@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/platform/pr-summary.js

@@ -8,18 +8,17 @@ import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-exec
 import { readPrDeliveryFact } from '../task/pr-delivery-fact.js';
 import { resolvePlatformProviderContext } from './context.js';
 import { normalizeCommentContent } from './issue-comments.js';
+import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.js';
-import { buildPrChangeReport, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
+import { buildPrChangeReport, CANONICAL_REPORT_PLACEHOLDER, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
+import { manualValidationFinalSummaryProjectionMatches } from '../task/manual-validation-receipt.js';
+import { readManualValidationCompletion } from '../task/manual-validation-completion.js';
 function summaryMarker(taskId) {
     return `<!-- sync-pr:${taskId}:summary -->`;
 }
 function escapeSummaryAuditText(value) {
-    return value
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/\r\n?/g, '\n');
+    return escapeHtmlText(value).replace(/\r\n?/g, '\n');
 }
 function renderSummaryAuditLine(value) {
     const safe = escapeSummaryAuditText(value);
@@ -289,6 +288,25 @@ async function summaryContext(taskRef, options = {}) {
         artifacts: canonicalArtifacts(resolved.taskDir)
     };
 }
+async function summaryCommentState(taskRef, options = {}) {
+    const context = await summaryContext(taskRef, options);
+    if (!context.task.prNumber || !context.pullRequest)
+        return { ...context, comment: null };
+    const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client });
+    if (!loaded.ok || !loaded.value.provider.comments?.list)
+        return { ...context, comment: null };
+    const listed = await loaded.value.provider.comments.list({
+        context: providerOperationContext(loaded.value),
+        parent: providerResourceToken(loaded.value.provider, 'pull-request', String(context.task.prNumber))
+    });
+    if (!listed.ok)
+        return { ...context, comment: null };
+    const matches = listed.value.filter((comment) => comment.body.includes(summaryMarker(context.task.id)));
+    return {
+        ...context,
+        comment: matches.length === 1 ? { id: /^\d+$/u.test(matches[0].id) ? Number(matches[0].id) : matches[0].id, body: matches[0].body } : null
+    };
+}
 async function reportWrite(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok)
@@ -447,7 +465,7 @@ async function syncPullRequestSummary(taskRef, options) {
         return preserveFailure(context);
     }
     try {
-        return await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, options.agent, async () => {
+        const execute = async () => {
             const { taskContent, boundFact } = readBoundTaskSnapshot(resolved.taskMdPath);
             if (!boundFact)
                 return {
@@ -466,6 +484,34 @@ async function syncPullRequestSummary(taskRef, options) {
             const initial = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrNumber, loaded.value);
             if (!initial.ok)
                 return fail(initial.status, context, initial.error);
+            const manual = options.manualValidation;
+            const hasFinalManualValidation = /###\s+✅\s+(?:Manual Validation Passed|人工验证已通过)/u.test(options.body);
+            if (hasFinalManualValidation && (!manual || manual.phase !== 'final'))
+                return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'final manual-validation summary requires the transaction coordinator', retryable: false }, prNumber);
+            if (manual && (manual.phase === 'pending' ? hasFinalManualValidation : !hasFinalManualValidation))
+                return fail('failed', context, { code: 'MANUAL_VALIDATION_SUMMARY_PHASE_INVALID', message: 'manual-validation summary phase does not match the requested writer phase', retryable: false }, prNumber);
+            if (manual) {
+                if (manual.phase === 'final' && (!manual.transactionId || !manual.receiptDigest || !manual.prHeadSha || manual.prHeadSha !== initial.value.head.sha))
+                    return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'final manual-validation summary requires transaction, receipt, and current head identity', retryable: false }, prNumber);
+                if (manual.phase === 'final') {
+                    if (manual.authority !== 'coordinator')
+                        return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'final manual-validation summary requires coordinator authority', retryable: false }, prNumber);
+                    const completion = readManualValidationCompletion(resolved.taskDir, {
