@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/dist/lib/internal/task-qualification.js

@@ -0,0 +1,90 @@
+import fs from 'node:fs';
+import { applyQualificationConfirmation } from '../task/qualification-confirmation.js';
+import { applyQualificationProposal } from '../task/qualification-intents.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
+import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+const USAGE = `Usage: agent-infra-internal task-qualification <task-ref> <proposal|confirm|supersede|revoke> --input <json-file> [--dry-run]\n`;
+function fail(message, code = 'QUALIFICATION_PROPOSAL_INVALID') {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code, message } })}\n`);
+    process.stderr.write(USAGE);
+    process.exitCode = 1;
+}
+async function taskQualification(args = []) {
+    const [taskRef, operation] = args;
+    const registered = [
+        internalHandlerRoute('task-qualification', 'proposal', operation ?? ''),
+        internalHandlerRoute('task-qualification', 'confirm', operation ?? ''),
+        internalHandlerRoute('task-qualification', 'supersede', operation ?? ''),
+        internalHandlerRoute('task-qualification', 'revoke', operation ?? '')
+    ].some(Boolean);
+    if (!registered) {
+        fail('task ref and a valid qualification operation are required');
+        return;
+    }
+    if (!ensureInternalHandlerRoute('task-qualification', args))
+        return;
+    if (!taskRef || !['proposal', 'confirm', 'supersede', 'revoke'].includes(operation ?? '')) {
+        fail('task ref and a valid qualification operation are required');
+        return;
+    }
+    let inputPath = '';
+    let dryRun = false;
+    for (let index = 2; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--dry-run') {
+            if (dryRun) {
+                fail('duplicate option --dry-run');
+                return;
+            }
+            dryRun = true;
+            continue;
+        }
+        if (arg !== '--input' || inputPath) {
+            fail(`unknown or duplicate option '${arg}'`);
+            return;
+        }
+        inputPath = args[++index] ?? '';
+        if (!inputPath || inputPath.startsWith('--')) {
+            fail("option '--input' requires a value");
+            return;
+        }
+    }
+    if (!inputPath) {
+        fail("option '--input' is required");
+        return;
+    }
+    let payload;
+    try {
+        payload = JSON.parse(fs.readFileSync(inputPath, 'utf8'));
+    }
+    catch (error) {
+        fail(`cannot read qualification input: ${error instanceof Error ? error.message : String(error)}`);
+        return;
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        fail('qualification input must be an object');
+        return;
+    }
+    const resolved = resolveTaskRef(taskRef);
+    if (!resolved.ok) {
+        fail(resolved.message, resolved.code);
+        return;
+    }
+    try {
+        const result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-qualification.${operation}`, () => operation === 'proposal'
+            ? applyQualificationProposal({ ...payload, taskRef: resolved.taskId, dryRun }, { repoRoot: resolved.repoRoot })
+            : applyQualificationConfirmation({ ...payload, taskRef: resolved.taskId, operation, dryRun }, { repoRoot: resolved.repoRoot }));
+        process.stdout.write(`${JSON.stringify(result)}\n`);
+        if (result.status === 'failed')
+            process.exitCode = 1;
+    }
+    catch (error) {
+        if (error instanceof TaskExecutionLockError)
+            fail(`${error.code}: ${error.message}`, error.code);
+        else
+            throw error;
+    }
+}
+export { taskQualification };
+//# sourceMappingURL=task-qualification.js.map

package/dist/lib/internal/task-review.js

@@ -2,6 +2,7 @@ import { finalizeReviewSummary } from '../task/review-finalization.js';
 import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-review <task-ref> finalize-summary --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
 function failUsage(message) {
     process.stdout.write(`${JSON.stringify({
@@ -13,7 +14,9 @@ function failUsage(message) {
     process.stderr.write(USAGE);
     process.exitCode = 2;
 }
-function taskReview(args = []) {
+async function taskReview(args = []) {
+    if (!ensureInternalHandlerRoute('task-review', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
@@ -22,7 +25,7 @@ function taskReview(args = []) {
         failUsage('task ref and intent are required');
         return;
     }
-    if (args[1] !== 'finalize-summary') {
+    if (!internalHandlerRoute('task-review', 'finalize-summary', args[1] ?? '')) {
         failUsage(`unknown intent '${args[1]}'`);
         return;
     }
@@ -86,7 +89,7 @@ function taskReview(args = []) {
     let result;
     let humanOverride = null;
     try {
-        result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-review.finalize-summary', () => {
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, 'task-review.finalize-summary', async () => {
             let current = finalizeReviewSummary({ taskRef: args[0], stage, artifact, orchestrated, dryRun }, { lockAlreadyHeld: true });
             if (current.status !== 'failed' || !overrideTicket)
                 return current;
@@ -94,7 +97,7 @@ function taskReview(args = []) {
                 failUsage('override ticket requires target and scope');
                 return current;
             }
-            const consumed = consumeHumanOverride({
+            const consumed = await consumeHumanOverride({
                 taskRef: args[0], ticketId: overrideTicket,
                 failureId: failureId('review-finalization', current.error?.code ?? 'TASK_STATE_MISMATCH'),
                 target: overrideTarget, scope: overrideScope

