@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/dist/lib/internal/cli-route-inventory.js

@@ -0,0 +1,152 @@
+export const PUBLIC_CLI_COMMAND_ALIASES = Object.freeze({
+    '': 'help',
+    s: 'sandbox',
+    t: 'task',
+    '--version': 'version',
+    '-v': 'version'
+});
+export const PUBLIC_CLI_SELECTOR_ALIASES = Object.freeze({
+    task: Object.freeze({ d: 'decisions' })
+});
+export const PUBLIC_CLI_ROUTE_SELECTORS = Object.freeze({
+    'agent-client': ['list', 'status', 'enable', 'disable', 'configure'],
+    cp: ['cp'],
+    data: ['capture', 'verify', 'audit', 'repair', 'export'],
+    decide: ['decide'],
+    help: ['help'],
+    init: ['init'],
+    merge: ['merge'],
+    run: ['create-task', 'task-skill', 'recreate'],
+    sandbox: ['create', 'exec', 'ls', 'show', 'prune', 'rebuild', 'refresh', 'rm', 'start', 'vm'],
+    server: ['start', 'stop', 'status', 'logs', '__daemon'],
+    task: ['cat', 'decisions', 'files', 'grep', 'issue-body', 'log', 'ls', 'show', 'status'],
+    sync: ['sync'],
+    update: ['update'],
+    version: ['version']
+});
+/**
+ * The selector definitions consumed by every internal handler. Keep this
+ * module free of handler imports so the pre-import task-view guard remains
+ * effective.
+ */
+export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
+    'task-create': ['input'],
+    'task-qualification': ['proposal', 'confirm', 'supersede', 'revoke'],
+    'sandbox-control': ['serve', 'execute', 'recover', 'client'],
+    'agent-client': ['next-steps', 'model-selection'],
+    'codex-lifecycle': ['preflight', 'capability-arm', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
+    'codex-sandbox-controller': ['verify-context', 'run'],
+    'git-workflow': ['inspect', 'preview-tree', 'snapshot', 'compare-trees', 'commit', 'push-rebased'],
+    'task-delivery': ['deliver'],
+    'release-workflow': ['inspect', 'prepare', 'publish', 'post-prepare', 'post-publish'],
+    'platform-release-notes': ['context', 'stage', 'publish'],
+    'platform-security': ['read', 'dismiss'],
+    'platform-metadata': ['init-labels', 'init-milestones'],
+    'platform-context': ['resolve'],
+    'platform-comment': ['list', 'owner', 'backfill', 'sync'],
+    'platform-issue': ['inspect', 'create', 'bind', 'sync'],
+    'platform-pr': ['inspect', 'summary-context', 'resolve-external', 'create', 'bind', 'skip', 'sync', 'change-report', 'summary-sync', 'sync-in-labels'],
+    'platform-pr-review': ['inspect', 'list', 'publish-pr', 'publish-task'],
+    'pr-review-grade': ['decide', 'resolve-host', 'verify-artifact'],
+    'platform-checks': ['inspect', 'watch', 'resolve-run', 'logs'],
+    'task-context': ['resolve'],
+    'task-ledger': ['decision-next-id', 'stage-status', 'finding-upsert', 'finding-respond', 'finding-review', 'decision-upsert', 'rework-intent-upsert'],
+    'task-warning': ['list', 'add', 'set-status'],
+    'task-activity': ['pr-review-inspect', 'pr-review-start', 'pr-review-complete', 'pr-review-terminate'],
+    'task-artifact': ['inspect', 'init', 'repair', 'finalize-local'],
+    'task-orchestration': ['status', 'progress'],
+    'task-review': ['finalize-summary'],
+    'task-event': ['event'],
+    'task-invalidation': ['reconcile'],
+    'task-override': ['diagnose', 'issue', 'consume'],
+    'task-lifecycle': ['intent'],
+    'task-finalization': ['complete'],
+    'task-short-id': ['list', 'list-verify', 'alloc', 'release', 'resolve'],
+    'task-snapshot': ['snapshot'],
+    'task-verify': ['event'],
