@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/internal/task-artifact.js

@@ -1,11 +1,48 @@
+import fs from 'node:fs';
+import path from 'node:path';
 import { resolveArtifactContext } from '../task/artifact-lifecycle.js';
-const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family>\n\nInspect one workflow artifact family and print a read-only JSON context.\n`;
+import { parseArtifactName } from '../task/artifact-lifecycle.js';
+import { locateActivityLog, pairEntries, startedBackedRows } from '../task/activity-log.js';
+import { finalizeLocalArtifact } from '../task/local-artifact-finalization.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+import { getArtifactSchema } from '../task/artifact-schema.js';
+import { applyArtifactRepair, initializeArtifactSkeleton, inspectArtifactStructure } from '../task/artifact-operations.js';
+const USAGE = `Usage: agent-infra-internal task-artifact <N | TASK-id> inspect --family <family>\n       agent-infra-internal task-artifact <N | TASK-id> init --family <family> --artifact <artifact> [--locale <zh-CN|en>]\n       agent-infra-internal task-artifact <N | TASK-id> repair --family <family> --artifact <artifact> --expected-sha256 <sha256> --expected-semantic-digest <digest>\n       agent-infra-internal task-artifact <N | TASK-id> finalize-local --family <analysis|plan|code> --artifact <artifact>\n\nInspect, initialize, repair, or finalize a workflow artifact without changing task state.\n`;
 function failUsage(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);
     process.exitCode = 2;
 }
+function hasOpenLocalArtifactRound(taskDir, family, round) {
+    try {
+        const activity = locateActivityLog(fs.readFileSync(path.join(taskDir, 'task.md'), 'utf8'));
+        if (!activity)
+            return false;
+        const label = family === 'analysis'
+            ? 'Analyze Task'
+            : family === 'review-analysis'
+                ? 'Review Analysis'
+                : family === 'plan'
+                    ? 'Plan Task'
+                    : family === 'review-plan'
+                        ? 'Review Plan'
+                        : family === 'code'
+                            ? 'Code Task'
+                            : 'Review Code';
+        const qualifier = family === 'code'
+            ? '(?:, (?:fix for review-code(?:-r\\d+)?\\.md|decision II-[1-9]\\d*))?'
+            : '';
+        const expected = new RegExp(`^${label} \\(Round ${round}${qualifier}\\)$`);
+        return startedBackedRows(pairEntries(activity.entries)).some((row) => expected.test(row.step) && !row.done);
+    }
+    catch {
+        return false;
+    }
+}
 function taskArtifact(args = []) {
+    if (!ensureInternalHandlerRoute('task-artifact', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
@@ -14,15 +51,23 @@ function taskArtifact(args = []) {
         failUsage('task ref and operation are required');
         return;
     }
-    if (args[1] !== 'inspect') {
-        failUsage(`unknown operation '${args[1]}'`);
+    const operation = args[1];
+    if (!internalHandlerRoute('task-artifact', 'inspect', operation ?? '')
+        && !internalHandlerRoute('task-artifact', 'init', operation ?? '')
+        && !internalHandlerRoute('task-artifact', 'repair', operation ?? '')
+        && !internalHandlerRoute('task-artifact', 'finalize-local', operation ?? '')) {
+        failUsage(`unknown operation '${operation}'`);
         return;
     }
     let family = '';
+    let artifact = '';
+    let locale;
+    let expectedSha256 = '';
+    let expectedSemanticDigest = '';
     const seen = new Set();
     for (let index = 2; index < args.length; index += 1) {
         const flag = args[index];
-        if (flag !== '--family') {
+        if (flag !== '--family' && flag !== '--artifact' && flag !== '--locale' && flag !== '--expected-sha256' && flag !== '--expected-semantic-digest') {
             failUsage(`unknown option '${flag}'`);
             return;
         }
@@ -36,32 +81,198 @@ function taskArtifact(args = []) {
             return;
         }
         seen.add(flag);
-        family = value;
+        if (flag === '--family')
+            family = value;
+        else if (flag === '--artifact')
+            artifact = value;
+        else if (flag === '--locale') {
+            if (value !== 'zh-CN' && value !== 'en') {
+                failUsage("option '--locale' must be 'zh-CN' or 'en'");
+                return;
+            }
+            locale = value;
+        }
+        else if (flag === '--expected-sha256')