package/dist/lib/internal/task-short-id.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { detectRepoRoot } from '../task/resolve-ref.js';
 import { configuredShortIdLength, executeShortIdCommand } from '../task/short-id.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-short-id <alloc|release|resolve|list> [argument] [--active-dir <path>] [--short-id-length <N>] [--verify]\n`;
 function failure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, output: '', error: { code: 'SHORT_ID_PAYLOAD_INVALID', message } })}\n`);
@@ -8,12 +9,21 @@ function failure(message) {
     process.exitCode = 1;
 }
 function taskShortId(args = []) {
+    if (!ensureInternalHandlerRoute('task-short-id', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['alloc', 'release', 'resolve', 'list'].includes(operation)) {
+    const route = operation === 'list' && args.includes('--verify') ? 'list-verify' : operation ?? '';
+    if (!operation || ![
+        internalHandlerRoute('task-short-id', 'alloc', route),
+        internalHandlerRoute('task-short-id', 'release', route),
+        internalHandlerRoute('task-short-id', 'resolve', route),
+        internalHandlerRoute('task-short-id', 'list', route),
+        internalHandlerRoute('task-short-id', 'list-verify', route)
+    ].some(Boolean)) {
         failure('a valid short-id operation is required');
         return;
     }

package/dist/lib/internal/task-snapshot.js

@@ -1,4 +1,5 @@
 import { collectTaskSnapshot } from '../task/snapshot.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-snapshot <N | TASK-id> [--format json|text]\n';
 function fail(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'SNAPSHOT_PAYLOAD_INVALID', message } })}\n`);
@@ -6,11 +7,13 @@ function fail(message) {
     process.exitCode = 1;
 }
 function taskSnapshot(args = []) {
+    if (!ensureInternalHandlerRoute('task-snapshot', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (!args[0] || args[0].startsWith('--')) {
+    if (!args[0] || args[0].startsWith('--') || !internalHandlerRoute('task-snapshot', 'snapshot', 'snapshot')) {
         fail('task ref is required');
         return;
     }

package/dist/lib/internal/task-validate.js

@@ -16,6 +16,7 @@ import { readSandboxControlManifest } from '../sandbox/control/lifecycle.js';
 import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from '../sandbox/control/protocol.js';
 import { getProcessStartTime } from '../server/process-state.js';
 import { assertGitWorktreeBinding } from '../git/worktree-identity.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
 const MAX_TIMEOUT_MS = 60 * 60 * 1000;
 const RECOVERY_GRACE_MS = 30_000;
@@ -273,6 +274,8 @@ function sniffFormat(args) {
     return index >= 0 && args[index + 1] === 'json' ? 'json' : 'text';
 }
 function taskValidate(args) {
+    if (!ensureInternalHandlerRoute('task-validate', args))
+        return;
     let options;
     try {
         options = parseValidateArgs(args);
@@ -290,9 +293,11 @@ function taskValidate(args) {
         const target = resolveSandboxTarget(options.target, config.repoRoot);
         const commit = git(config.repoRoot, ['rev-parse', target.branch]);
         const startedAt = new Date().toISOString();
-        const result = options.scope === 'snapshot'
+        const result = internalHandlerRoute('task-validate', 'snapshot', options.scope)
             ? snapshotValidation(config.repoRoot, commit, options)
-            : inplaceValidation(config, target, options);
+            : internalHandlerRoute('task-validate', 'inplace', options.scope)
+                ? inplaceValidation(config, target, options)
+                : (() => { throw new Error('TASK_VALIDATE_SCOPE_UNREGISTERED'); })();
         const evidence = {
             version: 1,
             taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,

