@fitlab-ai/agent-infra 0.9.12 → 0.9.14

package/templates/.agents/skills/run-manual-validation/SKILL.zh-CN.md

@@ -8,12 +8,18 @@ description: >
 
 # 运行人工校验
 
+生命周期事件必须携带显式触发信息：编排调用使用 `{trigger-initiator}=orchestrator`，否则使用 `model`；`{request-id}` 是本任务与本轮产物的稳定单行标识，`{reason-code}` 使用 `user-request` 或 `validation-rerun`；started 与 completed 使用同一组值。
+
 ## 任务上下文解析
 
 入口可省略 task ref；显式 task scope 仅接受 `--task <ref>` 或 `-t <ref>`，不再解释位置 task ref。先解析 `--scope`、`--timeout`、`--format`，在 `--` 后原样保留用户命令，再调用 `agent-infra-internal task-context resolve {task-scope}`。解析失败时透传非零退出码，不自行扫描任务。内部 `task-validate` 协议仍使用位置 task ref。
 
 ## 行为边界
 
+### 持久化报告证据
+
+生成验证报告时，先读取 `.agents/rules/evidence-reporting.md`。只记录命令名称、目标范围、退出状态、sanitized result 和覆盖缺口；不得记录完整 argv、环境变量、token、绝对路径或原始敏感 transcript。
+
 - 本技能负责选择校验模式、调用唯一机械入口并记录证据；不把 PR 人工校验标为完成。
 - `complete-manual-validation` 仍是维护者确认覆盖充分后的最终登记入口。
 - 禁止直接操作临时 worktree、lease 或 container；只调用 `agent-infra-internal task-validate`。
@@ -22,7 +28,7 @@ description: >
 
 ## 第 0 步：状态核对（执行前硬约束）
 
-解析任务引用后运行，并把原文写入产物：
+解析任务引用后运行，并在产物中记录任务/产物范围、关键结果和未覆盖部分；正常成功不粘贴完整目录清单或 `task.md` 尾部，失败、阻塞、身份不一致或争议时附决定性原文行：
 
 ```bash
 agent-infra-internal task-snapshot {task-id} --format text
@@ -32,10 +38,10 @@ agent-infra-internal task-snapshot {task-id} --format text
 
 1. 读取 `reference/discovery-and-execution.md`，解析输入模式；非法或半截输入在 started 前停止，不写产物。
 2. 运行 `agent-infra-internal task-artifact {task-id} inspect --family validation-run`，读取最新 review-code 人工校验项；再运行 `agent-infra-internal platform-pr inspect {task-id}`，按 reference 的状态矩阵发现、归并并编号。仅在自动模式下，可靠来源无项或唯一可能来源不可读时才在 started 前停止；合法显式模式始终以用户命令作为有效工作继续。
-3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
+3. 从核心结果取得轮次和产物名；确认存在有效显式工作或非空发现清单后，运行 `agent-infra-internal task-event {task-id} validation-run.started --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code}`，并逐项分类为 `executable|unavailable|unknown|unsafe|unresolved`。
 4. 每个可执行项分别调用 `agent-infra-internal task-validate {task-ref} --scope snapshot --format json -- {command...}`；只有证据表明必须原位时才对该项进行第二次显式 inplace 调用。零项可执行时不运行伪造命令，但仍继续产出覆盖缺口证据。
 5. 读取 `reference/report-template.md`，创建 `validation-run.md|validation-run-r{N}.md`；记录输入模式、发现清单、逐项结果、CLI JSON allowlist 与去敏摘要。
-6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
+6. 运行 `agent-infra-internal task-event {task-id} validation-run.completed --agent {standard-agent-token} --initiator {trigger-initiator} --request-id {request-id} --reason-code {reason-code} --artifact {artifact}`。存在 Issue 时依次运行 `agent-infra-internal platform-comment sync {task-id} --kind task --agent {standard-agent-token}` 和 `agent-infra-internal platform-comment sync {task-id} --kind artifact --artifact {artifact} --agent {standard-agent-token}`。
 7. 运行 `agent-infra-internal task-verify {task-id} validation-run.completed --artifact {artifact} --format text`；未通过则修复后重跑。
 8. 告知用户证据路径、覆盖缺口和验证结果；明确仍需维护者判断是否执行 `complete-manual-validation`。读取 `.agents/rules/next-step-output.md`，最后一行输出 `Completed at`。
 

package/templates/.agents/skills/run-manual-validation/reference/report-template.en.md

@@ -10,8 +10,9 @@
 
