@fitlab-ai/agent-infra 0.9.0 → 0.9.2

package/lib/platform/change-request-git-evidence.ts

@@ -0,0 +1,159 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+
+import { resolvePlatformChangeRequestGitEvidence } from "./adapters.ts";
+import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.ts";
+import type { ReviewedHeadRelation } from "./merged-pr-equivalence.ts";
+import type { PullRequestSnapshot } from "./pull-requests.ts";
+
+const SHA_PATTERN = /^[0-9a-f]{40}$/i;
+const REVIEWED_HEAD_REF = "refs/agent-infra/reviewed-head";
+const TARGET_HEAD_REF = "refs/agent-infra/target-head";
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"]
+  }).trim();
+}
+
+function validRef(ref: string): boolean {
+  return spawnSync("git", ["check-ref-format", ref], {
+    encoding: "utf8",
+    stdio: ["ignore", "ignore", "ignore"]
+  }).status === 0;
+}
+
+function blocked(code: string, message: string): ReviewedHeadRelation {
+  return { status: "blocked", code, message };
+}
+
+function failed(code: string, message: string): ReviewedHeadRelation {
+  return { status: "failed", code, message };
+}
+
+function validMergeIdentity(lastReviewedCommit: string, pullRequest: PullRequestSnapshot):
+  ReviewedHeadRelation | null {
+  if (
+    pullRequest.state !== "closed" ||
+    !pullRequest.mergedAt ||
+    !pullRequest.mergeCommitSha ||
+    !SHA_PATTERN.test(lastReviewedCommit) ||
+    lastReviewedCommit !== pullRequest.head.sha
+  ) {
+    return failed(
+      "PR_MERGE_IDENTITY_INVALID",
+      "PR merge identity does not match the reviewed head"
+    );
+  }
+  return null;
+}
+
+function resolveMaterializedReviewedHeadRelation(input: {
+  cwd: string;
+  platformType: string | null;
+  lastReviewedCommit: string;
+  pullRequest: PullRequestSnapshot;
+}): ReviewedHeadRelation {
+  const identityFailure = validMergeIdentity(input.lastReviewedCommit, input.pullRequest);
+  if (identityFailure) return identityFailure;
+
+  const source = resolvePlatformChangeRequestGitEvidence(input.platformType, {
+    cwd: input.cwd,
+    repository: input.pullRequest.repository,
+    number: input.pullRequest.number,
+    pullRequest: input.pullRequest
+  });
+  if (!source.ok || !source.value) {
+    return blocked(
+      source.error?.code || "PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE",
+      source.error?.message || "Unable to resolve authoritative PR Git evidence"
+    );
+  }
+  if (
+    !source.value.remoteUrl.trim() ||
+    source.value.remoteUrl.trimStart().startsWith("-") ||
+    !validRef(source.value.reviewedHeadRef) ||
+    !validRef(source.value.targetHeadRef)
+  ) {
+    return blocked(
+      "PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE",
+      "Platform returned an invalid PR Git evidence source"
+    );
+  }
+
+  let evidenceRoot: string | null = null;
+  let phase: "prepare" | "fetch" | "resolve" = "prepare";
+  let result: ReviewedHeadRelation = blocked(
+    "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE",
+    "Unable to prepare isolated PR Git evidence"
+  );
+  try {
+    evidenceRoot = fs.mkdtempSync(path.join(os.tmpdir(), "agent-infra-pr-evidence-"));
+    execFileSync("git", ["init", "--bare", "-q", evidenceRoot], {
+      cwd: input.cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+
+    phase = "fetch";
+    git(evidenceRoot, [
+      "fetch",
+      "--no-tags",
+      "--no-write-fetch-head",
+      source.value.remoteUrl,
+      `+${source.value.reviewedHeadRef}:${REVIEWED_HEAD_REF}`,
+      `+${source.value.targetHeadRef}:${TARGET_HEAD_REF}`
+    ]);
+
+    phase = "resolve";
+    const fetchedReviewedHead = git(evidenceRoot, ["rev-parse", `${REVIEWED_HEAD_REF}^{commit}`]);
+    const comparisonHead = git(evidenceRoot, ["rev-parse", `${TARGET_HEAD_REF}^{commit}`]);
+    if (fetchedReviewedHead !== input.pullRequest.head.sha) {
+      result = failed(
+        "PR_MERGE_FETCHED_HEAD_MISMATCH",
+        "Fetched PR head does not match the authoritative platform snapshot"
+      );
+    } else {
+      result = resolveReviewedHeadRelation({
+        gitRoot: evidenceRoot,
+        comparisonHead,
+        lastReviewedCommit: input.lastReviewedCommit,
+        pullRequest: input.pullRequest
+      });
+    }
+  } catch {
+    result = phase === "fetch"
+      ? blocked(
+          "PR_MERGE_EVIDENCE_FETCH_FAILED",
+          "Unable to fetch PR Git evidence; verify Git credentials and platform refs"
+        )
+      : phase === "resolve"
+        ? blocked(
+            "PR_MERGE_OBJECT_MISSING",
+            "Fetched PR Git evidence is incomplete"
+          )
+        : blocked(
+            "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE",
+            "Unable to prepare isolated PR Git evidence"
+          );
+  } finally {
+    if (evidenceRoot) {
+      try {
+        fs.rmSync(evidenceRoot, { recursive: true, force: true });
+      } catch {
+        result = blocked(
+          "PR_MERGE_EVIDENCE_CLEANUP_FAILED",
+          "Unable to clean up isolated PR Git evidence"
+        );
+      }
+    }
+  }
+  return result;
+}
+
+export { resolveMaterializedReviewedHeadRelation };

