@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/platform/verification-sync.js

@@ -6,12 +6,11 @@ import { resolvePlatformProviderContext } from "./context.js";
 import { hasCheckedRequirement, resolveRequirementSection } from "./issue-metadata.js";
 import { requirementSectionAnchors } from "./issues.js";
 import { taskTypeLabel } from "./metadata-labels.js";
-import { planInLabelUpdate, validateInLabelMapping, validateRepositoryLabelPayload } from "./in-label-sync.js";
-import { inspectGitHubPullRequest } from "./pull-requests.js";
-import { createGitHubClient } from "./github-client.js";
+import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.js";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.js";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.js";
 import { taskIssueIdentity } from "./task-identities.js";
+import { CONTROL_MARKER_PATTERN, canonicalizeCommentBody, renderSafeCodeFence, sanitizeMarkdownDocument } from "./comment-safety.js";
 const CHECK_TYPE = "platform-sync";
 const VERSION_LINE_REGEX = /^[0-9]+\.[0-9]+\.x$/;
 const FRONTMATTER_FIELD_MAP = {
@@ -26,8 +25,6 @@ const OPTION_LOCALIZATION = {
     "中": "Medium",
     "低": "Low"
 };
-let activeShared = null;
-let repoRoot = "";
 export function getDefaults() {
     return {
         statusLabels: {
@@ -47,47 +44,16 @@ export function getDefaults() {
         }
     };
 }
-function getShared() {
-    if (!activeShared) {
-        throw new Error("platform-sync adapter shared utilities are unavailable");
-    }
-    return activeShared;
-}
-function loadTask(...args) {
-    return getShared().loadTask(...args);
-}
-function getCheckedRequirements(...args) {
-    return getShared().getCheckedRequirements(...args);
-}
-function normalizeContent(...args) {
-    return getShared().normalizeContent(...args);
-}
-function isBlank(...args) {
-    return getShared().isBlank(...args);
-}
-function escapeRegExp(...args) {
-    return getShared().escapeRegExp(...args);
-}
-function passResult(...args) {
-    return getShared().passResult(...args);
-}
-function failResult(...args) {
-    return getShared().failResult(...args);
-}
-function blockedResult(...args) {
-    return getShared().blockedResult(...args);
-}
-function safeStat(...args) {
-    return getShared().safeStat(...args);
+function sanitizeCommentContent(content) {
+    const result = sanitizeMarkdownDocument(content, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+    return result.ok ? result.value : null;
 }
 export async function check({ taskDir, config, artifactFile }, shared) {
-    activeShared = shared;
-    repoRoot = shared.repoRoot;
-    const context = await buildSyncContext({ taskDir, config, artifactFile });
+    const context = await buildSyncContext({ taskDir, config, artifactFile }, shared);
     if (context.earlyReturn) {
         return context.earlyReturn;
     }
-    const remoteData = await fetchRemoteData(context);
+    const remoteData = await fetchRemoteData(context, shared);
     if (remoteData.earlyReturn) {
         return remoteData.earlyReturn;
     }
@@ -110,52 +76,52 @@ export async function check({ taskDir, config, artifactFile }, shared) {
         checkMilestone
     ];
     for (const subCheck of subChecks) {
-        const result = subCheck(context, remoteData);
+        const result = subCheck(context, remoteData, shared);
         if (result) {
             return result;
         }
     }
-    return passResult(CHECK_TYPE, `Platform sync checks passed for Issue ${context.issueNumber || "identity"}`);
+    return shared.passResult(CHECK_TYPE, `Platform sync checks passed for Issue ${context.issueNumber || "identity"}`);
 }
-async function buildSyncContext({ taskDir, config, artifactFile }) {
-    const task = loadTask(taskDir);
+async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
+    const task = shared.loadTask(taskDir);
     if (!task.ok) {
-        return { earlyReturn: failResult(CHECK_TYPE, task.message) };
+        return { earlyReturn: shared.failResult(CHECK_TYPE, task.message) };
     }
     const issueIdentity = taskIssueIdentity(task.metadata);
     const issueNumber = resourceIdentityNumber(issueIdentity);
     const fact = readPrDeliveryFact(task.metadata);
     if (fact.status === "invalid") {
-        return { earlyReturn: failResult(CHECK_TYPE, fact.error.message, "check_failed") };
+        return { earlyReturn: shared.failResult(CHECK_TYPE, fact.error.message, "check_failed") };
     }
     const prIdentity = fact.status === "valid" && fact.fact.state === "bound" ? fact.fact.identity.resource : null;
