@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/dist/lib/platform/issue-comments.js

@@ -7,6 +7,7 @@ import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, unsupportedProviderOperation } from './provider-bridge.js';
 import { resourceIdentityNumber } from './resource-identity.js';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.js';
+import { CONTROL_MARKER_PATTERN, escapeHtmlText, fenceRanges, renderSafeCodeFence, sanitizeMarkdownDocument } from './comment-safety.js';
 function providerCommentId(id, provider) {
     return provider.identity?.comment === 'number' && /^\d+$/.test(id) ? Number(id) : id;
 }
@@ -37,14 +38,21 @@ function splitFrontmatter(content) {
         return { frontmatter: null, body: content };
     return { frontmatter: match[1], body: content.slice(match[0].length).replace(/^\r?\n/, '') };
 }
+function sanitizeCommentBody(value, label) {
+    const result = sanitizeMarkdownDocument(value, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+    if (!result.ok)
+        throw new Error(`${result.error.code}: ${label}: ${result.error.message} at offset ${result.error.offset}`);
+    return result.value;
+}
 function footer(agent, taskId) {
     return `---\n*由 ${agent} 自动生成 · 内部追踪：${taskId}*`;
 }
 function renderTaskComment(content, taskId, agent) {
     const split = splitFrontmatter(content);
+    const safeBody = sanitizeCommentBody(split.body, 'task body');
     const taskBody = split.frontmatter === null
-        ? split.body
-        : `<details><summary>元数据 (frontmatter)</summary>\n\n\`\`\`yaml\n---\n${split.frontmatter}\n---\n\`\`\`\n\n</details>\n\n${split.body}`;
+        ? safeBody
+        : `<details><summary>元数据 (frontmatter)</summary>\n\n${renderSafeCodeFence(`---\n${split.frontmatter}\n---`, 'yaml')}\n\n</details>\n\n${safeBody}`;
     return normalizeCommentContent([
         MARKERS.task(taskId),
         '## 任务文件',
@@ -69,10 +77,11 @@ function chunkByUtf8(content, maxBytes) {
     if (maxBytes <= 0)
         throw new Error('comment byte limit is too small');
     const chunks = [];
-    let remaining = content;
-    while (remaining) {
+    let start = 0;
+    while (start < content.length) {
+        const remaining = content.slice(start);
         if (Buffer.byteLength(remaining, 'utf8') <= maxBytes) {
-            chunks.push(remaining);
+            chunks.push({ content: remaining, start, end: content.length });
             break;
         }
         let bytes = 0;
@@ -90,12 +99,109 @@ function chunkByUtf8(content, maxBytes) {
         const cut = newlineIndex > 0 ? newlineIndex : index;
         if (cut === 0)
             throw new Error('comment byte limit cannot fit one Unicode code point');
-        chunks.push(remaining.slice(0, cut));
-        remaining = remaining.slice(cut);
+        chunks.push({ content: remaining.slice(0, cut), start, end: start + cut });
+        start += cut;
+    }
+    return chunks.length > 0 ? chunks : [{ content: '', start: 0, end: 0 }];
+}
+function longestFenceLineRun(content, character) {
+    const pattern = new RegExp(`^ {0,3}(${character}+)[ \\t]*(?:\\n|$)`, 'gm');
+    let longest = 0;
+    for (const match of content.matchAll(pattern))
+        longest = Math.max(longest, match[1].length);
+    return longest;
+}
+function boundedFence(content, sourceCharacter, maxBytes) {
+    const candidates = sourceCharacter === '`' ? ['~', '`'] : ['`', '~'];
+    for (const character of candidates) {
+        const length = Math.max(3, longestFenceLineRun(content, character) + 1);
+        const delimiter = character.repeat(length);
+        if (Buffer.byteLength(delimiter, 'utf8') * 2 + 2 <= maxBytes)
+            return { opening: `${delimiter}\n`, closing: `${delimiter}\n` };
     }
-    return chunks.length > 0 ? chunks : [''];
+    return null;
+}
+function sourceSlice(piece, start, end) {
+    return piece.content.slice(Math.max(0, start - piece.start), Math.max(0, end - piece.start));
 }
-function buildArtifactChunk(taskId, stem, title, agent, content, part, total, chunked, backfill) {
