@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/task/qualification-intents.js

@@ -0,0 +1,148 @@
+import fs from 'node:fs';
+import { CONSTRAINT_COLUMNS, CANDIDATE_COLUMNS, parseTaskQualification } from './qualification-audit.js';
+import { resolveTaskRef } from './resolve-ref.js';
+import { captureTaskWriteMetadata, writeTask } from './write.js';
+function failed(code, message, taskId = null) {
+    return { status: 'failed', changed: false, taskId, operations: [], error: { code, message } };
+}
+function validSingleLine(value) {
+    return typeof value === 'string' && Boolean(value.trim()) && !/[\r\n]/.test(value);
+}
+function assertProposalKeys(value, keys, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    const record = value;
+    const unexpected = Object.keys(record).find((key) => !keys.includes(key));
+    if (unexpected)
+        throw new Error(`${label} does not accept '${unexpected}'`);
+    return record;
+}
+function parseConstraintProposal(value) {
+    const row = assertProposalKeys(value, ['constraintId', 'statement', 'status', 'authority', 'source', 'evidence', 'derivedFrom', 'approvalEvidence'], 'constraint proposal');
+    for (const key of ['constraintId', 'statement', 'status', 'authority', 'source', 'evidence', 'approvalEvidence']) {
+        if (typeof row[key] !== 'string' || /[\r\n]/.test(row[key]))
+            throw new Error(`constraint proposal '${key}' must be a single-line string`);
+    }
+    if (!/^C-[1-9]\d*$/.test(row.constraintId))
+        throw new Error(`constraint proposal id '${row.constraintId}' is invalid`);
+    if (row.status === 'confirmed' || !['derived', 'assumption', 'open', 'conflicted', 'superseded'].includes(row.status))
+        throw new Error('proposal cannot write confirmed constraint status');
+    if (row.approvalEvidence !== '')
+        throw new Error('proposal cannot write approval_evidence');
+    if (!Array.isArray(row.derivedFrom) || row.derivedFrom.some((item) => typeof item !== 'string' || !/^C-[1-9]\d*$/.test(item)))
+        throw new Error('constraint proposal derivedFrom is invalid');
+    return {
+        constraintId: row.constraintId, statement: row.statement, status: row.status,
+        authority: row.authority, source: row.source, evidence: row.evidence,
+        derivedFrom: [...row.derivedFrom], approvalEvidence: ''
+    };
+}
+function parseCandidateProposal(value) {
+    const row = assertProposalKeys(value, ['candidateId', 'statement', 'status', 'constraintIds', 'impact', 'evidence'], 'candidate proposal');
+    for (const key of ['candidateId', 'statement', 'status', 'impact', 'evidence'])
+        if (!validSingleLine(row[key]))
+            throw new Error(`candidate proposal '${key}' must be a non-empty single-line string`);
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(row.candidateId))
+        throw new Error(`candidate proposal id '${row.candidateId}' is invalid`);
+    if (row.status !== 'pending')
+        throw new Error('proposal can only write pending candidate status');
+    if (!Array.isArray(row.constraintIds) || row.constraintIds.some((item) => typeof item !== 'string' || !/^C-[1-9]\d*$/.test(item)))
+        throw new Error('candidate proposal constraintIds is invalid');
+    return row;
+}
+function proposalValues(request) {
+    if (!/^[a-f0-9]{64}$/i.test(request.expectedTaskInputDigest))
+        throw new Error('expectedTaskInputDigest must be a sha256 digest');
+    if (Object.keys(request).some((key) => !['taskRef', 'expectedTaskInputDigest', 'constraints', 'candidates', 'dryRun'].includes(key)))
+        throw new Error('proposal contains an unsupported field');
+    if (!Array.isArray(request.constraints) && request.constraints !== undefined)
+        throw new Error('constraints must be an array');
+    if (!Array.isArray(request.candidates) && request.candidates !== undefined)
+        throw new Error('candidates must be an array');
+    return {
+        constraints: (request.constraints ?? []).map(parseConstraintProposal),
+        candidates: (request.candidates ?? []).map(parseCandidateProposal)
+    };
+}
+function applyQualificationProposal(request, options = {}) {
+    if (!request || typeof request !== 'object' || !validSingleLine(request.taskRef))
+        return failed('QUALIFICATION_PROPOSAL_INVALID', 'taskRef is required');
+    let values;
+    try {
+        values = proposalValues(request);
+    }
+    catch (error) {
+        return failed('QUALIFICATION_PROPOSAL_INVALID', error instanceof Error ? error.message : String(error));
+    }