+            expectedSha256 = value;
+        else
+            expectedSemanticDigest = value;
     }
     if (!family) {
         failUsage("option '--family' is required");
         return;
     }
-    const result = resolveArtifactContext(args[0], family);
-    const output = family === 'code' && result.codeMode ? {
-        ...result,
-        mode: result.codeMode.mode,
-        code_max: result.codeMode.codeMax,
-        rev_max: result.codeMode.reviewMax,
-        verdict: result.codeMode.verdict,
-        next_round: result.next?.round ?? null,
-        next_artifact: result.next?.name ?? null,
-        review_artifact: result.codeMode.reviewArtifact,
-        implementation_input: result.codeMode.implementationInput,
-        decision_id: result.codeMode.decisionId,
-        decision_evidence: result.codeMode.decisionEvidence,
-        message: result.codeMode.message
-    } : result;
-    process.stdout.write(`${JSON.stringify(output)}\n`);
-    if (result.status === 'refused')
+    if ((operation === 'init' || operation === 'repair' || operation === 'finalize-local') && !artifact) {
+        failUsage("option '--artifact' is required");
+        return;
+    }
+    if (internalHandlerRoute('task-artifact', 'inspect', operation ?? '')) {
+        if (artifact || locale || expectedSha256 || expectedSemanticDigest) {
+            failUsage("artifact options are only valid for init, repair, or finalize-local");
+            return;
+        }
+        const result = resolveArtifactContext(args[0], family);
+        const output = family === 'code' && result.codeMode ? {
+            ...result,
+            mode: result.codeMode.mode,
+            code_max: result.codeMode.codeMax,
+            rev_max: result.codeMode.reviewMax,
+            verdict: result.codeMode.verdict,
+            next_round: result.next?.round ?? null,
+            next_artifact: result.next?.name ?? null,
+            review_artifact: result.codeMode.reviewArtifact,
+            implementation_input: result.codeMode.implementationInput,
+            decision_id: result.codeMode.decisionId,
+            decision_evidence: result.codeMode.decisionEvidence,
+            message: result.codeMode.message
+        } : result;
+        process.stdout.write(`${JSON.stringify(output)}\n`);
+        if (result.status === 'refused')
+            process.exitCode = 1;
+        else if (result.status === 'failed')
+            process.exitCode = 2;
+        return;
+    }
+    if (internalHandlerRoute('task-artifact', 'init', operation ?? '')) {
+        if (expectedSha256 || expectedSemanticDigest) {
+            failUsage("repair baseline options are only valid for repair");
+            return;
+        }
+        const schema = getArtifactSchema(family);
+        const resolved = resolveTaskRef(args[0]);
+        if (!schema) {
+            failUsage(`init does not support artifact family '${family}'`);
+            return;
+        }
+        if (!resolved.ok) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: resolved.code, message: resolved.message } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const parsed = parseArtifactName(artifact);
+        if (!parsed || parsed.family !== family) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_INIT_CONTEXT_INVALID', message: `artifact '${artifact}' does not match ${family}` } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const context = resolveArtifactContext(args[0], family);
+        const isNextArtifact = context.status === 'ready' && context.next?.name === artifact;
+        const isCurrentOpenArtifact = context.status === 'ready'
+            && context.taskDir !== null
+            && hasOpenLocalArtifactRound(context.taskDir, family, parsed.round);
+        if (!isNextArtifact && !isCurrentOpenArtifact) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_INIT_CONTEXT_INVALID', message: context.error?.message ?? `artifact '${artifact}' is not the next ${family} artifact` } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (!context.taskId || !context.taskDir) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_INIT_CONTEXT_INVALID', message: `artifact '${artifact}' does not match ${family}` } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const existing = fs.lstatSync(path.join(resolved.taskDir, artifact));
+            if (existing.isSymbolicLink() || !existing.isFile()) {
+                process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_INIT_TARGET_INVALID', message: 'artifact target is not a regular file' } })}\n`);