+                        transactionId: manual.transactionId,
+                        taskId: resolved.taskId,
+                        prNumber,
+                        prHeadSha: initial.value.head.sha,
+                        receiptDigest: manual.receiptDigest
+                    });
+                    if (!completion.ok)
+                        return fail('failed', context, platformError(completion.error), prNumber);
+                    const { receipt, transaction } = completion.value;
+                    if (transaction.phase !== 'final-promotion-in-progress' || !transaction.eventAppended)
+                        return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_PHASE_INVALID', message: 'final summary requires a receipt-backed promotion intent', retryable: false }, prNumber);
+                    if (!manualValidationFinalSummaryProjectionMatches(options.body, receipt))
+                        return fail('failed', context, { code: 'MANUAL_VALIDATION_SUMMARY_PROJECTION_INVALID', message: 'final summary body does not match the canonical receipt projection', retryable: false }, prNumber);
+                }
+            }
             const expectedReportPath = taskReportPath(resolved.taskDir);
             const suppliedReportPath = path.resolve(resolved.repoRoot, options.changeReportFile);
             if (suppliedReportPath !== expectedReportPath)
@@ -476,7 +522,31 @@ async function syncPullRequestSummary(taskRef, options) {
             const checked = currentReportCheck(report.value, initial.value, taskContent, resolved.repoRoot);
             if (!checked.ok)
                 return fail('failed', context, checked.error);
-            const replaced = replaceCanonicalReportPlaceholder(options.body, report.value);
+            const placeholder = CANONICAL_REPORT_PLACEHOLDER;
+            const split = splitDocumentPlaceholder(options.body, placeholder);
+            if (!split.ok)
+                return fail('failed', context, {
+                    code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+                    message: split.error.message,
+                    retryable: false
+                });
+            const prefix = sanitizeMarkdownDocument(split.value.prefix, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+            const suffix = sanitizeMarkdownDocument(split.value.suffix, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+            if (!prefix.ok) {
+                return fail('failed', context, {
+                    code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+                    message: `${prefix.error.message} at offset ${prefix.error.offset}`,
+                    retryable: false
+                });
+            }
+            if (!suffix.ok) {
+                return fail('failed', context, {
+                    code: 'PR_SUMMARY_BODY_CONTRACT_INVALID',
+                    message: `${suffix.error.message} at offset ${suffix.error.offset}`,
+                    retryable: false
+                });
+            }
+            const replaced = replaceCanonicalReportPlaceholder(`${prefix.value}${placeholder}${suffix.value}`, report.value);
             if (!replaced.ok)
                 return fail('failed', context, platformError(replaced.error));
             const desired = buildPullRequestSummary(resolved.taskId, replaced.value, initial.value.head.sha, renderHumanOverrideAudit(taskContent));
@@ -589,7 +659,10 @@ async function syncPullRequestSummary(taskRef, options) {
                 operations: [{ name: `summary:${reconciliation.action}`, status: 'applied', reasonCode: null }],
                 result: null, warnings: [], ...info
             };
-        });
+        };
+        return await (options.lockAlreadyHeld
+            ? execute()
+            : withTaskExecutionLock(resolved.repoRoot, resolved.taskId, options.agent, execute));
     }
     catch (error) {
         const lockError = error instanceof TaskExecutionLockError
@@ -598,5 +671,5 @@ async function syncPullRequestSummary(taskRef, options) {
         return fail(lockError.retryable ? 'blocked' : 'failed', context, lockError);
     }
 }
-export { buildPullRequestSummary, reconcileSummaryComment, reportWrite, summaryContext, summaryMarker, syncPullRequestSummary, warningResultForPrimary };
+export { buildPullRequestSummary, reconcileSummaryComment, reportWrite, summaryCommentState, summaryContext, summaryMarker, syncPullRequestSummary, warningResultForPrimary };
 //# sourceMappingURL=pr-summary.js.map

package/dist/lib/platform/provider-contract.d.ts

@@ -15,6 +15,7 @@ type ProviderResult<T> = {