+    if (values.constraints.length === 0 && values.candidates.length === 0)
+        return failed('QUALIFICATION_PROPOSAL_INVALID', 'proposal must contain a constraint or candidate');
+    const resolved = resolveTaskRef(request.taskRef, { repoRoot: options.repoRoot });
+    if (!resolved.ok)
+        return failed(resolved.code, resolved.message, resolved.taskId);
+    if (resolved.state !== 'active')
+        return failed('TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
+    let content;
+    try {
+        content = fs.readFileSync(resolved.taskMdPath, 'utf8');
+    }
+    catch (error) {
+        return failed('TASK_READ_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
+    }
+    const parsed = parseTaskQualification(content);
+    if (!parsed.ok)
+        return failed(parsed.code, parsed.message, resolved.taskId);
+    if (!parsed.qualification.present)
+        return failed('QUALIFICATION_TASK_CONTRACT_MISSING', 'task qualification contract is missing', resolved.taskId);
+    const currentConstraintMap = new Map(parsed.qualification.constraints.map((row) => [row.constraintId, row]));
+    const currentCandidateMap = new Map(parsed.qualification.candidates.map((row) => [row.candidateId, row]));
+    const proposalAlreadyApplied = values.constraints.every((row) => {
+        const current = currentConstraintMap.get(row.constraintId);
+        return current && current.statement === row.statement && current.status === row.status && current.authority === row.authority
+            && current.source === row.source && current.evidence === row.evidence && current.derivedFrom.join(',') === row.derivedFrom.join(',') && current.approvalEvidence === '';
+    }) && values.candidates.every((row) => {
+        const current = currentCandidateMap.get(row.candidateId);
+        return current && current.statement === row.statement && current.status === row.status && current.constraintIds.join(',') === row.constraintIds.join(',')
+            && current.impact === row.impact && current.evidence === row.evidence;
+    });
+    if (parsed.qualification.taskInputDigest !== request.expectedTaskInputDigest) {
+        return proposalAlreadyApplied
+            ? { status: 'no-op', changed: false, taskId: resolved.taskId, operations: [], error: null }
+            : failed('QUALIFICATION_DIGEST_CONFLICT', 'task qualification input changed before proposal was applied', resolved.taskId);
+    }
+    for (const row of values.constraints) {
+        const current = currentConstraintMap.get(row.constraintId);
+        if (current?.status === 'confirmed')
+            return failed('QUALIFICATION_CONFIRMATION_REQUIRED', `confirmed constraint '${row.constraintId}' must be superseded or revoked through task-qualification`, resolved.taskId);
+    }
+    const knownConstraintIds = new Set([...parsed.qualification.constraints.map((row) => row.constraintId), ...values.constraints.map((row) => row.constraintId)]);
+    for (const row of values.constraints)
+        for (const parent of row.derivedFrom)
+            if (!knownConstraintIds.has(parent))
+                return failed('QUALIFICATION_CONSTRAINT_UNKNOWN', `constraint proposal '${row.constraintId}' references unknown '${parent}'`, resolved.taskId);
+    for (const row of values.candidates)
+        for (const id of row.constraintIds)
+            if (!knownConstraintIds.has(id))
+                return failed('QUALIFICATION_CONSTRAINT_UNKNOWN', `candidate proposal '${row.candidateId}' references unknown '${id}'`, resolved.taskId);
+    const mutations = [];
+    for (const row of values.constraints) {
+        mutations.push({ kind: 'table-row', action: 'upsert', sectionAliases: ['约束', 'Constraints'], columns: CONSTRAINT_COLUMNS, keyColumn: 'constraint_id', key: row.constraintId, values: { statement: row.statement, status: row.status, authority: row.authority, source: row.source, evidence: row.evidence, derived_from: row.derivedFrom.join(','), approval_evidence: '' } });
+    }
+    for (const row of values.candidates) {
+        mutations.push({ kind: 'table-row', action: 'upsert', sectionAliases: ['候选与否决方案', 'Candidate and Rejected Options', 'Candidates and Rejected Options', 'Candidates and Rejected Alternatives'], columns: CANDIDATE_COLUMNS, keyColumn: 'candidate_id', key: row.candidateId, values: { statement: row.statement, status: row.status, constraint_ids: row.constraintIds.join(','), impact: row.impact, evidence: row.evidence } });
+    }
+    // Only the submitted rows are mutated; no actor, confirmation, or QCR fields
+    // can be smuggled into this internal proposal operation.
