@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/task/task-execution-lock.js

@@ -160,6 +160,25 @@ function withTaskExecutionLock(repoRoot, taskId, ownerName, callback, options =
     };
     const serialized = `${JSON.stringify(owner)}\n`;
     let ownsFixed = false;
+    let deferRelease = false;
+    const release = () => {
+        try {
+            unlinkIfPresent(candidate);
+        }
+        catch {
+            // Candidate cleanup is best-effort and must not replace the primary result.
+        }
+        if (ownsFixed) {
+            try {
+                const current = parseOwner(fs.readFileSync(fixed, 'utf8'), key);
+                if (current.token === token)
+                    unlinkIfPresent(fixed);
+            }
+            catch {
+                // A missing or replaced fixed lock is not owned by this invocation.
+            }
+        }
+    };
     try {
         fs.mkdirSync(lockRoot, { recursive: true });
         cleanStaleCandidates(lockRoot, key, options.identityMatches ?? processIdentityMatches);
@@ -202,7 +221,12 @@ function withTaskExecutionLock(repoRoot, taskId, ownerName, callback, options =
             throw new TaskExecutionLockError('ORCHESTRATION_LOCK_BUSY', 'lifecycle task lock could not be acquired after stale recovery', { operation: 'acquire', errno: 'EEXIST', key });
         }
         unlinkIfPresent(candidate);
-        return callback();
+        const value = callback();
+        if (value && typeof value.then === 'function') {
+            deferRelease = true;
+            return value.finally(release);
+        }
+        return value;
     }
     catch (error) {
         if (error instanceof TaskExecutionLockError)
@@ -212,22 +236,8 @@ function withTaskExecutionLock(repoRoot, taskId, ownerName, callback, options =
         throw new TaskExecutionLockError('ORCHESTRATION_LOCK_FAILED', 'lifecycle task lock operation failed', { operation: ownsFixed ? 'callback' : 'acquire', errno: errno(error), key });
     }
     finally {
-        try {
-            unlinkIfPresent(candidate);
-        }
-        catch {
-            // Candidate cleanup is best-effort and must not replace the primary result.
-        }
-        if (ownsFixed) {
-            try {
-                const current = parseOwner(fs.readFileSync(fixed, 'utf8'), key);
-                if (current.token === token)
-                    unlinkIfPresent(fixed);
-            }
-            catch {
-                // A missing or replaced fixed lock is not owned by this invocation.
-            }
-        }
+        if (!deferRelease)
+            release();
     }
 }
 function withRepositoryMutationLock(repoRoot, callback, options = {}) {

package/dist/lib/task/verification-config.js

@@ -1,5 +1,6 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { getArtifactSchema } from './artifact-schema.js';
 function loadVerificationConfig(repositoryRoot, skillName) {
     const verifyPath = path.join(repositoryRoot, '.agents', 'skills', skillName, 'config', 'verify.json');
     if (!fs.existsSync(verifyPath))
@@ -8,6 +9,16 @@ function loadVerificationConfig(repositoryRoot, skillName) {
     if (!parsed.checks || typeof parsed.checks !== 'object' || Array.isArray(parsed.checks)) {
         throw new Error(`config/verify.json has invalid checks for skill '${skillName}'`);
     }
+    const artifact = parsed.checks.artifact;
+    if (artifact && typeof artifact === 'object' && !Array.isArray(artifact)) {
+        const schema = artifact.schema;
+        if (schema !== undefined && (typeof schema !== 'string' || !getArtifactSchema(schema))) {
+            throw new Error(`config/verify.json has unknown artifact schema '${String(schema)}' for skill '${skillName}'`);
+        }
+        if (schema !== undefined && 'required_patterns' in artifact) {
+            throw new Error(`config/verify.json must not duplicate required_patterns for schema '${String(schema)}' in skill '${skillName}'`);
+        }
+    }
     return { ...(parsed.skill ? { skill: parsed.skill } : {}), checks: parsed.checks };
 }
 export { loadVerificationConfig };