+    'task-validate': ['snapshot', 'inplace']
+});
+export const INTERNAL_CLI_ROUTE_SELECTORS = INTERNAL_HANDLER_ROUTE_SELECTORS;
+function first(args) {
+    return args[0] ?? '';
+}
+function optionValue(args, name) {
+    const index = args.indexOf(name);
+    if (index >= 0)
+        return args[index + 1];
+    const prefix = `${name}=`;
+    return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
+export function internalRouteSelector(command, args) {
+    if (command === 'sandbox-control')
+        return first(args);
+    if (command === 'task-create')
+        return 'input';
+    if (command === 'task-qualification')
+        return args[1] ?? '';
+    if (command === 'task-lifecycle')
+        return args[1] ? 'intent' : '';
+    if (command === 'task-finalization')
+        return args[1] === 'complete' ? 'complete' : '';
+    if (command === 'task-event')
+        return args[1] ? 'event' : '';
+    if (command === 'task-verify')
+        return args[0] && args[1] ? 'event' : '';
+    if (command === 'task-snapshot')
+        return 'snapshot';
+    if (command === 'task-validate')
+        return optionValue(args, '--scope') ?? 'snapshot';
+    if (command === 'task-short-id')
+        return first(args) === 'list' && args.includes('--verify') ? 'list-verify' : first(args);
+    if (command === 'task-orchestration')
+        return args[1] === 'status' ? 'status' : args[1] ? 'progress' : '';
+    if (command === 'task-review')
+        return args[1] ?? '';
+    if (command === 'task-invalidation')
+        return args[1] ?? '';
+    if (command === 'task-override')
+        return args[1] ?? '';
+    if (command === 'task-artifact')
+        return args[1] ?? '';
+    if (command === 'platform-pr-review' && first(args) === 'publish') {
+        const scope = optionValue(args, '--scope') ?? '';
+        return /^TASK-\d{8}-\d{6}$/u.test(scope) ? 'publish-task' : /^pr\d+$/u.test(scope) ? 'publish-pr' : '';
+    }
+    if (['task-ledger', 'task-warning', 'task-activity'].includes(command))
+        return args[1] ?? '';
+    if (command === 'task-delivery')
+        return args[1] ?? '';
+    if (command === 'task-context')
+        return first(args);
+    return first(args);
+}
+export function isInternalHandlerRoute(command, args) {
+    if (args[0] === '--help' || args[0] === '-h')
+        return true;
+    const selector = internalRouteSelector(command, args);
+    const selectors = INTERNAL_HANDLER_ROUTE_SELECTORS[command];
+    return Boolean(selector && selectors?.some((candidate) => candidate === selector));
+}
+/**
+ * Marks a selector at the handler's actual dispatch branch.
+ *
+ * The call is intentionally side-effect free so the top-level task-view guard
+ * can still run before a handler module is imported. Route coverage tests read
+ * these branch markers independently from the pre-import inventory.
+ */
+export function internalHandlerRoute(command, selector, actualSelector) {
+    return command.length > 0 && selector === actualSelector;
+}
+export function ensureInternalHandlerRoute(command, args) {
+    if (isInternalHandlerRoute(command, args))
+        return true;
+    const selector = internalRouteSelector(command, args);
+    process.stdout.write(`${JSON.stringify({
+        status: 'failed',
+        changed: false,
+        error: { code: 'INTERNAL_ROUTE_UNREGISTERED', message: `operation '${command} ${selector || first(args)}' is not registered` }
+    })}\n`);
+    process.exitCode = 1;
+    return false;
+}
+//# sourceMappingURL=cli-route-inventory.js.map

