@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/lib/platform/pr-summary.ts

@@ -11,6 +11,7 @@ import type { PrDeliveryFact } from '../task/pr-delivery-fact.ts';
 import { resolvePlatformProviderContext } from './context.ts';
 import type { LoadedContext, PlatformClient } from './context.ts';
 import { normalizeCommentContent } from './issue-comments.ts';
+import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.ts';
 import { platformResult } from './types.ts';
 import type { PlatformResult } from './types.ts';
 import type { OperationWarning } from '../task/operation-outcome.ts';
@@ -19,6 +20,7 @@ import type { PlatformChangeRequestSnapshot } from './adapters.ts';
 import type { ChangeRequestSnapshot } from './provider-contract.ts';
 import {
   buildPrChangeReport,
+  CANONICAL_REPORT_PLACEHOLDER,
   readPrChangeReport,
   replaceCanonicalReportPlaceholder,
   runMechanicalChangeReport,
@@ -57,11 +59,7 @@ function summaryMarker(taskId: string): string {
 }
 
 function escapeSummaryAuditText(value: string): string {
-  return value
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/\r\n?/g, '\n');
+  return escapeHtmlText(value).replace(/\r\n?/g, '\n');
 }
 
 function renderSummaryAuditLine(value: string): string {
@@ -528,7 +526,30 @@ async function syncPullRequestSummary(
       if (!report.ok) return fail('failed', context, platformError(report.error));
       const checked = currentReportCheck(report.value, initial.value, taskContent, resolved.repoRoot);
       if (!checked.ok) return fail('failed', context, checked.error);
-      const replaced = replaceCanonicalReportPlaceholder(options.body, report.value);
+      const placeholder = CANONICAL_REPORT_PLACEHOLDER;
+      const split = splitDocumentPlaceholder(options.body, placeholder);
+      if (!split.ok) return fail('failed', context, {
+        code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+        message: split.error.message,
+        retryable: false
+      });
+      const prefix = sanitizeMarkdownDocument(split.value.prefix, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+      const suffix = sanitizeMarkdownDocument(split.value.suffix, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+      if (!prefix.ok) {
+        return fail('failed', context, {
+          code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+          message: `${prefix.error.message} at offset ${prefix.error.offset}`,
+          retryable: false
+        });
+      }
+      if (!suffix.ok) {
+        return fail('failed', context, {
+          code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+          message: `${suffix.error.message} at offset ${suffix.error.offset}`,
+          retryable: false
+        });
+      }
+      const replaced = replaceCanonicalReportPlaceholder(`${prefix.value}${placeholder}${suffix.value}`, report.value);
       if (!replaced.ok) return fail('failed', context, platformError(replaced.error));
       const desired = buildPullRequestSummary(resolved.taskId, replaced.value, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
       if (!isSafeSummaryEnvelope(desired, resolved.taskId)) return fail('failed', context, {

package/lib/platform/provider-contract.ts

@@ -22,7 +22,7 @@ type PlatformError = {
 
 type ProviderResult<T> =
   | { ok: true; value: T }
-  | { ok: false; error: PlatformError };
+  | { ok: false; error: PlatformError; value?: T };
 
 type ProviderOperationContext = {
   repositoryRoot: string;
@@ -162,6 +162,41 @@ type MutationReceipt = {
   operationId?: string;
 };
 