 ```text
 $ agent-infra-internal task-snapshot {task-id} --format text
-{raw-output}
+{command-summary-and-key-result}
 ```
+> Follow `.agents/rules/evidence-reporting.md`: record command name, target scope, exit status, sanitized result, and coverage gap; do not paste complete argv or sensitive transcripts.
 
 ## Validation Target
 
@@ -67,3 +68,4 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 $ agent-infra-internal task-validate {task-ref} --scope {scope} --format json -- {redacted-command}
 {sanitized-result}
 ```
+> Keep only the allowed public command and sanitized structured result; complete successful stdout is not default report content.

package/templates/.agents/skills/run-manual-validation/reference/report-template.zh-CN.md

@@ -10,8 +10,9 @@
 
 ```text
 $ agent-infra-internal task-snapshot {task-id} --format text
-{raw-output}
+{command-summary-and-key-result}
 ```
+> 按 `.agents/rules/evidence-reporting.md` 记录命令名称、目标范围、退出状态、sanitized result 和覆盖缺口；不得粘贴完整 argv 或敏感 transcript。
 
 ## 验证目标
 
@@ -67,3 +68,4 @@ $ agent-infra-internal task-snapshot {task-id} --format text
 $ agent-infra-internal task-validate {task-ref} --scope {scope} --format json -- {redacted-command}
 {sanitized-result}
 ```
+> 仅保留允许公开的命令与脱敏结构化结果；完整成功 stdout 不属于默认报告内容。

package/templates/.agents/skills/test/SKILL.en.md

@@ -27,6 +27,17 @@ Confirm no compilation errors.
 
 This project uses three test layers as an optional optimization; if the test suite is small, all layers may map to the same full test command.
 
+### fast smoke (target <5s)
+
+```bash
+# TODO: Replace with this project's fast smoke subset command
+# npm run test:smoke:fast       (Node.js)
+# pytest -m "not slow"          (Python)
+# go test -short ./...          (Go)
+```
+
+Use for code-task inner loops when the project provides a build-free fast path. It should cover the same tests as smoke while skipping redundant compilation or generation.
+
 ### smoke (target <5s)
 
 ```bash
@@ -37,8 +48,8 @@ This project uses three test layers as an optional optimization; if the test sui
 ```
 
 Use for:
-- code-task inner loops
-- save-and-run / frequent feedback
+- after completing an implementation step
+- save-and-run / frequent feedback when no fast path exists
 - project structure, configuration, and template contract checks
 
 ### core (target <15s)

package/templates/.agents/skills/test/SKILL.zh-CN.md

@@ -25,6 +25,17 @@ description: >
 
 三层测试是可选的反馈速度优化；如果测试套件较小，所有层级都可以映射到同一个完整测试命令。
 
+### fast smoke（目标 <5s）
+
+```bash
+# TODO：替换为项目的 fast smoke 子集命令
+# npm run test:smoke:fast       (Node.js)
+# pytest -m "not slow"          (Python)
+# go test -short ./...          (Go)
+```
+
+当项目提供不重复构建的快速路径时，用于 code-task 内循环。它应覆盖与 smoke 相同的测试，同时跳过重复的编译或生成步骤。
+
 ### smoke（目标 <5s）
 