package/dist/lib/task/verification-engine.js

@@ -21,6 +21,10 @@ import { snapshotReview } from "../git/review-snapshot.js";
 import { OrchestrationStateError, readRun } from "./orchestration.js";
 import { resolveDeliveryTarget } from "./delivery-target.js";
 import { readPrDeliveryFact } from "./pr-delivery-fact.js";
+import { validateLocalArtifact } from "./local-artifact-finalization.js";
+import { validateQualificationAudit } from "./qualification-audit.js";
+import { getArtifactSchema } from "./artifact-schema.js";
+import { inspectArtifactContract } from "./artifact-operations.js";
 const TASK_ENUMS = {
     type: ["feature", "bugfix", "refactor", "docs", "chore"],
     workflow: ["feature-development", "bug-fix", "refactoring"],
@@ -69,7 +73,7 @@ const scriptPath = fileURLToPath(import.meta.url);
 let repoRoot = path.resolve(path.dirname(scriptPath), "..", "..");
 const PLATFORM_ADAPTERS = {
     "platform-sync": checkPlatformSync,
-    "platform-sync-preflight": (context, shared) => ({ ...checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
+    "platform-sync-preflight": async (context, shared) => ({ ...await checkPlatformSync(context, shared), type: "platform-sync-preflight" }),
     "required-checks": checkRequiredChecks
 };
 const OPTIONAL_PLATFORM_CHECKS = new Set(["platform-sync"]);
@@ -86,7 +90,7 @@ const sharedUtils = {
     parseIssueNumber,
     parsePrNumber
 };
-function runCheck(type, context, shared) {
+async function runCheck(type, context, shared) {
     switch (type) {
         case "task-meta":
             return checkTaskMeta(context);
@@ -124,7 +128,7 @@ function runCheck(type, context, shared) {
                 }
                 return failResult(type, `Unsupported check type '${type}'.`);
             }
-            return adapter(context, shared);
+            return await adapter(context, shared);
         }
     }
 }
@@ -419,7 +423,7 @@ function checkTaskMeta({ taskDir, config }) {
     const warningSuffix = warnings.length > 0 ? `; warnings: ${warnings.join("; ")}` : "";
     return passResult("task-meta", `Task metadata valid (${requiredFields.length} required fields checked${warningSuffix})`, warnings);
 }
-function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
+async function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
     const task = loadTask(taskDir);
     if (!task.ok)
         return failResult('required-pr-delivery', task.message);
@@ -438,10 +442,11 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
         return failResult('required-pr-delivery', factRead.error.message);
     const fact = factRead.status === 'valid' ? factRead.fact : null;
     const status = fact?.state || 'unbound';
-    const prNumber = fact?.state === 'bound' ? fact.identity.number : null;
+    const prIdentity = fact?.state === 'bound' ? fact.identity.resource : null;
+    const prNumber = prIdentity?.kind === 'number' ? prIdentity.value : null;
     if (flow === 'disabled')
         return passResult('required-pr-delivery', 'Pull request delivery is disabled by project policy');
-    if (flow === 'required' && (status !== 'bound' || prNumber === null)) {
+    if (flow === 'required' && (status !== 'bound' || !prIdentity)) {
         return failResult('required-pr-delivery', 'Project policy requires a bound pull request before completion');
     }
     if (flow !== 'required' && status === 'unbound') {
@@ -451,7 +456,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
         if (mode === 'gate') {
             return passResult('required-pr-delivery', 'Bound pull request shape is valid; merged-state inspection is reserved for hard preflight');
         }
-        const inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
+        const inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: repositoryRoot });
         if (inspected.status === 'blocked') {
             return blockedResult('required-pr-delivery', inspected.error?.message || 'Unable to inspect the required pull request', inspected.error?.code || 'PR_INSPECTION_BLOCKED');
         }
@@ -459,7 +464,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
         const repository = inspected.platform.repository?.toLowerCase() || '';
         const taskBranch = String(task.metadata.branch || '').trim();
         const deliveryBaseRef = String(task.metadata.delivery_base_ref || projectConfig.delivery?.baseRef || '').trim();
-        if (inspected.status !== 'no-op' || !pullRequest || pullRequest.number !== prNumber) {
+        if (inspected.status !== 'no-op' || !pullRequest) {
             return failResult('required-pr-delivery', 'Bound pull request identity could not be verified');
         }
         if (!repository