+function renderOversizedFenceChunk(piece, fences, maxBytes) {
+    const insertions = new Map();
+    const omitted = [];
+    const insert = (position, value, ensureLineStart = false) => {
+        const values = insertions.get(position) || [];
+        values.push({ value, ensureLineStart });
+        insertions.set(position, values);
+    };
+    for (const fence of fences) {
+        if (piece.end <= fence.start || piece.start >= fence.end)
+            continue;
+        const oversized = Buffer.byteLength(fence.opening, 'utf8') > maxBytes
+            || Buffer.byteLength(fence.closing, 'utf8') > maxBytes;
+        if (!oversized) {
+            if (piece.start > fence.start && piece.start < fence.end)
+                insert(piece.start, fence.opening);
+            if (piece.end > fence.start && piece.end < fence.end)
+                insert(piece.end, fence.closing, true);
+            continue;
+        }
+        const code = sourceSlice(piece, Math.max(piece.start, fence.openingEnd), Math.min(piece.end, fence.closingStart));
+        const delimiter = boundedFence(code, fence.character, maxBytes);
+        if (!delimiter)
+            return escapeHtmlText(piece.content);
+        insert(Math.max(piece.start, fence.start), delimiter.opening);
+        insert(Math.min(piece.end, fence.end), delimiter.closing, true);
+        const openingStart = Math.max(piece.start, fence.start);
+        const openingEnd = Math.min(piece.end, fence.openingEnd);
+        if (openingStart < openingEnd)
+            omitted.push({ start: openingStart, end: openingEnd });
+        const closingStart = Math.max(piece.start, fence.closingStart);
+        const closingEnd = Math.min(piece.end, fence.end);
+        if (closingStart < closingEnd)
+            omitted.push({ start: closingStart, end: closingEnd });
+    }
+    const boundaries = new Set([piece.start, piece.end]);
+    for (const position of insertions.keys())
+        boundaries.add(position);
+    for (const range of omitted) {
+        boundaries.add(range.start);
+        boundaries.add(range.end);
+    }
+    const points = [...boundaries].sort((left, right) => left - right);
+    let content = '';
+    for (let index = 0; index < points.length; index += 1) {
+        const point = points[index];
+        for (const insertion of insertions.get(point) || []) {
+            if (insertion.ensureLineStart && content.length > 0 && !content.endsWith('\n'))
+                content += '\n';
+            content += insertion.value;
+        }
+        const next = points[index + 1];
+        if (next === undefined)
+            continue;
+        const skipped = omitted.some((range) => range.start <= point && next <= range.end);
+        if (!skipped)
+            content += sourceSlice(piece, point, next);
+    }
+    return content;
+}
+function independentChunkContent(piece, fences, maxBytes) {
+    const oversizedFence = fences.some((fence) => piece.end > fence.start && piece.start < fence.end
+        && (Buffer.byteLength(fence.opening, 'utf8') > maxBytes || Buffer.byteLength(fence.closing, 'utf8') > maxBytes));
+    if (oversizedFence)
+        return renderOversizedFenceChunk(piece, fences, maxBytes);
+    const openingFence = fences.find((fence) => piece.start > fence.start && piece.start < fence.end);
+    const closingFence = fences.find((fence) => piece.end > fence.start && piece.end < fence.end);
+    let content = piece.content;
+    if (openingFence)
+        content = openingFence.opening + content;
+    if (closingFence) {
+        if (!content.endsWith('\n'))
+            content += '\n';
+        content += closingFence.closing;
+    }
+    return content;
+}
+function buildArtifactChunk(taskId, stem, title, agent, content, part, total, chunked, backfill, renderedContent = content) {
     const marker = chunked ? MARKERS.artifactChunk(taskId, stem, part, total) : MARKERS.artifact(taskId, stem);
     const heading = chunked ? `## ${title}（${part}/${total}）` : `## ${title}`;
