
+  const noReplyLogin = email
+    ? /^(?:\d+\+)?([^@]+)@users\.noreply\.github\.com$/i.exec(email)?.[1]?.toLowerCase() || null
+    : null;
+  const login = platformLogin || noReplyLogin;
+  return {
+    name,
+    email,
+    login,
+    bot: Boolean(login?.endsWith('[bot]')),
+    resolution: platformLogin ? 'platform-user' : noReplyLogin ? 'platform-noreply' : 'unresolved'
+  };
+}
+
+function failure(error: { code: string; message: string; retryable: boolean }) {
+  return {
+    status: error.retryable ? 'blocked' as const : 'failed' as const,
+    changed: false,
+    operation: null,
+    url: null,
+    error
+  };
+}
+
+function publishGitHubReleaseNotes(
+  input: { repository: string; tag: string; title: string; notesFile: string; dryRun?: boolean },
+  options: GitHubReleaseNoteOptions = {}
+) {
+  const client = options.client ?? createGitHubClient();
+  const inspected = client.json<{ url?: string }>(
+    ['release', 'view', input.tag, '--repo', input.repository, '--json', 'url'],
+    { cwd: options.cwd }
+  );
+  if (!inspected.ok && inspected.error.code !== 'RESOURCE_NOT_FOUND') return failure(inspected.error);
+  const exists = inspected.ok;
+  const operation = exists ? 'release:update-notes' as const : 'release:create' as const;
+  if (input.dryRun) {
+    return {
+      status: 'planned' as const,
+      changed: false,
+      operation,
+      url: inspected.ok ? inspected.value.url || null : null,
+      error: null
+    };
+  }
+  const args = exists
+    ? ['release', 'edit', input.tag, '--repo', input.repository, '--notes-file', input.notesFile]
+    : ['release', 'create', input.tag, '--repo', input.repository, '--title', input.title, '--notes-file', input.notesFile];
+  const written = client.text(args, { cwd: options.cwd, method: exists ? 'PATCH' : 'POST' });
+  if (!written.ok) return failure(written.error);
+  return {
+    status: 'applied' as const,
+    changed: true,
+    operation,
+    url: written.value || (inspected.ok ? inspected.value.url || null : null),
+    error: null
+  };
+}
+
+function fetchGitHubReleaseNoteData(
+  input: { repository: string; commitOids: string[]; branch: string; historyLimit: number; fromTime: string; toTime: string },
+  options: GitHubReleaseNoteOptions = {}
+) {
+  const client = options.client ?? createGitHubClient();
+  const releases = client.json<Array<{ tagName?: string; isDraft?: boolean; isPrerelease?: boolean }>>(
+    ['release', 'list', '--repo', input.repository, '--limit', String(input.historyLimit + 10), '--json', 'tagName,isDraft,isPrerelease'],
+    { cwd: options.cwd }
+  );
+  if (!releases.ok) return failure(releases.error);
+  const history = [];
+  for (const item of releases.value.filter((entry) => !entry.isDraft && !entry.isPrerelease).slice(0, input.historyLimit)) {
+    const viewed = client.json<{ body?: string; url?: string }>(
+      ['release', 'view', String(item.tagName), '--repo', input.repository, '--json', 'body,url'],
+      { cwd: options.cwd }
+    );
+    if (!viewed.ok) return failure(viewed.error);
+    history.push({ tag: String(item.tagName), body: String(viewed.value.body || ''), url: viewed.value.url || null });
+  }
+  const prs = client.json<Array<Record<string, unknown>>>(
+    ['pr', 'list', '--repo', input.repository, '--state', 'merged', '--base', input.branch, '--limit', '1000', '--json', 'number,title,body,url,mergedAt,labels,author,closingIssuesReferences'],
+    { cwd: options.cwd }
+  );
+  if (!prs.ok) return failure(prs.error);
+  const authors = new Map<string, ReleaseNoteActor[]>();
+  for (const oid of input.commitOids) {
+    const query = `query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{authors(first:100){nodes{name email user{login}} pageInfo{hasNextPage}}}}}}`;
+    const [owner, name] = input.repository.split('/');
+    const result = client.json<{
+      data?: { repository?: { object?: { authors?: { nodes?: GitHubActorInput[]; pageInfo?: { hasNextPage?: boolean } } } } };
+    }>([
+      'api', 'graphql', '-f', `query=${query}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `oid=${oid}`
+    ], { cwd: options.cwd });
+    if (!result.ok) return failure(result.error);
+    const connection = result.value.data?.repository?.object?.authors;
+    if (connection?.pageInfo?.hasNextPage) {
+      return failure({ code: 'RELEASE_NOTES_AUTHORS_TRUNCATED', message: `Commit authors exceeded the supported page size for ${oid}`, retryable: false });
+    }
+    authors.set(oid, (connection?.nodes || []).map(normalizeGitHubActor));
+  }
+  const fromTime = Date.parse(input.fromTime);
+  const toTime = Date.parse(input.toTime);
+  const pullRequests = prs.value.filter((item) => {
+    const mergedAt = Date.parse(String(item.mergedAt || ''));
+    return Number.isFinite(mergedAt) && mergedAt > fromTime && mergedAt <= toTime;
+  });
+  return { status: 'no-op' as const, changed: false, history, pullRequests, authors, error: null };
+}
+
+export { fetchGitHubReleaseNoteData, normalizeGitHubActor, publishGitHubReleaseNotes };
+export type { ReleaseNoteActor };