@@ -472,7 +477,7 @@ function checkRequiredPrDelivery({ taskDir, repositoryRoot, mode }) {
         if (pullRequest.state !== 'closed' || !pullRequest.mergedAt || !pullRequest.mergeCommitSha) {
             return failResult('required-pr-delivery', 'Project policy requires the bound pull request to be merged');
         }
-        return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR #${prNumber})`);
+        return passResult('required-pr-delivery', `Pull request delivery policy satisfied (merged PR ${prNumber === null ? 'identity' : `#${prNumber}`})`);
     }
     return passResult('required-pr-delivery', `Pull request delivery policy satisfied (${status})`);
 }
@@ -504,7 +509,7 @@ function loadProjectName() {
         return "";
     }
 }
-function checkArtifact({ taskDir, config, artifactFile }) {
+function checkArtifact({ taskDir, config, artifactFile, skillName }) {
     const resolvedArtifact = resolveArtifactPath(taskDir, config.file_pattern, artifactFile);
     if (!resolvedArtifact.ok) {
         return failResult("artifact", resolvedArtifact.message);
@@ -518,6 +523,56 @@ function checkArtifact({ taskDir, config, artifactFile }) {
         return failResult("artifact", `Artifact is empty: ${path.basename(artifactPath)}`);
     }
     const content = fs.readFileSync(artifactPath, "utf8");
+    let taskContent = "";
+    const taskPath = path.join(taskDir, "task.md");
+    if (fs.existsSync(taskPath)) {
+        try {
+            taskContent = fs.readFileSync(taskPath, "utf8");
+        }
+        catch (error) {
+            return failResult("artifact", `Cannot read task qualification contract: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    if (taskContent && /^review-(?:analysis|plan|code)$/.test(skillName)) {
+        const qualification = validateQualificationAudit(taskContent, content, { artifact: path.basename(artifactPath) });
+        if (!qualification.ok)
+            return failResult("artifact", `${path.basename(artifactPath)} has qualification audit errors: ${qualification.code}: ${qualification.message}`);
+    }
+    const schemaFamily = skillName === "analyze-task"
+        ? "analysis"
+        : skillName === "review-analysis"
+            ? "review-analysis"
+            : skillName === "plan-task"
+                ? "plan"
+                : skillName === "review-plan"
+                    ? "review-plan"
+                    : skillName === "code-task"
+                        ? "code"
+                        : skillName === "review-code" ? "review-code" : null;
+    const schema = schemaFamily ? getArtifactSchema(schemaFamily) : null;
+    const localFamily = skillName === "analyze-task"
+        ? "analysis"
+        : skillName === "plan-task" ? "plan" : skillName === "code-task" ? "code" : null;
+    if (schema) {
+        const structure = inspectArtifactContract(content, schema);
+        if (!structure.ok && !localFamily) {
+            return failResult("artifact", `${path.basename(artifactPath)} has shared structural errors: ${structure.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`);
+        }
+    }
+    if (localFamily) {
+        const local = validateLocalArtifact(content, {
+            family: localFamily,
+            ...(taskContent ? { taskContent } : {}),
+            artifact: path.basename(artifactPath)
+        });
+        if (!local.ok) {
+            return failResult("artifact", `${path.basename(artifactPath)} has local structural errors: ${local.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ')}`);
+        }
+        return passResult("artifact", `${path.basename(artifactPath)} passed (${schema?.sections.length ?? 0} sections)`);
+    }
+    if (schema) {
+        return passResult("artifact", `${path.basename(artifactPath)} passed (${schema.sections.length} sections)`);
+    }
     const requiredSections = config.required_sections || [];
     const missingSections = requiredSections.filter((section) => !new RegExp(`^##\\s+${escapeRegExp(section)}\\s*$`, "m").test(content));
     if (missingSections.length > 0) {
@@ -670,6 +725,7 @@ function checkActivityLog({ taskDir, config }) {
     let previousTimestamp = "";
     let latestAction = "";
     let latestTimestamp = "";
+    const doneActions = [];
     for (const entry of entries) {
         const match = entry.match(ACTIVITY_LOG_PATTERN);
         if (!match) {
@@ -686,6 +742,16 @@ function checkActivityLog({ taskDir, config }) {
         if (!ACTIVITY_LOG_STARTED_RE.test(action)) {
             latestTimestamp = timestamp;
             latestAction = action;
+            doneActions.push(action);
+        }
+    }
+    if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {
+        const expected = new RegExp(config.expected_action_pattern);
+        let index = doneActions.length - 1;