+                process.exitCode = 1;
+                return;
+            }
+            const result = initializeArtifactSkeleton({ repoRoot: resolved.repoRoot, taskId: resolved.taskId, taskDir: resolved.taskDir, family: schema.family, artifact, ...(locale ? { locale } : {}) });
+            process.stdout.write(`${JSON.stringify({ ...result, taskId: resolved.taskId, taskDir: resolved.taskDir, family, artifact })}\n`);
+            if (result.status === 'failed')
+                process.exitCode = 1;
+            return;
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT') {
+                process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_INIT_TARGET_INVALID', message: String(error) } })}\n`);
+                process.exitCode = 1;
+                return;
+            }
+        }
+        const result = initializeArtifactSkeleton({
+            repoRoot: resolved.repoRoot,
+            taskId: context.taskId,
+            taskDir: context.taskDir,
+            family: schema.family,
+            artifact,
+            ...(locale ? { locale } : {})
+        });
+        process.stdout.write(`${JSON.stringify({ ...result, taskId: context.taskId, taskDir: context.taskDir, family, artifact })}\n`);
+        if (result.status === 'failed')
+            process.exitCode = 1;
+        return;
+    }
+    if (internalHandlerRoute('task-artifact', 'repair', operation ?? '')) {
+        if (locale) {
+            failUsage("option '--locale' is only valid for init");
+            return;
+        }
+        if (!/^[a-f0-9]{64}$/.test(expectedSha256) || !/^[a-f0-9]{64}$/.test(expectedSemanticDigest)) {
+            failUsage("repair requires lowercase 64-character '--expected-sha256' and '--expected-semantic-digest'");
+            return;
+        }
+        const schema = getArtifactSchema(family);
+        const resolved = resolveTaskRef(args[0]);
+        const parsed = parseArtifactName(artifact);
+        if (!schema || !parsed || parsed.family !== family) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_REPAIR_TARGET_INVALID', message: `artifact '${artifact}' does not match ${family}` } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (!resolved.ok) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: resolved.code, message: resolved.message } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        let content;
+        try {
+            content = fs.readFileSync(path.join(resolved.taskDir, artifact), 'utf8');
+        }
+        catch (error) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'ARTIFACT_REPAIR_TARGET_INVALID', message: String(error) } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const inspection = inspectArtifactStructure(content, schema);
+        if (!inspection.repair) {
+            process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, artifact, family, diagnostics: inspection.diagnostics, error: { code: 'ARTIFACT_REPAIR_UNSAFE', message: inspection.diagnostics.map((item) => `${item.code}: ${item.message}`).join('; ') || 'no deterministic structural repair is available' } })}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const result = applyArtifactRepair({
+            repoRoot: resolved.repoRoot,
+            taskId: resolved.taskId,
+            taskDir: resolved.taskDir,
+            family: schema.family,
+            artifact,
+            expectedSha256,
+            expectedSemanticDigest,
+            operation: inspection.repair
+        });
+        process.stdout.write(`${JSON.stringify({ ...result, taskId: resolved.taskId, taskDir: resolved.taskDir, family, artifact })}\n`);
+        if (result.status === 'failed')
+            process.exitCode = 1;
+        return;
+    }
+    const resolved = resolveTaskRef(args[0]);
+    const repositoryRoot = resolved.ok ? resolved.repoRoot : process.cwd();
+    if (!artifact) {
+        failUsage("option '--artifact' is required");
+        return;
+    }
+    if (family !== 'analysis' && family !== 'plan' && family !== 'code') {
+        failUsage("finalize-local only supports 'analysis', 'plan', and 'code'");
+        return;
+    }
+    const result = finalizeLocalArtifact({
+        taskRef: args[0],
+        family: family,
+        artifact,
+        repoRoot: repositoryRoot
+    });
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    if (result.status === 'failed')
         process.exitCode = 1;
-    else if (result.status === 'failed')
-        process.exitCode = 2;
 }
 export { taskArtifact };
 //# sourceMappingURL=task-artifact.js.map