     const prNumber = resourceIdentityNumber(prIdentity);
     if (config.when === "issue_number_exists" && !issueIdentity) {
-        return { earlyReturn: passResult(CHECK_TYPE, "Skipped: task has no issue_number") };
+        return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no issue_number") };
     }
     if (config.when === "pr_fact_bound" && !prIdentity) {
-        return { earlyReturn: passResult(CHECK_TYPE, "Skipped: task has no verified bound pull request") };
+        return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no verified bound pull request") };
     }
     if (!issueIdentity) {
-        return { earlyReturn: passResult(CHECK_TYPE, "Skipped: platform-sync not required for this task") };
+        return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: platform-sync not required for this task") };
     }
-    const loaded = await resolvePlatformProviderContext({ cwd: repoRoot });
+    const loaded = await resolvePlatformProviderContext({ cwd: shared.repoRoot });
     const platformContext = loaded.ok ? loaded.value.context : loaded.context;
     if (platformContext.status === "failed") {
-        return { earlyReturn: failResult(CHECK_TYPE, platformContext.error?.message || "Platform context failed", "check_failed") };
+        return { earlyReturn: shared.failResult(CHECK_TYPE, platformContext.error?.message || "Platform context failed", "check_failed") };
     }
     if (platformContext.status === "blocked") {
-        return { earlyReturn: blockedResult(CHECK_TYPE, platformContext.error?.message || "Platform context blocked", "network_error") };
+        return { earlyReturn: shared.blockedResult(CHECK_TYPE, platformContext.error?.message || "Platform context blocked", "network_error") };
     }
     if (!platformContext.platform.repository) {
         if (platformContext.error?.code === "REMOTE_MISSING" || platformContext.error?.code === "REMOTE_INVALID") {
-            return { earlyReturn: blockedResult(CHECK_TYPE, platformContext.error.message, "network_error") };
+            return { earlyReturn: shared.blockedResult(CHECK_TYPE, platformContext.error.message, "network_error") };
         }
-        return { earlyReturn: passResult(CHECK_TYPE, `Skipped: ${platformContext.error?.message || "platform unavailable"}`) };
+        return { earlyReturn: shared.passResult(CHECK_TYPE, `Skipped: ${platformContext.error?.message || "platform unavailable"}`) };
     }
     const expectedValues = resolveExpectedValues(config);
     if (!expectedValues.ok) {
-        return { earlyReturn: failResult(CHECK_TYPE, expectedValues.message, "check_failed") };
+        return { earlyReturn: shared.failResult(CHECK_TYPE, expectedValues.message, "check_failed") };
     }
     const marker = expectedValues.commentMarker
         ? interpolate(expectedValues.commentMarker, taskDir, artifactFile)
@@ -174,7 +140,6 @@ async function buildSyncContext({ taskDir, config, artifactFile }) {
         prIdentity,
         issueNumber,
         prNumber,
-        upstreamRepo: platformContext.platform.repository,
         repoOwnerType: String(loaded.ok ? loaded.value.snapshot.metadata?.ownerType || "unknown" : "unknown"),
         hasTriage: platformContext.capabilities.triage,
         hasPush: platformContext.capabilities.push,
@@ -232,7 +197,7 @@ function resolveDefaultValue({ collection, key, value, configKey }) {
     }
     return { ok: true, value: resolvedValue };
 }
-async function fetchRemoteData(context) {
+async function fetchRemoteData(context, shared) {
     const provider = context.provider;
     const operationContext = providerOperationContext(context.loadedContext, context.taskDir);
     const facts = provider?.verification?.fetchRemoteFacts
@@ -248,8 +213,8 @@ async function fetchRemoteData(context) {
     if (!facts.ok) {
         return {
             earlyReturn: facts.error.retryable
-                ? blockedResult(CHECK_TYPE, providerError(facts.error, "PLATFORM_PROVIDER_OPERATION_FAILED").message, "network_error")
-                : failResult(CHECK_TYPE, providerError(facts.error, "PLATFORM_PROVIDER_OPERATION_FAILED").message, "check_failed")
+                ? shared.blockedResult(CHECK_TYPE, providerError(facts.error, "PLATFORM_PROVIDER_OPERATION_FAILED").message, "network_error")
+                : shared.failResult(CHECK_TYPE, providerError(facts.error, "PLATFORM_PROVIDER_OPERATION_FAILED").message, "check_failed")
         };
     }
     const issueSnapshot = facts.value.issue;