+        while (index >= 0 && doneActions[index] === 'Commit' && !expected.test(doneActions[index]))
+            index -= 1;
+        if (index >= 0 && expected.test(doneActions[index])) {
+            latestAction = doneActions[index];
         }
     }
     if (config.expected_action_pattern && !new RegExp(config.expected_action_pattern).test(latestAction)) {
@@ -902,6 +968,8 @@ function checkManualValidation({ taskDir }) {
     // 1. Latest review-code artifact; none -> pass (no review, check not applicable).
     const review = findAuthoritativeReviewCodeArtifact(taskDir);
     if (!review.ok) {
+        if (review.error)
+            return failResult("manual-validation", `Review-code artifact is unavailable: ${review.error}`);
         return passResult("manual-validation", "No review-code artifact; manual validation not applicable");
     }
     // 2. Parse the numeric manual-validation count; unparseable/null -> fail closed
@@ -953,9 +1021,11 @@ function checkManualValidation({ taskDir }) {
     }
     return passResult("manual-validation", `Manual validation completed → ${artifactName}`);
 }
-function checkPostReviewCommit({ taskDir, config }) {
+async function checkPostReviewCommit({ taskDir, config }) {
     const reviewArtifact = findAuthoritativeReviewCodeArtifact(taskDir);
     if (!reviewArtifact.ok) {
+        if (reviewArtifact.error)
+            return failResult("post-review-commit", `Review-code artifact is unavailable: ${reviewArtifact.error}`);
         return passResult("post-review-commit", "No review-code artifact; check inactive");
     }
     let gitRoot;
@@ -977,7 +1047,7 @@ function checkPostReviewCommit({ taskDir, config }) {
     const hasPullRequest = fact?.state === 'bound';
     let inspected = null;
     if (hasPullRequest) {
-        inspected = inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
+        inspected = await inspectPlatformPullRequest(task.metadata.id, { cwd: gitRoot });
         if (!inspected.pullRequest) {
             const message = inspected.error?.message || "PR merge snapshot is unavailable";
             const code = inspected.error?.code || "PR_INSPECTION_INVALID";
@@ -988,7 +1058,7 @@ function checkPostReviewCommit({ taskDir, config }) {
         if (inspected.pullRequest.state === "closed" &&
             inspected.pullRequest.mergedAt &&
             inspected.pullRequest.mergeCommitSha) {
-            const relation = resolveMaterializedReviewedHeadRelation({
+            const relation = await resolveMaterializedReviewedHeadRelation({
                 cwd: gitRoot,
                 platformType: inspected.platform.type,
                 lastReviewedCommit,
@@ -1124,6 +1194,13 @@ function checkReviewFact({ taskDir, artifactFile }) {
     if (!resolvedArtifact.ok) {
         return failResult("review-fact", resolvedArtifact.message);
     }
+    const authoritative = findAuthoritativeReviewCodeArtifact(taskDir);
+    if (!authoritative.ok) {
+        return failResult("review-fact", authoritative.error ?? "No active review-code artifact is available");
+    }
+    if (path.basename(resolvedArtifact.path) !== authoritative.fileName) {
+        return failResult("review-fact", `review-code artifact ${path.basename(resolvedArtifact.path)} is not the current active artifact ${authoritative.fileName}; re-run review-code`);
+    }
     const task = loadTask(taskDir);
     if (!task.ok) {
         return failResult("review-fact", task.message);
@@ -1401,7 +1478,7 @@ function escapeRegExp(value) {
 function isBlank(value) {
     return value === undefined || value === null || String(value).trim() === "";
 }
-function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }) {
+async function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: requestedChecks, repositoryRoot }) {
     if (repositoryRoot)
         repoRoot = path.resolve(repositoryRoot);
     else {
@@ -1418,7 +1495,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
         for (const [type, checkConfig] of Object.entries(verifyConfig.checks || {})) {
             if (checkConfig === null)
                 continue;
-            const result = runCheck(type, {
+            const result = await runCheck(type, {
                 mode,
                 skillName,
                 taskDir: path.resolve(taskDir),
@@ -1441,7 +1518,7 @@ function verifyInProcess({ mode, skillName, taskDir, artifactFile, checks: reque
         return { skill: skillName, ...passResult(type, `Check '${type}' is disabled for skill '${skillName}'.`) };
     return {
         skill: skillName,
-        ...runCheck(type, {
+        ...await runCheck(type, {
             skillName,
             taskDir: path.resolve(taskDir),
             artifactFile,