package/dist/lib/internal/task-verify.js

@@ -2,18 +2,22 @@ import { renderTaskVerification, verifyTaskEvent } from '../task/verification.js
 import { consumeHumanOverride, failureId } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-verify <N | TASK-id> <verification-event> [--artifact <canonical.md>] [--format json|text] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
 function fail(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'VERIFY_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);
     process.exitCode = 1;
 }
-function taskVerify(args = []) {
+async function taskVerify(args = []) {
+    if (!ensureInternalHandlerRoute('task-verify', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (!args[0] || !args[1] || args[0].startsWith('--') || args[1].startsWith('--')) {
+    if (!args[0] || !args[1] || args[0].startsWith('--') || args[1].startsWith('--')
+        || !internalHandlerRoute('task-verify', 'event', args[1] ? 'event' : '')) {
         fail('task ref and verification event are required');
         return;
     }
@@ -64,8 +68,8 @@ function taskVerify(args = []) {
     let result;
     let humanOverride = null;
     try {
-        result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, () => {
-            let current = verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-verify.${event}`, async () => {
+            let current = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) });
             if (current.status === 'pass' || !overrideTicket)
                 return current;
             if (!overrideTarget || !overrideScope) {
@@ -80,13 +84,13 @@ function taskVerify(args = []) {
                 : current.status === 'fail'
                     ? 'CHECK_FAILED'
                     : current.error?.code ?? 'VERIFY_TASK_STATE_MISMATCH';
-            const consumed = consumeHumanOverride({
+            const consumed = await consumeHumanOverride({
                 taskRef, ticketId: overrideTicket,
                 failureId: failureId(failureProducer, failureCode),
                 target: overrideTarget, scope: overrideScope
             }, {
-                effectExecutor: (capability) => {
-                    const retried = verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }, { manualOverride: capability });
+                effectExecutor: async (capability) => {
+                    const retried = await verifyTaskEvent({ taskRef, event, ...(artifact ? { artifact } : {}) }, { manualOverride: capability });
                     current = retried;
                     return retried.status !== 'pass'
                         ? { code: 'OVERRIDE_EFFECT_FAILED', message: `${retried.error?.code ?? 'VERIFY_FAILED'}: ${retried.error?.message ?? 'manual verification effect failed'}` }

package/dist/lib/internal/task-warning.js

@@ -2,6 +2,7 @@ import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js'
 import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal task-warning <task-ref> <add|set-status|list> [intent flags] [--dry-run]\n`;
 const FLAGS = {
     '--step': 'step', '--severity': 'severity', '--code': 'code', '--target': 'target',
@@ -13,13 +14,19 @@ function usageFailure(message) {
     process.stderr.write(USAGE);
     process.exitCode = 1;
 }
-function taskWarning(args = []) {
+async function taskWarning(args = []) {
+    if (!ensureInternalHandlerRoute('task-warning', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const [taskRef, kind] = args;
-    if (!taskRef || !kind || !['add', 'set-status', 'list'].includes(kind)) {
+    if (!taskRef || !kind || ![
+        internalHandlerRoute('task-warning', 'add', kind ?? ''),
+        internalHandlerRoute('task-warning', 'set-status', kind ?? ''),
+        internalHandlerRoute('task-warning', 'list', kind ?? '')
+    ].some(Boolean)) {
         usageFailure('task ref and a valid intent are required');
         return;
     }
@@ -85,7 +92,7 @@ function taskWarning(args = []) {
     let result;
     let humanOverride = null;
     try {
-        result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, () => {
+        result = await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-warning.${kind}`, async () => {
             let current = applyWorkflowWarningIntent(values);
             if (current.status !== 'failed' || !values.overrideTicket)
                 return current;
@@ -93,7 +100,7 @@ function taskWarning(args = []) {
                 usageFailure('override ticket requires target and scope');
                 return current;
             }
-            const consumed = consumeHumanOverride({
+            const consumed = await consumeHumanOverride({
                 taskRef, ticketId: String(values.overrideTicket),
                 failureId: failureId('workflow-warning', current.error?.code ?? 'TASK_STATE_MISMATCH'),
                 target: String(values.overrideTarget), scope: String(values.overrideScope)

package/dist/lib/platform/adapters.js

@@ -8,9 +8,7 @@ function getPlatformAdapter(type) {
     return type ? adapters.get(type) ?? null : null;
 }
 function registerPlatformCapabilities(type, capabilities) {
-    const adapter = adapters.get(type);
-    if (!adapter)
-        throw new Error(`Platform adapter '${type}' must be registered before its capabilities`);
+    const adapter = adapters.get(type) ?? { type };
     adapters.set(type, { ...adapter, ...capabilities });
 }
 function hasPlatformCapability(type, capability) {