@@ -275,12 +240,34 @@ async function fetchRemoteData(context) {
         if (!listed.ok)
             return {
                 earlyReturn: listed.error.retryable
-                    ? blockedResult(CHECK_TYPE, listed.error.message, "network_error")
-                    : failResult(CHECK_TYPE, listed.error.message, "check_failed")
+                    ? shared.blockedResult(CHECK_TYPE, listed.error.message, "network_error")
+                    : shared.failResult(CHECK_TYPE, listed.error.message, "check_failed")
             };
         prComments = listed.value.map((comment) => ({ id: comment.id, body: comment.body }));
     }
     const changeRequest = facts.value.changeRequest;
+    let inLabelMapping = {};
+    let repositoryLabels = [];
+    if (context.config.verify_in_labels_computed && context.hasTriage) {
+        const mapping = loadInLabelMapping(shared);
+        if (!mapping.ok)
+            return { earlyReturn: shared.failResult(CHECK_TYPE, mapping.message, "check_failed") };
+        inLabelMapping = mapping.value;
+        if (Object.keys(inLabelMapping).length > 0) {
+            const labels = provider?.issues?.listLabels
+                ? await provider.issues.listLabels({ context: operationContext })
+                : unsupportedProviderOperation(provider, "issues.listLabels");
+            if (!labels.ok) {
+                const error = providerError(labels.error, "PLATFORM_PROVIDER_OPERATION_FAILED");
+                return {
+                    earlyReturn: error.retryable
+                        ? shared.blockedResult(CHECK_TYPE, `${error.code}: ${error.message}`, "network_error")
+                        : shared.failResult(CHECK_TYPE, `${error.code}: ${error.message}`, "check_failed")
+                };
+            }
+            repositoryLabels = labels.value;
+        }
+    }
     return {
         issue,
         comments: facts.value.comments.map((comment) => ({ id: comment.id, body: comment.body })),
@@ -294,7 +281,9 @@ async function fetchRemoteData(context) {
             ? (changeRequest.milestone ? { title: changeRequest.milestone } : null)
             : undefined,
         prAssignees: changeRequest?.assignees,
-        prHeadSha: changeRequest?.headSha
+        prHeadSha: changeRequest?.headSha,
+        inLabelMapping,
+        repositoryLabels
     };
 }
 function mapTaskTypeToLabel(taskType) {
@@ -309,7 +298,7 @@ function shouldFetchComments(config) {
         || config.verify_comment_content
         || config.verify_task_comment_content);
 }
-function checkStatusLabel(context, remoteData) {
+function checkStatusLabel(context, remoteData, shared) {
     if (!context.expectedStatusLabel || !context.hasTriage) {
         return null;
     }
@@ -320,9 +309,9 @@ function checkStatusLabel(context, remoteData) {
     if (labels.includes(context.expectedStatusLabel)) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Expected label '${context.expectedStatusLabel}' not found on Issue #${context.issueNumber}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Expected label '${context.expectedStatusLabel}' not found on Issue #${context.issueNumber}`, "check_failed");
 }
-function checkClosedIssueStatusLabels(context, remoteData) {
+function checkClosedIssueStatusLabels(context, remoteData, shared) {
     if (!context.config.verify_closed_issue_has_no_status_labels) {
         return null;
     }
@@ -334,9 +323,9 @@ function checkClosedIssueStatusLabels(context, remoteData) {
     if (statusLabels.length === 0) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} retains status labels: ${statusLabels.join(", ")}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Closed Issue #${context.issueNumber} retains status labels: ${statusLabels.join(", ")}`, "check_failed");
 }
-function checkCommentMarker(context, remoteData) {
+function checkCommentMarker(context, remoteData, shared) {
     if (!context.marker) {
         return null;
     }
@@ -344,9 +333,9 @@ function checkCommentMarker(context, remoteData) {
     if (comment) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Expected comment marker '${context.marker}' not found on Issue #${context.issueNumber}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Expected comment marker '${context.marker}' not found on Issue #${context.issueNumber}`, "check_failed");
 }
-function checkPrCommentMarker(context, remoteData) {
+function checkPrCommentMarker(context, remoteData, shared) {
     if (!context.prMarker) {
         return null;
     }
@@ -354,88 +343,107 @@ function checkPrCommentMarker(context, remoteData) {