package/lib/platform/issues.ts

@@ -6,7 +6,7 @@ import { buildDefaultBody } from '../task/commands/issue-body.ts';
 import { extractTitle, parseTaskFrontmatter } from '../task/frontmatter.ts';
 import { requirementFieldLabels, renderTemplateBody } from '../task/issue-form.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { extractSection } from '../task/sections.ts';
+import { extractSection, findSectionHeading } from '../task/sections.ts';
 import { writeTask } from '../task/write.ts';
 import { resolvePlatformContext } from './context.ts';
 import { createGitHubClient } from './github-client.ts';
@@ -308,9 +308,11 @@ function deterministicIssueBody(repoRoot: string, content: string, taskType: str
   if (selected) {
     try {
       return renderTemplateBody(fs.readFileSync(selected, 'utf8'), {
-      title: taskTitle(content),
-      description: extractSection(content, ['描述', 'Description']),
-      requirements: extractSection(content, ['需求', 'Requirements'])
+        title: taskTitle(content),
+        description: extractSection(content, ['描述', 'Description']),
+        requirements: extractSection(content, ['需求', 'Requirements']),
+        taskInput: extractSection(content, ['任务输入', 'Task Input']),
+        taskInputHeading: findSectionHeading(content, ['任务输入', 'Task Input'])
       });
     } catch {
       // Invalid or unavailable forms fall back to the deterministic default body.