+    let metadata;
+    try {
+        metadata = (options.metadataProvider ?? captureTaskWriteMetadata)();
+    }
+    catch (error) {
+        return failed('METADATA_CAPTURE_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
+    }
+    const result = writeTask({ taskRef: resolved.taskId, expectedState: 'active', mutations, dryRun: request.dryRun }, { ...options, taskLocation: { repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskMdPath: resolved.taskMdPath, state: resolved.state }, metadataProvider: () => metadata });
+    if (result.status === 'failed')
+        return failed(result.error.code, result.error.message, result.taskId);
+    return { status: result.status, changed: result.changed, taskId: result.taskId, operations: result.operations, error: null };
+}
+export { applyQualificationProposal };
+//# sourceMappingURL=qualification-intents.js.map

package/dist/lib/task/review-artifacts.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { scanVisibleMarkdown } from './decision-details.js';
 const SUMMARY_HEADINGS = new Set(['审查摘要', 'Review Summary']);
 const PLACEHOLDERS = [
     '{unresolved-blockers}',
@@ -36,42 +37,40 @@ function normalizeVerdict(raw) {
     return '';
 }
 function extractSection(content, names) {
-    const lines = content.split(/\r?\n/);
     const nameSet = new Set(names);
-    const start = lines.findIndex((line) => {
-        const match = line.trim().match(/^##\s+(.+?)\s*$/);
-        return match ? nameSet.has(match[1]) : false;
-    });
-    if (start === -1)
+    const scanned = scanVisibleMarkdown(content);
+    const heading = scanned.headings.find((item) => item.level === 2 && nameSet.has(item.text));
+    if (!heading)
         return '';
-    const sectionLines = [];
-    for (let index = start + 1; index < lines.length; index += 1) {
-        if (/^##\s+/.test(lines[index]))
-            break;
-        sectionLines.push(lines[index]);
-    }
-    return sectionLines.join('\n');
+    const next = scanned.headings.find((item) => item.start > heading.start && item.level <= 2);
+    return content.slice(heading.end, next?.start ?? content.length);
 }
 function summaryBounds(content) {
-    const headings = [...content.matchAll(/^##\s+(.+?)\s*$/gm)]
-        .map((match) => ({ index: match.index, end: match.index + match[0].length, name: match[1] }));
-    const summaries = headings.filter((heading) => SUMMARY_HEADINGS.has(heading.name));
+    const scanned = scanVisibleMarkdown(content);
+    const summaries = scanned.headings.filter((heading) => heading.level === 2 && SUMMARY_HEADINGS.has(heading.text));
     if (summaries.length !== 1)
         return null;
     const summary = summaries[0];
-    const next = headings.find((heading) => heading.index > summary.index);
-    return { start: summary.end, end: next?.index ?? content.length };
+    const next = scanned.headings.find((heading) => heading.start > summary.start && heading.level <= 2);
+    return { start: summary.end, end: next?.start ?? content.length };
 }
 function uniqueLine(content, bounds, pattern) {
-    const section = content.slice(bounds.start, bounds.end);
-    const matches = [...section.matchAll(pattern)];
+    const matches = [];
+    for (const line of scanVisibleMarkdown(content).lines) {
+        if (line.start < bounds.start || line.start >= bounds.end)
+            continue;
+        pattern.lastIndex = 0;
+        const match = pattern.exec(line.text);
+        if (match)
+            matches.push({ value: match[1], index: line.start + match.index, length: match[0].length });
+    }
     if (matches.length !== 1)
         return null;
     const match = matches[0];
     return {
-        value: match[1],
-        start: bounds.start + match.index,
-        end: bounds.start + match.index + match[0].length
+        value: match.value,
+        start: match.index,
+        end: match.index + match.length
     };
 }