     if (comment) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
 }
-function checkPrCommentLastCommit(context, remoteData) {
+function checkPrCommentLastCommit(context, remoteData, shared) {
     if (!context.config.verify_pr_comment_last_commit_matches_head) {
         return null;
     }
     if (!context.prMarker) {
-        return failResult(CHECK_TYPE, "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker", "check_failed");
+        return shared.failResult(CHECK_TYPE, "verify_pr_comment_last_commit_matches_head requires expected_pr_comment_marker", "check_failed");
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (!comment) {
-        return failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
     }
     const match = String(comment.body || "").match(/<!--\s*last-commit:\s*([0-9a-f]{7,40})\s*-->/i);
     if (!match) {
-        return failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing '<!-- last-commit: <sha> -->' metadata`, "check_failed");
     }
     const expectedHead = String(remoteData.prHeadSha || "").trim();
     if (!expectedHead)
-        return blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error");
+        return shared.blockedResult(CHECK_TYPE, "Unable to resolve the PR head SHA", "network_error");
     const actualHead = match[1].trim();
     if (expectedHead === actualHead) {
         return null;
     }
-    return failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment last-commit metadata mismatch: expected ${expectedHead}, got ${actualHead}`, "check_failed");
 }
-function checkPrCommentRequiredPatterns(context, remoteData) {
+function checkPrCommentRequiredPatterns(context, remoteData, shared) {
     const patterns = context.config.expected_pr_comment_required_patterns || [];
     if (!Array.isArray(patterns) || patterns.length === 0) {
         return null;
     }
     if (!context.prMarker) {
-        return failResult(CHECK_TYPE, "expected_pr_comment_required_patterns requires expected_pr_comment_marker", "check_failed");
+        return shared.failResult(CHECK_TYPE, "expected_pr_comment_required_patterns requires expected_pr_comment_marker", "check_failed");
     }
     const comment = findCommentByMarker(remoteData.prComments, context.prMarker);
     if (!comment) {
-        return failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Expected PR comment marker '${context.prMarker}' not found on PR #${context.prNumber}`, "check_failed");
     }
     const body = String(comment.body || "");
     for (const pattern of patterns) {
         const regex = new RegExp(pattern, "m");
         if (!regex.test(body)) {
-            return failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`, "check_failed");
+            return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} summary comment is missing required pattern: ${pattern}`, "check_failed");
         }
     }
     return null;
 }
-function checkCommentContent(context, remoteData) {
+function checkCommentContent(context, remoteData, shared) {
     if (!context.config.verify_comment_content) {
         return null;
     }
     if (!context.marker) {
-        return failResult(CHECK_TYPE, "verify_comment_content requires expected_comment_marker", "check_failed");
+        return shared.failResult(CHECK_TYPE, "verify_comment_content requires expected_comment_marker", "check_failed");
     }
-    if (!context.artifactPath || !safeStat(context.artifactPath)) {
-        return failResult(CHECK_TYPE, `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`, "check_failed");
+    if (!context.artifactPath || !shared.safeStat(context.artifactPath)) {
+        return shared.failResult(CHECK_TYPE, `Artifact not found for comment verification: ${context.artifactFile || "(missing artifactFile)"}`, "check_failed");
     }
     const comment = findCommentByMarker(remoteData.comments, context.marker);
-    const localContent = normalizeContent(fs.readFileSync(context.artifactPath, "utf8"));
-    const commentContent = normalizeContent(extractCommentBody(comment?.body || ""));
+    let localContent;
+    let commentContent;
+    try {
+        const localCanonical = canonicalizeCommentBody(fs.readFileSync(context.artifactPath, "utf8"));
+        const commentCanonical = canonicalizeCommentBody(extractCommentBody(comment?.body || ""));
+        if (!localCanonical.ok) {
+            return shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${localCanonical.error.message}`, "check_failed");
+        }
+        if (!commentCanonical.ok) {