package/dist/lib/platform/change-request-git-evidence.js

@@ -2,7 +2,9 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { execFileSync, spawnSync } from "node:child_process";
-import { resolvePlatformChangeRequestGitEvidence } from "./adapters.js";
+import { resolvePlatformProviderContext } from './context.js';
+import { providerError, providerOperationContext, unsupportedProviderOperation } from './provider-bridge.js';
+import { isResourceIdentity } from './resource-identity.js';
 import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.js";
 const SHA_PATTERN = /^[0-9a-f]{40}$/i;
 const REVIEWED_HEAD_REF = "refs/agent-infra/reviewed-head";
@@ -37,18 +39,36 @@ function validMergeIdentity(lastReviewedCommit, pullRequest) {
     }
     return null;
 }
-function resolveMaterializedReviewedHeadRelation(input) {
+async function resolveMaterializedReviewedHeadRelation(input) {
     const identityFailure = validMergeIdentity(input.lastReviewedCommit, input.pullRequest);
     if (identityFailure)
         return identityFailure;
-    const source = resolvePlatformChangeRequestGitEvidence(input.platformType, {
+    const loaded = await resolvePlatformProviderContext({
         cwd: input.cwd,
-        repository: input.pullRequest.repository,
-        number: input.pullRequest.number,
-        pullRequest: input.pullRequest
+        platformType: input.platformType || undefined
     });
+    if (!loaded.ok) {
+        return blocked(loaded.context.error?.code || 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE', loaded.context.error?.message || 'Unable to resolve the configured platform provider');
+    }
+    const target = isResourceIdentity(input.pullRequest.identity)
+        ? input.pullRequest.identity
+        : { kind: 'number', value: input.pullRequest.number };
+    const operation = loaded.value.provider.changeRequests?.resolveGitEvidence
+        ? await loaded.value.provider.changeRequests.resolveGitEvidence({
+            context: providerOperationContext(loaded.value),
+            target,
+            expected: {
+                baseSha: input.pullRequest.base.sha,
+                headSha: input.pullRequest.head.sha,
+                targetBranch: input.pullRequest.base.ref
+            }
+        })
+        : unsupportedProviderOperation(loaded.value.provider, 'changeRequests.resolveGitEvidence');
+    const source = operation.ok
+        ? operation
+        : { ok: false, error: providerError(operation.error, 'PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE') };
     if (!source.ok || !source.value) {
-        return blocked(source.error?.code || "PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE", source.error?.message || "Unable to resolve authoritative PR Git evidence");
+        return blocked(('error' in source && source.error?.code) || "PR_MERGE_EVIDENCE_SOURCE_UNAVAILABLE", ('error' in source && source.error?.message) || "Unable to resolve authoritative PR Git evidence");
     }
     if (!source.value.remoteUrl.trim() ||
         source.value.remoteUrl.trimStart().startsWith("-") ||