package/dist/lib/internal/codex-lifecycle.js

@@ -10,6 +10,7 @@ import { verifyCodexSandboxControllerContextWithWarnings } from '../agent-client
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { hasSealableOrchestrationDelegation } from '../task/orchestration.js';
 import { activateCodexOrchestrationDelegation, activateCodexSpawnDelegation, reconcileCodexOrchestrationDelegation, sealCodexOrchestrationDelegation, sealCodexParentDelegation } from '../task/codex-orchestration.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal codex-lifecycle <capability-arm|hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
 const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
 function output(value) {
@@ -144,11 +145,13 @@ function payloadText(payload, key) {
         : '';
 }
 async function codexLifecycle(args = []) {
+    if (!ensureInternalHandlerRoute('codex-lifecycle', args))
+        return;
     const parsed = parse(args);
     if (!parsed || process.exitCode)
         return;
     try {
-        if (parsed.operation === 'preflight') {
+        if (internalHandlerRoute('codex-lifecycle', 'preflight', parsed.operation)) {
             const format = parsed.values['--format'] ?? 'json';
             if (!['text', 'json'].includes(format))
                 throw new Error("format must be 'text' or 'json'");
@@ -173,7 +176,7 @@ async function codexLifecycle(args = []) {
                 output({ status: 'ready', changed: false, evidence: result, diagnostics: result.diagnostics, error: null });
             return;
         }
-        if (parsed.operation === 'capability-arm') {
+        if (internalHandlerRoute('codex-lifecycle', 'capability-arm', parsed.operation)) {
             const taskId = parsed.values['--task-id'];
             if (!taskId)
                 throw new Error('capability-arm requires --task-id');
@@ -197,7 +200,7 @@ async function codexLifecycle(args = []) {
             return;
         }
         const store = createCodexLifecycleStore({ cliVersion: cliVersion() });
-        if (parsed.operation === 'hook-event') {
+        if (internalHandlerRoute('codex-lifecycle', 'hook-event', parsed.operation)) {
             const phase = parsed.values['--event'];
             if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
                 throw new Error('hook-event requires a known --event');
@@ -337,7 +340,7 @@ async function codexLifecycle(args = []) {
         const childThreadId = parsed.values['--child-id'];
         if (!childThreadId)
             throw new Error(`operation '${parsed.operation}' requires --child-id`);
-        if (parsed.operation === 'resolve-start') {
+        if (internalHandlerRoute('codex-lifecycle', 'resolve-start', parsed.operation)) {
             if (store.read(childThreadId).state.spawn?.hookDefinitionHash !== hookDefinitionHash()) {
                 throw new Error('Codex lifecycle hook definition hash is stale');
             }
@@ -351,7 +354,7 @@ async function codexLifecycle(args = []) {
                 process.exitCode = 1;
             return;
         }
-        if (parsed.operation === 'resolve-stop') {
+        if (internalHandlerRoute('codex-lifecycle', 'resolve-stop', parsed.operation)) {
             const stopTurnId = store.read(childThreadId).state.stop?.turnId;
             if (!stopTurnId)
                 throw new Error('Codex lifecycle stop hook is not available');
@@ -363,7 +366,7 @@ async function codexLifecycle(args = []) {
             output({ status: latest.state.status, changed: true, evidence: latest.state.stopEvidence, diagnostics: [], error: latest.state.error });
             return;
         }
-        if (parsed.operation === 'consume') {
+        if (internalHandlerRoute('codex-lifecycle', 'consume', parsed.operation)) {
             const consumer = parsed.values['--consumer'];
             if (!consumer)
                 throw new Error('consume requires --consumer');