 } | {
     ok: false;
     error: PlatformError;
+    value?: T;
 };
 type ProviderOperationContext = {
     repositoryRoot: string;
@@ -172,6 +173,35 @@ type MutationReceipt = {
     changed: boolean;
     operationId?: string;
 };
+type SecurityAlertKind = 'dependabot' | 'code-scanning';
+type SecurityAlertSnapshot = {
+    kind: SecurityAlertKind;
+    number: number;
+    state: string;
+    data: JsonValue;
+};
+type LabelDefinition = {
+    name: string;
+    color: string;
+    description: string;
+};
+type LabelReconciliation = {
+    changed: boolean;
+    created: string[];
+    updated: string[];
+    removed: string[];
+    skipped: string[];
+};
+type MilestoneDefinition = {
+    title: string;
+    description: string;
+    state: 'open' | 'closed';
+};
+type MilestoneInitialization = {
+    changed: boolean;
+    created: string[];
+    skipped: string[];
+};
 type RepositoryMetadataSnapshot = {
     repository: {
         identity: ResourceIdentity;
@@ -334,6 +364,14 @@ type PlatformProvider = {
             context: ProviderOperationContext;
             target: ResourceIdentity;
         }): Promise<ProviderResult<ChangeRequestSnapshot>>;
+        listFiles?(input: {
+            context: ProviderOperationContext;
+            target: ResourceIdentity;
+        }): Promise<ProviderResult<string[]>>;
+        listClosingIssues?(input: {
+            context: ProviderOperationContext;
+            target: ResourceIdentity;
+        }): Promise<ProviderResult<ResourceIdentity[]>>;
         listClosing(input: {
             context: ProviderOperationContext;
             issue: ResourceIdentity;
@@ -468,6 +506,34 @@ type PlatformProvider = {
             historyLimit: number;
         }): Promise<ProviderResult<ReleaseNotesFacts>>;
     };
+    securityAlerts?: {
+        inspect(input: {
+            context: ProviderOperationContext;
+            kind: SecurityAlertKind;
+            number: number;
+        }): Promise<ProviderResult<SecurityAlertSnapshot>>;
+        dismiss(input: {
+            context: ProviderOperationContext;
+            kind: SecurityAlertKind;
+            number: number;
+            reason: string;
+            comment: string;
+            mutation: MutationIdentity;
+        }): Promise<ProviderResult<MutationReceipt>>;
+    };
+    repositoryMetadata?: {
+        reconcileLabels(input: {
+            context: ProviderOperationContext;
+            desired: LabelDefinition[];
+            cleanupStaleIn: boolean;
+            mutation: MutationIdentity;
+        }): Promise<ProviderResult<LabelReconciliation>>;
+        reconcileMilestones(input: {
+            context: ProviderOperationContext;
+            desired: MilestoneDefinition[];
+            mutation: MutationIdentity;
+        }): Promise<ProviderResult<MilestoneInitialization>>;
+    };
     verification?: {
         fetchRemoteFacts(input: {
             context: ProviderOperationContext;
@@ -484,4 +550,4 @@ declare const PLATFORM_PROVIDER_CONTRACT_VERSION: 1;
 declare function isPlatformProviderFactory(value: unknown): value is PlatformProviderFactory;
 declare function validatePlatformProvider(value: unknown, providerType: string): ProviderResult<PlatformProvider>;
 export { PLATFORM_PROVIDER_CONTRACT_VERSION, isPlatformProviderFactory, validatePlatformProvider };
-export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, PlatformError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ResourceIdentity, ReviewSnapshot, VerificationRemoteFacts };
+export type { ChangeRequestSnapshot, CheckLogSnapshot, CheckRunSnapshot, GitEvidenceSnapshot, IssueSnapshot, JsonValue, MilestoneReconciliation, MilestoneDefinition, MilestoneInitialization, LabelDefinition, LabelReconciliation, MutationIdentity, MutationReceipt, PlatformCapabilities, PlatformContextSnapshot, PlatformError, PlatformProvider, PlatformProviderFactory, PlatformProviderFactoryInput, ProviderOperationContext, ProviderResult, ReleaseSnapshot, RemoteCommentSnapshot, RequiredCheckSnapshot, RepositoryMetadataSnapshot, ReleaseNotesFacts, ResourceIdentity, SecurityAlertKind, SecurityAlertSnapshot, ReviewSnapshot, VerificationRemoteFacts };

package/dist/lib/platform/provider-contract.js

@@ -7,12 +7,14 @@ function isPlatformProviderFactory(value) {
 }
 function validatePlatformProvider(value, providerType) {
     const operationGroups = {
-        issues: { required: ['inspect', 'create', 'update', 'describeRepository'], optional: [] },
+        issues: { required: ['inspect', 'create', 'update', 'describeRepository'], optional: ['listLabels', 'listMilestones'] },
         comments: { required: ['list', 'write', 'delete'], optional: [] },