 ```bash
@@ -35,8 +46,8 @@ description: >
 ```
 
 适用场景：
-- code-task 内循环
-- 保存即跑 / 频繁反馈
+- 完成一个实施步骤后
+- 项目没有 fast 路径时的保存即跑 / 频繁反馈
 - 仅断言项目结构、配置、模板契约
 
 ### core（目标 <15s）

package/templates/.agents/skills/update-agent-infra/scripts/sync-templates.js

@@ -1269,6 +1269,9 @@ function syncTemplates(projectRoot, templateRootOverride) {
     }
   }
   const version = resolveVersionFromTemplateRoot(templateRoot);
+  const projectTemplateRoot = path.join(projectRoot, 'templates');
+  const sourceRepositoryTemplate = fs.existsSync(projectTemplateRoot)
+    && fs.realpathSync(templateRoot) === fs.realpathSync(projectTemplateRoot);
 
   const { project, org, language: lang = 'en' } = cfg;
   const platformType = cfg.platform?.type || DEFAULTS.platform.type;
@@ -1771,6 +1774,17 @@ function syncTemplates(projectRoot, templateRootOverride) {
     for (const [tgt, src] of selected) {
       if (expectedTargets) expectedTargets.add(tgt);
 
+      if (sourceRepositoryTemplate && tgt === '.github/workflows/pr-label.yml') {
+        report.managed.protected.push({
+          target: tgt,
+          reason: 'source-repository',
+          baseline: trustedBaseline(managedBaselines[tgt]),
+          local: fs.existsSync(path.join(projectRoot, tgt)) ? sha256(fs.readFileSync(path.join(projectRoot, tgt))) : null,
+          template: sha256(renderContent(fs.readFileSync(path.join(templateRoot, src), 'utf8'), vars))
+        });
+        continue;
+      }
+
       if (matchesAny(tgt, merged) || matchesAny(tgt, ejected)) {
         report.managed.skippedMerged.push(tgt);
         continue;

package/templates/.agents/skills/watch-pr/SKILL.en.md

@@ -48,13 +48,13 @@ Resolve the target PR number `{pr#}` and an optional `{task-id}` via these deter
 
 Before running this step, read `reference/monitor-and-heal.md` and `.agents/rules/pr-checks-commands.md`.
 
-Initialize `repairCommits=[]` and `rebaseAttempts=0`. Run `agent-infra-internal platform-checks watch {task-id} --interval-seconds 30 --deadline-seconds 1800`, then route only by `readiness.state`: `ready` to step 7, `conflicting|checks-failed` to step 3, and `pending|timed-out|cancelled` to step 4.
+Initialize `repairCommits=[]` and `rebaseAttempts=0`. Before readiness in every round, run `platform-pr summary-context`, rebuild the task-bound `pr-change-report.json` for the authoritative PR head using the shared PR change-report contract, and refresh the single summary with a body containing one `<!-- canonical-pr-change-report -->` placeholder via `summary-sync --change-report-file ... --result no_op --strict`. `--strict` preserves report or summary refresh failures as `failed/blocked` instead of treating warnings as success. A report or summary refresh failure must not enter the ready/complete exit; use step 4. After the refresh, run `agent-infra-internal platform-checks watch {task-id} --interval-seconds 30 --deadline-seconds 1800`, then route only by `readiness.state`: `ready` to step 7, `conflicting|checks-failed` to step 3, and `pending|timed-out|cancelled` to step 4.
 
 ### 3. Self-Heal Loop
 
 Before running this step, read the "Self-Heal Decision Tree" of `reference/monitor-and-heal.md` and "Resolve a Failing Run id and Pull Logs" of `.agents/rules/pr-checks-commands.md`.
 
-For `checks-failed`, minimally fix a locatable code-layer failure, test, and publish through the existing commit/push intents. For `conflicting`, follow the reference's same-repository, clean-tree, head/base identity, rebase, full-test, and `git-workflow push-rebased` exact-lease flow, capped at two attempts. Append only remotely verified SHAs, then watch the new head again; any failed safety check goes to step 4.