 function parseCounts(value) {

package/dist/lib/task/review-finalization.js

@@ -10,6 +10,9 @@ import { resolveTaskRef } from './resolve-ref.js';
 import { validateLifecycleExecution } from './lifecycle-execution.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { allowsManualOverride } from './guard-override.js';
+import { getArtifactSchema } from './artifact-schema.js';
+import { canonicalSemanticDigest, inspectArtifactContract, sha256Content } from './artifact-operations.js';
+import { readArtifactRepairIntent, writeArtifactRepairIntent } from './artifact-repair-intent.js';
 const STAGES = {
     analysis: { family: 'review-analysis', action: 'Review Analysis' },
     plan: { family: 'review-plan', action: 'Review Plan' },
@@ -22,7 +25,7 @@ const DEFAULT_FILE_SYSTEM = {
     renameSync: (from, to) => fs.renameSync(from, to),
     unlinkSync: (file) => fs.unlinkSync(file)
 };
-function failed(request, code, message, taskId = null, stageStatus = null) {
+function failed(request, code, message, taskId = null, stageStatus = null, extra = {}) {
     return {
         status: 'failed',
         changed: false,
@@ -32,8 +35,13 @@ function failed(request, code, message, taskId = null, stageStatus = null) {
         stage: request.stage,
         artifact: request.artifact,
         stageStatus,
+        artifactSha256: null,
+        semanticDigest: null,
+        repairable: false,
+        operation: null,
         operations: [],
-        error: { code, message }
+        error: { code, message },
+        ...extra
     };
 }
 function openReviewRound(content, action, round) {
@@ -86,6 +94,73 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     catch (error) {
         return failed(request, 'REVIEW_ARTIFACT_NOT_REGULAR', String(error), resolved.taskId);
     }
+    const schema = getArtifactSchema(spec.family);
+    const structure = schema ? inspectArtifactContract(artifactContent, schema) : null;
+    const artifactSha256 = sha256Content(artifactContent);
+    const artifactSemanticDigest = canonicalSemanticDigest(artifactContent);
+    let repairIntent;
+    try {
+        repairIntent = readArtifactRepairIntent(resolved.repoRoot, resolved.taskId, spec.family, request.artifact);
+    }
+    catch (error) {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', String(error), resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: artifactSemanticDigest
+        });
+    }
+    if (structure && !structure.ok) {
+        const repairable = structure.repair !== null && structure.diagnostics.length === 1 && structure.diagnostics[0]?.repairable === true;
+        if (repairable) {
+            if (repairIntent && (repairIntent.state !== 'awaiting-repair' ||
+                repairIntent.artifactSha256 !== artifactSha256 ||
+                repairIntent.semanticDigest !== structure.semanticDigest)) {
+                return failed(request, 'REVIEW_PROVENANCE_INVALID', 'a different review repair baseline is already recorded for this artifact', resolved.taskId, null, {
+                    artifactSha256,
+                    semanticDigest: structure.semanticDigest
+                });
+            }
+            try {
+                if (!repairIntent) {
+                    writeArtifactRepairIntent(resolved.repoRoot, {
+                        version: 1,
+                        taskId: resolved.taskId,
+                        family: spec.family,
+                        artifact: request.artifact,
+                        state: 'awaiting-repair',
+                        baselineSemanticDigest: structure.semanticDigest,
+                        artifactSha256,
+                        semanticDigest: structure.semanticDigest
+                    });
+                }
+            }
+            catch (error) {
+                return failed(request, 'REVIEW_PROVENANCE_INVALID', `cannot record repair provenance: ${String(error)}`, resolved.taskId, null, {
