@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/dist/lib/platform/repository-metadata.js

@@ -0,0 +1,377 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolvePlatformProviderContext } from './context.js';
+import { providerError, providerOperationContext, providerStatus } from './provider-bridge.js';
+import { platformResult } from './types.js';
+const COMMON_LABELS = [
+    { name: 'type: bug', color: 'DED6F9', description: 'A general bug' },
+    { name: 'type: enhancement', color: 'DED6F9', description: 'A general enhancement' },
+    { name: 'type: feature', color: 'DED6F9', description: 'A general feature' },
+    { name: 'type: documentation', color: 'DED6F9', description: 'A documentation task' },
+    { name: 'type: dependency-upgrade', color: 'DED6F9', description: 'A dependency upgrade' },
+    { name: 'type: task', color: 'DED6F9', description: 'A general task' },
+    { name: 'status: waiting-for-triage', color: 'FCF1C4', description: "An issue we've not yet triaged or decided on" },
+    { name: 'status: waiting-for-feedback', color: 'FCF1C4', description: 'We need additional information before we can continue' },
+    { name: 'status: feedback-provided', color: 'FCF1C4', description: 'Feedback has been provided' },
+    { name: 'status: feedback-reminder', color: 'FCF1C4', description: "We've sent a reminder that we need additional information before we can continue" },
+    { name: 'status: pending-design-work', color: 'FCF1C4', description: 'Needs design work before any code can be developed' },
+    { name: 'status: in-progress', color: 'FCF1C4', description: 'Work is actively being developed' },
+    { name: 'status: on-hold', color: 'FCF1C4', description: "We can't start working on this issue yet" },
+    { name: 'status: blocked', color: 'FCF1C4', description: "An issue that's blocked on an external project change" },
+    { name: 'status: declined', color: 'FCF1C4', description: "A suggestion or change that we don't feel we should currently apply" },
+    { name: 'status: duplicate', color: 'FCF1C4', description: 'A duplicate of another issue' },
+    { name: 'status: invalid', color: 'FCF1C4', description: "An issue that we don't feel is valid" },
+    { name: 'status: superseded', color: 'FCF1C4', description: 'An issue that has been superseded by another' },
+    { name: 'status: bulk-closed', color: 'FCF1C4', description: "An outdated, unresolved issue that's closed in bulk as part of a cleaning process" },
+    { name: 'status: ideal-for-contribution', color: 'FCF1C4', description: 'An issue that a contributor can help us with' },
+    { name: 'status: backported', color: 'FCF1C4', description: 'An issue that has been backported to maintenance branches' },
+    { name: 'status: waiting-for-internal-feedback', color: 'FCF1C4', description: 'An issue that needs input from a member or another team' },
+    { name: 'good first issue', color: 'F9D9E6', description: 'Good for newcomers' },
+    { name: 'help wanted', color: '008672', description: 'Extra attention is needed' },
+    { name: 'dependencies', color: '0366D6', description: 'Pull requests that update a dependency file' }
+];
+function validIdentifiers(value, prerelease) {
+    if (!value)
+        return false;
+    return value.split('.').every((identifier) => /^[0-9A-Za-z-]+$/.test(identifier)
+        && (!prerelease || !/^\d+$/.test(identifier) || /^(0|[1-9]\d*)$/.test(identifier)));
+}
+function parseVersionTag(tag) {
+    if (!tag.startsWith('v'))
+        return null;
+    let version = tag.slice(1);
+    const plusAt = version.indexOf('+');
+    if (plusAt >= 0) {
+        const build = version.slice(plusAt + 1);
+        if (!validIdentifiers(build, false))
+            return null;
+        version = version.slice(0, plusAt);
+    }
+    let prerelease = '';
+    const dashAt = version.indexOf('-');
+    if (dashAt >= 0) {
+        prerelease = version.slice(dashAt + 1);
+        if (!validIdentifiers(prerelease, true))
+            return null;
+        version = version.slice(0, dashAt);
+    }
+    const core = version.split('.');
+    if (core.length !== 3 || !core.every((part) => /^(0|[1-9]\d*)$/.test(part)))
+        return null;
+    return { tag, major: core[0], minor: core[1], patch: core[2], prerelease };
+}
+function compareDecimal(left, right) {
+    if (left.length !== right.length)
+        return left.length > right.length ? 1 : -1;
+    if (left === right)
+        return 0;
+    return left > right ? 1 : -1;
+}