     const timelineHint = backfill ? '> 历史产物补发' : null;
@@ -106,7 +212,7 @@ function buildArtifactChunk(taskId, stem, title, agent, content, part, total, ch
         '',
         `> **${agent}** · ${taskId}`,
         '',
-        content,
+        renderedContent,
         '',
         footer(agent, taskId)
     ].join('\n'));
@@ -115,25 +221,32 @@ function buildArtifactChunk(taskId, stem, title, agent, content, part, total, ch
 function chunkArtifactComment(input) {
     const byteLimit = input.byteLimit || 60_000;
     const identity = artifactIdentity(input.artifact);
-    const single = buildArtifactChunk(input.taskId, identity.stem, identity.title, input.agent, input.body, 1, 1, false, Boolean(input.backfill));
+    const safeBody = sanitizeCommentBody(input.body, 'artifact body');
+    const single = buildArtifactChunk(input.taskId, identity.stem, identity.title, input.agent, safeBody, 1, 1, false, Boolean(input.backfill));
     if (Buffer.byteLength(single.body, 'utf8') <= byteLimit)
         return [single];
     let total = 2;
-    let pieces = [];
+    let payloadLimit = Number.POSITIVE_INFINITY;
+    const ranges = fenceRanges(safeBody);
+    if (!ranges.ok)
+        throw new Error(`${ranges.error.code}: artifact body: ${ranges.error.message} at offset ${ranges.error.offset}`);
     for (;;) {
         const probe = buildArtifactChunk(input.taskId, identity.stem, identity.title, input.agent, '', total, total, true, Boolean(input.backfill));
         const available = byteLimit - Buffer.byteLength(probe.body, 'utf8');
-        pieces = chunkByUtf8(input.body, available);
-        if (pieces.length === total)
-            break;
-        total = pieces.length;
+        const sourceLimit = Math.min(available, payloadLimit);
+        if (sourceLimit <= 0)
+            throw new Error('comment byte limit is too small for an artifact chunk');
+        const pieces = chunkByUtf8(safeBody, sourceLimit);
+        if (pieces.length !== total) {
+            total = pieces.length;
+            continue;
+        }
+        const chunks = pieces.map((piece, index) => buildArtifactChunk(input.taskId, identity.stem, identity.title, input.agent, piece.content, index + 1, total, true, Boolean(input.backfill), independentChunkContent(piece, ranges.value, sourceLimit)));
+        const overflow = Math.max(...chunks.map((chunk) => Buffer.byteLength(chunk.body, 'utf8') - byteLimit));
+        if (overflow <= 0)
+            return chunks;
+        payloadLimit = sourceLimit - overflow;
     }
-    return pieces.map((content, index) => {
-        const chunk = buildArtifactChunk(input.taskId, identity.stem, identity.title, input.agent, content, index + 1, total, true, Boolean(input.backfill));
-        if (Buffer.byteLength(chunk.body, 'utf8') > byteLimit)
-            throw new Error('rendered comment exceeds byte limit');
-        return chunk;
-    });
 }
 function findMarkerComments(comments, marker) {
     return comments.filter((comment) => normalizeCommentContent(String(comment.body || '')).split('\n', 1)[0] === marker);
@@ -166,7 +279,7 @@ function hasResolvedPlatformContext(context) {
 }
 function bodyEnvelope(marker, title, taskId, agent, body) {
     return normalizeCommentContent([
-        marker, `## ${title}`, '', `> **${agent}** · ${taskId}`, '', body.replace(/\n+$/, ''), '', footer(agent, taskId)
+        marker, `## ${title}`, '', `> **${agent}** · ${taskId}`, '', sanitizeCommentBody(body, `${title} body`).replace(/\n+$/, ''), '', footer(agent, taskId)
     ].join('\n'));
 }
 function resolveArtifactBody(taskDir, artifact) {
@@ -271,6 +384,16 @@ async function syncPlatformComment(taskRef, options) {
             error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no valid issue_number', retryable: false }
         });
     }
+    let desired;
+    try {
+        desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, options);
+    }
+    catch (error) {
+        return platformResult('failed', {