+type SecurityAlertKind = 'dependabot' | 'code-scanning';
+
+type SecurityAlertSnapshot = {
+  kind: SecurityAlertKind;
+  number: number;
+  state: string;
+  data: JsonValue;
+};
+
+type LabelDefinition = {
+  name: string;
+  color: string;
+  description: string;
+};
+
+type LabelReconciliation = {
+  changed: boolean;
+  created: string[];
+  updated: string[];
+  removed: string[];
+  skipped: string[];
+};
+
+type MilestoneDefinition = {
+  title: string;
+  description: string;
+  state: 'open' | 'closed';
+};
+
+type MilestoneInitialization = {
+  changed: boolean;
+  created: string[];
+  skipped: string[];
+};
+
 type RepositoryMetadataSnapshot = {
   repository: { identity: ResourceIdentity; name: string; url: string | null };
   labels: Array<{ identity: ResourceIdentity; name: string }>;
@@ -286,6 +321,8 @@ type PlatformProvider = {
       head: string;
     }): Promise<ProviderResult<{ sha: string }>>;
     inspect(input: { context: ProviderOperationContext; target: ResourceIdentity }): Promise<ProviderResult<ChangeRequestSnapshot>>;
+    listFiles?(input: { context: ProviderOperationContext; target: ResourceIdentity }): Promise<ProviderResult<string[]>>;
+    listClosingIssues?(input: { context: ProviderOperationContext; target: ResourceIdentity }): Promise<ProviderResult<ResourceIdentity[]>>;
     listClosing(input: { context: ProviderOperationContext; issue: ResourceIdentity }): Promise<ProviderResult<ChangeRequestSnapshot[]>>;
     create(input: {
       context: ProviderOperationContext;
@@ -383,6 +420,34 @@ type PlatformProvider = {
       historyLimit: number;
     }): Promise<ProviderResult<ReleaseNotesFacts>>;
   };
+  securityAlerts?: {
+    inspect(input: {
+      context: ProviderOperationContext;
+      kind: SecurityAlertKind;
+      number: number;
+    }): Promise<ProviderResult<SecurityAlertSnapshot>>;
+    dismiss(input: {
+      context: ProviderOperationContext;
+      kind: SecurityAlertKind;
+      number: number;
+      reason: string;
+      comment: string;
+      mutation: MutationIdentity;
+    }): Promise<ProviderResult<MutationReceipt>>;
+  };
+  repositoryMetadata?: {
+    reconcileLabels(input: {
+      context: ProviderOperationContext;
+      desired: LabelDefinition[];
+      cleanupStaleIn: boolean;
+      mutation: MutationIdentity;
+    }): Promise<ProviderResult<LabelReconciliation>>;
+    reconcileMilestones(input: {
+      context: ProviderOperationContext;
+      desired: MilestoneDefinition[];
+      mutation: MutationIdentity;
+    }): Promise<ProviderResult<MilestoneInitialization>>;
+  };
   verification?: {
     fetchRemoteFacts(input: {
       context: ProviderOperationContext;
@@ -414,12 +479,14 @@ function validatePlatformProvider(
   providerType: string
 ): ProviderResult<PlatformProvider> {
   const operationGroups: Record<string, { required: string[]; optional: string[] }> = {
-    issues: { required: ['inspect', 'create', 'update', 'describeRepository'], optional: [] },
+    issues: { required: ['inspect', 'create', 'update', 'describeRepository'], optional: ['listLabels', 'listMilestones'] },
     comments: { required: ['list', 'write', 'delete'], optional: [] },
-    changeRequests: { required: ['inspect', 'listClosing', 'create', 'update', 'resolveGitEvidence'], optional: ['verifyHead'] },
+    changeRequests: { required: ['inspect', 'listClosing', 'create', 'update', 'resolveGitEvidence'], optional: ['verifyHead', 'listFiles', 'listClosingIssues'] },
     checks: { required: ['inspectRequired', 'resolveRun', 'fetchLogs'], optional: [] },
     reviews: { required: ['list', 'publish'], optional: [] },
     releases: { required: ['inspect', 'create', 'update', 'reconcileMilestones', 'publishNotes', 'collectNotes'], optional: [] },
+    securityAlerts: { required: ['inspect', 'dismiss'], optional: [] },
+    repositoryMetadata: { required: ['reconcileLabels', 'reconcileMilestones'], optional: [] },
     verification: { required: ['fetchRemoteFacts'], optional: [] }
   };
   const resourceKindsByGroup: Record<string, PlatformResourceKind[]> = {
@@ -429,6 +496,8 @@ function validatePlatformProvider(
     checks: ['pull-request'],
     reviews: ['pull-request'],
     releases: ['release', 'issue', 'pull-request'],
+    securityAlerts: [],
+    repositoryMetadata: [],
     verification: ['issue', 'pull-request']
   };
   if (!isRecord(value)
@@ -515,6 +584,10 @@ export type {
   IssueSnapshot,
   JsonValue,
   MilestoneReconciliation,
+  MilestoneDefinition,
+  MilestoneInitialization,
+  LabelDefinition,
+  LabelReconciliation,
   MutationIdentity,
   MutationReceipt,
   PlatformCapabilities,
@@ -531,6 +604,8 @@ export type {
   RepositoryMetadataSnapshot,
   ReleaseNotesFacts,
   ResourceIdentity,
+  SecurityAlertKind,
+  SecurityAlertSnapshot,
   ReviewSnapshot,
   VerificationRemoteFacts
 };