package/lib/platform/github-release-notes.ts

@@ -0,0 +1,132 @@
+import type { GitHubClient } from './github-client.ts';
+import { createGitHubClient } from './github-client.ts';
+
+type GitHubActorInput = {
+  name?: string | null;
+  email?: string | null;
+  user?: { login?: string | null } | null;
+};
+
+type ReleaseNoteActor = {
+  name: string;
+  email: string | null;
+  login: string | null;
+  bot: boolean;
+  resolution: 'platform-user' | 'platform-noreply' | 'unresolved';
+};
+
+type GitHubReleaseNoteOptions = { cwd?: string; client?: GitHubClient };
+
+function normalizeGitHubActor(actor: GitHubActorInput): ReleaseNoteActor {
+  const name = String(actor.name || '').trim();
+  const email = actor.email ? String(actor.email).trim() : null;
+  const platformLogin = actor.user?.login?.trim().toLowerCase() || null;
+  const noReplyLogin = email
+    ? /^(?:\d+\+)?([^@]+)@users\.noreply\.github\.com$/i.exec(email)?.[1]?.toLowerCase() || null
+    : null;
+  const login = platformLogin || noReplyLogin;
+  return {
+    name,
+    email,
+    login,
+    bot: Boolean(login?.endsWith('[bot]')),
+    resolution: platformLogin ? 'platform-user' : noReplyLogin ? 'platform-noreply' : 'unresolved'
+  };
+}
+
+function failure(error: { code: string; message: string; retryable: boolean }) {
+  return {
+    status: error.retryable ? 'blocked' as const : 'failed' as const,
+    changed: false,
+    operation: null,
+    url: null,
+    error
+  };
+}
+
+function publishGitHubReleaseNotes(
+  input: { repository: string; tag: string; title: string; notesFile: string; dryRun?: boolean },
+  options: GitHubReleaseNoteOptions = {}
+) {
+  const client = options.client ?? createGitHubClient();
+  const inspected = client.json<{ url?: string }>(
+    ['release', 'view', input.tag, '--repo', input.repository, '--json', 'url'],
+    { cwd: options.cwd }
+  );
+  if (!inspected.ok && inspected.error.code !== 'RESOURCE_NOT_FOUND') return failure(inspected.error);
+  const exists = inspected.ok;
+  const operation = exists ? 'release:update-notes' as const : 'release:create' as const;
+  if (input.dryRun) {
+    return {
+      status: 'planned' as const,
+      changed: false,
+      operation,
+      url: inspected.ok ? inspected.value.url || null : null,
+      error: null
+    };
+  }
+  const args = exists
+    ? ['release', 'edit', input.tag, '--repo', input.repository, '--notes-file', input.notesFile]
+    : ['release', 'create', input.tag, '--repo', input.repository, '--title', input.title, '--notes-file', input.notesFile];
+  const written = client.text(args, { cwd: options.cwd, method: exists ? 'PATCH' : 'POST' });
+  if (!written.ok) return failure(written.error);
+  return {
+    status: 'applied' as const,
+    changed: true,
+    operation,
+    url: written.value || (inspected.ok ? inspected.value.url || null : null),
+    error: null
+  };
+}
+
+function fetchGitHubReleaseNoteData(