+            resource: { kind: 'issue', number: resourceIdentityNumber(issueIdentityFromTask) },
+            error: { code: 'COMMENT_PAYLOAD_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        });
+    }
     const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client: options.client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
     if (!hasResolvedPlatformContext(context) || !loaded.ok)
@@ -293,17 +416,6 @@ async function syncPlatformComment(taskRef, options) {
             ...contextFields(context), resource: { kind: 'issue', number: issue }, error: listed.error
         });
     }
-    let desired;
-    try {
-        desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, options);
-    }
-    catch (error) {
-        return platformResult('failed', {
-            ...contextFields(context),
-            resource: { kind: 'issue', number: issue },
-            error: { code: 'COMMENT_PAYLOAD_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
-        });
-    }
     const existing = relatedComments(listed.value, markerPrefix(resolved.taskId, options));
     if (!validateRelatedMarkerSet(existing, markerPrefix(resolved.taskId, options)).ok) {
         return platformResult('failed', {

package/dist/lib/platform/pr-change-report.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
+import { escapeHtmlText } from './comment-safety.js';
 const REPORT_FILE_NAME = 'pr-change-report.json';
 const REPORT_VERSION = 1;
 const CANONICAL_REPORT_PLACEHOLDER = '<!-- canonical-pr-change-report -->';
@@ -429,21 +430,14 @@ const MAX_REPRESENTATIVE_FILES = 3;
 function representativePath(file) {
     return file.newPath || file.oldPath || '';
 }
-function escapeHtml(value) {
-    return value
-        .replaceAll('&', '&amp;')
-        .replaceAll('<', '&lt;')
-        .replaceAll('>', '&gt;')
-        .replaceAll('"', '&quot;')
-        .replaceAll("'", '&#39;')
-        .replaceAll('\r', '\\r')
-        .replaceAll('\n', '\\n');
+function escapeReportText(value) {
+    return escapeHtmlText(value).replaceAll('\r', '\\r').replaceAll('\n', '\\n');
 }
 function renderRepresentativePath(file) {
     const paths = file.oldPath && file.newPath && file.oldPath !== file.newPath
         ? [file.oldPath, file.newPath]
         : [representativePath(file)];
-    return paths.map((filePath) => `<code>${escapeHtml(filePath)}</code>`).join(' → ');
+    return paths.map((filePath) => `<code>${escapeReportText(filePath)}</code>`).join(' → ');
 }
 function representativeScore(file, metric) {
     return metric === 'lines' ? file.additions + file.deletions : Math.abs(file.netBytes);
@@ -492,11 +486,11 @@ function renderEvidence(evidence) {
                 ? `:${evidence.startLine}`
                 : `:${evidence.startLine}-${evidence.endLine}`
             : `:${evidence.startLine ?? evidence.endLine}`;
-    return `  - 证据：<code>${escapeHtml(evidence.path)}</code>${location}：${escapeHtml(evidence.detail)}`;
+    return `  - 证据：<code>${escapeReportText(evidence.path)}</code>${location}：${escapeReportText(evidence.detail)}`;
 }
 function renderPrechecks(checks) {
     return checks.flatMap((check) => [
-        `- **${PRECHECK_LABELS[check.id]}（${check.id}）**：${check.verdict === 'pass' ? '通过' : '需复核'}。${escapeHtml(check.rationale)}`,
+        `- **${PRECHECK_LABELS[check.id]}（${check.id}）**：${check.verdict === 'pass' ? '通过' : '需复核'}。${escapeReportText(check.rationale)}`,
         ...check.evidence.slice(0, 1).map(renderEvidence)
     ]);
 }

package/dist/lib/platform/pr-summary.js

@@ -8,18 +8,15 @@ import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-exec
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { normalizeCommentContent } from './issue-comments.js';
+import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.js';
-import { buildPrChangeReport, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
+import { buildPrChangeReport, CANONICAL_REPORT_PLACEHOLDER, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