package/dist/lib/internal/codex-sandbox-controller.js

@@ -1,4 +1,5 @@
 import { runCodexSandboxController, verifyCodexSandboxControllerContextWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
 function fail(code, message, exitCode = 1) {
     process.stdout.write(`${JSON.stringify({
@@ -14,7 +15,10 @@ function parse(args) {
         return null;
     }
     const operation = args[0];
-    if (!operation || !['run', 'verify-context'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('codex-sandbox-controller', 'run', operation),
+        internalHandlerRoute('codex-sandbox-controller', 'verify-context', operation)
+    ].some(Boolean)) {
         process.stderr.write(USAGE);
         fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', 'operation must be run or verify-context', 2);
         return null;
@@ -44,11 +48,13 @@ function parse(args) {
     return { operation, values };
 }
 async function codexSandboxController(args = []) {
+    if (!ensureInternalHandlerRoute('codex-sandbox-controller', args))
+        return;
     const parsed = parse(args);
     if (!parsed || process.exitCode)
         return;
     try {
-        if (parsed.operation === 'verify-context') {
+        if (internalHandlerRoute('codex-sandbox-controller', 'verify-context', parsed.operation)) {
             const contextPath = parsed.values['--context']
                 ?? process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
             if (!contextPath)

package/dist/lib/internal/git-workflow.js

@@ -3,42 +3,46 @@ import { inspectGitWorkflow, previewCommitTree, pushRebasedBranch } from '../git
 import { compareReviewTrees, snapshotReview } from '../git/review-snapshot.js';
 import { resolvePostReviewGlobs } from '../task/review-fingerprint.js';
 import { executeCommitOperation } from '../task/commit-operation.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 function output(value) { process.stdout.write(`${JSON.stringify(value)}\n`); }
 function gitWorkflow(args = []) {
+    if (!ensureInternalHandlerRoute('git-workflow', args))
+        return;
     const [action, ...rest] = args;
     const cwdIndex = rest.indexOf('--cwd');
     const cwd = cwdIndex >= 0 ? rest[cwdIndex + 1] : process.cwd();
     let result;
-    if (action === 'inspect') {
+    if (internalHandlerRoute('git-workflow', 'inspect', action ?? '')) {
         const inputIndex = rest.indexOf('--input');
         const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
         result = inspectGitWorkflow(cwd ?? process.cwd(), undefined, input?.remote && input.refs ? { remote: input.remote, refs: input.refs } : undefined);
     }
-    else if (action === 'commit') {
+    else if (internalHandlerRoute('git-workflow', 'commit', action ?? '')) {
         const inputIndex = rest.indexOf('--input');
         const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
         result = input
             ? executeCommitOperation({ cwd: cwd ?? process.cwd(), ...input })
             : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
     }
-    else if (action === 'push-rebased') {
+    else if (internalHandlerRoute('git-workflow', 'push-rebased', action ?? '')) {
         const inputIndex = rest.indexOf('--input');
         const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
         result = input ? pushRebasedBranch({ cwd: cwd ?? process.cwd(), ...input }) : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
     }
-    else if (action === 'preview-tree') {
+    else if (internalHandlerRoute('git-workflow', 'preview-tree', action ?? '')) {
         const inputIndex = rest.indexOf('--input');
         const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
         result = input
             ? previewCommitTree({ cwd: cwd ?? process.cwd(), paths: input.paths, expectedHead: input.expectedHead })
             : { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
     }
-    else if (action === 'snapshot' || action === 'compare-trees') {
+    else if (internalHandlerRoute('git-workflow', 'snapshot', action ?? '')
+        || internalHandlerRoute('git-workflow', 'compare-trees', action ?? '')) {
         const inputIndex = rest.indexOf('--input');
         const input = inputIndex >= 0 && rest[inputIndex + 1] ? JSON.parse(fs.readFileSync(rest[inputIndex + 1], 'utf8')) : null;
         if (!input)
             result = { status: 'failed', changed: false, error: { code: 'GIT_INPUT_REQUIRED', message: '--input JSON file is required' } };
-        else if (action === 'snapshot')
+        else if (internalHandlerRoute('git-workflow', 'snapshot', action ?? ''))
             result = { status: 'no-op', changed: false, snapshot: snapshotReview({ cwd: cwd ?? process.cwd(), mode: input.mode, baseline: input.baseline, diffBase: input.diffBase, globs: input.globs ?? resolvePostReviewGlobs({}, {}) }), error: null };
         else
             result = { status: 'no-op', changed: false, comparison: compareReviewTrees({ cwd: cwd ?? process.cwd(), expected: input.expected, actual: input.actual }), error: null };

