@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/lib/platform/security-alerts.ts

@@ -0,0 +1,191 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import type { PlatformClient } from './context.ts';
+import { resolvePlatformProviderContext } from './context.ts';
+import {
+  providerError,
+  providerOperationContext,
+  providerStatus
+} from './provider-bridge.ts';
+import type {
+  PlatformError,
+  SecurityAlertKind,
+  SecurityAlertSnapshot
+} from './provider-contract.ts';
+import { platformResult } from './types.ts';
+import type { PlatformResult } from './types.ts';
+
+type SecurityAlertOptions = {
+  cwd?: string;
+  client?: PlatformClient;
+  platformType?: string;
+};
+
+type SecurityAlertResult = PlatformResult & {
+  operation: 'read' | 'dismiss';
+  alert: SecurityAlertSnapshot | null;
+  data: SecurityAlertSnapshot['data'] | null;
+};
+
+function baseResult(
+  operation: SecurityAlertResult['operation'],
+  status: PlatformResult['status'],
+  context: PlatformResult,
+  overrides: Partial<SecurityAlertResult> = {}
+): SecurityAlertResult {
+  return {
+    ...platformResult(status, {
+      platform: context.platform,
+      capabilities: context.capabilities,
+      operations: context.operations,
+      error: context.error,
+      changed: false
+    }),
+    operation,
+    alert: null,
+    data: null,
+    ...overrides
+  };
+}
+
+function unsupported(providerType: string): PlatformError {
+  return {
+    code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
+    message: `Platform '${providerType}' does not provide securityAlerts`,
+    retryable: false
+  };
+}
+
+function resultStatus(error: PlatformError): PlatformResult['status'] {
+  return error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED' ? 'degraded' : providerStatus(error);
+}
+
+function validKind(value: string | undefined): value is SecurityAlertKind {
+  return value === 'dependabot' || value === 'code-scanning';
+}
+
+function validNumber(value: number): boolean {
+  return Number.isSafeInteger(value) && value > 0;
+}
+
+function unavailable(
+  operation: SecurityAlertResult['operation'],
+  context: PlatformResult,
+  error?: PlatformError
+): SecurityAlertResult {
+  const status = context.status === 'blocked' || context.status === 'failed' ? context.status : 'degraded';
+  return baseResult(operation, status, context, {
+    error: error || context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Security alert operations are unavailable', retryable: false }
+  });
+}
+
+async function readSecurityAlert(
+  input: { kind: SecurityAlertKind; number: number },
+  options: SecurityAlertOptions = {}
+): Promise<SecurityAlertResult> {
+  if (!validKind(input.kind)) return baseResult('read', 'failed', platformResult('failed'), {
+    error: { code: 'SECURITY_KIND_INVALID', message: 'Alert kind must be dependabot or code-scanning', retryable: false }
+  });
+  if (!validNumber(input.number)) return baseResult('read', 'failed', platformResult('failed'), {
+    error: { code: 'SECURITY_NUMBER_INVALID', message: 'Alert number must be a positive integer', retryable: false }
+  });
+
+  const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+  const context = loaded.ok ? loaded.value.context : loaded.context;
+  if (!loaded.ok || !context.platform.repository) return unavailable('read', context);
+  const inspect = loaded.value.provider.securityAlerts?.inspect;
+  if (!inspect) return unavailable('read', context, unsupported(loaded.value.provider.type));
+  const result = await inspect({ context: providerOperationContext(loaded.value), kind: input.kind, number: input.number });
+  if (!result.ok) return {
+    ...baseResult('read', resultStatus(result.error), context),
+    error: providerError(result.error, 'SECURITY_ALERT_READ_FAILED')
+  };
+  return {
+    ...baseResult('read', 'applied', context, {
+      alert: result.value,
+      data: result.value.data,
+      operations: [{ name: 'inspect-alert', status: 'applied', reasonCode: null }]
+    }),
+    changed: false,
+    error: null
+  };
+}
+
+async function dismissSecurityAlert(
+  input: { kind: SecurityAlertKind; number: number; reason: string; comment: string },
+  options: SecurityAlertOptions = {}
+): Promise<SecurityAlertResult> {
+  if (!validKind(input.kind)) return baseResult('dismiss', 'failed', platformResult('failed'), {
+    error: { code: 'SECURITY_KIND_INVALID', message: 'Alert kind must be dependabot or code-scanning', retryable: false }
+  });
+  if (!validNumber(input.number)) return baseResult('dismiss', 'failed', platformResult('failed'), {
+    error: { code: 'SECURITY_NUMBER_INVALID', message: 'Alert number must be a positive integer', retryable: false }
+  });
+  if (!input.reason || typeof input.comment !== 'string') return baseResult('dismiss', 'failed', platformResult('failed'), {
+    error: { code: 'SECURITY_DISMISS_INPUT_INVALID', message: 'Dismissal reason and comment are required', retryable: false }
+  });
+
+  const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+  const context = loaded.ok ? loaded.value.context : loaded.context;
+  if (!loaded.ok || !context.platform.repository) return unavailable('dismiss', context);
+  const inspect = loaded.value.provider.securityAlerts?.inspect;
+  const dismiss = loaded.value.provider.securityAlerts?.dismiss;
+  if (!inspect || !dismiss) return unavailable('dismiss', context, unsupported(loaded.value.provider.type));
+  const current = await inspect({ context: providerOperationContext(loaded.value), kind: input.kind, number: input.number });
+  if (!current.ok) return {
+    ...baseResult('dismiss', resultStatus(current.error), context),
+    error: providerError(current.error, 'SECURITY_ALERT_READ_FAILED')
+  };
+  if (current.value.state === 'dismissed' || current.value.state === 'fixed') return {
+    ...baseResult('dismiss', 'no-op', context, {
+      alert: current.value,
+      data: current.value.data,
+      operations: [{ name: 'inspect-alert', status: 'no-op', reasonCode: 'ALREADY_CLOSED' }]
+    }),
+    error: null
+  };
+  if (current.value.state !== 'open') return {
+    ...baseResult('dismiss', 'failed', context, {
+      alert: current.value,
+      data: current.value.data,
+      operations: [{ name: 'inspect-alert', status: 'failed', reasonCode: 'INVALID_STATE' }]
+    }),
+    error: { code: 'SECURITY_RESPONSE_INVALID', message: 'The platform returned an alert without a valid state', retryable: false }
+  };
+  const changed = await dismiss({
+    context: providerOperationContext(loaded.value),
+    kind: input.kind,
+    number: input.number,
+    reason: input.reason,
+    comment: input.comment,
+    mutation: { idempotencyKey: `security-alert:dismiss:${input.kind}:${input.number}` }
+  });
+  if (!changed.ok) return {
+    ...baseResult('dismiss', resultStatus(changed.error), context, {
+      alert: current.value,
+      data: current.value.data,
+      operations: [{ name: 'dismiss-alert', status: 'failed', reasonCode: null }]
+    }),
+    error: providerError(changed.error, 'SECURITY_ALERT_DISMISS_FAILED')
+  };
+  return {
+    ...baseResult('dismiss', changed.value.changed ? 'applied' : 'no-op', context, {
+      operations: [{ name: 'dismiss-alert', status: changed.value.changed ? 'applied' : 'no-op', reasonCode: null }]
+    }),
+    changed: changed.value.changed,
+    error: null
+  };
+}
+
+function readCommentFile(commentFile: string, cwd = process.cwd()): { ok: true; value: string } | { ok: false; error: PlatformError } {
+  try {
+    const requested = path.resolve(cwd, commentFile);
+    return { ok: true, value: fs.readFileSync(requested, 'utf8') };
+  } catch {
+    return { ok: false, error: { code: 'SECURITY_DISMISS_INPUT_INVALID', message: 'Dismissal comment file could not be read', retryable: false } };
+  }
+}
+
+export { dismissSecurityAlert, readCommentFile, readSecurityAlert };
+export type { SecurityAlertOptions, SecurityAlertResult };