package/lib/platform/merged-pr-equivalence.ts

@@ -0,0 +1,70 @@
+import { execFileSync } from "node:child_process";
+
+import type { PullRequestSnapshot } from "./pull-requests.ts";
+
+const SHA_PATTERN = /^[0-9a-f]{40}$/i;
+
+type ReviewedHeadRelation =
+  | { status: "strict"; reviewedHead: string }
+  | { status: "merged-equivalent"; reviewedHead: string; mergeCommit: string }
+  | { status: "failed" | "blocked"; code: string; message: string };
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync("git", args, { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+
+function commitExists(gitRoot: string, sha: string): boolean {
+  try {
+    git(gitRoot, ["cat-file", "-e", `${sha}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export function resolveReviewedHeadRelation(input: {
+  gitRoot: string;
+  localHead: string;
+  lastReviewedCommit: string;
+  pullRequest: PullRequestSnapshot;
+  pathspecs: string[];
+}): ReviewedHeadRelation {
+  const { gitRoot, localHead, lastReviewedCommit, pullRequest, pathspecs } = input;
+  if (localHead === lastReviewedCommit && lastReviewedCommit === pullRequest.head.sha) {
+    return { status: "strict", reviewedHead: lastReviewedCommit };
+  }
+  if (pullRequest.state !== "closed" || !pullRequest.mergedAt || !pullRequest.mergeCommitSha ||
+      lastReviewedCommit !== pullRequest.head.sha) {
+    return { status: "failed", code: "PR_MERGE_IDENTITY_INVALID", message: "PR merge identity does not match the reviewed head" };
+  }
+  const shas = [pullRequest.base.sha, pullRequest.head.sha, pullRequest.mergeCommitSha, localHead];
+  if (shas.some((sha) => !SHA_PATTERN.test(sha) || !commitExists(gitRoot, sha))) {
+    return { status: "blocked", code: "PR_MERGE_OBJECT_MISSING", message: "Required PR merge Git objects are unavailable" };
+  }
+  try {
+    git(gitRoot, ["merge-base", "--is-ancestor", pullRequest.mergeCommitSha, localHead]);
+    const parents = git(gitRoot, ["rev-list", "--parents", "-n", "1", pullRequest.mergeCommitSha]).trim().split(/\s+/);
+    if (parents.length !== 2) {
+      return { status: "failed", code: "PR_MERGE_TOPOLOGY_INVALID", message: "PR merge commit is not a single-parent squash commit" };
+    }
+    const diffArgs = ["diff", "--no-renames", "--binary", "--full-index"];
+    const reviewedDiff = git(gitRoot, [...diffArgs, pullRequest.base.sha, pullRequest.head.sha]);
+    const mergedDiff = git(gitRoot, [...diffArgs, `${pullRequest.mergeCommitSha}^`, pullRequest.mergeCommitSha]);
+    if (reviewedDiff !== mergedDiff) {
+      return { status: "failed", code: "PR_MERGE_CONTENT_MISMATCH", message: "Squash merge content differs from the reviewed PR changes" };
+    }
+    const postMerge = git(gitRoot, ["rev-list", `${pullRequest.mergeCommitSha}..${localHead}`, "--", ...pathspecs]).trim();
+    if (postMerge) {
+      return { status: "failed", code: "POST_MERGE_CHANGES", message: "Protected paths changed after the squash merge" };
+    }
+  } catch {
+    return { status: "blocked", code: "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE", message: "Unable to verify PR merge topology or content" };
+  }
+  return {
+    status: "merged-equivalent",
+    reviewedHead: lastReviewedCommit,
+    mergeCommit: pullRequest.mergeCommitSha
+  };
+}
+
+export type { ReviewedHeadRelation };

package/lib/platform/pr-checks.ts

@@ -8,6 +8,7 @@ import type { GitHubClient } from './github-client.ts';
 import { inspectPlatformPullRequest } from './pull-requests.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
+import type { PullRequestSnapshot } from './pull-requests.ts';
 