-        changeRequests: { required: ['inspect', 'listClosing', 'create', 'update', 'resolveGitEvidence'], optional: ['verifyHead'] },
+        changeRequests: { required: ['inspect', 'listClosing', 'create', 'update', 'resolveGitEvidence'], optional: ['verifyHead', 'listFiles', 'listClosingIssues'] },
         checks: { required: ['inspectRequired', 'resolveRun', 'fetchLogs'], optional: [] },
         reviews: { required: ['list', 'publish'], optional: [] },
         releases: { required: ['inspect', 'create', 'update', 'reconcileMilestones', 'publishNotes', 'collectNotes'], optional: [] },
+        securityAlerts: { required: ['inspect', 'dismiss'], optional: [] },
+        repositoryMetadata: { required: ['reconcileLabels', 'reconcileMilestones'], optional: [] },
         verification: { required: ['fetchRemoteFacts'], optional: [] }
     };
     const resourceKindsByGroup = {
@@ -22,6 +24,8 @@ function validatePlatformProvider(value, providerType) {
         checks: ['pull-request'],
         reviews: ['pull-request'],
         releases: ['release', 'issue', 'pull-request'],
+        securityAlerts: [],
+        repositoryMetadata: [],
         verification: ['issue', 'pull-request']
     };
     if (!isRecord(value)

package/dist/lib/platform/provider-validation.js

@@ -250,6 +250,64 @@ function validateReceipt(value) {
         ...(item.operationId === undefined ? {} : { operationId: stringValue(item.operationId, 'receipt.operationId') })
     };
 }
+function positiveInteger(value, label) {
+    if (!Number.isSafeInteger(value) || value <= 0)
+        throw new Error(`${label} must be a positive integer`);
+    return value;
+}
+function validateSecurityAlert(value) {
+    const item = record(value, 'security alert');
+    exactKeys(item, ['kind', 'number', 'state', 'data'], 'security alert');
+    if (item.kind !== 'dependabot' && item.kind !== 'code-scanning')
+        throw new Error('security alert.kind is invalid');
+    return {
+        kind: item.kind,
+        number: positiveInteger(item.number, 'security alert.number'),
+        state: stringValue(item.state, 'security alert.state'),
+        data: jsonValue(item.data, 'security alert.data')
+    };
+}
+function validateLabelDefinition(value, label) {
+    const item = record(value, label);
+    exactKeys(item, ['name', 'color', 'description'], label);
+    return {
+        name: stringValue(item.name, `${label}.name`),
+        color: stringValue(item.color, `${label}.color`),
+        description: stringValue(item.description, `${label}.description`, true)
+    };
+}
+function validateLabelReconciliation(value) {
+    const item = record(value, 'label reconciliation');
+    exactKeys(item, ['changed', 'created', 'updated', 'removed', 'skipped'], 'label reconciliation');
+    const names = (field) => arrayValue(item[field], `label reconciliation.${field}`).map((entry) => stringValue(entry, `${field}[]`));
+    return {
+        changed: booleanValue(item.changed, 'label reconciliation.changed'),
+        created: names('created'),
+        updated: names('updated'),
+        removed: names('removed'),
+        skipped: names('skipped')
+    };
+}
+function validateMilestoneDefinition(value, label) {
+    const item = record(value, label);
+    exactKeys(item, ['title', 'description', 'state'], label);
+    if (item.state !== 'open' && item.state !== 'closed')
+        throw new Error(`${label}.state is invalid`);
+    return {
+        title: stringValue(item.title, `${label}.title`),
+        description: stringValue(item.description, `${label}.description`, true),
+        state: item.state
+    };
+}
+function validateMilestoneInitialization(value) {
+    const item = record(value, 'milestone initialization');
+    exactKeys(item, ['changed', 'created', 'skipped'], 'milestone initialization');
+    return {
+        changed: booleanValue(item.changed, 'milestone initialization.changed'),
+        created: arrayValue(item.created, 'milestone initialization.created').map((entry) => stringValue(entry, 'created[]')),
+        skipped: arrayValue(item.skipped, 'milestone initialization.skipped').map((entry) => stringValue(entry, 'skipped[]'))
+    };
+}
 function validateMetadata(value) {
     const item = record(value, 'repository metadata');
     exactKeys(item, ['repository', 'labels', 'milestones', 'issueTypes', 'fields'], 'repository metadata');
@@ -352,6 +410,11 @@ const PROVIDER_ERROR_CATALOG = {
     ISSUE_NUMBER_INVALID: { message: 'The issue number is invalid', retryable: false },
     ISSUE_CREATE_RESPONSE_INVALID: { message: 'Issue creation returned an invalid response', retryable: false },