+function compareAscii(left, right) {
+    const alphabet = '+-.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+    const limit = Math.min(left.length, right.length);
+    for (let index = 0; index < limit; index += 1) {
+        const leftRank = alphabet.indexOf(left[index]);
+        const rightRank = alphabet.indexOf(right[index]);
+        if (leftRank !== rightRank)
+            return leftRank > rightRank ? 1 : -1;
+    }
+    if (left.length === right.length)
+        return 0;
+    return left.length > right.length ? 1 : -1;
+}
+function comparePrerelease(left, right) {
+    if (!left || !right) {
+        if (left === right)
+            return 0;
+        return left ? -1 : 1;
+    }
+    const leftIds = left.split('.');
+    const rightIds = right.split('.');
+    const limit = Math.min(leftIds.length, rightIds.length);
+    for (let index = 0; index < limit; index += 1) {
+        const leftId = leftIds[index];
+        const rightId = rightIds[index];
+        const leftNumeric = /^\d+$/.test(leftId);
+        const rightNumeric = /^\d+$/.test(rightId);
+        const comparison = leftNumeric && rightNumeric
+            ? compareDecimal(leftId, rightId)
+            : leftNumeric !== rightNumeric
+                ? leftNumeric ? -1 : 1
+                : compareAscii(leftId, rightId);
+        if (comparison !== 0)
+            return comparison;
+    }
+    if (leftIds.length === rightIds.length)
+        return 0;
+    return leftIds.length > rightIds.length ? 1 : -1;
+}
+function compareVersions(left, right) {
+    for (const [leftPart, rightPart] of [
+        [left.major, right.major],
+        [left.minor, right.minor],
+        [left.patch, right.patch]
+    ]) {
+        const comparison = compareDecimal(leftPart, rightPart);
+        if (comparison !== 0)
+            return comparison;
+    }
+    const prerelease = comparePrerelease(left.prerelease, right.prerelease);
+    return prerelease !== 0 ? prerelease : compareAscii(left.tag, right.tag);
+}
+function incrementDecimal(value) {
+    const digits = value.split('');
+    let carry = 1;
+    for (let index = digits.length - 1; index >= 0 && carry; index -= 1) {
+        const next = Number(digits[index]) + carry;
+        digits[index] = String(next % 10);
+        carry = next === 10 ? 1 : 0;
+    }
+    return carry ? `1${digits.join('')}` : digits.join('');
+}
+function buildMilestonePlan(tags, history) {
+    const parsed = tags.flatMap((tag) => {
+        const version = parseVersionTag(tag);
+        return version ? [version] : [];
+    });
+    const selected = parsed.reduce((best, candidate) => !best || compareVersions(candidate, best) > 0 ? candidate : best, null);
+    const baseline = selected
+        ? { version: `${selected.major}.${selected.minor}.${selected.patch}`, source: `git tag ${selected.tag}` }
+        : { version: '0.1.0', source: 'compatibility default' };
+    const [major, minor, patch] = baseline.version.split('.');
+    const desired = [];
+    const titles = new Set();
+    const add = (title, description, state) => {
+        if (titles.has(title))
+            return;
+        titles.add(title);
+        desired.push({ title, description, state });
+    };
+    const line = `${major}.${minor}.x`;
+    const version = selected
+        ? `${major}.${minor}.${incrementDecimal(patch)}`
+        : baseline.version;
+    add('General Backlog', 'All unsorted backlogged tasks may be completed in a future version.', 'open');
+    add(line, `Issues that we want to resolve in ${major}.${minor} line.`, 'open');
+    add(version, `Issues that we want to release in v${version}.`, 'open');
+    if (patch === '0') {
+        const nextMinor = `${major}.${incrementDecimal(minor)}.0`;
+        const nextLine = `${major}.${incrementDecimal(minor)}.x`;
+        add(nextMinor, `Issues that we want to release in v${nextMinor}.`, 'open');
+        add(nextLine, `Issues that we want to resolve in ${major}.${incrementDecimal(minor)} line.`, 'open');
+    }
+    if (history) {
+        for (const historical of parsed) {
+            const historicalVersion = `${historical.major}.${historical.minor}.${historical.patch}`;
+            add(`${historical.major}.${historical.minor}.x`, `Issues that we want to resolve in ${historical.major}.${historical.minor} line.`, 'open');
+            add(historicalVersion, `Issues that we want to release in v${historicalVersion}.`, 'closed');
+        }
+    }
+    return { baseline, history, desired };
+}