+            return shared.failResult(CHECK_TYPE, `Comment content cannot be canonicalized for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${commentCanonical.error.message}`, "check_failed");
+        }
+        localContent = shared.normalizeContent(localCanonical.value);
+        commentContent = shared.normalizeContent(commentCanonical.value);
+    }
+    catch (error) {
+        return shared.failResult(CHECK_TYPE, `Comment content cannot be read for '${path.basename(context.artifactPath, path.extname(context.artifactPath))}': ${error instanceof Error ? error.message : String(error)}`, "check_failed");
+    }
     if (localContent === commentContent) {
         return null;
     }
-    return failResult(CHECK_TYPE, buildCommentContentMismatchMessage(path.basename(context.artifactPath, path.extname(context.artifactPath)), context.issueNumber, localContent, commentContent), "check_failed");
+    return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage(path.basename(context.artifactPath, path.extname(context.artifactPath)), context.issueNumber, localContent, commentContent), "check_failed");
 }
-function checkTaskCommentContent(context, remoteData) {
+function checkTaskCommentContent(context, remoteData, shared) {
     if (!context.config.verify_task_comment_content) {
         return null;
     }
     const taskMarker = `<!-- sync-issue:${context.task.metadata.id}:task -->`;
     const comment = findCommentByMarker(remoteData.comments, taskMarker);
     if (!comment) {
-        return failResult(CHECK_TYPE, `Expected comment marker '${taskMarker}' not found on Issue #${context.issueNumber}`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Expected comment marker '${taskMarker}' not found on Issue #${context.issueNumber}`, "check_failed");
+    }
+    const expectedTaskBody = buildExpectedTaskBody(context.task.content, shared);
+    if (expectedTaskBody === null) {
+        return shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed");
     }
-    const expectedBody = normalizeContent(buildExpectedTaskBody(context.task.content));
-    const commentBody = normalizeContent(extractCommentBody(comment.body || ""));
+    const expectedBody = shared.normalizeContent(expectedTaskBody);
+    const commentBody = shared.normalizeContent(extractCommentBody(comment.body || ""));
     if (expectedBody === commentBody) {
         return null;
     }
-    return failResult(CHECK_TYPE, buildCommentContentMismatchMessage("task", context.issueNumber, expectedBody, commentBody), "check_failed");
+    return shared.failResult(CHECK_TYPE, buildCommentContentMismatchMessage("task", context.issueNumber, expectedBody, commentBody), "check_failed");
 }
-function checkPrTypeLabel(context, remoteData) {
+function checkPrTypeLabel(context, remoteData, shared) {
     if (!context.config.verify_pr_type_label || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
         return null;
     }
@@ -446,9 +454,9 @@ function checkPrTypeLabel(context, remoteData) {
     if (remoteData.prLabels.includes(expectedLabel)) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Expected type label '${expectedLabel}' not found on PR #${context.prNumber}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Expected type label '${expectedLabel}' not found on PR #${context.prNumber}`, "check_failed");
 }
-function checkInLabelsMatchPr(context, remoteData) {
+function checkInLabelsMatchPr(context, remoteData, shared) {
     if (!context.config.verify_in_labels_match_pr || !context.hasTriage || !context.prNumber || !remoteData.prLabels) {
         return null;
     }
@@ -461,17 +469,17 @@ function checkInLabelsMatchPr(context, remoteData) {
     if (arraysEqual(issueInLabels, prInLabels)) {
         return null;
     }
-    return failResult(CHECK_TYPE, `in: labels mismatch — PR #${context.prNumber} has [${formatLabelList(prInLabels)}], Issue #${context.issueNumber} has [${formatLabelList(issueInLabels)}]`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `in: labels mismatch — PR #${context.prNumber} has [${formatLabelList(prInLabels)}], Issue #${context.issueNumber} has [${formatLabelList(issueInLabels)}]`, "check_failed");
 }
-function checkInLabelsComputed(context, remoteData) {
+function checkInLabelsComputed(context, remoteData, shared) {
     if (!context.config.verify_in_labels_computed || !context.hasTriage) {
         return null;
     }
-    const expectedInLabels = computeExpectedInLabels(context.taskDir, context.upstreamRepo);
+    const expectedInLabels = computeExpectedInLabels(context.taskDir, remoteData.repositoryLabels, remoteData.inLabelMapping, shared);