+  input: { repository: string; commitOids: string[]; branch: string; historyLimit: number; fromTime: string; toTime: string },
+  options: GitHubReleaseNoteOptions = {}
+) {
+  const client = options.client ?? createGitHubClient();
+  const releases = client.json<Array<{ tagName?: string; isDraft?: boolean; isPrerelease?: boolean }>>(
+    ['release', 'list', '--repo', input.repository, '--limit', String(input.historyLimit + 10), '--json', 'tagName,isDraft,isPrerelease'],
+    { cwd: options.cwd }
+  );
+  if (!releases.ok) return failure(releases.error);
+  const history = [];
+  for (const item of releases.value.filter((entry) => !entry.isDraft && !entry.isPrerelease).slice(0, input.historyLimit)) {
+    const viewed = client.json<{ body?: string; url?: string }>(
+      ['release', 'view', String(item.tagName), '--repo', input.repository, '--json', 'body,url'],
+      { cwd: options.cwd }
+    );
+    if (!viewed.ok) return failure(viewed.error);
+    history.push({ tag: String(item.tagName), body: String(viewed.value.body || ''), url: viewed.value.url || null });
+  }
+  const prs = client.json<Array<Record<string, unknown>>>(
+    ['pr', 'list', '--repo', input.repository, '--state', 'merged', '--base', input.branch, '--limit', '1000', '--json', 'number,title,body,url,mergedAt,labels,author,closingIssuesReferences'],
+    { cwd: options.cwd }
+  );
+  if (!prs.ok) return failure(prs.error);
+  const authors = new Map<string, ReleaseNoteActor[]>();
+  for (const oid of input.commitOids) {
+    const query = `query($owner:String!,$name:String!,$oid:GitObjectID!){repository(owner:$owner,name:$name){object(oid:$oid){... on Commit{authors(first:100){nodes{name email user{login}} pageInfo{hasNextPage}}}}}}`;
+    const [owner, name] = input.repository.split('/');
+    const result = client.json<{
+      data?: { repository?: { object?: { authors?: { nodes?: GitHubActorInput[]; pageInfo?: { hasNextPage?: boolean } } } } };
+    }>([
+      'api', 'graphql', '-f', `query=${query}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `oid=${oid}`
+    ], { cwd: options.cwd });
+    if (!result.ok) return failure(result.error);
+    const connection = result.value.data?.repository?.object?.authors;
+    if (connection?.pageInfo?.hasNextPage) {
+      return failure({ code: 'RELEASE_NOTES_AUTHORS_TRUNCATED', message: `Commit authors exceeded the supported page size for ${oid}`, retryable: false });
+    }
+    authors.set(oid, (connection?.nodes || []).map(normalizeGitHubActor));
+  }
+  const fromTime = Date.parse(input.fromTime);
+  const toTime = Date.parse(input.toTime);
+  const pullRequests = prs.value.filter((item) => {
+    const mergedAt = Date.parse(String(item.mergedAt || ''));
+    return Number.isFinite(mergedAt) && mergedAt > fromTime && mergedAt <= toTime;
+  });
+  return { status: 'no-op' as const, changed: false, history, pullRequests, authors, error: null };
+}
+
+export { fetchGitHubReleaseNoteData, normalizeGitHubActor, publishGitHubReleaseNotes };
+export type { ReleaseNoteActor };