package/dist/lib/internal/task-context.js

@@ -1,5 +1,6 @@
 import { parseTaskScope } from '../task/command-options.js';
 import { resolveTaskContext } from '../task/resolve-ref.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-context resolve [<task-ref> | --task <task-ref> | -t <task-ref>]\n`;
 function fail(code, message, usage = false) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code, message } })}\n`);
@@ -8,11 +9,13 @@ function fail(code, message, usage = false) {
     process.exitCode = 1;
 }
 function taskContext(args = []) {
+    if (!ensureInternalHandlerRoute('task-context', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (args[0] !== 'resolve') {
+    if (!internalHandlerRoute('task-context', 'resolve', args[0] ?? '')) {
         fail('TASK_CONTEXT_PAYLOAD_INVALID', "operation 'resolve' is required", true);
         return;
     }

package/dist/lib/internal/task-create.js

@@ -1,21 +1,46 @@
 import fs from 'node:fs';
 import path from 'node:path';
-import { requestSandboxTaskCreate, SandboxControlClientError } from '../sandbox/control/client.js';
+import { classifySandboxControlEnvironment, requestSandboxTaskCreate, SandboxControlClientError } from '../sandbox/control/client.js';
 import { SANDBOX_CONTROL_MAX_BYTES } from '../sandbox/control/protocol.js';
 import { validateTaskCreateCandidate } from '../task/create.js';
-import { createTask } from '../task/create-service.js';
-function failed(code, message, retryable = false) {
-    return {
-        status: retryable ? 'blocked' : 'failed', changed: false, task: { id: null, shortId: null }, issue: null,
-        operations: [], warnings: [], error: { code, message, retryable }
-    };
+import { createTask, parseTaskCreateResult, projectTaskCreateResult, taskCreateExitCode, taskCreateFailure } from '../task/create-service.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+function failed(code, message, retryable = false, control) {
+    return taskCreateFailure({ code, message, retryable }, control);
 }
 function output(result) {
     process.stdout.write(`${JSON.stringify(result)}\n`);
-    process.exitCode = result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+    process.exitCode = taskCreateExitCode(result);
+}
+function clientErrorControl(error) {
+    return {
+        requestId: error.requestId,
+        accepted: error.accepted,
+        recovery: error.accepted ? 'same-request-id' : error.detail.retryable ? 'new-request-id' : 'none'
+    };
+}
+function parseControlledResult(response) {
+    if (response.phase !== 'completed' || response.error !== null) {
+        return failed('SANDBOX_CONTROL_RESPONSE_INVALID', 'SANDBOX_CONTROL_RESPONSE_INVALID: completed task-create response is invalid', false, { requestId: response.id, accepted: true, recovery: 'same-request-id' });
+    }
+    let result;
+    try {
+        result = parseTaskCreateResult(JSON.parse(response.stdout));
+    }
+    catch {
+        return failed('TASK_CREATE_RESULT_INVALID', 'TASK_CREATE_RESULT_INVALID: task-create result payload is invalid', false, { requestId: response.id, accepted: true, recovery: 'same-request-id' });
+    }
+    if (!result.control || result.control.requestId !== response.id || result.control.accepted !== true) {
+        return failed('TASK_CREATE_RESULT_INVALID', 'TASK_CREATE_RESULT_INVALID: controlled task-create result is missing request evidence', false, { requestId: response.id, accepted: true, recovery: 'same-request-id' });
+    }
+    process.stderr.write(response.stderr);
+    return result;
 }
-function taskCreate(args) {
-    const inputIndex = args.indexOf('--input');
+async function taskCreate(args) {
+    if (!ensureInternalHandlerRoute('task-create', args))
+        return;
+    const inputSelector = args.includes('--input') ? 'input' : '';
+    const inputIndex = internalHandlerRoute('task-create', 'input', inputSelector) ? args.indexOf('--input') : -1;
     const input = inputIndex >= 0 ? args[inputIndex + 1] : undefined;
     if (!input || args.length !== 2 || inputIndex !== 0) {
         output(failed('TASK_CREATE_PAYLOAD_INVALID', 'Usage: agent-infra-internal task-create --input <candidate.json>'));
@@ -29,22 +54,30 @@ function taskCreate(args) {
         if (stat.size > SANDBOX_CONTROL_MAX_BYTES)
             throw new Error('TASK_CREATE_INPUT_TOO_LARGE: input exceeds the control limit');
         const candidate = validateTaskCreateCandidate(JSON.parse(fs.readFileSync(inputPath, 'utf8')));
-        if (process.env.AGENT_INFRA_CONTROL_TOKEN) {
+        const environment = classifySandboxControlEnvironment();
+        if (environment.kind === 'invalid') {
+            output(failed(environment.code ?? 'TASK_CONTROL_TRANSPORT_INVALID', environment.message ?? 'sandbox client control configuration is invalid'));
+            return;
+        }
+        if (environment.kind === 'controlled') {
             const response = requestSandboxTaskCreate({ candidate });
             if (response.phase === 'rejected') {
-                output(failed(response.error?.code ?? 'SANDBOX_CONTROL_REJECTED', response.error?.message ?? response.stderr, response.error?.retryable ?? false));
+                const accepted = response.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN';
+                output(failed(response.error?.code ?? 'SANDBOX_CONTROL_REJECTED', response.error?.message ?? response.stderr, response.error?.retryable ?? false, {
+                    requestId: response.id,
+                    accepted,
+                    recovery: accepted ? 'same-request-id' : response.error?.retryable ? 'new-request-id' : 'none'
+                }));
                 return;
             }
-            process.stdout.write(response.stdout);
-            process.stderr.write(response.stderr);
-            process.exitCode = response.exitCode;
+            output(parseControlledResult(response));
             return;
         }
-        output(createTask(candidate, { repoRoot: process.cwd() }));
+        output(await createTask(candidate, { repoRoot: process.cwd() }));
     }
     catch (error) {
         if (error instanceof SandboxControlClientError) {
-            output(failed(error.detail.code, error.detail.message, error.detail.retryable));
+            output(failed(error.detail.code, error.detail.message, error.detail.retryable, clientErrorControl(error)));
             return;
         }
         const message = error instanceof Error ? error.message : String(error);