     COMMENT_ID_INVALID: { message: 'The comment identity is invalid', retryable: false },
+    SECURITY_KIND_INVALID: { message: 'The security alert kind is invalid', retryable: false },
+    SECURITY_NUMBER_INVALID: { message: 'The security alert number is invalid', retryable: false },
+    SECURITY_RESPONSE_INVALID: { message: 'The platform returned an invalid security alert', retryable: false },
+    LABEL_RESPONSE_INVALID: { message: 'The platform returned an invalid label response', retryable: false },
+    MILESTONE_RESPONSE_INVALID: { message: 'The platform returned an invalid milestone response', retryable: false },
     MILESTONE_IDENTITY_INVALID: { message: 'The milestone identity is invalid', retryable: false },
     CHECK_RUN_NOT_FOUND: { message: 'The check run was not found', retryable: false },
     RELEASE_NOTES_AUTHORS_TRUNCATED: { message: 'Release note commit authors exceeded the supported limit', retryable: false },
@@ -390,6 +453,8 @@ function validators(providerType, declaration) {
             return { sha: stringValue(item.sha, 'change request head.sha') };
         },
         'changeRequests.inspect': (value) => validateChangeRequest(value, declaredIdentityKind(declaration, 'pull-request'), true),
+        'changeRequests.listFiles': (value) => arrayValue(value, 'pull request files').map((entry) => stringValue(entry, 'pull request files[]')),
+        'changeRequests.listClosingIssues': (value) => arrayValue(value, 'closing issues').map((entry) => identity(entry, 'closing issues[]', declaredIdentityKind(declaration, 'issue'))),
         'changeRequests.listClosing': (value) => arrayValue(value, 'changeRequests').map((entry) => validateChangeRequest(entry, declaredIdentityKind(declaration, 'pull-request'), true)),
         'changeRequests.create': validateReceipt,
         'changeRequests.update': validateReceipt,
@@ -433,6 +498,10 @@ function validators(providerType, declaration) {
         },
         'releases.publishNotes': validateReceipt,
         'releases.collectNotes': (value) => validateReleaseNotes(value, declaration),
+        'securityAlerts.inspect': validateSecurityAlert,
+        'securityAlerts.dismiss': validateReceipt,
+        'repositoryMetadata.reconcileLabels': validateLabelReconciliation,
+        'repositoryMetadata.reconcileMilestones': validateMilestoneInitialization,
         'verification.fetchRemoteFacts': (value) => {
             const item = record(value, 'verification facts');
             exactKeys(item, ['issue', 'comments', 'changeRequest', 'commit', 'fields'], 'verification facts');
@@ -462,12 +531,16 @@ async function invokeProviderOperation(providerType, operation, call, validate)
         }
         if (envelope.ok === false && envelope.error && typeof envelope.error === 'object' && !Array.isArray(envelope.error)) {
             try {
-                exactKeys(envelope, ['ok', 'error'], `${operation} result`);
+                exactKeys(envelope, Object.hasOwn(envelope, 'value') ? ['ok', 'error', 'value'] : ['ok', 'error'], `${operation} result`);
                 const error = envelope.error;
                 exactKeys(error, ['code', 'message', 'retryable'], `${operation} error`);
                 if (typeof error.code !== 'string' || !error.code || typeof error.message !== 'string' || !error.message || typeof error.retryable !== 'boolean')
                     throw new Error('invalid provider error');
-                return { ok: false, error: safeProviderError(providerType, operation, error) };
+                return {
+                    ok: false,
+                    error: safeProviderError(providerType, operation, error),
+                    ...(Object.hasOwn(envelope, 'value') ? { value: validate(envelope.value) } : {})
+                };
             }
             catch {
                 return { ok: false, error: validationError(providerType, operation, 'Provider operation returned an invalid error') };
@@ -483,7 +556,7 @@ function wrapProviderOperations(provider) {
     const map = validators(provider.type, provider.identity);
     const wrapped = { ...provider, context: { ...provider.context } };
     wrapped.context.resolve = (input) => invokeProviderOperation(provider.type, 'context.resolve', () => provider.context.resolve(input), map['context.resolve']);
-    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'verification']) {
+    for (const groupName of ['issues', 'comments', 'changeRequests', 'checks', 'reviews', 'releases', 'securityAlerts', 'repositoryMetadata', 'verification']) {
         const group = provider[groupName];
         if (!group)
             continue;