+function buildLabelDefinitions(config) {
+    const labels = config && typeof config === 'object' && !Array.isArray(config)
+        ? config.labels
+        : undefined;
+    const mapping = labels && typeof labels === 'object' && !Array.isArray(labels)
+        ? labels.in
+        : undefined;
+    if (mapping === undefined)
+        return [...COMMON_LABELS];
+    if (!mapping || typeof mapping !== 'object' || Array.isArray(mapping))
+        throw new Error('labels.in must be an object');
+    const dynamic = Object.keys(mapping).sort().map((key) => {
+        if (!key || /[\r\n\t]/.test(key))
+            throw new Error('labels.in keys must be non-empty single-line values');
+        return { name: `in: ${key}`, color: 'BFD4F2', description: `Module label for ${key}` };
+    });
+    return [...COMMON_LABELS, ...dynamic];
+}
+function configAt(root) {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(root, '.agents', '.airc.json'), 'utf8'));
+    }
+    catch {
+        return {};
+    }
+}
+function baseResult(status, context, extra = {}) {
+    return {
+        ...platformResult(status, {
+            platform: context.platform,
+            capabilities: context.capabilities,
+            operations: context.operations,
+            error: context.error
+        }),
+        ...extra
+    };
+}
+function unsupported(providerType, operation) {
+    return {
+        code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
+        message: `Platform '${providerType}' does not provide ${operation}`,
+        retryable: false
+    };
+}
+function operationStatus(changed) {
+    return changed ? 'applied' : 'no-op';
+}
+function errorStatus(error) {
+    return error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED' ? 'degraded' : providerStatus(error);
+}
+function initialLabelsResult(context, labels) {
+    return baseResult('degraded', context, {
+        operation: 'init-labels',
+        labels: {
+            commonCount: COMMON_LABELS.length,
+            inCount: labels.filter((item) => item.name.startsWith('in:')).length,
+            created: [], updated: [], removed: [], skipped: []
+        },
+        error: context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Label initialization is unavailable', retryable: false }
+    });
+}
+function initialMilestonesResult(context, history) {
+    return baseResult('degraded', context, {
+        operation: 'init-milestones',
+        milestones: { baseline: null, history, desired: [], created: [], skipped: [] },
+        error: context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Milestone initialization is unavailable', retryable: false }
+    });
+}
+function labelsFromReconciliation(initial, value) {
+    if (!value)
+        return initial.labels;
+    return {
+        ...initial.labels,
+        created: value.created,
+        updated: value.updated,
+        removed: value.removed,
+        skipped: value.skipped
+    };
+}
+function milestonesFromInitialization(initial, value) {
+    if (!value)
+        return initial.milestones;
+    return {
+        ...initial.milestones,
+        created: value.created,
+        skipped: value.skipped
+    };
+}
+function usableContext(loaded) {
+    return loaded.ok && Boolean(loaded.value.context.platform.repository);
+}
+async function initializeLabels(input = {}, options = {}) {
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    let definitions;
+    try {
+        definitions = buildLabelDefinitions(loaded.ok ? configAt(loaded.value.repositoryRoot) : {});
+    }
+    catch (error) {
+        return {
+            ...initialLabelsResult(context, []),
+            status: 'failed',
+            error: { code: 'LABEL_CONFIG_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
+    }
+    const initial = initialLabelsResult(context, definitions);
+    if (!usableContext(loaded))
+        return { ...initial, error: initial.error || context.error };
+    const operation = loaded.value.provider.repositoryMetadata?.reconcileLabels;
+    if (!operation)
+        return { ...initial, error: unsupported(loaded.value.provider.type, 'repositoryMetadata.reconcileLabels') };
+    const reconciled = await operation({
+        context: providerOperationContext(loaded.value),
+        desired: definitions,
+        cleanupStaleIn: input.cleanupStaleIn === true,
+        mutation: { idempotencyKey: 'labels:init' }
+    });
+    if (!reconciled.ok)
+        return {
+            ...initial,
+            status: errorStatus(reconciled.error),