package/lib/platform/provider-validation.ts

@@ -5,7 +5,11 @@ import type {
   CheckLogSnapshot,
   CheckRunSnapshot,
   GitEvidenceSnapshot,
+  LabelDefinition,
+  LabelReconciliation,
   IssueSnapshot,
+  MilestoneDefinition,
+  MilestoneInitialization,
   MilestoneReconciliation,
   MutationReceipt,
   PlatformContextSnapshot,
@@ -18,6 +22,8 @@ import type {
   RepositoryMetadataSnapshot,
   RequiredCheckSnapshot,
   ReviewSnapshot,
+  SecurityAlertKind,
+  SecurityAlertSnapshot,
   VerificationRemoteFacts
 } from './provider-contract.ts';
 import type { JsonValue } from './provider-contract.ts';
@@ -273,6 +279,67 @@ function validateReceipt(value: unknown): MutationReceipt {
   };
 }
 
+function positiveInteger(value: unknown, label: string): number {
+  if (!Number.isSafeInteger(value) || (value as number) <= 0) throw new Error(`${label} must be a positive integer`);
+  return value as number;
+}
+
+function validateSecurityAlert(value: unknown): SecurityAlertSnapshot {
+  const item = record(value, 'security alert');
+  exactKeys(item, ['kind', 'number', 'state', 'data'], 'security alert');
+  if (item.kind !== 'dependabot' && item.kind !== 'code-scanning') throw new Error('security alert.kind is invalid');
+  return {
+    kind: item.kind as SecurityAlertKind,
+    number: positiveInteger(item.number, 'security alert.number'),
+    state: stringValue(item.state, 'security alert.state'),
+    data: jsonValue(item.data, 'security alert.data')
+  };
+}
+
+function validateLabelDefinition(value: unknown, label: string): LabelDefinition {
+  const item = record(value, label);
+  exactKeys(item, ['name', 'color', 'description'], label);
+  return {
+    name: stringValue(item.name, `${label}.name`),
+    color: stringValue(item.color, `${label}.color`),
+    description: stringValue(item.description, `${label}.description`, true)
+  };
+}
+
+function validateLabelReconciliation(value: unknown): LabelReconciliation {
+  const item = record(value, 'label reconciliation');
+  exactKeys(item, ['changed', 'created', 'updated', 'removed', 'skipped'], 'label reconciliation');
+  const names = (field: string) => arrayValue(item[field], `label reconciliation.${field}`).map((entry) => stringValue(entry, `${field}[]`));
+  return {
+    changed: booleanValue(item.changed, 'label reconciliation.changed'),
+    created: names('created'),
+    updated: names('updated'),
+    removed: names('removed'),
+    skipped: names('skipped')
+  };
+}
+
+function validateMilestoneDefinition(value: unknown, label: string): MilestoneDefinition {
+  const item = record(value, label);
+  exactKeys(item, ['title', 'description', 'state'], label);
+  if (item.state !== 'open' && item.state !== 'closed') throw new Error(`${label}.state is invalid`);
+  return {
+    title: stringValue(item.title, `${label}.title`),
+    description: stringValue(item.description, `${label}.description`, true),
+    state: item.state
+  };
+}
+
+function validateMilestoneInitialization(value: unknown): MilestoneInitialization {
+  const item = record(value, 'milestone initialization');
+  exactKeys(item, ['changed', 'created', 'skipped'], 'milestone initialization');
+  return {
+    changed: booleanValue(item.changed, 'milestone initialization.changed'),
+    created: arrayValue(item.created, 'milestone initialization.created').map((entry) => stringValue(entry, 'created[]')),
+    skipped: arrayValue(item.skipped, 'milestone initialization.skipped').map((entry) => stringValue(entry, 'skipped[]'))
+  };
+}
+
 function validateMetadata(value: unknown): RepositoryMetadataSnapshot {
   const item = record(value, 'repository metadata');
   exactKeys(item, ['repository', 'labels', 'milestones', 'issueTypes', 'fields'], 'repository metadata');
@@ -375,6 +442,11 @@ const PROVIDER_ERROR_CATALOG: Readonly<Record<string, { message: string; retryab
   ISSUE_NUMBER_INVALID: { message: 'The issue number is invalid', retryable: false },
   ISSUE_CREATE_RESPONSE_INVALID: { message: 'Issue creation returned an invalid response', retryable: false },
   COMMENT_ID_INVALID: { message: 'The comment identity is invalid', retryable: false },
+  SECURITY_KIND_INVALID: { message: 'The security alert kind is invalid', retryable: false },
+  SECURITY_NUMBER_INVALID: { message: 'The security alert number is invalid', retryable: false },