package/dist/lib/platform/comment-safety.js

@@ -0,0 +1,226 @@
+const CONTROL_MARKER_PATTERN = /<!--\s*(?:sync-issue|sync-pr|last-commit)\b[\s\S]*?-->|<!--\s*canonical-pr-change-report\s*-->/gi;
+function ok(value) {
+    return { ok: true, value };
+}
+function invalid(message, offset) {
+    return { ok: false, error: { code: 'COMMENT_DOCUMENT_INVALID', message, offset } };
+}
+function normalized(value) {
+    return value.replace(/\r\n?/g, '\n');
+}
+function linesOf(value) {
+    const lines = [];
+    let start = 0;
+    while (start < value.length) {
+        const newline = value.indexOf('\n', start);
+        const end = newline === -1 ? value.length : newline;
+        lines.push({ start, end: newline === -1 ? end : newline + 1, text: value.slice(start, end) });
+        start = newline === -1 ? value.length : newline + 1;
+    }
+    if (value.length === 0)
+        lines.push({ start: 0, end: 0, text: '' });
+    return lines;
+}
+function openingFence(line) {
+    const match = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+    if (!match)
+        return null;
+    const character = match[1][0];
+    const info = match[2];
+    if (character === '`' && info.includes('`'))
+        return 'invalid';
+    return { character, length: match[1].length };
+}
+function closesFence(line, fence) {
+    const escaped = fence.character === '`' ? '`' : '~';
+    return new RegExp(`^ {0,3}${escaped}{${fence.length},}[ \\t]*$`).test(line);
+}
+function fenceRanges(value) {
+    const ranges = [];
+    let fence = null;
+    for (const line of linesOf(value)) {
+        if (!fence) {
+            const opening = openingFence(line.text);
+            if (opening === 'invalid')
+                return invalid('fenced code info string is invalid', line.start);
+            if (opening)
+                fence = { ...opening, start: line.start, openingEnd: line.end };
+            continue;
+        }
+        if (closesFence(line.text, fence)) {
+            ranges.push({
+                start: fence.start,
+                end: line.end,
+                openingEnd: fence.openingEnd,
+                closingStart: line.start,
+                character: fence.character,
+                opening: value.slice(fence.start, fence.openingEnd),
+                closing: value.slice(line.start, line.end)
+            });
+            fence = null;
+        }
+    }
+    if (fence)
+        return invalid('fenced code block is not closed', fence.start);
+    return ok(ranges);
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+function escapeHtmlText(value) {
+    return escapeHtml(value);
+}
+function escapeHtmlAttribute(value) {
+    return escapeHtml(value);
+}
+function escapeMarkdownLiteral(value) {
+    return value.replace(/[\\`*_{}\[\]()#+.!|<>-]/g, '\\$&');
+}
+function markerSafe(value, markers) {
+    let result = value;
+    for (const marker of markers) {
+        const flags = marker.flags.includes('g') ? marker.flags : `${marker.flags}g`;
+        const pattern = new RegExp(marker.source, flags);
+        result = result.replace(pattern, (match) => escapeHtmlText(match));
+    }
+    return result;
+}
+function tagEnd(value, start) {
+    let quote = null;
+    for (let index = start + 1; index < value.length; index += 1) {
+        const character = value[index];
+        if (quote) {
+            if (character === quote)
+                quote = null;
+        }
+        else if (character === '"' || character === "'") {
+            quote = character;
+        }
+        else if (character === '>') {
+            return index;
+        }
+    }
+    return -1;
+}
+function isMarkdownAutolink(value, start) {
+    const end = value.indexOf('>', start + 1);
+    if (end === -1)
+        return false;
+    const target = value.slice(start + 1, end);
+    return /^(?:https?:\/\/|mailto:)[^<>\s]+$/i.test(target)
+        || /^[^<>\s@]+@[^<>\s@]+\.[^<>\s@]+$/.test(target);
+}
+function sanitizeOutside(value, baseOffset) {
+    let result = '';
+    let index = 0;
+    while (index < value.length) {
+        if (value.startsWith('<!--', index)) {
+            const end = value.indexOf('-->', index + 4);
+            if (end === -1)
+                return invalid('HTML comment is not closed', baseOffset + index);
+            const token = value.slice(index, end + 3);
+            result += escapeHtmlText(token);
+            index = end + 3;
+            continue;
+        }
+        if (value[index] === '<' && isMarkdownAutolink(value, index)) {
+            const end = value.indexOf('>', index + 1);
+            result += value.slice(index, end + 1);
+            index = end + 1;
+            continue;
+        }
+        if (value[index] === '<' && /[\\/!?A-Za-z]/.test(value[index + 1] || '')) {
+            const end = tagEnd(value, index);
+            if (end === -1)
+                return invalid('HTML-like tag is not closed', baseOffset + index);
+            result += escapeHtmlText(value.slice(index, end + 1));
+            index = end + 1;
+            continue;
+        }
+        result += value[index];
+        index += 1;
+    }
+    return ok(result);
+}
+function sanitizeMarkdownDocument(value, options = {}) {
+    const source = normalized(value);
+    const ranges = fenceRanges(source);
+    if (!ranges.ok)
+        return ranges;
+    const markers = options.reservedMarkers || [];
+    let result = '';
+    let cursor = 0;
+    for (const range of ranges.value) {
+        const outside = sanitizeOutside(source.slice(cursor, range.start), cursor);
+        if (!outside.ok)
+            return outside;
+        result += outside.value;
+        result += markerSafe(source.slice(range.start, range.end), markers);
+        cursor = range.end;
+    }
+    const tail = sanitizeOutside(source.slice(cursor), cursor);
+    if (!tail.ok)
+        return tail;
+    return ok(result + tail.value);
+}
+function renderSafeCodeFence(value, language = '', reservedMarkers = [CONTROL_MARKER_PATTERN]) {
+    const content = markerSafe(normalized(value), reservedMarkers);
+    const longestRun = Math.max(0, ...(content.match(/`+/g) || []).map((run) => run.length));
+    const delimiter = '`'.repeat(Math.max(3, longestRun + 1));
+    const suffix = content.endsWith('\n') ? '' : '\n';
+    return `${delimiter}${language}\n${content}${suffix}${delimiter}`;
+}
+function commentRangesOutsideFences(source, ranges) {
+    const comments = [];
+    let cursor = 0;
+    for (const fence of [...ranges, { start: source.length, end: source.length }]) {
+        const segment = source.slice(cursor, fence.start);
+        let index = 0;
+        while (index < segment.length) {
+            const opening = segment.indexOf('<!--', index);
+            if (opening === -1)
+                break;
+            const absoluteStart = cursor + opening;
+            const closing = segment.indexOf('-->', opening + 4);
+            if (closing === -1)
+                return invalid('HTML comment is not closed', absoluteStart);
+            comments.push({ start: absoluteStart, end: cursor + closing + 3 });
+            index = closing + 3;
+        }
+        cursor = fence.end;
+    }
+    return ok(comments);
+}
+function splitDocumentPlaceholder(value, placeholder) {
+    const source = normalized(value);
+    const ranges = fenceRanges(source);
+    if (!ranges.ok)
+        return ranges;
+    const positions = [];
+    let cursor = source.indexOf(placeholder);
+    while (cursor !== -1) {
+        positions.push(cursor);
+        cursor = source.indexOf(placeholder, cursor + placeholder.length);
+    }
+    if (positions.length !== 1)
+        return invalid('document must contain exactly one placeholder', positions[1] ?? positions[0] ?? source.length);
+    const position = positions[0];
+    if (ranges.value.some((range) => position >= range.start && position < range.end)) {
+        return invalid('placeholder must be outside fenced code', position);
+    }
+    const comments = commentRangesOutsideFences(source, ranges.value);
+    if (!comments.ok)
+        return comments;
+    const containing = comments.value.find((comment) => position >= comment.start && position < comment.end);
+    if (containing && (containing.start !== position || containing.end !== position + placeholder.length)) {
+        return invalid('placeholder must not be nested in another HTML comment', position);
+    }
+    return ok({ prefix: source.slice(0, position), suffix: source.slice(position + placeholder.length) });
+}
+export { CONTROL_MARKER_PATTERN, escapeHtmlAttribute, escapeHtmlText, escapeMarkdownLiteral, fenceRanges, renderSafeCodeFence, sanitizeMarkdownDocument, splitDocumentPlaceholder };
+//# sourceMappingURL=comment-safety.js.map