+                    artifactSha256,
+                    semanticDigest: structure.semanticDigest,
+                    operation: structure.repair
+                });
+            }
+        }
+        return failed(request, 'REVIEW_ARTIFACT_STRUCTURE_INVALID', structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; '), resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: structure.semanticDigest,
+            repairable,
+            operation: structure.repair
+        });
+    }
+    if (repairIntent?.state === 'awaiting-repair' && repairIntent.baselineSemanticDigest !== artifactSemanticDigest) {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', 'the repaired review artifact semantic digest does not match the recorded repair baseline', resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: artifactSemanticDigest
+        });
+    }
+    if ((repairIntent?.state === 'passed' || repairIntent?.state === 'consumed')
+        && (repairIntent.artifactSha256 !== artifactSha256 || repairIntent.semanticDigest !== artifactSemanticDigest)) {
+        return failed(request, 'REVIEW_PROVENANCE_INVALID', 'the review artifact changed after its finalization provenance was recorded', resolved.taskId, null, {
+            artifactSha256,
+            semanticDigest: artifactSemanticDigest
+        });
+    }
     if (!openReviewRound(taskContent, spec.action, parsedArtifact.round)) {
         return failed(request, 'REVIEW_ARTIFACT_IDENTITY_INVALID', `${request.artifact} does not have one matching open started review event`, resolved.taskId);
     }
@@ -127,8 +202,27 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         return failed(request, transformed.code, transformed.message, resolved.taskId, stageStatus);
     }
     if (!transformed.changed) {
+        if (repairIntent?.state === 'awaiting-repair') {
+            try {
+                writeArtifactRepairIntent(resolved.repoRoot, {
+                    ...repairIntent,
+                    state: 'passed',
+                    artifactSha256,
+                    semanticDigest: artifactSemanticDigest
+                });
+            }
+            catch (error) {
+                return failed(request, 'REVIEW_PROVENANCE_INVALID', `cannot record repaired review provenance: ${String(error)}`, resolved.taskId, stageStatus, {
+                    artifactSha256,
+                    semanticDigest: artifactSemanticDigest
+                });
+            }
+        }
         return {
-            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
+            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus, {
+                artifactSha256,
+                semanticDigest: artifactSemanticDigest
+            }),
             status: 'no-op',
             error: null
         };
@@ -136,7 +230,10 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
     const operations = [{ kind: 'artifact', artifact: request.artifact, operation: 'update' }];
     if (request.dryRun) {
         return {
-            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus),
+            ...failed(request, 'REVIEW_ARTIFACT_CONFLICT', '', resolved.taskId, stageStatus, {
+                artifactSha256: sha256Content(transformed.content),
+                semanticDigest: canonicalSemanticDigest(transformed.content)
+            }),
             status: 'planned',
             changed: true,
             operations,
@@ -164,6 +261,22 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         cleanupTemp(fileSystem, tempPath);
         return failed(request, 'REVIEW_RENAME_FAILED', String(error), resolved.taskId, stageStatus);
     }
+    if (repairIntent?.state === 'awaiting-repair') {
+        try {
+            writeArtifactRepairIntent(resolved.repoRoot, {
+                ...repairIntent,
+                state: 'passed',
+                artifactSha256: sha256Content(transformed.content),