+            changed: reconciled.value?.changed || false,
+            operations: [{ name: 'reconcile-labels', status: 'failed', reasonCode: reconciled.error.code }],
+            labels: labelsFromReconciliation(initial, reconciled.value),
+            error: providerError(reconciled.error, 'LABEL_INITIALIZATION_FAILED')
+        };
+    return {
+        ...initial,
+        status: operationStatus(reconciled.value.changed),
+        changed: reconciled.value.changed,
+        operations: [{ name: 'reconcile-labels', status: operationStatus(reconciled.value.changed), reasonCode: null }],
+        labels: {
+            commonCount: COMMON_LABELS.length,
+            inCount: definitions.length - COMMON_LABELS.length,
+            created: reconciled.value.created,
+            updated: reconciled.value.updated,
+            removed: reconciled.value.removed,
+            skipped: reconciled.value.skipped
+        },
+        error: null
+    };
+}
+function gitTags(cwd) {
+    const output = execFileSync('git', ['tag', '--list', 'v*'], { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+    return output ? output.split(/\r?\n/).filter(Boolean) : [];
+}
+async function initializeMilestones(input = {}, options = {}) {
+    const history = input.history === true;
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    const initial = initialMilestonesResult(context, history);
+    if (!usableContext(loaded))
+        return initial;
+    let plan;
+    try {
+        plan = buildMilestonePlan(gitTags(loaded.value.workingDirectory), history);
+    }
+    catch (error) {
+        return {
+            ...initial,
+            status: 'failed',
+            error: { code: 'MILESTONE_TAG_DISCOVERY_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false }
+        };
+    }
+    const operation = loaded.value.provider.repositoryMetadata?.reconcileMilestones;
+    if (!operation)
+        return {
+            ...initial,
+            milestones: { ...initial.milestones, baseline: plan.baseline, history, desired: plan.desired.map((item) => item.title) },
+            error: unsupported(loaded.value.provider.type, 'repositoryMetadata.reconcileMilestones')
+        };
+    const reconciled = await operation({
+        context: providerOperationContext(loaded.value),
+        desired: plan.desired,
+        mutation: { idempotencyKey: `milestones:init:${plan.baseline.version}:${history}` }
+    });
+    if (!reconciled.ok)
+        return {
+            ...initial,
+            status: errorStatus(reconciled.error),
+            changed: reconciled.value?.changed || false,
+            operations: [{ name: 'reconcile-milestones', status: 'failed', reasonCode: reconciled.error.code }],
+            milestones: milestonesFromInitialization({
+                ...initial,
+                milestones: { ...initial.milestones, baseline: plan.baseline, history, desired: plan.desired.map((item) => item.title) }
+            }, reconciled.value),
+            error: providerError(reconciled.error, 'MILESTONE_INITIALIZATION_FAILED')
+        };
+    return {
+        ...initial,
+        status: operationStatus(reconciled.value.changed),
+        changed: reconciled.value.changed,
+        operations: [{ name: 'reconcile-milestones', status: operationStatus(reconciled.value.changed), reasonCode: null }],
+        milestones: {
+            baseline: plan.baseline,
+            history,
+            desired: plan.desired.map((item) => item.title),
+            created: reconciled.value.created,
+            skipped: reconciled.value.skipped
+        },
+        error: null
+    };
+}
+export { buildLabelDefinitions, buildMilestonePlan, initializeLabels, initializeMilestones };
+//# sourceMappingURL=repository-metadata.js.map

package/dist/lib/platform/security-alerts.js

@@ -0,0 +1,155 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolvePlatformProviderContext } from './context.js';
+import { providerError, providerOperationContext, providerStatus } from './provider-bridge.js';
+import { platformResult } from './types.js';
+function baseResult(operation, status, context, overrides = {}) {
+    return {
+        ...platformResult(status, {
+            platform: context.platform,
+            capabilities: context.capabilities,
+            operations: context.operations,
+            error: context.error,
+            changed: false
+        }),
+        operation,
+        alert: null,
+        data: null,
+        ...overrides
+    };