     if (!expectedInLabels.ok) {
         return expectedInLabels.type === "check_failed"
-            ? failResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type)
-            : blockedResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type);
+            ? shared.failResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type)
+            : shared.blockedResult(CHECK_TYPE, expectedInLabels.message, expectedInLabels.type);
     }
     if (expectedInLabels.mode === "skipped") {
         return null;
@@ -482,32 +490,32 @@ function checkInLabelsComputed(context, remoteData) {
     if (arraysEqual(expectedInLabels.labels, actualInLabels)) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels do not match committed changes: expected [${formatLabelList(expectedInLabels.labels)}], got [${formatLabelList(actualInLabels)}]`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} in: labels do not match committed changes: expected [${formatLabelList(expectedInLabels.labels)}], got [${formatLabelList(actualInLabels)}]`, "check_failed");
 }
-function checkSyncedRequirements(context, remoteData) {
+function checkSyncedRequirements(context, remoteData, shared) {
     if (!context.config.sync_checked_requirements || !context.hasTriage) {
         return null;
     }
-    const checkedRequirements = getCheckedRequirements(context.task.content);
+    const checkedRequirements = shared.getCheckedRequirements(context.task.content);
     if (checkedRequirements.length === 0) {
         return null;
     }
     const issueBody = remoteData.issue.body || "";
-    const resolution = resolveRequirementSection(issueBody, requirementSectionAnchors(repoRoot, context.task.metadata.type || "task"));
+    const resolution = resolveRequirementSection(issueBody, requirementSectionAnchors(shared.repoRoot, context.task.metadata.type || "task"));
     if (resolution.status === "missing") {
         return null;
     }
     if (resolution.status === "ambiguous") {
-        return failResult(CHECK_TYPE, `Issue #${context.issueNumber} requirements section is ambiguous`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} requirements section is ambiguous`, "check_failed");
     }
     const requirementBody = issueBody.slice(resolution.bodyStart, resolution.bodyEnd);
     const missingRequirements = checkedRequirements.filter((item) => !hasCheckedRequirement(requirementBody, item));
     if (missingRequirements.length === 0) {
         return null;
     }
-    return failResult(CHECK_TYPE, `Issue body is missing checked requirements: ${missingRequirements.join(", ")}`, "check_failed");
+    return shared.failResult(CHECK_TYPE, `Issue body is missing checked requirements: ${missingRequirements.join(", ")}`, "check_failed");
 }
-function checkIssueType(context, remoteData) {
+function checkIssueType(context, remoteData, shared) {
     if (!context.config.verify_issue_type || !context.hasPush) {
         return null;
     }
@@ -518,15 +526,15 @@ function checkIssueType(context, remoteData) {
         if (context.repoOwnerType === "User") {
             return null;
         }
-        return failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no Issue Type set`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no Issue Type set`, "check_failed");
     }
     const expectedType = mapTaskTypeToIssueType(context.task.metadata.type);
     if (expectedType && remoteData.issueType !== expectedType) {
-        return failResult(CHECK_TYPE, `Issue #${context.issueNumber} has type '${remoteData.issueType}', expected '${expectedType}' (from task type '${context.task.metadata.type}')`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has type '${remoteData.issueType}', expected '${expectedType}' (from task type '${context.task.metadata.type}')`, "check_failed");
     }
     return null;
 }
-function checkIssueFields(context, remoteData) {
+function checkIssueFields(context, remoteData, shared) {
     if (!context.config.verify_issue_fields || !context.hasPush) {
         return null;
     }
@@ -535,7 +543,7 @@ function checkIssueFields(context, remoteData) {
     }
     for (const [metadataKey, fieldName] of Object.entries(FRONTMATTER_FIELD_MAP)) {
         const expectedRaw = context.task.metadata[metadataKey];
-        if (isBlank(expectedRaw) || !remoteData.issueFields.pinnedNames.has(fieldName)) {
+        if (shared.isBlank(expectedRaw) || !remoteData.issueFields.pinnedNames.has(fieldName)) {
             continue;
         }