package/lib/platform/issues.ts

@@ -6,7 +6,7 @@ import { buildDefaultBody } from '../task/commands/issue-body.ts';
 import { extractTitle, parseTaskFrontmatter } from '../task/frontmatter.ts';
 import { requirementFieldLabels, renderTemplateBody } from '../task/issue-form.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
-import { extractSection } from '../task/sections.ts';
+import { extractSection, findSectionHeading } from '../task/sections.ts';
 import { writeTask } from '../task/write.ts';
 import { resolvePlatformContext } from './context.ts';
 import { createGitHubClient } from './github-client.ts';
@@ -308,9 +308,11 @@ function deterministicIssueBody(repoRoot: string, content: string, taskType: str
   if (selected) {
     try {
       return renderTemplateBody(fs.readFileSync(selected, 'utf8'), {
-      title: taskTitle(content),
-      description: extractSection(content, ['描述', 'Description']),
-      requirements: extractSection(content, ['需求', 'Requirements'])
+        title: taskTitle(content),
+        description: extractSection(content, ['描述', 'Description']),
+        requirements: extractSection(content, ['需求', 'Requirements']),
+        taskInput: extractSection(content, ['任务输入', 'Task Input']),
+        taskInputHeading: findSectionHeading(content, ['任务输入', 'Task Input'])
       });
     } catch {
       // Invalid or unavailable forms fall back to the deterministic default body.

package/lib/platform/merged-pr-equivalence.ts

@@ -0,0 +1,107 @@
+import { execFileSync, spawnSync } from "node:child_process";
+
+import type { PullRequestSnapshot } from "./pull-requests.ts";
+
+const SHA_PATTERN = /^[0-9a-f]{40}$/i;
+
+type ReviewedHeadRelation =
+  | { status: "strict"; reviewedHead: string }
+  | {
+      status: "merged-equivalent";
+      reviewedHead: string;
+      mergeCommit: string;
+      comparisonHead: string;
+    }
+  | { status: "failed" | "blocked"; code: string; message: string };
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    maxBuffer: 32 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+
+function commitExists(gitRoot: string, sha: string): boolean {
+  try {
+    git(gitRoot, ["cat-file", "-e", `${sha}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isAncestor(gitRoot: string, ancestor: string, descendant: string):
+  | { status: "yes" | "no" }
+  | { status: "error" } {
+  const result = spawnSync("git", ["merge-base", "--is-ancestor", ancestor, descendant], {
+    cwd: gitRoot,
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.status === 0) return { status: "yes" };
+  if (result.status === 1) return { status: "no" };
+  return { status: "error" };
+}
+
+export function resolveReviewedHeadRelation(input: {
+  gitRoot: string;
+  comparisonHead: string;
+  lastReviewedCommit: string;
+  pullRequest: PullRequestSnapshot;
+}): ReviewedHeadRelation {
+  const { gitRoot, comparisonHead, lastReviewedCommit, pullRequest } = input;
+  if (
+    comparisonHead === lastReviewedCommit &&
+    lastReviewedCommit === pullRequest.head.sha &&
+    !(pullRequest.state === "closed" && pullRequest.mergedAt && pullRequest.mergeCommitSha)
+  ) {
+    return { status: "strict", reviewedHead: lastReviewedCommit };
+  }
+  if (pullRequest.state !== "closed" || !pullRequest.mergedAt || !pullRequest.mergeCommitSha ||
+      lastReviewedCommit !== pullRequest.head.sha) {
+    return { status: "failed", code: "PR_MERGE_IDENTITY_INVALID", message: "PR merge identity does not match the reviewed head" };
+  }
+  const shas = [pullRequest.base.sha, pullRequest.head.sha, pullRequest.mergeCommitSha, comparisonHead];
+  if (shas.some((sha) => !SHA_PATTERN.test(sha) || !commitExists(gitRoot, sha))) {
+    return { status: "blocked", code: "PR_MERGE_OBJECT_MISSING", message: "Required PR merge Git objects are unavailable" };
+  }
+  const ancestry = isAncestor(gitRoot, pullRequest.mergeCommitSha, comparisonHead);
+  if (ancestry.status === "no") {
+    return {
+      status: "failed",
+      code: "PR_MERGE_TARGET_MISMATCH",
+      message: "PR merge commit is not in the authoritative target history"
+    };
+  }
+  if (ancestry.status === "error") {
+    return {
+      status: "blocked",
+      code: "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE",
+      message: "Unable to verify PR merge ancestry"
+    };
+  }
+  try {
+    const parents = git(gitRoot, ["rev-list", "--parents", "-n", "1", pullRequest.mergeCommitSha]).trim().split(/\s+/);
+    if (parents.length !== 2) {
+      return { status: "failed", code: "PR_MERGE_TOPOLOGY_INVALID", message: "PR merge commit is not a single-parent squash commit" };
+    }
+    const diffArgs = ["diff", "--no-renames", "--binary", "--full-index"];
+    const reviewedDiff = git(gitRoot, [...diffArgs, pullRequest.base.sha, pullRequest.head.sha]);
+    const mergedDiff = git(gitRoot, [...diffArgs, `${pullRequest.mergeCommitSha}^`, pullRequest.mergeCommitSha]);
+    if (reviewedDiff !== mergedDiff) {
+      return { status: "failed", code: "PR_MERGE_CONTENT_MISMATCH", message: "Squash merge content differs from the reviewed PR changes" };
+    }
+  } catch {
+    return { status: "blocked", code: "PR_MERGE_GIT_EVIDENCE_UNAVAILABLE", message: "Unable to verify PR merge topology or content" };
+  }
+  return {
+    status: "merged-equivalent",
+    reviewedHead: lastReviewedCommit,
+    mergeCommit: pullRequest.mergeCommitSha,
+    comparisonHead
+  };
+}
+
+export type { ReviewedHeadRelation };