package/dist/lib/internal/task-delivery.js

@@ -1,11 +1,14 @@
 import path from 'node:path';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { deliverTaskBranch } from '../task/delivery.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-delivery <task-ref> deliver --agent <agent> [--remote <name>] [--base <branch>] [--dry-run] [--cwd <path>]\n`;
 function taskDelivery(args = []) {
+    if (!ensureInternalHandlerRoute('task-delivery', args))
+        return;
     const taskRef = args[0];
     const operation = args[1];
-    if (!taskRef || operation !== 'deliver') {
+    if (!taskRef || !internalHandlerRoute('task-delivery', 'deliver', operation ?? '')) {
         process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'DELIVERY_PAYLOAD_INVALID', message: 'task ref and deliver operation are required' } })}\n`);
         process.stderr.write(USAGE);
         process.exitCode = 1;

package/dist/lib/internal/task-event.js

@@ -3,6 +3,7 @@ import { applyTaskEvent, eventCatalog } from '../task/events.js';
 import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-event <N | TASK-id> <event> --agent <agent> [event options] [--orchestrated] [--dry-run]
 
 Apply one closed-set task lifecycle event and print a structured JSON result.
@@ -10,6 +11,9 @@ Events: ${eventCatalog.join(', ')}
 `;
 const FLAGS = {
     '--agent': 'agent', '--round': 'round', '--question': 'question', '--artifact': 'artifact',
+    '--artifact-sha256': 'artifactSha256', '--semantic-digest': 'semanticDigest',
+    '--initiator': 'initiator', '--request-id': 'requestId', '--reason-code': 'reasonCode',
+    '--source-finding': 'sourceFinding', '--source-artifact': 'sourceArtifact', '--source-sha256': 'sourceSha256',
     '--fix-for': 'fixFor', '--implementation-input': 'implementationInput',
     '--verdict': 'verdict', '--blockers': 'blockers', '--major': 'major',
     '--minor': 'minor', '--manual-validation': 'manualValidation', '--files-modified': 'filesModified',
@@ -22,12 +26,14 @@ function usageFailure(message) {
     process.stderr.write(USAGE);
     process.exitCode = 1;
 }
-function taskEvent(args = []) {
+async function taskEvent(args = []) {
+    if (!ensureInternalHandlerRoute('task-event', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (args.length < 2) {
+    if (args.length < 2 || !internalHandlerRoute('task-event', 'event', args[1] ? 'event' : '')) {
         usageFailure('task ref and event are required');
         return;
     }
@@ -95,7 +101,7 @@ function taskEvent(args = []) {
     let result;
     let humanOverride = null;
     try {
-        result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-event.${request.event}`, () => {
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-event.${request.event}`, async () => {
             let current = applyTaskEvent(request, { lockAlreadyHeld: true });
             const values = request;
             if (current.status !== 'failed' || !values.overrideTicket)
@@ -103,7 +109,7 @@ function taskEvent(args = []) {
             if (!values.overrideTarget || !values.overrideScope) {
                 return { ...current, humanOverride: { status: 'failed', error: { code: 'OVERRIDE_PAYLOAD_INVALID', message: 'override ticket requires target and scope' } } };
             }
-            const consumed = consumeHumanOverride({
+            const consumed = await consumeHumanOverride({
                 taskRef: request.taskRef,
                 ticketId: String(values.overrideTicket),
                 failureId: failureId('task-event', current.error?.code ?? 'EVENT_TRANSITION_INVALID'),