package/dist/lib/internal/platform-checks.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { fetchPlatformCheckLogs, inspectPullRequestReadiness, resolvePlatformCheckRun, watchPullRequestReadiness } from '../platform/pr-checks.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal platform-checks inspect <task-ref> [--cwd <path>]
        agent-infra-internal platform-checks watch <task-ref> --interval-seconds <N> --deadline-seconds <N> [--cwd <path>]
        agent-infra-internal platform-checks resolve-run <task-ref> --check-name <name> [--details-url <url>] [--cwd <path>]
@@ -43,12 +44,19 @@ function positive(value) {
     return Number.isFinite(number) && number > 0 ? number : null;
 }
 async function platformChecks(args = []) {
+    if (!ensureInternalHandlerRoute('platform-checks', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['inspect', 'watch', 'resolve-run', 'logs'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('platform-checks', 'inspect', operation),
+        internalHandlerRoute('platform-checks', 'watch', operation),
+        internalHandlerRoute('platform-checks', 'resolve-run', operation),
+        internalHandlerRoute('platform-checks', 'logs', operation)
+    ].some(Boolean)) {
         fail('a valid operation is required');
         return;
     }
@@ -75,11 +83,11 @@ async function platformChecks(args = []) {
         fail(`${operation} does not accept --${unexpected}`);
         return;
     }
-    if (operation === 'inspect') {
+    if (internalHandlerRoute('platform-checks', 'inspect', operation)) {
         finish(await inspectPullRequestReadiness(taskRef, { cwd }));
         return;
     }
-    if (operation === 'resolve-run') {
+    if (internalHandlerRoute('platform-checks', 'resolve-run', operation)) {
         if (!values.checkName) {
             fail('resolve-run requires --check-name');
             return;
@@ -87,7 +95,7 @@ async function platformChecks(args = []) {
         finish(await resolvePlatformCheckRun(taskRef, { cwd, checkName: values.checkName, detailsUrl: values.detailsUrl }));
         return;
     }
-    if (operation === 'logs') {
+    if (internalHandlerRoute('platform-checks', 'logs', operation)) {
         const run = positive(values.run);
         const job = values.job === undefined ? undefined : positive(values.job);
         if (!run || values.job !== undefined && !job) {
@@ -97,6 +105,10 @@ async function platformChecks(args = []) {
         finish(await fetchPlatformCheckLogs(taskRef, { cwd, run, job: job || undefined }));
         return;
     }
+    if (!internalHandlerRoute('platform-checks', 'watch', operation)) {
+        fail('operation is not registered');
+        return;
+    }
     const intervalSeconds = positive(values.intervalSeconds);
     const deadlineSeconds = positive(values.deadlineSeconds);
     if (!intervalSeconds || !deadlineSeconds) {