         const actual = remoteData.issueFields.values.get(fieldName);
@@ -544,40 +552,40 @@ function checkIssueFields(context, remoteData) {
             continue;
         }
         if (!actual) {
-            return failResult(CHECK_TYPE, `Issue #${context.issueNumber} field '${fieldName}' is missing, expected '${expected.value}'`, "check_failed");
+            return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} field '${fieldName}' is missing, expected '${expected.value}'`, "check_failed");
         }
         if (actual.kind !== expected.kind || actual.value !== expected.value) {
-            return failResult(CHECK_TYPE, `Issue #${context.issueNumber} field '${fieldName}' is '${actual.value}', expected '${expected.value}'`, "check_failed");
+            return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} field '${fieldName}' is '${actual.value}', expected '${expected.value}'`, "check_failed");
         }
     }
     return null;
 }
-function checkPrAssignee(context, remoteData) {
+function checkPrAssignee(context, remoteData, shared) {
     if (!context.config.verify_pr_assignee || !context.hasPush || !context.prNumber) {
         return null;
     }
     if (!remoteData.prAssignees || remoteData.prAssignees.length === 0) {
-        return failResult(CHECK_TYPE, `PR #${context.prNumber} has no assignee`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no assignee`, "check_failed");
     }
     return null;
 }
-function checkMilestone(context, remoteData) {
+function checkMilestone(context, remoteData, shared) {
     if (!context.config.verify_milestone || !context.hasTriage) {
         return null;
     }
     if (!remoteData.issue?.milestone?.title) {
-        return failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no milestone set`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} has no milestone set`, "check_failed");
     }
     if (context.prNumber && remoteData.prMilestone !== undefined && !remoteData.prMilestone?.title) {
-        return failResult(CHECK_TYPE, `PR #${context.prNumber} has no milestone set`, "check_failed");
+        return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} has no milestone set`, "check_failed");
     }
     if (context.config.verify_milestone_specific) {
         const issueTitle = remoteData.issue.milestone.title;
         if (VERSION_LINE_REGEX.test(issueTitle)) {
-            return failResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone '${issueTitle}' is a release line; narrow to a specific version (e.g. ${issueTitle.replace(/\.x$/, ".N")}) before continuing`, "check_failed");
+            return shared.failResult(CHECK_TYPE, `Issue #${context.issueNumber} milestone '${issueTitle}' is a release line; narrow to a specific version (e.g. ${issueTitle.replace(/\.x$/, ".N")}) before continuing`, "check_failed");
         }
         if (context.prNumber && remoteData.prMilestone?.title && VERSION_LINE_REGEX.test(remoteData.prMilestone.title)) {
-            return failResult(CHECK_TYPE, `PR #${context.prNumber} milestone '${remoteData.prMilestone.title}' is a release line; narrow to a specific version before continuing`, "check_failed");
+            return shared.failResult(CHECK_TYPE, `PR #${context.prNumber} milestone '${remoteData.prMilestone.title}' is a release line; narrow to a specific version before continuing`, "check_failed");
         }
     }
     return null;
@@ -622,37 +630,38 @@ function extractCommentBody(commentBody) {
     }
     return lines.slice(start, end).join("\n");
 }
-function buildExpectedTaskBody(taskContent) {
+function buildExpectedTaskBody(taskContent, shared) {
     const frontmatterMatch = taskContent.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
     if (!frontmatterMatch) {
-        return taskContent.trim();
+        return sanitizeCommentContent(taskContent.trim());
+    }
+    const body = sanitizeCommentContent(taskContent.slice(frontmatterMatch[0].length).trim());
+    if (body === null) {
+        return null;
     }
-    const body = taskContent.slice(frontmatterMatch[0].length).trim();
     return [
-        buildTaskFrontmatterSummary(),
+        buildTaskFrontmatterSummary(shared),
         "",
-        "```yaml",
-        frontmatterMatch[0].trim(),
-        "```",
+        renderSafeCodeFence(frontmatterMatch[0].trim(), "yaml"),
         "",
         "</details>",
         "",
         body
     ].join("\n").trim();
 }
-function buildTaskFrontmatterSummary() {
-    const language = loadProjectLanguage();
+function buildTaskFrontmatterSummary(shared) {