+For `checks-failed`, minimally fix a locatable code-layer failure, test, and publish through the existing commit/push intents. For `conflicting`, follow the reference's same-repository, clean-tree, head/base identity, rebase, full-test, and `git-workflow push-rebased` exact-lease flow, capped at two attempts. Append only remotely verified SHAs; after any external push, self-heal commit, or rebase changes the head, refresh the report and summary before watching the new head again; any failed safety check goes to step 4.
 
 ### 4. Help Exit (Produce-Then-Stop)
 

package/templates/.agents/skills/watch-pr/SKILL.zh-CN.md

@@ -48,13 +48,13 @@ description: >
 
 执行此步骤前，先读取 `reference/monitor-and-heal.md` 与 `.agents/rules/pr-checks-commands.md`。
 
-进入本轮时初始化 `repairCommits=[]` 与 `rebaseAttempts=0`。调用 `agent-infra-internal platform-checks watch {task-id} --interval-seconds 30 --deadline-seconds 1800`，只按结构化 `readiness.state` 分流：`ready` 进入步骤 7，`conflicting` 或 `checks-failed` 进入步骤 3，`pending|timed-out|cancelled` 进入步骤 4。
+进入本轮时初始化 `repairCommits=[]` 与 `rebaseAttempts=0`。每轮 readiness 前先调用 `platform-pr summary-context`，按共享 PR change-report contract 以当前权威 PR head 重建任务绑定的 `pr-change-report.json`，再用含唯一 `<!-- canonical-pr-change-report -->` 占位符的正文调用 `summary-sync --change-report-file ... --result no_op --strict` 刷新同一条摘要。`--strict` 将报告或摘要刷新失败保留为 `failed/blocked`，不得把 warning 当作成功；刷新失败时不得进入 ready/complete 出口，按步骤 4 记录阻塞。刷新完成后调用 `agent-infra-internal platform-checks watch {task-id} --interval-seconds 30 --deadline-seconds 1800`，只按结构化 `readiness.state` 分流：`ready` 进入步骤 7，`conflicting` 或 `checks-failed` 进入步骤 3，`pending|timed-out|cancelled` 进入步骤 4。
 
 ### 3. 自愈循环
 
 执行此步骤前，先读取 `reference/monitor-and-heal.md` 的「自愈决策树」与 `.agents/rules/pr-checks-commands.md` 的「解析失败 run id 并拉日志」。
 
-`checks-failed` 只对可定位代码层失败做最小修复和测试，再用既有 commit/push intent 发布。`conflicting` 严格执行 reference 的同仓库、干净工作树、head/base 身份、rebase、完整测试与 `git-workflow push-rebased` 精确 lease 流程；上限 2 次。仅记录远端复核成功的 SHA，随后重新监控新 head；任一安全检查失败转步骤 4。
+`checks-failed` 只对可定位代码层失败做最小修复和测试，再用既有 commit/push intent 发布。`conflicting` 严格执行 reference 的同仓库、干净工作树、head/base 身份、rebase、完整测试与 `git-workflow push-rebased` 精确 lease 流程；上限 2 次。仅记录远端复核成功的 SHA；任何外部 push、自愈 commit 或 rebase 改变 head 后，先按本轮报告→摘要顺序刷新，再重新监控新 head；任一安全检查失败转步骤 4。
 
 ### 4. 求助出口（产出后停止）
 

package/templates/.agents/skills/watch-pr/reference/monitor-and-heal.en.md

@@ -11,6 +11,12 @@ After the watch command, route by structured `readiness.state`:
 - `conflicting`: the platform explicitly reports a head/base conflict → rebase healing in SKILL step 3.
 - `pending|timed-out|cancelled`: no reliable success fact exists → SKILL step 4.
 
+## Summary Refresh Boundary
+
+Before readiness in every round, and after an external push, self-heal commit, or successful rebase changes the PR head, rerun `summary-context` → mechanical report and six-check precheck → `platform-pr change-report` → `summary-sync --change-report-file ... --result no_op --strict` with exactly one `<!-- canonical-pr-change-report -->` placeholder. `--strict` preserves report or summary refresh failures as `failed/blocked` so warnings cannot reach the ready/complete route. The core revalidates the sidecar against the authoritative PR snapshot, task-intent digest, and complete patch; missing, stale, invalid, bypassed, or raced publication must not continue to a ready/complete route and must enter the help exit with a warning.
+
+When rebuilding the precheck, each of the six `rationale` fields must state the corresponding high-level finding and include at least one path, line range, and concise `detail` as evidence. `change-composition` must describe where responsibilities are concentrated; compatibility, legacy-path, redundancy, and scope checks must state their actual results separately, without reused generic boilerplate. Use the deployed skill's language for rationales and evidence details; Chinese skill deployments must use Chinese.
+
 ## Self-Heal Decision Tree
 