package/dist/lib/internal/platform-comment.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { checkPlatformCommentOwner, listPlatformComments, syncPlatformComment } from '../platform/issue-comments.js';
 import { backfillCompletionComments } from '../platform/completion-backfill.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal platform-comment list --issue <token> [--cwd <path>]
        agent-infra-internal platform-comment owner <task-ref> [--cwd <path>]
        agent-infra-internal platform-comment backfill <task-ref> --agent <agent> [--cwd <path>]
@@ -48,12 +49,19 @@ function readBodyFile(value, cwd) {
     return fs.readFileSync(path.resolve(cwd, value), 'utf8');
 }
 async function platformComment(args = []) {
+    if (!ensureInternalHandlerRoute('platform-comment', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['list', 'owner', 'backfill', 'sync'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('platform-comment', 'list', operation),
+        internalHandlerRoute('platform-comment', 'owner', operation),
+        internalHandlerRoute('platform-comment', 'backfill', operation),
+        internalHandlerRoute('platform-comment', 'sync', operation)
+    ].some(Boolean)) {
         fail('a valid operation is required');
         return;
     }
@@ -69,7 +77,7 @@ async function platformComment(args = []) {
         return;
     }
     const cwd = path.resolve(typeof parsed.values.cwd === 'string' ? parsed.values.cwd : process.cwd());
-    if (operation === 'list') {
+    if (internalHandlerRoute('platform-comment', 'list', operation)) {
         const issue = parsed.values.issue;
         if (typeof issue !== 'string' || !issue) {
             fail('list requires --issue <token>');
@@ -83,7 +91,7 @@ async function platformComment(args = []) {
         finish(await listPlatformComments(issue, cwd));
         return;
     }
-    if (operation === 'owner') {
+    if (internalHandlerRoute('platform-comment', 'owner', operation)) {
         const unexpected = Object.keys(parsed.values).find((key) => key !== 'cwd');
         if (unexpected) {
             fail(`owner does not accept '--${unexpected}'`);
@@ -92,7 +100,7 @@ async function platformComment(args = []) {
         finish(await checkPlatformCommentOwner(taskRef, { cwd }));
         return;
     }
-    if (operation === 'backfill') {
+    if (internalHandlerRoute('platform-comment', 'backfill', operation)) {
         const unexpected = Object.keys(parsed.values).find((key) => !['cwd', 'agent'].includes(key));
         if (unexpected) {
             fail(`backfill does not accept '--${unexpected}'`);
@@ -111,6 +119,10 @@ async function platformComment(args = []) {
         finish(await backfillCompletionComments(taskRef, { cwd, agent: normalizedAgent }));
         return;
     }
+    if (!internalHandlerRoute('platform-comment', 'sync', operation)) {
+        fail('operation is not registered');
+        return;
+    }
     const kind = parsed.values.kind;
     const agent = parsed.values.agent;
     if (!['task', 'artifact', 'summary', 'cancel'].includes(String(kind))) {

package/dist/lib/internal/platform-context.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { resolvePlatformContext } from '../platform/context.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal platform-context resolve [--cwd <path>]\n';
 function fail(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'PLATFORM_PAYLOAD_INVALID', message } })}\n`);
@@ -7,11 +8,13 @@ function fail(message) {
     process.exitCode = 1;
 }
 async function platformContext(args = []) {
+    if (!ensureInternalHandlerRoute('platform-context', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
-    if (args[0] !== 'resolve') {
+    if (!internalHandlerRoute('platform-context', 'resolve', args[0] ?? '')) {
         fail("operation must be 'resolve'");
         return;
     }

package/dist/lib/internal/platform-issue.js

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { bindPlatformIssue, createPlatformIssue, inspectPlatformIssue, syncPlatformIssue } from '../platform/issues.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal platform-issue inspect <task-ref> [--cwd <path>]
        agent-infra-internal platform-issue create <task-ref> --agent <agent> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-issue bind <task-ref> --issue <token> --agent <agent> [--dry-run] [--cwd <path>]
@@ -55,12 +56,19 @@ function oneOf(values, name, allowed) {
     return value;
 }
 async function platformIssue(args = []) {
+    if (!ensureInternalHandlerRoute('platform-issue', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['inspect', 'create', 'bind', 'sync'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('platform-issue', 'inspect', operation),
+        internalHandlerRoute('platform-issue', 'create', operation),
+        internalHandlerRoute('platform-issue', 'bind', operation),
+        internalHandlerRoute('platform-issue', 'sync', operation)
+    ].some(Boolean)) {
         fail('a valid operation is required');
         return;
     }
@@ -85,7 +93,7 @@ async function platformIssue(args = []) {
         fail(`${operation} does not accept --${unexpected}`);
         return;
     }
-    if (operation === 'inspect') {
+    if (internalHandlerRoute('platform-issue', 'inspect', operation)) {
         finish(await inspectPlatformIssue(taskRef, { cwd }));
         return;
     }
@@ -99,11 +107,11 @@ async function platformIssue(args = []) {
         return;
     }
     values.agent = agent;
-    if (operation === 'create') {
+    if (internalHandlerRoute('platform-issue', 'create', operation)) {
         finish(await createPlatformIssue(taskRef, { cwd, agent: values.agent, dryRun: values.dryRun === true }));
         return;
     }
-    if (operation === 'bind') {
+    if (internalHandlerRoute('platform-issue', 'bind', operation)) {
         if (typeof values.issue !== 'string' || !values.issue) {
             fail('bind requires --issue <token>');
             return;