+  SECURITY_RESPONSE_INVALID: { message: 'The platform returned an invalid security alert', retryable: false },
+  LABEL_RESPONSE_INVALID: { message: 'The platform returned an invalid label response', retryable: false },
+  MILESTONE_RESPONSE_INVALID: { message: 'The platform returned an invalid milestone response', retryable: false },
   MILESTONE_IDENTITY_INVALID: { message: 'The milestone identity is invalid', retryable: false },
   CHECK_RUN_NOT_FOUND: { message: 'The check run was not found', retryable: false },
   RELEASE_NOTES_AUTHORS_TRUNCATED: { message: 'Release note commit authors exceeded the supported limit', retryable: false },
@@ -415,6 +487,8 @@ function validators(providerType: string, declaration?: ProviderIdentityDeclarat
       return { sha: stringValue(item.sha, 'change request head.sha') };
     },
     'changeRequests.inspect': (value) => validateChangeRequest(value, declaredIdentityKind(declaration, 'pull-request'), true),
+    'changeRequests.listFiles': (value) => arrayValue(value, 'pull request files').map((entry) => stringValue(entry, 'pull request files[]')),
+    'changeRequests.listClosingIssues': (value) => arrayValue(value, 'closing issues').map((entry) => identity(entry, 'closing issues[]', declaredIdentityKind(declaration, 'issue'))),
     'changeRequests.listClosing': (value) => arrayValue(value, 'changeRequests').map((entry) => validateChangeRequest(entry, declaredIdentityKind(declaration, 'pull-request'), true)),
     'changeRequests.create': validateReceipt,
     'changeRequests.update': validateReceipt,
@@ -458,6 +532,10 @@ function validators(providerType: string, declaration?: ProviderIdentityDeclarat
     },
     'releases.publishNotes': validateReceipt,
     'releases.collectNotes': (value) => validateReleaseNotes(value, declaration),
+    'securityAlerts.inspect': validateSecurityAlert,
+    'securityAlerts.dismiss': validateReceipt,
+    'repositoryMetadata.reconcileLabels': validateLabelReconciliation,
+    'repositoryMetadata.reconcileMilestones': validateMilestoneInitialization,
     'verification.fetchRemoteFacts': (value) => {
       const item = record(value, 'verification facts');
       exactKeys(item, ['issue', 'comments', 'changeRequest', 'commit', 'fields'], 'verification facts');
@@ -491,11 +569,15 @@ async function invokeProviderOperation<T>(
     }
     if (envelope.ok === false && envelope.error && typeof envelope.error === 'object' && !Array.isArray(envelope.error)) {
       try {
-        exactKeys(envelope, ['ok', 'error'], `${operation} result`);
+        exactKeys(envelope, Object.hasOwn(envelope, 'value') ? ['ok', 'error', 'value'] : ['ok', 'error'], `${operation} result`);
         const error = envelope.error as Record<string, unknown>;
         exactKeys(error, ['code', 'message', 'retryable'], `${operation} error`);
         if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message || typeof error.retryable !== 'boolean') throw new Error('invalid provider error');
-        return { ok: false, error: safeProviderError(providerType, operation, error) };
+        return {
+          ok: false,
+          error: safeProviderError(providerType, operation, error),
+          ...(Object.hasOwn(envelope, 'value') ? { value: validate(envelope.value) } : {})
+        };
       } catch {
         return { ok: false, error: validationError(providerType, operation, 'Provider operation returned an invalid error') };
       }
@@ -510,7 +592,7 @@ function wrapProviderOperations(provider: PlatformProvider): PlatformProvider {
   const map = validators(provider.type, provider.identity);
   const wrapped: PlatformProvider = { ...provider, context: { ...provider.context } };
   wrapped.context.resolve = (input) => invokeProviderOperation(provider.type, 'context.resolve', () => provider.context.resolve(input), map['context.resolve']! as ResultValidator<PlatformContextSnapshot>);
-  for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'verification'] as const) {
+  for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'securityAlerts', 'repositoryMetadata', 'verification'] as const) {
     const group = provider[groupName];
     if (!group) continue;
     const target: Record<string, unknown> = { ...group };