package/dist/lib/task/verification.js

@@ -41,7 +41,7 @@ function failure(request, code, message, extra = {}) {
         artifact: request.artifact ?? null, invocations: [], error: { code, message }, ...extra
     };
 }
-function verifyTaskEvent(request, options = {}) {
+async function verifyTaskEvent(request, options = {}) {
     const spec = VERIFICATION_CATALOG[request.event];
     if (!spec)
         return failure(request, 'VERIFY_EVENT_UNKNOWN', `unknown verification event '${request.event}'`);
@@ -66,7 +66,7 @@ function verifyTaskEvent(request, options = {}) {
     const invocations = [];
     const engine = options.engine ?? verifyInProcess;
     if (spec.mode === 'gate') {
-        const payload = engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
+        const payload = await engine({ mode: 'gate', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [], repositoryRoot: resolved.repoRoot });
         const status = payload.gate;
         if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
             invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, gate: 'pass', humanOverride: 'human-approved', originalGate: status } });
@@ -79,7 +79,7 @@ function verifyTaskEvent(request, options = {}) {
     }
     else {
         for (const check of spec.checks ?? []) {
-            const payload = engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
+            const payload = await engine({ mode: 'checks', skillName: spec.skill, taskDir: resolved.taskDir, artifactFile: request.artifact, checks: [check], repositoryRoot: resolved.repoRoot });
             const status = payload.status;
             if (status !== 'pass' && allowsManualOverride(options.manualOverride, 'verification-engine', status === 'blocked' ? 'CHECK_BLOCKED' : 'CHECK_FAILED')) {
                 invocations.push({ status: 'pass', exitCode: 0, payload: { ...payload, status: 'pass', humanOverride: 'human-approved', originalStatus: status } });

package/dist/lib/task/workflow-warning-intents.js

@@ -38,7 +38,7 @@ function sectionMutation(content) {
     const english = /^##\s+Activity Log\s*$/m.test(content);
     return [{
             kind: 'section', aliases: WORKFLOW_WARNING_HEADINGS, heading: english ? 'Workflow Warnings' : '工作流告警',
-            body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|`
+            body: `| ${WORKFLOW_WARNING_COLUMNS.join(' | ')} |\n|----|------|------|----------|------|--------|---------|--------|-------------|------------|------------|`
         }];
 }
 function rowMutation(row) {

package/dist/lib/task/write.js

@@ -6,6 +6,7 @@ import { resolveTaskRef } from './resolve-ref.js';
 import { allowsManualOverride } from './guard-override.js';
 import { mutateTableRow, upsertSection } from './sections.js';
 import { validateCurrentTaskContract } from './current-contract.js';
+import { invalidationBlocks, parseInvalidationDocument } from './invalidation.js';
 const DEFAULT_FILE_SYSTEM = {
     readFileSync: (file) => fs.readFileSync(file, 'utf8'),
     statModeSync: (file) => fs.statSync(file).mode,
@@ -90,6 +91,16 @@ function writeTask(request, options = {}) {
         if (!contract.ok) {
             return failure(request, identity, contract.code, contract.message);
         }
+        if (invalidationBlocks(contract.invalidation)
+            && options.invalidationContext !== 'source-completion'
+            && options.invalidationContext !== 'reconcile') {
+            return failure(request, identity, 'TASK_INVALIDATION_BLOCKED', 'task has an incomplete artifact invalidation operation; reconcile it before writing downstream state');
+        }
+    }
+    else {
+        const invalidation = parseInvalidationDocument(original);
+        if (!invalidation.ok)
+            return failure(request, identity, 'TASK_INVALIDATION_INVALID', invalidation.message);
     }
     let candidate = original;
     const operations = [];