+                semanticDigest: canonicalSemanticDigest(transformed.content)
+            });
+        }
+        catch (error) {
+            return failed(request, 'REVIEW_PROVENANCE_INVALID', `cannot record repaired review provenance: ${String(error)}`, resolved.taskId, stageStatus, {
+                artifactSha256: sha256Content(transformed.content),
+                semanticDigest: canonicalSemanticDigest(transformed.content)
+            });
+        }
+    }
     return {
         status: 'applied',
         changed: true,
@@ -173,6 +286,10 @@ function finalizeReviewSummaryUnlocked(request, options = {}) {
         stage,
         artifact: request.artifact,
         stageStatus,
+        artifactSha256: sha256Content(transformed.content),
+        semanticDigest: canonicalSemanticDigest(transformed.content),
+        repairable: false,
+        operation: null,
         operations,
         error: null
     };

package/dist/lib/task/review-fingerprint.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { artifactName, maxRound } from "./review-artifacts.js";
+import { invalidationBlocks, isArtifactInvalidated, parseInvalidationDocument } from "./invalidation.js";
 const REVIEWED_TREE_RE = /^[a-f0-9]{40,64}$/;
 export function parseReviewedGitTree(value) {
     return REVIEWED_TREE_RE.test(value) ? value : null;
@@ -30,14 +31,35 @@ export function findAuthoritativeReviewCodeArtifact(taskDir) {
     const entries = fs.existsSync(taskDir) ? fs.readdirSync(taskDir) : [];
     const round = maxRound(entries, "review-code");
     if (round === 0) {
-        return { ok: false, round: 0, fileName: null, path: null };
+        return { ok: false, round: 0, fileName: null, path: null, error: null };
     }
     const fileName = artifactName("review-code", round);
+    let taskContent;
+    try {
+        taskContent = fs.readFileSync(path.join(taskDir, "task.md"), "utf8");
+    }
+    catch (error) {
+        return {
+            ok: false, round, fileName, path: null,
+            error: error instanceof Error ? error.message : String(error)
+        };
+    }
+    const invalidation = parseInvalidationDocument(taskContent);
+    if (!invalidation.ok) {
+        return { ok: false, round, fileName, path: null, error: invalidation.message };
+    }
+    if (invalidationBlocks(invalidation.document)) {
+        return { ok: false, round, fileName, path: null, error: "artifact invalidation is incomplete; reconcile task.md before using review-code" };
+    }
+    if (isArtifactInvalidated(invalidation.document, "review-code", fileName)) {
+        return { ok: false, round, fileName, path: null, error: `${fileName} is invalidated; re-run review-code` };
+    }
     return {
         ok: true,
         round,
         fileName,
-        path: path.join(taskDir, fileName)
+        path: path.join(taskDir, fileName),
+        error: null
     };
 }
 export function extractReviewBaseline(content) {

package/dist/lib/task/rework-intent.js

@@ -0,0 +1,138 @@
+const REWORK_INTENT_HEADINGS = ['返工意图', 'Rework Intent'];
+const REWORK_INTENT_COLUMNS = [
+    'intent_id', 'finding_id', 'source_artifact', 'source_sha256', 'target',
+    'status', 'declared_at', 'consumed_at'
+];
+function cells(line) {
+    const first = line.indexOf('|');
+    const last = line.lastIndexOf('|');
+    if (first < 0 || first === last || line.slice(0, first).trim() || line.slice(last + 1).trim())
+        return null;
+    const inner = line.slice(first + 1, last);
+    const result = [];
+    let start = 0;
+    let escaped = false;
+    for (let index = 0; index < inner.length; index += 1) {
+        const char = inner[index];
+        if (char === '|' && !escaped) {
+            result.push(inner.slice(start, index));
+            start = index + 1;
+        }
+        escaped = char === '\\' && !escaped;
+        if (char !== '\\')
+            escaped = false;