package/dist/lib/internal/platform-metadata.js

@@ -0,0 +1,88 @@
+import path from 'node:path';
+import { initializeLabels, initializeMilestones } from '../platform/repository-metadata.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+const USAGE = `Usage: agent-infra-internal platform-metadata init-labels [--cleanup-stale-in] [--cwd <path>]
+       agent-infra-internal platform-metadata init-milestones [--history] [--cwd <path>]
+`;
+function fail(message) {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'METADATA_INPUT_INVALID', message, retryable: false } })}\n`);
+    process.stderr.write(USAGE);
+    process.exitCode = 1;
+}
+function finish(result, preserveMilestoneFallback = false) {
+    if (preserveMilestoneFallback && result.error && typeof result.error === 'object'
+        && result.error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED') {
+        process.stderr.write('Milestone initialization skipped for unsupported platform.\n');
+        process.exitCode = 0;
+        return;
+    }
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    process.exitCode = result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+}
+function parseOptions(args) {
+    let cwd = process.cwd();
+    let cleanup = false;
+    let history = false;
+    const seen = new Set();
+    for (let index = 0; index < args.length; index += 1) {
+        const flag = args[index];
+        if (seen.has(flag))
+            return null;
+        seen.add(flag);
+        if (flag === '--cleanup-stale-in') {
+            cleanup = true;
+            continue;
+        }
+        if (flag === '--history') {
+            history = true;
+            continue;
+        }
+        if (flag === '--cwd') {
+            const value = args[++index];
+            if (!value || value.startsWith('--'))
+                return null;
+            cwd = path.resolve(value);
+            continue;
+        }
+        return null;
+    }
+    return { cwd: path.resolve(cwd), cleanup, history };
+}
+async function platformMetadata(args = []) {
+    if (!ensureInternalHandlerRoute('platform-metadata', args))
+        return;
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const action = args[0];
+    if (!internalHandlerRoute('platform-metadata', 'init-labels', action ?? '')
+        && !internalHandlerRoute('platform-metadata', 'init-milestones', action ?? '')) {
+        fail('a valid operation is required');
+        return;
+    }
+    if (action !== 'init-labels' && action !== 'init-milestones') {
+        fail('a valid operation is required');
+        return;
+    }
+    const parsed = parseOptions(args.slice(1));
+    if (!parsed) {
+        fail('invalid metadata options');
+        return;
+    }
+    if (action === 'init-labels' && parsed.history) {
+        fail('init-labels does not accept --history');
+        return;
+    }
+    if (action === 'init-milestones' && parsed.cleanup) {
+        fail('init-milestones does not accept --cleanup-stale-in');
+        return;
+    }
+    if (action === 'init-labels') {
+        finish(await initializeLabels({ cleanupStaleIn: parsed.cleanup }, { cwd: parsed.cwd }));
+        return;
+    }
+    finish(await initializeMilestones({ history: parsed.history }, { cwd: parsed.cwd }), true);
+}
+export { platformMetadata };
+//# sourceMappingURL=platform-metadata.js.map