+}
+function unsupported(providerType) {
+    return {
+        code: 'PLATFORM_CAPABILITY_UNSUPPORTED',
+        message: `Platform '${providerType}' does not provide securityAlerts`,
+        retryable: false
+    };
+}
+function resultStatus(error) {
+    return error.code === 'PLATFORM_CAPABILITY_UNSUPPORTED' ? 'degraded' : providerStatus(error);
+}
+function validKind(value) {
+    return value === 'dependabot' || value === 'code-scanning';
+}
+function validNumber(value) {
+    return Number.isSafeInteger(value) && value > 0;
+}
+function unavailable(operation, context, error) {
+    const status = context.status === 'blocked' || context.status === 'failed' ? context.status : 'degraded';
+    return baseResult(operation, status, context, {
+        error: error || context.error || { code: 'PLATFORM_CAPABILITY_UNSUPPORTED', message: 'Security alert operations are unavailable', retryable: false }
+    });
+}
+async function readSecurityAlert(input, options = {}) {
+    if (!validKind(input.kind))
+        return baseResult('read', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_KIND_INVALID', message: 'Alert kind must be dependabot or code-scanning', retryable: false }
+        });
+    if (!validNumber(input.number))
+        return baseResult('read', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_NUMBER_INVALID', message: 'Alert number must be a positive integer', retryable: false }
+        });
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    if (!loaded.ok || !context.platform.repository)
+        return unavailable('read', context);
+    const inspect = loaded.value.provider.securityAlerts?.inspect;
+    if (!inspect)
+        return unavailable('read', context, unsupported(loaded.value.provider.type));
+    const result = await inspect({ context: providerOperationContext(loaded.value), kind: input.kind, number: input.number });
+    if (!result.ok)
+        return {
+            ...baseResult('read', resultStatus(result.error), context),
+            error: providerError(result.error, 'SECURITY_ALERT_READ_FAILED')
+        };
+    return {
+        ...baseResult('read', 'applied', context, {
+            alert: result.value,
+            data: result.value.data,
+            operations: [{ name: 'inspect-alert', status: 'applied', reasonCode: null }]
+        }),
+        changed: false,
+        error: null
+    };
+}
+async function dismissSecurityAlert(input, options = {}) {
+    if (!validKind(input.kind))
+        return baseResult('dismiss', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_KIND_INVALID', message: 'Alert kind must be dependabot or code-scanning', retryable: false }
+        });
+    if (!validNumber(input.number))
+        return baseResult('dismiss', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_NUMBER_INVALID', message: 'Alert number must be a positive integer', retryable: false }
+        });
+    if (!input.reason || typeof input.comment !== 'string')
+        return baseResult('dismiss', 'failed', platformResult('failed'), {
+            error: { code: 'SECURITY_DISMISS_INPUT_INVALID', message: 'Dismissal reason and comment are required', retryable: false }
+        });
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client, platformType: options.platformType });
+    const context = loaded.ok ? loaded.value.context : loaded.context;
+    if (!loaded.ok || !context.platform.repository)
+        return unavailable('dismiss', context);
+    const inspect = loaded.value.provider.securityAlerts?.inspect;
+    const dismiss = loaded.value.provider.securityAlerts?.dismiss;
+    if (!inspect || !dismiss)
+        return unavailable('dismiss', context, unsupported(loaded.value.provider.type));
+    const current = await inspect({ context: providerOperationContext(loaded.value), kind: input.kind, number: input.number });
+    if (!current.ok)
+        return {
+            ...baseResult('dismiss', resultStatus(current.error), context),
+            error: providerError(current.error, 'SECURITY_ALERT_READ_FAILED')
+        };
+    if (current.value.state === 'dismissed' || current.value.state === 'fixed')
+        return {
+            ...baseResult('dismiss', 'no-op', context, {
+                alert: current.value,
+                data: current.value.data,
+                operations: [{ name: 'inspect-alert', status: 'no-op', reasonCode: 'ALREADY_CLOSED' }]
+            }),
+            error: null
+        };
+    if (current.value.state !== 'open')
+        return {