package/dist/lib/internal/task-finalization.js

@@ -1,6 +1,7 @@
 import { createDirectHostExecutionContext, dispatchTaskControlOperation, parseTaskControlOperation } from '../task/control-authority.js';
 import { applyTaskFinalization } from '../task/finalization.js';
 import { detectRepoRoot, resolveTaskRef } from '../task/resolve-ref.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-finalization <N | TASK-id> complete --agent <agent>\n';
 function envelope(status, changed, accepted, result, error) {
     return `${JSON.stringify({ version: 1, status, changed, accepted, result, error })}\n`;
@@ -18,7 +19,9 @@ function parseFailure(error) {
     const message = error instanceof Error ? error.message : String(error);
     return message.replace(/^TASK_CONTROL_OPERATION_INVALID: /u, '');
 }
-function taskFinalization(args = []) {
+async function taskFinalization(args = []) {
+    if (!ensureInternalHandlerRoute('task-finalization', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
@@ -31,7 +34,7 @@ function taskFinalization(args = []) {
         fail(parseFailure(error));
         return;
     }
-    if (operation.family !== 'task-finalization') {
+    if (operation.family !== 'task-finalization' || !internalHandlerRoute('task-finalization', 'complete', args[1] ?? '')) {
         fail('finalization operation is invalid');
         return;
     }
@@ -56,7 +59,7 @@ function taskFinalization(args = []) {
         ...operation,
         request: { ...operation.request, taskRef: resolved.taskId }
     };
-    const result = dispatchTaskControlOperation(createDirectHostExecutionContext({ repoRoot }), boundOperation);
+    const result = await dispatchTaskControlOperation(createDirectHostExecutionContext({ repoRoot }), boundOperation);
     process.stdout.write(envelope(result.status, result.changed, true, result, result.error));
     process.exitCode = exitCode(result.status);
 }

package/dist/lib/internal/task-invalidation.js

@@ -0,0 +1,63 @@
+import { reconcileTaskInvalidation } from '../task/invalidation-command.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
+import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+const USAGE = 'Usage: agent-infra-internal task-invalidation <task-ref> reconcile [--max-targets <n>] [--dry-run]\n';
+function taskInvalidation(args = []) {
+    if (!ensureInternalHandlerRoute('task-invalidation', args))
+        return;
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const taskRef = args[0];
+    if (!taskRef || !internalHandlerRoute('task-invalidation', 'reconcile', args[1] ?? '')) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'INVALIDATION_PAYLOAD_INVALID', message: 'task ref and reconcile are required' } })}\n`);
+        process.stderr.write(USAGE);
+        process.exitCode = 1;
+        return;
+    }
+    let maxTargets;
+    let dryRun = false;
+    for (let index = 2; index < args.length; index += 1) {
+        const flag = args[index];
+        if (flag === '--dry-run') {
+            if (dryRun) {
+                process.exitCode = 1;
+                return;
+            }
+            dryRun = true;
+            continue;
+        }
+        if (flag !== '--max-targets') {
+            process.exitCode = 1;
+            return;
+        }
+        const value = Number(args[++index]);
+        if (!Number.isInteger(value) || value < 1 || maxTargets !== undefined) {
+            process.exitCode = 1;
+            return;
+        }
+        maxTargets = value;
+    }
+    const resolved = resolveTaskRef(taskRef);
+    if (!resolved.ok) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: resolved.code, message: resolved.message } })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-invalidation.reconcile', () => reconcileTaskInvalidation(taskRef, { ...(maxTargets === undefined ? {} : { maxTargets }), dryRun }));
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+        if (result.status === 'failed')
+            process.exitCode = 1;
+    }
+    catch (error) {
+        if (!(error instanceof TaskExecutionLockError))
+            throw error;
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
+        process.exitCode = 1;
+    }
+}
+export { taskInvalidation };
+//# sourceMappingURL=task-invalidation.js.map