 function summaryMarker(taskId) {
     return `<!-- sync-pr:${taskId}:summary -->`;
 }
 function escapeSummaryAuditText(value) {
-    return value
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/\r\n?/g, '\n');
+    return escapeHtmlText(value).replace(/\r\n?/g, '\n');
 }
 function renderSummaryAuditLine(value) {
     const safe = escapeSummaryAuditText(value);
@@ -476,7 +473,31 @@ async function syncPullRequestSummary(taskRef, options) {
             const checked = currentReportCheck(report.value, initial.value, taskContent, resolved.repoRoot);
             if (!checked.ok)
                 return fail('failed', context, checked.error);
-            const replaced = replaceCanonicalReportPlaceholder(options.body, report.value);
+            const placeholder = CANONICAL_REPORT_PLACEHOLDER;
+            const split = splitDocumentPlaceholder(options.body, placeholder);
+            if (!split.ok)
+                return fail('failed', context, {
+                    code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+                    message: split.error.message,
+                    retryable: false
+                });
+            const prefix = sanitizeMarkdownDocument(split.value.prefix, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+            const suffix = sanitizeMarkdownDocument(split.value.suffix, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+            if (!prefix.ok) {
+                return fail('failed', context, {
+                    code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+                    message: `${prefix.error.message} at offset ${prefix.error.offset}`,
+                    retryable: false
+                });
+            }
+            if (!suffix.ok) {
+                return fail('failed', context, {
+                    code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+                    message: `${suffix.error.message} at offset ${suffix.error.offset}`,
+                    retryable: false
+                });
+            }
+            const replaced = replaceCanonicalReportPlaceholder(`${prefix.value}${placeholder}${suffix.value}`, report.value);
             if (!replaced.ok)
                 return fail('failed', context, platformError(replaced.error));
             const desired = buildPullRequestSummary(resolved.taskId, replaced.value, initial.value.head.sha, renderHumanOverrideAudit(taskContent));

package/dist/lib/platform/provider-contract.d.ts

@@ -15,6 +15,7 @@ type ProviderResult<T> = {
 } | {
     ok: false;
     error: PlatformError;
+    value?: T;
 };
 type ProviderOperationContext = {
     repositoryRoot: string;
@@ -172,6 +173,35 @@ type MutationReceipt = {
     changed: boolean;
     operationId?: string;
 };
+type SecurityAlertKind = 'dependabot' | 'code-scanning';
+type SecurityAlertSnapshot = {
+    kind: SecurityAlertKind;
+    number: number;
+    state: string;
+    data: JsonValue;
+};
+type LabelDefinition = {
+    name: string;
+    color: string;
+    description: string;
+};
+type LabelReconciliation = {
+    changed: boolean;
+    created: string[];
+    updated: string[];
+    removed: string[];
+    skipped: string[];
+};
+type MilestoneDefinition = {
+    title: string;
+    description: string;
+    state: 'open' | 'closed';
+};
+type MilestoneInitialization = {
+    changed: boolean;
+    created: string[];
+    skipped: string[];
+};
 type RepositoryMetadataSnapshot = {
     repository: {
         identity: ResourceIdentity;
@@ -334,6 +364,14 @@ type PlatformProvider = {
             context: ProviderOperationContext;
             target: ResourceIdentity;
         }): Promise<ProviderResult<ChangeRequestSnapshot>>;
+        listFiles?(input: {
+            context: ProviderOperationContext;
+            target: ResourceIdentity;
+        }): Promise<ProviderResult<string[]>>;
+        listClosingIssues?(input: {
+            context: ProviderOperationContext;
+            target: ResourceIdentity;