+            ...baseResult('dismiss', 'failed', context, {
+                alert: current.value,
+                data: current.value.data,
+                operations: [{ name: 'inspect-alert', status: 'failed', reasonCode: 'INVALID_STATE' }]
+            }),
+            error: { code: 'SECURITY_RESPONSE_INVALID', message: 'The platform returned an alert without a valid state', retryable: false }
+        };
+    const changed = await dismiss({
+        context: providerOperationContext(loaded.value),
+        kind: input.kind,
+        number: input.number,
+        reason: input.reason,
+        comment: input.comment,
+        mutation: { idempotencyKey: `security-alert:dismiss:${input.kind}:${input.number}` }
+    });
+    if (!changed.ok)
+        return {
+            ...baseResult('dismiss', resultStatus(changed.error), context, {
+                alert: current.value,
+                data: current.value.data,
+                operations: [{ name: 'dismiss-alert', status: 'failed', reasonCode: null }]
+            }),
+            error: providerError(changed.error, 'SECURITY_ALERT_DISMISS_FAILED')
+        };
+    return {
+        ...baseResult('dismiss', changed.value.changed ? 'applied' : 'no-op', context, {
+            operations: [{ name: 'dismiss-alert', status: changed.value.changed ? 'applied' : 'no-op', reasonCode: null }]
+        }),
+        changed: changed.value.changed,
+        error: null
+    };
+}
+function readCommentFile(commentFile, cwd = process.cwd()) {
+    try {
+        const requested = path.resolve(cwd, commentFile);
+        return { ok: true, value: fs.readFileSync(requested, 'utf8') };
+    }
+    catch {
+        return { ok: false, error: { code: 'SECURITY_DISMISS_INPUT_INVALID', message: 'Dismissal comment file could not be read', retryable: false } };
+    }
+}
+export { dismissSecurityAlert, readCommentFile, readSecurityAlert };
+//# sourceMappingURL=security-alerts.js.map

package/dist/lib/platform/verification-sync.js

@@ -6,9 +6,7 @@ import { resolvePlatformProviderContext } from "./context.js";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.js";
 import { requirementSectionAnchors } from "./issues.js";
 import { taskTypeLabel } from "./metadata-labels.js";
-import { planInLabelUpdate, validateInLabelMapping, validateRepositoryLabelPayload } from "./in-label-sync.js";
-import { inspectGitHubPullRequest } from "./pull-requests.js";
-import { createGitHubClient } from "./github-client.js";
+import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.js";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.js";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.js";
 import { taskIssueIdentity } from "./task-identities.js";
@@ -174,7 +172,6 @@ async function buildSyncContext({ taskDir, config, artifactFile }) {
         prIdentity,
         issueNumber,
         prNumber,
-        upstreamRepo: platformContext.platform.repository,
         repoOwnerType: String(loaded.ok ? loaded.value.snapshot.metadata?.ownerType || "unknown" : "unknown"),
         hasTriage: platformContext.capabilities.triage,
         hasPush: platformContext.capabilities.push,
@@ -281,6 +278,28 @@ async function fetchRemoteData(context) {
         prComments = listed.value.map((comment) => ({ id: comment.id, body: comment.body }));
     }
     const changeRequest = facts.value.changeRequest;
+    let inLabelMapping = {};
+    let repositoryLabels = [];
+    if (context.config.verify_in_labels_computed && context.hasTriage) {
+        const mapping = loadInLabelMapping();
+        if (!mapping.ok)
+            return { earlyReturn: failResult(CHECK_TYPE, mapping.message, "check_failed") };
+        inLabelMapping = mapping.value;
+        if (Object.keys(inLabelMapping).length > 0) {
+            const labels = provider?.issues?.listLabels
+                ? await provider.issues.listLabels({ context: operationContext })
+                : unsupportedProviderOperation(provider, "issues.listLabels");
+            if (!labels.ok) {
+                const error = providerError(labels.error, "PLATFORM_PROVIDER_OPERATION_FAILED");
+                return {
+                    earlyReturn: error.retryable
+                        ? blockedResult(CHECK_TYPE, `${error.code}: ${error.message}`, "network_error")
+                        : failResult(CHECK_TYPE, `${error.code}: ${error.message}`, "check_failed")
+                };
+            }
+            repositoryLabels = labels.value;
+        }
+    }
     return {