+    }
+    result.push(inner.slice(start));
+    return result.map((cell) => cell.replace(/\\([\\|])/g, '$1').trim());
+}
+function sectionBody(content) {
+    const heading = REWORK_INTENT_HEADINGS.map((value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
+    const match = new RegExp(`^##\\s+(${heading})\\s*$`, 'm').exec(content);
+    if (!match)
+        return null;
+    const start = (match.index ?? 0) + match[0].length;
+    const rest = content.slice(start);
+    const end = rest.search(/^##\s+/m);
+    return rest.slice(0, end < 0 ? rest.length : end);
+}
+function parseReworkIntentDocument(content) {
+    const body = sectionBody(content);
+    if (body === null)
+        return { ok: true, present: false, intents: [] };
+    const lines = body.split(/\r?\n/).filter((line) => line.trim());
+    const header = lines[0] ? cells(lines[0]) : null;
+    const separator = lines[1] ? cells(lines[1]) : null;
+    if (!header || !separator || header.length !== REWORK_INTENT_COLUMNS.length || !header.every((value, index) => value === REWORK_INTENT_COLUMNS[index]) || !separator.every((value) => /^:?-{3,}:?$/.test(value))) {
+        return { ok: false, code: 'TASK_REWORK_INTENT_INVALID', message: 'rework intent section must contain its canonical table' };
+    }
+    try {
+        const intents = lines.slice(2).map((line) => {
+            const values = cells(line);
+            if (!values || values.length !== REWORK_INTENT_COLUMNS.length)
+                throw new Error('rework intent row has the wrong column count');
+            const row = Object.fromEntries(REWORK_INTENT_COLUMNS.map((column, index) => [column, values[index]]));
+            if (!/^RI-[1-9]\d*$/.test(row.intent_id))
+                throw new Error(`invalid intent id '${row.intent_id}'`);
+            if (!/^(AN|PL|CD)-[1-9]\d*$/.test(row.finding_id))
+                throw new Error(`invalid finding id '${row.finding_id}'`);
+            if (!['analysis', 'plan', 'code'].includes(row.target))
+                throw new Error(`invalid rework target '${row.target}'`);
+            if (!['pending', 'consumed', 'superseded'].includes(row.status))
+                throw new Error(`invalid rework status '${row.status}'`);
+            if (!/^[a-f0-9]{64}$/.test(row.source_sha256))
+                throw new Error(`invalid source hash for '${row.intent_id}'`);
+            if (!row.source_artifact || !row.declared_at)
+                throw new Error(`rework intent '${row.intent_id}' has invalid required fields`);
+            const terminal = row.status === 'consumed' || row.status === 'superseded';
+            if (terminal !== Boolean(row.consumed_at))
+                throw new Error(`rework intent '${row.intent_id}' has invalid consumed_at`);
+            return {
+                intentId: row.intent_id, findingId: row.finding_id, sourceArtifact: row.source_artifact,
+                sourceSha256: row.source_sha256, target: row.target,
+                status: row.status, declaredAt: row.declared_at, consumedAt: row.consumed_at
+            };
+        });
+        const ids = new Set();
+        for (const intent of intents) {
+            if (ids.has(intent.intentId))
+                throw new Error(`duplicate intent '${intent.intentId}'`);
+            ids.add(intent.intentId);
+        }
+        return { ok: true, present: true, intents };
+    }
+    catch (error) {
+        return { ok: false, code: 'TASK_REWORK_INTENT_INVALID', message: error instanceof Error ? error.message : String(error) };
+    }
+}
+function renderReworkIntents(intents) {
+    const escape = (value) => value.replace(/\\/g, '\\\\').replace(/\|/g, '\\|').replace(/[\r\n]/g, ' ');
+    return [
+        `| ${REWORK_INTENT_COLUMNS.join(' | ')} |`,
+        `| ${REWORK_INTENT_COLUMNS.map(() => '---').join(' | ')} |`,
+        ...intents.map((intent) => `| ${[