package/lib/platform/pr-checks.ts

@@ -2,32 +2,31 @@ import fs from 'node:fs';
 
 import { parseTaskFrontmatter } from '../task/frontmatter.ts';
 import { resolveTaskRef } from '../task/resolve-ref.ts';
+import {
+  inspectPlatformRequiredChecks,
+  registerPlatformCapabilities
+} from './adapters.ts';
+import type { PlatformCheckSnapshot } from './adapters.ts';
 import { resolvePlatformContext } from './context.ts';
 import { createGitHubClient } from './github-client.ts';
 import type { GitHubClient } from './github-client.ts';
 import { inspectPlatformPullRequest } from './pull-requests.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
+import type { PullRequestSnapshot } from './pull-requests.ts';
 
 type CheckBucket = 'pass' | 'fail' | 'pending' | 'cancel';
 type CheckState = 'passed' | 'failed' | 'pending' | 'timed-out' | 'cancelled' | 'no-required';
-type CheckSnapshot = {
-  name: string;
-  bucket: CheckBucket;
-  workflow?: string | null;
-  conclusion?: string | null;
-  detailsUrl?: string | null;
-  startedAt?: string | null;
-  completedAt?: string | null;
-};
+type CheckSnapshot = PlatformCheckSnapshot;
 type ChecksSnapshot = { state: Exclude<CheckState, 'timed-out'>; required: CheckSnapshot[] };
 type RunCandidate = { id: number; name: string; headSha: string; jobId?: number | null };
 type ChecksResult = PlatformResult & {
-  pullRequest: { number: number; headSha: string } | null;
+  pullRequest: PullRequestSnapshot | null;
   checks: { state: CheckState; required: CheckSnapshot[] };
   resolution?: { status: 'resolved' | 'missing' | 'ambiguous'; runId: number | null; jobId: number | null };
   logs?: { runId: number; jobId?: number; text: string };
 };
+type InspectionOptions = { cwd?: string; client?: unknown };
 type SharedOptions = { cwd?: string; client?: GitHubClient };
 
 function classifyRequiredChecks(required: CheckSnapshot[]): ChecksSnapshot {
@@ -113,14 +112,27 @@ function normalizeChecks(value: unknown): CheckSnapshot[] {
   });
 }
 