         issue,
         comments: facts.value.comments.map((comment) => ({ id: comment.id, body: comment.body })),
@@ -294,7 +313,9 @@ async function fetchRemoteData(context) {
             ? (changeRequest.milestone ? { title: changeRequest.milestone } : null)
             : undefined,
         prAssignees: changeRequest?.assignees,
-        prHeadSha: changeRequest?.headSha
+        prHeadSha: changeRequest?.headSha,
+        inLabelMapping,
+        repositoryLabels
     };
 }
 function mapTaskTypeToLabel(taskType) {
@@ -467,7 +488,7 @@ function checkInLabelsComputed(context, remoteData) {
     if (!context.config.verify_in_labels_computed || !context.hasTriage) {
         return null;
     }
-    const expectedInLabels = computeExpectedInLabels(context.taskDir, context.upstreamRepo);
+    const expectedInLabels = computeExpectedInLabels(context.taskDir, remoteData.repositoryLabels, remoteData.inLabelMapping);
     if (!expectedInLabels.ok) {
         return expectedInLabels.type === "check_failed"
             ? failResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type)
@@ -767,7 +788,7 @@ function arraysEqual(left, right) {
 function formatLabelList(labels) {
     return labels.length > 0 ? labels.join(", ") : "none";
 }
-function computeExpectedInLabels(taskDir, repository) {
+function computeExpectedInLabels(taskDir, repositoryLabels = [], mappingOverride) {
     const task = loadTask(taskDir);
     if (!task.ok) {
         return task;
@@ -784,29 +805,15 @@ function computeExpectedInLabels(taskDir, repository) {
         .split(/\r?\n/)
         .map((value) => value.trim())
         .filter(Boolean);
-    const mapping = loadInLabelMapping();
-    if (!mapping.ok) {
-        return mapping;
-    }
-    if (Object.keys(mapping.value ?? {}).length === 0) {
+    const mapping = mappingOverride ?? {};
+    if (Object.keys(mapping).length === 0) {
         return { ok: true, labels: [], mode: "mapped" };
     }
-    const client = createGitHubClient();
-    const repoLabelsResult = withRetry(() => client.json([
-        "api", "--paginate", "--slurp", `repos/${repository}/labels?per_page=100`
-    ], { cwd: taskDir }));
-    if (!repoLabelsResult.ok) {
-        return repoLabelsResult;
-    }
-    const repositoryLabels = validateRepositoryLabelPayload(repoLabelsResult.value);
-    if (!repositoryLabels.ok) {
-        return { ok: false, type: "check_failed", message: repositoryLabels.error.message };
-    }
     const planned = planInLabelUpdate({
         changedFiles,
         currentLabels: [],
-        mapping: mapping.value ?? {},
-        repositoryLabels: new Set(repositoryLabels.value)
+        mapping,
+        repositoryLabels: new Set(repositoryLabels)
     });
     if (planned.error) {
         return { ok: false, type: "check_failed", message: planned.error.message };
@@ -829,7 +836,7 @@ function loadInLabelMapping() {
         return { ok: false, type: "check_failed", message: `Unable to parse .agents/.airc.json: ${error.message}` };
     }
 }
-// === GitHub API ===
+// === Git working tree ===
 function gitText(args, cwd) {
     try {
         const value = execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });

package/dist/lib/process-data/index.js

@@ -9,6 +9,7 @@ import { readAppliedOverlays, repairSnapshot } from './repair.js';
 import { collectGitHubBoundary, resolveGitHubRepository } from './sources.js';
 import { canonicalJsonBytes, createObjectStore, findSnapshot, publishSnapshotV2, verifySnapshot } from './store.js';
 import { createGitHubClient } from '../platform/github-client.js';
+import { PUBLIC_CLI_ROUTE_SELECTORS } from '../internal/cli-route-inventory.js';
 const USAGE = `Usage: ai data <command> [options]
 
 Commands:
@@ -18,6 +19,7 @@ Commands:
   repair <snapshot-id> [--root <dir>] [--apply]
   export <snapshot-id> [--root <dir>] [--repairs none|applied] [--as-of <ISO>] [--output <file|->]
 `;
+const DATA_OPERATIONS = PUBLIC_CLI_ROUTE_SELECTORS.data;
 function parseArgs(args, valueOptions, booleanOptions) {
     const positionals = [];
     const options = new Map();
@@ -286,6 +288,11 @@ async function cmdData(args) {
         return command ? 0 : 1;
     }
     try {
+        if (!DATA_OPERATIONS.includes(command)) {
+            process.stderr.write(`Unknown data command: ${command}\n`);
+            process.stdout.write(USAGE);
+            return 1;
+        }
         switch (command) {
             case 'capture': return capture(rest);
             case 'verify': return verify(rest);