+        }): Promise<ProviderResult<ResourceIdentity[]>>;
         listClosing(input: {
             context: ProviderOperationContext;
             issue: ResourceIdentity;
@@ -468,6 +506,34 @@ type PlatformProvider = {
             historyLimit: number;
         }): Promise<ProviderResult<ReleaseNotesFacts>>;
     };
+    securityAlerts?: {
+        inspect(input: {
+            context: ProviderOperationContext;
+            kind: SecurityAlertKind;
+            number: number;
+        }): Promise<ProviderResult<SecurityAlertSnapshot>>;
+        dismiss(input: {
+            context: ProviderOperationContext;
+            kind: SecurityAlertKind;
+            number: number;
+            reason: string;
+            comment: string;
+            mutation: MutationIdentity;
+        }): Promise<ProviderResult<MutationReceipt>>;
+    };
+    repositoryMetadata?: {
+        reconcileLabels(input: {
+            context: ProviderOperationContext;
+            desired: LabelDefinition[];
+            cleanupStaleIn: boolean;
+            mutation: MutationIdentity;
+        }): Promise<ProviderResult<LabelReconciliation>>;
+        reconcileMilestones(input: {
+            context: ProviderOperationContext;
+            desired: MilestoneDefinition[];
+            mutation: MutationIdentity;
+        }): Promise<ProviderResult<MilestoneInitialization>>;
+    };
     verification?: {
         fetchRemoteFacts(input: {
             context: ProviderOperationContext;
@@ -484,4 +550,4 @@ declare const PLATFORM_PROVIDER_CONTRACT_VERSION: 1;
 declare function isPlatformProviderFactory(value: unknown): value is PlatformProviderFactory;
 declare function validatePlatformProvider(value: unknown, providerType: string): ProviderResult<PlatformProvider>;
 export { PLATFORM_PROVIDER_CONTRACT_VERSION, isPlatformProviderFactory, validatePlatformProvider };
-export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, PlatformError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ResourceIdentity, ReviewSnapshot, VerificationRemoteFacts };
+export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MilestoneDefinition, MilestoneInitialization, LabelDefinition, LabelReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, PlatformError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ResourceIdentity, SecurityAlertKind, SecurityAlertSnapshot, ReviewSnapshot, VerificationRemoteFacts };

package/dist/lib/platform/provider-contract.js

@@ -7,12 +7,14 @@ function isPlatformProviderFactory(value) {
 }
 function validatePlatformProvider(value, providerType) {
     const operationGroups = {
-        issues: { required: ['inspect', 'create', 'update', 'describeRepository'], optional: [] },
+        issues: { required: ['inspect', 'create', 'update', 'describeRepository'], optional: ['listLabels', 'listMilestones'] },
         comments: { required: ['list', 'write', 'delete'], optional: [] },
-        changeRequests: { required: ['inspect', 'listClosing', 'create', 'update', 'resolveGitEvidence'], optional: ['verifyHead'] },
+        changeRequests: { required: ['inspect', 'listClosing', 'create', 'update', 'resolveGitEvidence'], optional: ['verifyHead', 'listFiles', 'listClosingIssues'] },
         checks: { required: ['inspectRequired', 'resolveRun', 'fetchLogs'], optional: [] },
         reviews: { required: ['list', 'publish'], optional: [] },
         releases: { required: ['inspect', 'create', 'update', 'reconcileMilestones', 'publishNotes', 'collectNotes'], optional: [] },
+        securityAlerts: { required: ['inspect', 'dismiss'], optional: [] },
+        repositoryMetadata: { required: ['reconcileLabels', 'reconcileMilestones'], optional: [] },
         verification: { required: ['fetchRemoteFacts'], optional: [] }
     };
     const resourceKindsByGroup = {
@@ -22,6 +24,8 @@ function validatePlatformProvider(value, providerType) {
         checks: ['pull-request'],
         reviews: ['pull-request'],
         releases: ['release', 'issue', 'pull-request'],
+        securityAlerts: [],