 ```text

package/templates/.agents/skills/watch-pr/reference/monitor-and-heal.zh-CN.md

@@ -11,6 +11,12 @@
 - `conflicting`：平台明确当前 head 与 base 冲突 → SKILL 步骤 3 的 rebase 自愈。
 - `pending|timed-out|cancelled`：mergeability/checks 未形成可靠成功事实 → SKILL 步骤 4。
 
+## 摘要刷新边界
+
+每轮 readiness 之前，以及外部 push、自愈 commit 或 rebase 成功改变 PR head 之后，必须重新执行 `summary-context` → 机械报告与六项 precheck → `platform-pr change-report` → 含一次 `<!-- canonical-pr-change-report -->` 的 `summary-sync --change-report-file ... --result no_op --strict`。`--strict` 将报告或摘要刷新失败保留为 `failed/blocked`，不允许 warning 穿透到 ready/complete 路由。core 以权威 PR snapshot、任务意图 digest 和完整 patch 重新校验 sidecar；报告缺失、stale、invalid、占位符绕过或发布竞态时，不得继续 ready/complete 路由，转入求助出口并登记 warning。
+
+每轮重建 precheck 时，六项 `rationale` 都必须是对应检查的实际高层结论，并各带至少一条路径、行号和简短 `detail` 证据；`change-composition` 要说明职责集中位置，兼容、旧路径、冗余和范围检查要分别说明实际结果，禁止复用泛化套话。理由和证据详情遵循当前已部署技能的语言，中文技能必须使用中文。
+
 ## 自愈决策树
 
 ```text

package/templates/.agents/templates/task.en.md

@@ -36,10 +36,16 @@ delivery_remote_head:          # Most recent successfully delivered task branch
 
 ### Constraints
 
+| constraint_id | statement | status | authority | source | evidence | derived_from | approval_evidence |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+
 ### Confirmed Decisions
 
 ### Candidate and Rejected Options
 
+| candidate_id | statement | status | constraint_ids | impact | evidence |
+| --- | --- | --- | --- | --- | --- |
+
 ### Acceptance Criteria
 
 ### Open Questions
@@ -96,7 +102,24 @@ delivery_remote_head:          # Most recent successfully delivered task branch
 <!-- Workflow degradation, platform sync failures, permission gaps, and related events. Keep the header when empty. -->
 
 | id | time | step | severity | code | status | target | message | action | resolved_at | resolution |
-|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|
+|----|------|------|----------|------|--------|---------|--------|-------------|------------|------------|
+
+## Rework Intent
+
+| intent_id | finding_id | source_artifact | source_sha256 | target | status | declared_at | consumed_at |
+|-----------|------------|----------------|---------------|--------|--------|-------------|-------------|
+
+## Artifact Invalidation
+
+### Operations
+
+| operation_id | source_family | source_artifact | source_round | source_sha256 | status | processed | total | created_at | updated_at | completed_at | error |
+|--------------|---------------|-----------------|--------------|---------------|--------|-----------|-------|------------|------------|--------------|-------|
+
+### Targets
+
+| target_id | operation_id | target_kind | target_family | target_artifact | target_round | target_sha256 | status | reason_code | updated_at |
+|-----------|--------------|-------------|---------------|-----------------|--------------|---------------|--------|-------------|------------|
 
 ## Activity Log
 

package/templates/.agents/templates/task.zh-CN.md

@@ -36,10 +36,16 @@ delivery_remote_head:          # 最近一次成功交付到 remote 的任务分
 
 ### 约束
 
+| constraint_id | statement | status | authority | source | evidence | derived_from | approval_evidence |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+
 ### 已确认决策
 
 ### 候选与否决方案
 
+| candidate_id | statement | status | constraint_ids | impact | evidence |
+| --- | --- | --- | --- | --- | --- |
+
 ### 验收标准
 
 ### 未决事项
@@ -96,7 +102,24 @@ delivery_remote_head:          # 最近一次成功交付到 remote 的任务分
 <!-- 工作流降级、平台同步失败、权限不足等需要后续注意的事件写入此段。无告警时保留表头即可。 -->
 
 | id | time | step | severity | code | status | target | message | action | resolved_at | resolution |
-|----|------|------|----------|------|--------|--------|---------|--------|-------------|------------|
+|----|------|------|----------|------|--------|---------|--------|-------------|------------|------------|
+
+## 返工意图
+