package/dist/lib/version.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'node:fs';
+import semver from 'semver';
 const packageJsonUrl = [
     new URL('../package.json', import.meta.url),
     new URL('../../package.json', import.meta.url),
@@ -9,8 +10,17 @@ if (!packageJsonUrl) {
 const { version } = JSON.parse(readFileSync(packageJsonUrl, 'utf8'));
 const VERSION = `v${version}`;
 const AGENT_INFRA_VERSION_PATTERN = /^v\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const LEGACY_COMPATIBILITY_CUTOFF_VERSION = '1.0.0';
 function isValidAgentInfraVersion(value) {
     return typeof value === 'string' && AGENT_INFRA_VERSION_PATTERN.test(value);
 }
-export { VERSION, isValidAgentInfraVersion };
+function isLegacyCompatibilityEnabled(runtimeVersion = VERSION) {
+    const normalized = runtimeVersion.startsWith('v') ? runtimeVersion.slice(1) : runtimeVersion;
+    const parsed = semver.valid(normalized);
+    return parsed !== null && semver.lt(parsed, LEGACY_COMPATIBILITY_CUTOFF_VERSION);
+}
+function legacyCompatibilityError(resource, runtimeVersion = VERSION) {
+    return Object.assign(new Error(`PLATFORM_IDENTITY_LEGACY_UNSUPPORTED: ${resource} requires migration to the current schema before v${LEGACY_COMPATIBILITY_CUTOFF_VERSION} runtime ${runtimeVersion}`), { code: 'PLATFORM_IDENTITY_LEGACY_UNSUPPORTED' });
+}
+export { LEGACY_COMPATIBILITY_CUTOFF_VERSION, VERSION, isLegacyCompatibilityEnabled, isValidAgentInfraVersion, legacyCompatibilityError };
 //# sourceMappingURL=version.js.map

package/dist/lifecycle-build-manifest.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 3,
-  "packageVersion": "0.9.12",
-  "sourceInputHash": "5e1b341aad5fe825884f4dbdbd01d0752ca66107d1ccb4b0fe4d8d3aae49120d",
-  "internalExecutableBuildHash": "39bf2c60e3a9b834d4a24ab3088f108583d15ee2bdc77e6376e517921be47c80"
+  "packageVersion": "0.9.14",
+  "sourceInputHash": "a3cf306ad6576904e6ef7d962e51245c6684540bd41358beaebf8209c00f3cfc",
+  "internalExecutableBuildHash": "14773c26aea5022af695f2e3ca4a39bed3c87c1eab04347aeded028745d8ded1"
 }

package/lib/agent-client.ts

@@ -11,6 +11,9 @@ import { AGENT_CLIENT_IDS, isAgentClientId } from './agent-clients/types.ts';
 import type { AgentClientState } from './agent-clients/types.ts';
 import { closePrompt, multiSelect } from './prompt.ts';
 import { resolveTemplateDir } from './paths.ts';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from './internal/cli-route-inventory.ts';
+
+const AGENT_CLIENT_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS['agent-client'];
 
 const USAGE = `Usage: ai agent-client <operation>
 
@@ -107,6 +110,12 @@ async function cmdAgentClient(args: string[]): Promise<number> {
     process.stdout.write(USAGE);
     return 0;
   }
+  if (!AGENT_CLIENT_OPERATIONS.includes(operation as typeof AGENT_CLIENT_OPERATIONS[number])) {
+    throw new AgentClientCommandError(
+      'AGENT_CLIENT_OPERATION_INVALID',
+      `Unknown operation '${operation}'`
+    );
+  }
 