+    const language = loadProjectLanguage(shared);
     if (language === "en" || language === "en-US") {
         return "<details><summary>Metadata (frontmatter)</summary>";
     }
     return "<details><summary>元数据 (frontmatter)</summary>";
 }
-function loadProjectLanguage() {
+function loadProjectLanguage(shared) {
     const override = process.env.VALIDATE_ARTIFACT_LANGUAGE;
-    if (!isBlank(override)) {
+    if (!shared.isBlank(override)) {
         return String(override).trim();
     }
-    const configPath = path.join(repoRoot, ".agents", ".airc.json");
+    const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
     if (!fs.existsSync(configPath)) {
         return "";
     }
@@ -767,8 +776,8 @@ function arraysEqual(left, right) {
 function formatLabelList(labels) {
     return labels.length > 0 ? labels.join(", ") : "none";
 }
-function computeExpectedInLabels(taskDir, repository) {
-    const task = loadTask(taskDir);
+function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, shared) {
+    const task = shared.loadTask(taskDir);
     if (!task.ok) {
         return task;
     }
@@ -784,37 +793,23 @@ function computeExpectedInLabels(taskDir, repository) {
         .split(/\r?\n/)
         .map((value) => value.trim())
         .filter(Boolean);
-    const mapping = loadInLabelMapping();
-    if (!mapping.ok) {
-        return mapping;
-    }
-    if (Object.keys(mapping.value ?? {}).length === 0) {
+    const mapping = mappingOverride ?? {};
+    if (Object.keys(mapping).length === 0) {
         return { ok: true, labels: [], mode: "mapped" };
     }
-    const client = createGitHubClient();
-    const repoLabelsResult = withRetry(() => client.json([
-        "api", "--paginate", "--slurp", `repos/${repository}/labels?per_page=100`
-    ], { cwd: taskDir }));
-    if (!repoLabelsResult.ok) {
-        return repoLabelsResult;
-    }
-    const repositoryLabels = validateRepositoryLabelPayload(repoLabelsResult.value);
-    if (!repositoryLabels.ok) {
-        return { ok: false, type: "check_failed", message: repositoryLabels.error.message };
-    }
     const planned = planInLabelUpdate({
         changedFiles,
         currentLabels: [],
-        mapping: mapping.value ?? {},
-        repositoryLabels: new Set(repositoryLabels.value)
+        mapping,
+        repositoryLabels: new Set(repositoryLabels)
     });
     if (planned.error) {
         return { ok: false, type: "check_failed", message: planned.error.message };
     }
     return { ok: true, labels: planned.target, mode: "mapped" };
 }
-function loadInLabelMapping() {
-    const configPath = path.join(repoRoot, ".agents", ".airc.json");
+function loadInLabelMapping(shared) {
+    const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
     if (!fs.existsSync(configPath)) {
         return { ok: true, value: {} };
     }
@@ -829,7 +824,7 @@ function loadInLabelMapping() {
         return { ok: false, type: "check_failed", message: `Unable to parse .agents/.airc.json: ${error.message}` };
     }
 }
-// === GitHub API ===
+// === Git working tree ===
 function gitText(args, cwd) {
     try {
         const value = execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] });
@@ -845,12 +840,12 @@ function gitText(args, cwd) {
     }
 }
 function resolvePrHeadSha(context) {
-    const fallback = () => withRetry(() => gitText(["rev-parse", "HEAD"], context.taskDir));
+    const fallback = () => gitText(["rev-parse", "HEAD"], context.taskDir);
     const branch = String(context.task?.metadata?.branch || "").trim();
     if (!branch) {
         return fallback();
     }
-    const worktreeList = withRetry(() => gitText(["worktree", "list", "--porcelain"], context.taskDir));
+    const worktreeList = gitText(["worktree", "list", "--porcelain"], context.taskDir);
     if (!worktreeList.ok) {
         return fallback();
     }
@@ -858,7 +853,7 @@ function resolvePrHeadSha(context) {
     if (!matchedWorktree) {
         return fallback();
     }
-    const headInWorktree = withRetry(() => gitText(["rev-parse", "HEAD"], matchedWorktree));
+    const headInWorktree = gitText(["rev-parse", "HEAD"], matchedWorktree);
     if (!headInWorktree.ok) {
         return fallback();
     }
@@ -881,9 +876,6 @@ function findWorktreeForBranch(porcelainOutput, branch) {
     }
     return null;
 }
-function withRetry(operation) {
-    return operation();
-}
 function interpolate(template, taskDir, artifactFile) {
     const artifactStem = artifactFile ? path.basename(artifactFile, path.extname(artifactFile)) : "";
     return template