+| intent_id | finding_id | source_artifact | source_sha256 | target | status | declared_at | consumed_at |
+|-----------|------------|----------------|---------------|--------|--------|-------------|-------------|
+
+## 产物失效记录
+
+### Operations
+
+| operation_id | source_family | source_artifact | source_round | source_sha256 | status | processed | total | created_at | updated_at | completed_at | error |
+|--------------|---------------|-----------------|--------------|---------------|--------|-----------|-------|------------|------------|--------------|-------|
+
+### Targets
+
+| target_id | operation_id | target_kind | target_family | target_artifact | target_round | target_sha256 | status | reason_code | updated_at |
+|-----------|--------------|-------------|---------------|-----------------|--------------|---------------|--------|-------------|------------|
 
 ## 活动日志
 

package/templates/.github/workflows/pr-label.yml

@@ -20,36 +20,17 @@ jobs:
       - name: Checkout base branch
         uses: actions/checkout@v7
 
+      - name: Set up Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: 22.9.0
+
       - name: Sync in-labels
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          changed_files=$(gh api "repos/$GITHUB_REPOSITORY/pulls/$PR_NUMBER/files" \
-            --paginate --jq '.[].filename' | jq -Rn '[inputs]')
-
-          should_labels=$(jq -rn \
-            --argjson files "$changed_files" \
-            --argjson mapping "$(jq '.labels.in // {}' .agents/.airc.json)" \
-            '$mapping
-            | to_entries
-            | map(select(.value | any(. as $prefix | $files | any(startswith($prefix)))))
-            | map("in: " + .key)
-            | .[]?')
-
-          set -- \
-            --repo "$GITHUB_REPOSITORY" \
-            --pr "$PR_NUMBER" \
-            --prefix "in: "
-
-          while IFS= read -r label; do
-            [ -z "$label" ] && continue
-            set -- "$@" --target "$label"
-          done <<EOF
-          $should_labels
-          EOF
-
-          .github/scripts/sync-labels-to-set.sh "$@"
+          AGENT_INFRA_VERSION: 0.9.13-alpha.0
+        run: npm exec --yes --package="@fitlab-ai/agent-infra@$AGENT_INFRA_VERSION" -- agent-infra-internal platform-pr sync-in-labels --pr "$PR_NUMBER" --cwd "$GITHUB_WORKSPACE"
 
       - name: Assign PR creator if unassigned
         env:

package/templates/.agents/scripts/security-alerts.github.sh

@@ -1,151 +0,0 @@
-#!/bin/sh
-
-set -e
-
-operation="${1:-}"
-shift || true
-number=""
-reason=""
-comment_file=""
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --number)
-      number="${2:-}"
-      shift
-      ;;
-    --reason)
-      reason="${2:-}"
-      shift
-      ;;
-    --comment-file)
-      comment_file="${2:-}"
-      shift
-      ;;
-    *)
-      echo "Unknown option: $1" >&2
-      exit 2
-      ;;
-  esac
-  shift
-done
-
-emit_error() {
-  code="$1"
-  message="$2"
-  node - "$operation" "$code" "$message" <<'NODE'
-const [operation, code, message] = process.argv.slice(2);
-process.stdout.write(`${JSON.stringify({ status: "failed", operation, error: { code, message } })}\n`);
-NODE
-}
-
-case "$operation" in
-  read-dependabot|dismiss-dependabot|read-codescan|dismiss-codescan) ;;
-  *)
-    emit_error "SECURITY_OPERATION_INVALID" "Unknown security alert operation."
-    exit 1
-    ;;
-esac
-
-case "$number" in
-  ''|*[!0-9]*)
-    emit_error "SECURITY_NUMBER_INVALID" "Alert number must be a positive integer."
-    exit 1
-    ;;
-esac
-
-if ! command -v gh >/dev/null 2>&1; then
-  emit_error "PLATFORM_CLI_MISSING" "The platform CLI is not installed."
-  exit 1
-fi
-if ! gh auth token >/dev/null 2>&1; then
-  emit_error "PLATFORM_NOT_AUTHENTICATED" "The platform CLI is not authenticated."
-  exit 1
-fi
-repo="$(gh repo view --json nameWithOwner --jq '.nameWithOwner')" || {