package/lib/platform/task-identities.ts

@@ -0,0 +1,40 @@
+import type { ProviderIdentityDeclaration, ResourceIdentity } from './resource-identity.ts';
+import { parseResourceIdentity } from './resource-identity.ts';
+import { isLegacyCompatibilityEnabled, legacyCompatibilityError, VERSION } from '../version.ts';
+import { parse as parseYaml } from 'yaml';
+
+function taskIssueIdentity(
+  frontmatter: Record<string, string | number | boolean | null>,
+  _declaration?: ProviderIdentityDeclaration,
+  runtimeVersion = VERSION
+): ResourceIdentity | null {
+  const serialized = frontmatter.platform_issue_identity;
+  if (typeof serialized === 'string' && serialized.trim()) {
+    try {
+      const decoded = parseYaml(serialized);
+      return parseResourceIdentity(
+        JSON.parse(typeof decoded === 'string' ? decoded : serialized),
+        'platform_issue_identity'
+      );
+    } catch {
+      return null;
+    }
+  }
+  const legacy = frontmatter.issue_number;
+  const number = typeof legacy === 'number' ? legacy : typeof legacy === 'string' && /^[1-9]\d*$/u.test(legacy) ? Number(legacy) : NaN;
+  // TODO(compat): Remove the numeric issue_number fallback before the first stable v1.0.0 release.
+  if (Number.isSafeInteger(number) && number > 0 && !isLegacyCompatibilityEnabled(runtimeVersion)) {
+    throw legacyCompatibilityError('issue_number', runtimeVersion);
+  }
+  return Number.isSafeInteger(number) && number > 0 ? { kind: 'number', value: number } : null;
+}
+
+function taskIssueIdentityError(error: unknown): { code: string; message: string } {
+  const value = error && typeof error === 'object' ? error as { code?: unknown } : {};
+  return {
+    code: typeof value.code === 'string' ? value.code : 'PLATFORM_IDENTITY_INVALID',
+    message: error instanceof Error ? error.message : String(error)
+  };
+}
+
+export { taskIssueIdentity, taskIssueIdentityError };

package/lib/platform/types.ts

@@ -23,15 +23,17 @@ type PlatformOperation = {
 type CommentIdentity = {
   kind: 'task' | 'artifact' | 'summary' | 'cancel';
   marker: string;
-  ids: number[];
+  ids: Array<number | string>;
   parts: number;
 };
 