+            intent.intentId, intent.findingId, intent.sourceArtifact, intent.sourceSha256,
+            intent.target, intent.status, intent.declaredAt, intent.consumedAt
+        ].map(escape).join(' | ')} |`)
+    ].join('\n');
+}
+function upsertReworkIntent(intents, intent) {
+    const existing = intents.find((candidate) => candidate.intentId === intent.intentId);
+    if (!existing)
+        return { changed: true, intents: [...intents, intent] };
+    const identity = (value) => [value.intentId, value.findingId, value.sourceArtifact, value.sourceSha256, value.target];
+    if (JSON.stringify(identity(existing)) !== JSON.stringify(identity(intent)))
+        throw new Error(`intent '${intent.intentId}' identity conflicts with existing state`);
+    return { changed: false, intents };
+}
+function consumeReworkIntents(intents, target, sourceHashes, consumedAt) {
+    let changed = false;
+    const next = intents.map((intent) => {
+        if (intent.status !== 'pending'
+            || intent.target !== target
+            || sourceHashes[intent.sourceArtifact] !== intent.sourceSha256)
+            return intent;
+        changed = true;
+        return { ...intent, status: 'consumed', consumedAt };
+    });
+    return { changed, intents: next };
+}
+function supersedeReworkIntents(intents, sourceArtifact, sourceSha256, supersededAt) {
+    let changed = false;
+    const next = intents.map((intent) => {
+        if (intent.status !== 'pending' || intent.sourceArtifact !== sourceArtifact || intent.sourceSha256 === sourceSha256)
+            return intent;
+        changed = true;
+        return { ...intent, status: 'superseded', consumedAt: supersededAt };
+    });
+    return { changed, intents: next };
+}
+function reworkIntentMutation(content, intents) {
+    return {
+        kind: 'section',
+        aliases: REWORK_INTENT_HEADINGS,
+        heading: /^##\s+Rework Intent\s*$/m.test(content) ? REWORK_INTENT_HEADINGS[1] : REWORK_INTENT_HEADINGS[0],
+        body: renderReworkIntents(intents)
+    };
+}
+export { REWORK_INTENT_COLUMNS, REWORK_INTENT_HEADINGS, parseReworkIntentDocument, renderReworkIntents, reworkIntentMutation, consumeReworkIntents, supersedeReworkIntents, upsertReworkIntent };
+//# sourceMappingURL=rework-intent.js.map

package/dist/lib/task/sections.js

@@ -99,17 +99,19 @@ function matchingSections(content, aliases) {
     const allowed = new Set(aliases);
     return linesOf(content)
         .map((line, index, lines) => {
-        const match = /^##\s+(.+?)\s*$/.exec(line.text);
-        if (!match?.[1] || !allowed.has(match[1]))
+        const match = /^(#{2,3})\s+(.+?)\s*$/.exec(line.text);
+        if (!match?.[2] || !allowed.has(match[2]))
             return null;
+        const level = match[1].length;
         let end = content.length;
         for (let i = index + 1; i < lines.length; i += 1) {
-            if (/^##\s+/.test(lines[i].text)) {
+            const nextHeading = /^(#{2,3})\s+/.exec(lines[i].text);
+            if (nextHeading && nextHeading[1].length <= level) {
                 end = lines[i].start;
                 break;
             }
         }
-        return { heading: match[1], line, bodyStart: line.end, end };
+        return { heading: match[2], line, bodyStart: line.end, end };
     })
         .filter((match) => match !== null);
 }

package/dist/lib/task/skill-scope.js

@@ -0,0 +1,23 @@
+const TASK_SCOPE_SKILLS = new Set([
+    'analyze-task',
+    'block-task',
+    'cancel-task',
+    'check-task',
+    'code-task',
+    'commit',
+    'complete-manual-validation',
+    'complete-task',
+    'create-pr',
+    'plan-task',
+    'review-analysis',
+    'review-code',
+    'review-plan',
+    'run-manual-validation',
+    'run-task',
+    'watch-pr'
+]);
+function isTaskScopeSkill(skillName) {
+    return TASK_SCOPE_SKILLS.has(skillName);
+}
+export { TASK_SCOPE_SKILLS, isTaskScopeSkill };
+//# sourceMappingURL=skill-scope.js.map