   if (operation === 'list') {
     if (args.length !== 1) {

package/lib/agent-clients/next-steps.ts

@@ -1,6 +1,7 @@
 import { listEnabledAgentClientAdapters } from './registry.ts';
 import { renderAgentClientInvocation } from './invocation.ts';
 import semver from 'semver';
+import { isTaskScopeSkill } from '../task/skill-scope.ts';
 import type { CustomTUI } from './custom-tuis.ts';
 import type { AgentClientId, AgentClientState } from './types.ts';
 
@@ -45,7 +46,11 @@ function renderNextStepCommands(
   }
 
   const args = [
-    ...(input.taskRef === undefined ? [] : [input.taskRef]),
+    ...(input.taskRef === undefined
+      ? []
+      : isTaskScopeSkill(input.skillName)
+        ? ['--task', input.taskRef]
+        : [input.taskRef]),
     ...(input.version === undefined ? [] : [input.version])
   ];
 

package/lib/decide.ts

@@ -79,11 +79,11 @@ export async function decide(args: string[], options: DecideOptions = {}): Promi
       metadataProvider: () => ({ timestamp: now, agentInfraVersion: options.version ?? VERSION })
     };
     let result;
-    const execute = () => {
+    const execute = async () => {
       let current = applyHumanDecision(request, writeOptions);
       if (current.status !== 'failed' || !parsedDecision.overrideTicket) return current;
       if (!parsedDecision.overrideTarget || !parsedDecision.overrideScope) throw new Error('override ticket requires --override-target and --override-scope');
-      const consumed = consumeHumanOverride({
+      const consumed = await consumeHumanOverride({
         taskRef: resolved.taskId,
         ticketId: parsedDecision.overrideTicket,
         failureId: failureId('decision-intent', current.error?.code ?? 'TASK_STATE_MISMATCH'),
@@ -102,7 +102,7 @@ export async function decide(args: string[], options: DecideOptions = {}): Promi
       if (consumed.status === 'failed') throw new Error(consumed.error.message);
       return current;
     };
-    result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-decision', execute);
+    result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-decision', execute);
     if (result.error) throw new Error(result.error.message);
     return 0;
   } catch (error) {

package/lib/init.ts

@@ -40,7 +40,7 @@ type AgentConfig = {
   project: string;
   org: string;
   language: string;
-  platform: { type: string };
+  platform: { type: string; providers?: Record<string, unknown> };
   templateVersion: string;
   sandbox: Record<string, unknown>;
   task: { shortIdLength: number };

package/lib/internal/agent-client.ts

@@ -9,6 +9,7 @@ import { normalizeCustomTUIs } from '../agent-clients/custom-tuis.ts';
 import { renderNextStepCommands } from '../agent-clients/next-steps.ts';
 import { getAgentClientModelSelection } from '../agent-clients/registry.ts';
 import { isAgentClientId } from '../agent-clients/types.ts';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.ts';
 
 const USAGE = 'Usage: agent-infra-internal agent-client <next-steps|model-selection> [options]\n';
 
@@ -35,7 +36,7 @@ function parseArgs(args: string[]): ParsedArgs | null {
     process.stdout.write(USAGE);
     return null;
   }
-  if (args[0] !== 'next-steps') {
+  if (!internalHandlerRoute('agent-client', 'next-steps', args[0] ?? '')) {
     failure('AGENT_CLIENT_PAYLOAD_INVALID', "operation must be 'next-steps'");
     return null;
   }
@@ -84,7 +85,8 @@ function parseArgs(args: string[]): ParsedArgs | null {
 }
 
 function agentClient(args: string[] = []): void {
-  if (args[0] === 'model-selection') {
+  if (!ensureInternalHandlerRoute('agent-client', args)) return;
+  if (internalHandlerRoute('agent-client', 'model-selection', args[0] ?? '')) {
     const values: Record<string, string> = {};
     const seen = new Set<string>();
     for (let index = 1; index < args.length; index += 1) {