package/dist/lib/platform/completion-backfill.js

@@ -9,6 +9,7 @@ import { applyWorkflowWarningIntent } from '../task/workflow-warning-intents.js'
 import { captureTaskWriteMetadata } from '../task/write.js';
 import { syncPlatformComment } from './issue-comments.js';
 import { platformResult } from './types.js';
+import { taskIssueIdentity } from './task-identities.js';
 function result(base, artifacts, warnings) {
     return { ...base, artifacts, warnings };
 }
@@ -29,7 +30,7 @@ function excludedPrReview(taskDir, message) {
         return null;
     }
 }
-function backfillCompletionComments(taskRef, options) {
+async function backfillCompletionComments(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok)
         return result(platformResult('failed', {
@@ -45,16 +46,16 @@ function backfillCompletionComments(taskRef, options) {
             }
         }), [], []);
     const initialContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
-    const issueNumber = Number(parseTaskFrontmatter(initialContent).issue_number);
-    if (!Number.isInteger(issueNumber) || issueNumber <= 0)
+    const issueIdentity = taskIssueIdentity(parseTaskFrontmatter(initialContent));
+    if (!issueIdentity)
         return result(platformResult('no-op', {
-            error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no valid issue_number', retryable: false }
+            error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no valid platform issue identity', retryable: false }
         }), [], []);
     const artifacts = [];
     const operations = [];
     let latest = platformResult('no-op', { error: null });
     for (const artifact of inventory.artifacts) {
-        latest = syncPlatformComment(resolved.taskId, {
+        latest = await syncPlatformComment(resolved.taskId, {
             kind: 'artifact',
             artifact: artifact.name,
             agent: options.agent,