 type CheckBucket = 'pass' | 'fail' | 'pending' | 'cancel';
 type CheckState = 'passed' | 'failed' | 'pending' | 'timed-out' | 'cancelled' | 'no-required';
@@ -23,7 +24,7 @@ type CheckSnapshot = {
 type ChecksSnapshot = { state: Exclude<CheckState, 'timed-out'>; required: CheckSnapshot[] };
 type RunCandidate = { id: number; name: string; headSha: string; jobId?: number | null };
 type ChecksResult = PlatformResult & {
-  pullRequest: { number: number; headSha: string } | null;
+  pullRequest: PullRequestSnapshot | null;
   checks: { state: CheckState; required: CheckSnapshot[] };
   resolution?: { status: 'resolved' | 'missing' | 'ambiguous'; runId: number | null; jobId: number | null };
   logs?: { runId: number; jobId?: number; text: string };
@@ -140,7 +141,7 @@ function inspectRequiredChecks(taskRef: string, options: SharedOptions = {}): Ch
     return checksResult(inspected.error.retryable ? 'blocked' : 'failed', {
       platform: base.context.platform, capabilities: base.context.capabilities,
       resource: { kind: 'pull-request', number: base.prNumber },
-      pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, error: inspected.error
+      pullRequest: base.pullRequest, error: inspected.error
     });
   }
   const classified = classifyRequiredChecks(normalizeChecks(inspected.value));
@@ -150,7 +151,7 @@ function inspectRequiredChecks(taskRef: string, options: SharedOptions = {}): Ch
   return checksResult(status, {
     platform: base.context.platform, capabilities: base.context.capabilities,
     resource: { kind: 'pull-request', number: base.prNumber },
-    pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, checks: classified,
+    pullRequest: base.pullRequest, checks: classified,
     error: status === 'no-op' ? null : {
       code: classified.state === 'pending' ? 'REQUIRED_CHECKS_PENDING' : `REQUIRED_CHECKS_${classified.state.toUpperCase()}`,
       message: `Required checks are ${classified.state}`,
@@ -197,9 +198,9 @@ function resolvePlatformCheckRun(taskRef: string, options: SharedOptions & { che
   const direct = options.detailsUrl ? parseRunJobIdentity(options.detailsUrl) : null;
   if (direct) {
     const run = base.client.json<{ id?: number; head_sha?: string }>(['api', `repos/${base.context.platform.repository}/actions/runs/${direct.runId}`], { cwd: base.resolved.repoRoot });
-    if (!run.ok) return checksResult(run.error.retryable ? 'blocked' : 'failed', { platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, error: run.error });
+    if (!run.ok) return checksResult(run.error.retryable ? 'blocked' : 'failed', { platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: base.pullRequest, error: run.error });
     if (run.value.head_sha !== base.pullRequest.head.sha) return checksResult('failed', { error: { code: 'CHECK_RUN_HEAD_MISMATCH', message: 'Resolved run does not belong to the PR head SHA', retryable: false } });
-    return checksResult('no-op', { platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, resolution: { status: 'resolved', ...direct }, error: null });
+    return checksResult('no-op', { platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: base.pullRequest, resolution: { status: 'resolved', ...direct }, error: null });
   }
   const listed = base.client.json<{ check_runs?: Array<{ name?: string; details_url?: string }> }>(['api', `repos/${base.context.platform.repository}/commits/${base.pullRequest.head.sha}/check-runs`], { cwd: base.resolved.repoRoot });
   if (!listed.ok) return checksResult(listed.error.retryable ? 'blocked' : 'failed', { error: listed.error });
@@ -211,7 +212,7 @@ function resolvePlatformCheckRun(taskRef: string, options: SharedOptions & { che
   const resolution = resolveRunCandidate(candidates, base.pullRequest.head.sha, options.checkName);
   return checksResult(resolution.status === 'resolved' ? 'no-op' : 'failed', {
     platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha },
+    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: base.pullRequest,
     resolution,
     error: resolution.status === 'resolved' ? null : { code: resolution.status === 'ambiguous' ? 'CHECK_RUN_AMBIGUOUS' : 'CHECK_RUN_NOT_FOUND', message: `Check run is ${resolution.status}`, retryable: false }
   });
@@ -228,7 +229,7 @@ function fetchPlatformCheckLogs(taskRef: string, options: SharedOptions & { run:
   if (!fetched.value) return checksResult('failed', { error: { code: 'CHECK_LOGS_MISSING', message: 'No failed logs are available', retryable: false } });
   return checksResult('no-op', {
     platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha },
+    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: base.pullRequest,
     logs: { runId: options.run, ...(options.job ? { jobId: options.job } : {}), text: fetched.value }, error: null
   });
 }

package/lib/platform/pull-requests.ts

@@ -22,7 +22,9 @@ type PullRequestSnapshot = {
   body: string;
   draft: boolean;
   head: { repository: string; ref: string; sha: string };
-  base: { repository: string; ref: string };
+  base: { repository: string; ref: string; sha: string };
+  mergedAt: string | null;
+  mergeCommitSha: string | null;
   labels: string[];
   assignees: string[];
   milestone: string | null;
@@ -55,7 +57,9 @@ type RemotePullRequest = {
   draft?: boolean;
   pull_request?: unknown;
   head?: { ref?: string; sha?: string; repo?: { full_name?: string } | null };
-  base?: { ref?: string; repo?: { full_name?: string } | null };
+  base?: { ref?: string; sha?: string; repo?: { full_name?: string } | null };
+  merged_at?: string | null;
+  merge_commit_sha?: string | null;
   labels?: Array<string | { name?: string }>;
   assignees?: Array<{ login?: string }>;
   milestone?: { title?: string } | null;
@@ -92,7 +96,9 @@ function normalizePullRequest(remote: RemotePullRequest, repository: string): Pu
     body: remote.body || '',
     draft: Boolean(remote.draft),
     head: { repository: headRepository, ref: remote.head.ref, sha: remote.head.sha },
-    base: { repository: baseRepository, ref: remote.base.ref },
+    base: { repository: baseRepository, ref: remote.base.ref, sha: remote.base.sha || '' },
+    mergedAt: remote.merged_at || null,
+    mergeCommitSha: remote.merge_commit_sha || null,
     labels: (remote.labels || []).map((label) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
     assignees: (remote.assignees || []).map((assignee) => assignee.login || '').filter(Boolean).sort(),
     milestone: remote.milestone?.title || null