+import type { ResourceIdentity } from './resource-identity.ts';
+
 type PlatformResult = {
   status: PlatformStatus;
   changed: boolean;
   platform: { type: string | null; repository: string | null; currentUser: string | null };
-  resource: { kind: 'repository' | 'issue' | 'pull-request'; number: number | null };
+  resource: { kind: 'repository' | 'issue' | 'pull-request'; number: number | null; identity?: ResourceIdentity };
   capabilities: PlatformCapabilities;
   operations: PlatformOperation[];
   comment: CommentIdentity | null;

package/lib/platform/verification-required.ts

@@ -2,20 +2,15 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 
-import { hasPlatformCapability } from "./adapters.ts";
 import { inspectRequiredChecks } from "./pr-checks.ts";
-import { resolvePlatformContext } from "./context.ts";
+import { resolvePlatformProviderContext } from "./context.ts";
 import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.ts";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.ts";
+import { resourceIdentityNumber } from "./resource-identity.ts";
 
 const CHECK_TYPE = "required-checks";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 
-function validPrNumber(value: any): any {
-  const parsed = Number(value);
-  return Number.isInteger(parsed) && parsed > 0;
-}
-
 function readPrFlow(repoRoot: any): any {
   try {
     const config = JSON.parse(fs.readFileSync(path.join(repoRoot, ".agents", ".airc.json"), "utf8"));
@@ -40,8 +35,9 @@ export function evaluateRequiredChecks(context: any, shared: any): any {
     return shared.failResult(CHECK_TYPE, factRead.error.message, "check_failed");
   }
   const fact = factRead.status === "valid" ? factRead.fact : null;
-  const prNumber = fact?.state === "bound" ? fact.identity.number : null;
-  if (prFlow === "disabled" || fact?.state === "skipped" || !validPrNumber(prNumber)) {
+  const prIdentity = fact?.state === "bound" ? fact.identity.resource : null;
+  const prNumber = resourceIdentityNumber(prIdentity);
+  if (prFlow === "disabled" || fact?.state === "skipped" || !prIdentity) {
     return shared.passResult(CHECK_TYPE, "Skipped: required checks are not applicable to this task");
   }
 
@@ -90,7 +86,7 @@ export function evaluateRequiredChecks(context: any, shared: any): any {
   return shared.failResult(CHECK_TYPE, inspection.error?.message || `Required checks are ${state || "unavailable"}`, "check_failed");
 }
 
-export function check({ taskDir }: any, shared: any): any {
+export async function check({ taskDir }: any, shared: any): Promise<any> {
   const task = shared.loadTask(taskDir);
   if (!task.ok) return shared.failResult(CHECK_TYPE, task.message);
   const prFlow = readPrFlow(shared.repoRoot);
@@ -100,8 +96,10 @@ export function check({ taskDir }: any, shared: any): any {
   if (prFlow === "disabled" || (factRead.status === "valid" && factRead.fact.state === "skipped") || !bound) {
     return evaluateRequiredChecks({ metadata: task.metadata, localHead: null, inspection: null, prFlow }, shared);
   }
-  const platform = resolvePlatformContext({ cwd: shared.repoRoot });
-  if (!hasPlatformCapability(platform.platform.type, "required-checks")) {
+  const loaded = await resolvePlatformProviderContext({ cwd: shared.repoRoot });
+  const platform = loaded.ok ? loaded.value.context : loaded.context;
+  const supportsChecks = loaded.ok && Boolean(loaded.value.provider.checks?.inspectRequired);
+  if (!supportsChecks) {
     return shared.blockedResult(
       CHECK_TYPE,
       `Platform '${platform.platform.type || "none"}' does not provide required-checks inspection`,
@@ -110,7 +108,7 @@ export function check({ taskDir }: any, shared: any): any {
   }
   const localHead = readHead(shared.repoRoot);
   if (!localHead) return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection: null, prFlow }, shared);
-  const inspection = inspectRequiredChecks(task.metadata.id, { cwd: shared.repoRoot });
+  const inspection = await inspectRequiredChecks(task.metadata.id, { cwd: shared.repoRoot });
   return evaluateRequiredChecks({
     metadata: task.metadata,
     localHead,