-function resolvedTask(taskRef: string, options: SharedOptions) {
+registerPlatformCapabilities('github', {
+  inspectRequiredChecks({ client, repository, number, cwd }) {
+    const github = (client as GitHubClient | undefined) || createGitHubClient();
+    const inspected = github.json<unknown>([
+      'pr', 'checks', String(number), '--repo', repository, '--required',
+      '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
+    ], { cwd });
+    return inspected.ok
+      ? { ok: true, value: normalizeChecks(inspected.value) }
+      : { ok: false, error: inspected.error };
+  }
+});
+
+function resolvedTask(taskRef: string, options: InspectionOptions) {
   const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
   if (!resolved.ok) return { ok: false as const, output: checksResult('failed', { error: { code: resolved.code, message: resolved.message, retryable: false } }) };
   const frontmatter = parseTaskFrontmatter(fs.readFileSync(resolved.taskMdPath, 'utf8'));
   const pr = Number(frontmatter.pr_number);
   const prNumber = Number.isInteger(pr) && pr > 0 ? pr : null;
   if (!prNumber) return { ok: false as const, output: checksResult('failed', { error: { code: 'PR_NOT_LINKED', message: 'Task has no valid pr_number', retryable: false } }) };
-  const client = options.client || createGitHubClient();
+  const client = (options.client as GitHubClient | undefined) || createGitHubClient();
   const context = resolvePlatformContext({ cwd: resolved.repoRoot, client });
   if (!context.platform.repository || !['no-op', 'degraded'].includes(context.status)) return { ok: false as const, output: checksResult(context.status, { platform: context.platform, capabilities: context.capabilities, error: context.error }) };
   const inspected = inspectPlatformPullRequest(taskRef, { cwd: resolved.repoRoot, client });
@@ -128,29 +140,37 @@ function resolvedTask(taskRef: string, options: SharedOptions) {
   return { ok: true as const, resolved, prNumber, client, context, pullRequest: inspected.pullRequest };
 }
 
-function inspectRequiredChecks(taskRef: string, options: SharedOptions = {}): ChecksResult {
+function inspectRequiredChecks(taskRef: string, options: InspectionOptions = {}): ChecksResult {
   const base = resolvedTask(taskRef, options);
   if (!base.ok) return base.output;
   const repository = base.context.platform.repository!;
-  const inspected = base.client.json<unknown>([
-    'pr', 'checks', String(base.prNumber), '--repo', repository, '--required',
-    '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
-  ], { cwd: base.resolved.repoRoot });
-  if (!inspected.ok) {
-    return checksResult(inspected.error.retryable ? 'blocked' : 'failed', {
+  const inspected = inspectPlatformRequiredChecks(base.context.platform.type, {
+    cwd: base.resolved.repoRoot,
+    repository,
+    number: base.prNumber,
+    headSha: base.pullRequest.head.sha,
+    client: options.client || base.client
+  });
+  if (!inspected.ok || !inspected.value) {
+    const error = inspected.error || {
+      code: 'REQUIRED_CHECKS_INSPECTION_INVALID',
+      message: 'Platform adapter returned no required-checks snapshot',
+      retryable: false
+    };
+    return checksResult(error.retryable ? 'blocked' : 'failed', {
       platform: base.context.platform, capabilities: base.context.capabilities,
       resource: { kind: 'pull-request', number: base.prNumber },
-      pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, error: inspected.error
+      pullRequest: base.pullRequest, error
     });
   }
-  const classified = classifyRequiredChecks(normalizeChecks(inspected.value));
+  const classified = classifyRequiredChecks(inspected.value);
   const status = classified.state === 'passed' || classified.state === 'no-required'
     ? 'no-op'
     : classified.state === 'failed' || classified.state === 'cancelled' ? 'failed' : 'blocked';
   return checksResult(status, {
     platform: base.context.platform, capabilities: base.context.capabilities,
     resource: { kind: 'pull-request', number: base.prNumber },
-    pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, checks: classified,
+    pullRequest: base.pullRequest, checks: classified,
     error: status === 'no-op' ? null : {
       code: classified.state === 'pending' ? 'REQUIRED_CHECKS_PENDING' : `REQUIRED_CHECKS_${classified.state.toUpperCase()}`,
       message: `Required checks are ${classified.state}`,
@@ -159,7 +179,7 @@ function inspectRequiredChecks(taskRef: string, options: SharedOptions = {}): Ch
   });
 }
 