+        repositoryMetadata: [],
         verification: ['issue', 'pull-request']
     };
     if (!isRecord(value)

package/dist/lib/platform/provider-validation.js

@@ -250,6 +250,64 @@ function validateReceipt(value) {
         ...(item.operationId === undefined ? {} : { operationId: stringValue(item.operationId, 'receipt.operationId') })
     };
 }
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error(`${label} must be a positive integer`);
+    return value;
+}
+function validateSecurityAlert(value) {
+    const item = record(value, 'security alert');
+    exactKeys(item, ['kind', 'number', 'state', 'data'], 'security alert');
+    if (item.kind !== 'dependabot' && item.kind !== 'code-scanning')
+        throw new Error('security alert.kind is invalid');
+    return {
+        kind: item.kind,
+        number: positiveInteger(item.number, 'security alert.number'),
+        state: stringValue(item.state, 'security alert.state'),
+        data: jsonValue(item.data, 'security alert.data')
+    };
+}
+function validateLabelDefinition(value, label) {
+    const item = record(value, label);
+    exactKeys(item, ['name', 'color', 'description'], label);
+    return {
+        name: stringValue(item.name, `${label}.name`),
+        color: stringValue(item.color, `${label}.color`),
+        description: stringValue(item.description, `${label}.description`, true)
+    };
+}
+function validateLabelReconciliation(value) {
+    const item = record(value, 'label reconciliation');
+    exactKeys(item, ['changed', 'created', 'updated', 'removed', 'skipped'], 'label reconciliation');
+    const names = (field) => arrayValue(item[field], `label reconciliation.${field}`).map((entry) => stringValue(entry, `${field}[]`));
+    return {
+        changed: booleanValue(item.changed, 'label reconciliation.changed'),
+        created: names('created'),
+        updated: names('updated'),
+        removed: names('removed'),
+        skipped: names('skipped')
+    };
+}
+function validateMilestoneDefinition(value, label) {
+    const item = record(value, label);
+    exactKeys(item, ['title', 'description', 'state'], label);
+    if (item.state !== 'open' && item.state !== 'closed')
+        throw new Error(`${label}.state is invalid`);
+    return {
+        title: stringValue(item.title, `${label}.title`),
+        description: stringValue(item.description, `${label}.description`, true),
+        state: item.state
+    };
+}
+function validateMilestoneInitialization(value) {
+    const item = record(value, 'milestone initialization');
+    exactKeys(item, ['changed', 'created', 'skipped'], 'milestone initialization');
+    return {
+        changed: booleanValue(item.changed, 'milestone initialization.changed'),
+        created: arrayValue(item.created, 'milestone initialization.created').map((entry) => stringValue(entry, 'created[]')),
+        skipped: arrayValue(item.skipped, 'milestone initialization.skipped').map((entry) => stringValue(entry, 'skipped[]'))
+    };
+}
 function validateMetadata(value) {
     const item = record(value, 'repository metadata');
     exactKeys(item, ['repository', 'labels', 'milestones', 'issueTypes', 'fields'], 'repository metadata');
@@ -352,6 +410,11 @@ const PROVIDER_ERROR_CATALOG = {
     ISSUE_NUMBER_INVALID: { message: 'The issue number is invalid', retryable: false },
     ISSUE_CREATE_RESPONSE_INVALID: { message: 'Issue creation returned an invalid response', retryable: false },
     COMMENT_ID_INVALID: { message: 'The comment identity is invalid', retryable: false },
+    SECURITY_KIND_INVALID: { message: 'The security alert kind is invalid', retryable: false },
+    SECURITY_NUMBER_INVALID: { message: 'The security alert number is invalid', retryable: false },
+    SECURITY_RESPONSE_INVALID: { message: 'The platform returned an invalid security alert', retryable: false },
+    LABEL_RESPONSE_INVALID: { message: 'The platform returned an invalid label response', retryable: false },