-  emit_error "PLATFORM_REPOSITORY_UNAVAILABLE" "Unable to access the current repository."
-  exit 1
-}
-
-case "$operation" in
-  *dependabot*) endpoint="repos/$repo/dependabot/alerts/$number" ;;
-  *codescan*) endpoint="repos/$repo/code-scanning/alerts/$number" ;;
-esac
-
-tmpdir="$(mktemp -d)"
-trap 'rm -rf "$tmpdir"' EXIT HUP INT TERM
-
-if [ "$operation" = "read-dependabot" ] || [ "$operation" = "read-codescan" ]; then
-  if ! gh api "$endpoint" > "$tmpdir/response.json" 2> "$tmpdir/error.txt"; then
-    emit_error "SECURITY_API_FAILED" "Unable to read the security alert."
-    exit 2
-  fi
-else
-  if [ -z "$reason" ] || [ -z "$comment_file" ] || [ ! -f "$comment_file" ]; then
-    emit_error "SECURITY_DISMISS_INPUT_INVALID" "Dismissal reason and comment file are required."
-    exit 1
-  fi
-  if ! gh api "$endpoint" > "$tmpdir/current.json" 2> "$tmpdir/error.txt"; then
-    emit_error "SECURITY_API_FAILED" "Unable to read the security alert before dismissal."
-    exit 2
-  fi
-  state="$(node - "$tmpdir/current.json" <<'NODE'
-const fs = require("node:fs");
-try {
-  const alert = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
-  process.stdout.write(typeof alert.state === "string" ? alert.state : "invalid");
-} catch {
-  process.stdout.write("invalid");
-}
-NODE
-)"
-  case "$state" in
-    open) ;;
-    dismissed|fixed)
-      node - "$operation" "$tmpdir/current.json" <<'NODE'
-const fs = require("node:fs");
-const [operation, responsePath] = process.argv.slice(2);
-const data = JSON.parse(fs.readFileSync(responsePath, "utf8"));
-process.stdout.write(`${JSON.stringify({ status: "no-op", operation, data })}\n`);
-NODE
-      exit 0
-      ;;
-    *)
-      emit_error "SECURITY_RESPONSE_INVALID" "The platform returned an alert without a valid state."
-      exit 1
-      ;;
-  esac
-  node - "$reason" "$comment_file" > "$tmpdir/payload.json" <<'NODE'
-const fs = require("node:fs");
-const [reason, commentFile] = process.argv.slice(2);
-process.stdout.write(JSON.stringify({
-  state: "dismissed",
-  dismissed_reason: reason,
-  dismissed_comment: fs.readFileSync(commentFile, "utf8")
-}));
-NODE
-  if ! gh api --method PATCH "$endpoint" --input "$tmpdir/payload.json" > "$tmpdir/response.json" 2> "$tmpdir/error.txt"; then
-    emit_error "SECURITY_API_FAILED" "Unable to dismiss the security alert."
-    exit 2
-  fi
-fi
-
-node - "$operation" "$tmpdir/response.json" <<'NODE'
-const fs = require("node:fs");
-const [operation, responsePath] = process.argv.slice(2);
-const raw = fs.readFileSync(responsePath, "utf8").trim();
-let data = null;
-if (raw) {
-  try {
-    data = JSON.parse(raw);
-  } catch {
-    process.stdout.write(`${JSON.stringify({
-      status: "failed",
-      operation,
-      error: { code: "SECURITY_RESPONSE_INVALID", message: "The platform returned invalid JSON." }
-    })}\n`);
-    process.exit(1);
-  }
-}
-process.stdout.write(`${JSON.stringify({ status: "applied", operation, data })}\n`);
-NODE

package/templates/.agents/scripts/security-alerts.sh

@@ -1,31 +0,0 @@
-#!/bin/sh
-
-set -e
-
-operation="${1:-}"
-
-node - "$operation" <<'NODE'
-const operation = process.argv[2] || "";
-const known = new Set([
-  "read-dependabot",
-  "dismiss-dependabot",
-  "read-codescan",
-  "dismiss-codescan"
-]);
-const payload = known.has(operation)
-  ? {
-      status: "degraded",
-      operation,
-      error: {
-        code: "PLATFORM_SECURITY_UNSUPPORTED",
-        message: "The current platform does not provide a security alert adapter."
-      }
-    }
-  : {
-      status: "failed",
-      operation,
-      error: { code: "SECURITY_OPERATION_INVALID", message: "Unknown security alert operation." }
-    };
-process.stdout.write(`${JSON.stringify(payload)}\n`);
-process.exit(known.has(operation) ? 0 : 1);
-NODE