-async function watchPlatformChecks(taskRef: string, options: SharedOptions & {
+async function watchPlatformChecks(taskRef: string, options: InspectionOptions & {
   intervalSeconds: number;
   deadlineSeconds: number;
   signal?: AbortSignal;
@@ -197,9 +217,9 @@ function resolvePlatformCheckRun(taskRef: string, options: SharedOptions & { che
   const direct = options.detailsUrl ? parseRunJobIdentity(options.detailsUrl) : null;
   if (direct) {
     const run = base.client.json<{ id?: number; head_sha?: string }>(['api', `repos/${base.context.platform.repository}/actions/runs/${direct.runId}`], { cwd: base.resolved.repoRoot });
-    if (!run.ok) return checksResult(run.error.retryable ? 'blocked' : 'failed', { platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, error: run.error });
+    if (!run.ok) return checksResult(run.error.retryable ? 'blocked' : 'failed', { platform: base.context.platform, capabilities: base.context.capabilities, pullRequest: base.pullRequest, error: run.error });
     if (run.value.head_sha !== base.pullRequest.head.sha) return checksResult('failed', { error: { code: 'CHECK_RUN_HEAD_MISMATCH', message: 'Resolved run does not belong to the PR head SHA', retryable: false } });
-    return checksResult('no-op', { platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha }, resolution: { status: 'resolved', ...direct }, error: null });
+    return checksResult('no-op', { platform: base.context.platform, capabilities: base.context.capabilities, resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: base.pullRequest, resolution: { status: 'resolved', ...direct }, error: null });
   }
   const listed = base.client.json<{ check_runs?: Array<{ name?: string; details_url?: string }> }>(['api', `repos/${base.context.platform.repository}/commits/${base.pullRequest.head.sha}/check-runs`], { cwd: base.resolved.repoRoot });
   if (!listed.ok) return checksResult(listed.error.retryable ? 'blocked' : 'failed', { error: listed.error });
@@ -211,30 +231,39 @@ function resolvePlatformCheckRun(taskRef: string, options: SharedOptions & { che
   const resolution = resolveRunCandidate(candidates, base.pullRequest.head.sha, options.checkName);
   return checksResult(resolution.status === 'resolved' ? 'no-op' : 'failed', {
     platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha },
+    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: base.pullRequest,
     resolution,
     error: resolution.status === 'resolved' ? null : { code: resolution.status === 'ambiguous' ? 'CHECK_RUN_AMBIGUOUS' : 'CHECK_RUN_NOT_FOUND', message: `Check run is ${resolution.status}`, retryable: false }
   });
 }
 
+function fetchCheckLogText(client: GitHubClient, args: string[], cwd: string) {
+  const fetched = client.text(args, { cwd });
+  if (fetched.ok || args[0] !== 'api' || !/response contains terminal escape sequences/i.test(fetched.error.message)) {
+    return fetched;
+  }
+  return client.text([...args, '--allow-escape-sequences'], { cwd });
+}
+
 function fetchPlatformCheckLogs(taskRef: string, options: SharedOptions & { run: number; job?: number }): ChecksResult {
   const base = resolvedTask(taskRef, options);
   if (!base.ok) return base.output;
   const args = options.job
     ? ['api', `repos/${base.context.platform.repository}/actions/jobs/${options.job}/logs`]
     : ['run', 'view', String(options.run), '--repo', base.context.platform.repository!, '--log-failed'];
-  const fetched = base.client.text(args, { cwd: base.resolved.repoRoot });
+  const fetched = fetchCheckLogText(base.client, args, base.resolved.repoRoot);
   if (!fetched.ok) return checksResult(fetched.error.retryable ? 'blocked' : 'failed', { platform: base.context.platform, capabilities: base.context.capabilities, error: fetched.error });
   if (!fetched.value) return checksResult('failed', { error: { code: 'CHECK_LOGS_MISSING', message: 'No failed logs are available', retryable: false } });
   return checksResult('no-op', {
     platform: base.context.platform, capabilities: base.context.capabilities,
-    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: { number: base.prNumber, headSha: base.pullRequest.head.sha },
+    resource: { kind: 'pull-request', number: base.prNumber }, pullRequest: base.pullRequest,
     logs: { runId: options.run, ...(options.job ? { jobId: options.job } : {}), text: fetched.value }, error: null
   });
 }
 
 export {
   classifyRequiredChecks,
+  fetchCheckLogText,
   fetchPlatformCheckLogs,
   inspectRequiredChecks,
   parseRunJobIdentity,