+    MILESTONE_RESPONSE_INVALID: { message: 'The platform returned an invalid milestone response', retryable: false },
     MILESTONE_IDENTITY_INVALID: { message: 'The milestone identity is invalid', retryable: false },
     CHECK_RUN_NOT_FOUND: { message: 'The check run was not found', retryable: false },
     RELEASE_NOTES_AUTHORS_TRUNCATED: { message: 'Release note commit authors exceeded the supported limit', retryable: false },
@@ -390,6 +453,8 @@ function validators(providerType, declaration) {
             return { sha: stringValue(item.sha, 'change request head.sha') };
         },
         'changeRequests.inspect': (value) => validateChangeRequest(value, declaredIdentityKind(declaration, 'pull-request'), true),
+        'changeRequests.listFiles': (value) => arrayValue(value, 'pull request files').map((entry) => stringValue(entry, 'pull request files[]')),
+        'changeRequests.listClosingIssues': (value) => arrayValue(value, 'closing issues').map((entry) => identity(entry, 'closing issues[]', declaredIdentityKind(declaration, 'issue'))),
         'changeRequests.listClosing': (value) => arrayValue(value, 'changeRequests').map((entry) => validateChangeRequest(entry, declaredIdentityKind(declaration, 'pull-request'), true)),
         'changeRequests.create': validateReceipt,
         'changeRequests.update': validateReceipt,
@@ -433,6 +498,10 @@ function validators(providerType, declaration) {
         },
         'releases.publishNotes': validateReceipt,
         'releases.collectNotes': (value) => validateReleaseNotes(value, declaration),
+        'securityAlerts.inspect': validateSecurityAlert,
+        'securityAlerts.dismiss': validateReceipt,
+        'repositoryMetadata.reconcileLabels': validateLabelReconciliation,
+        'repositoryMetadata.reconcileMilestones': validateMilestoneInitialization,
         'verification.fetchRemoteFacts': (value) => {
             const item = record(value, 'verification facts');
             exactKeys(item, ['issue', 'comments', 'changeRequest', 'commit', 'fields'], 'verification facts');
@@ -462,12 +531,16 @@ async function invokeProviderOperation(providerType, operation, call, validate)
         }
         if (envelope.ok === false && envelope.error && typeof envelope.error === 'object' && !Array.isArray(envelope.error)) {
             try {
-                exactKeys(envelope, ['ok', 'error'], `${operation} result`);
+                exactKeys(envelope, Object.hasOwn(envelope, 'value') ? ['ok', 'error', 'value'] : ['ok', 'error'], `${operation} result`);
                 const error = envelope.error;
                 exactKeys(error, ['code', 'message', 'retryable'], `${operation} error`);
                 if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message || typeof error.retryable !== 'boolean')
                     throw new Error('invalid provider error');
-                return { ok: false, error: safeProviderError(providerType, operation, error) };
+                return {
+                    ok: false,
+                    error: safeProviderError(providerType, operation, error),
+                    ...(Object.hasOwn(envelope, 'value') ? { value: validate(envelope.value) } : {})
+                };
             }
             catch {
                 return { ok: false, error: validationError(providerType, operation, 'Provider operation returned an invalid error') };
@@ -483,7 +556,7 @@ function wrapProviderOperations(provider) {
     const map = validators(provider.type, provider.identity);
     const wrapped = { ...provider, context: { ...provider.context } };
     wrapped.context.resolve = (input) => invokeProviderOperation(provider.type, 'context.resolve', () => provider.context.resolve(input), map['context.resolve']);
-    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'verification']) {
+    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'securityAlerts', 'repositoryMetadata', 'verification']) {
         const group = provider[groupName];
         if (!group)
             continue;