@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/lib/platform/issue-comments.ts

@@ -16,6 +16,13 @@ import {
 } from './provider-bridge.ts';
 import { resourceIdentityNumber } from './resource-identity.ts';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.ts';
+import {
+  canonicalizeCommentBody,
+  escapeHtmlText,
+  fenceRanges,
+  renderSafeCodeFence
+} from './comment-safety.ts';
+import type { FenceRange } from './comment-safety.ts';
 
 type RemoteComment = { id: number | string; body: string; user?: { login?: string } };
 type RenderedChunk = { marker: string; body: string; content: string; part: number; total: number };
@@ -66,15 +73,22 @@ function splitFrontmatter(content: string): { frontmatter: string | null; body:
   return { frontmatter: match[1]!, body: content.slice(match[0].length).replace(/^\r?\n/, '') };
 }
 
+function sanitizeCommentBody(value: string, label: string): string {
+  const result = canonicalizeCommentBody(value);
+  if (!result.ok) throw new Error(`${result.error.code}: ${label}: ${result.error.message} at offset ${result.error.offset}`);
+  return result.value;
+}
+
 function footer(agent: string, taskId: string): string {
   return `---\n*由 ${agent} 自动生成 · 内部追踪：${taskId}*`;
 }
 
 function renderTaskComment(content: string, taskId: string, agent: string): string {
   const split = splitFrontmatter(content);
+  const safeBody = sanitizeCommentBody(split.body, 'task body');
   const taskBody = split.frontmatter === null
-    ? split.body
-    : `<details><summary>元数据 (frontmatter)</summary>\n\n\`\`\`yaml\n---\n${split.frontmatter}\n---\n\`\`\`\n\n</details>\n\n${split.body}`;
+    ? safeBody
+    : `<details><summary>元数据 (frontmatter)</summary>\n\n${renderSafeCodeFence(`---\n${split.frontmatter}\n---`, 'yaml')}\n\n</details>\n\n${safeBody}`;
   return normalizeCommentContent([
     MARKERS.task(taskId),
     '## 任务文件',
@@ -96,13 +110,16 @@ function artifactIdentity(artifact: string): { stem: string; title: string } {
   return { stem, title: `${base}（Round ${round}）` };
 }
 
-function chunkByUtf8(content: string, maxBytes: number): string[] {
+type SourceChunk = { content: string; start: number; end: number };
+
+function chunkByUtf8(content: string, maxBytes: number): SourceChunk[] {
   if (maxBytes <= 0) throw new Error('comment byte limit is too small');
-  const chunks: string[] = [];
-  let remaining = content;
-  while (remaining) {
+  const chunks: SourceChunk[] = [];
+  let start = 0;
+  while (start < content.length) {
+    const remaining = content.slice(start);
     if (Buffer.byteLength(remaining, 'utf8') <= maxBytes) {
-      chunks.push(remaining);
+      chunks.push({ content: remaining, start, end: content.length });
       break;
     }
     let bytes = 0;
@@ -117,10 +134,102 @@ function chunkByUtf8(content: string, maxBytes: number): string[] {
     }
     const cut = newlineIndex > 0 ? newlineIndex : index;
     if (cut === 0) throw new Error('comment byte limit cannot fit one Unicode code point');
-    chunks.push(remaining.slice(0, cut));
-    remaining = remaining.slice(cut);
+    chunks.push({ content: remaining.slice(0, cut), start, end: start + cut });
+    start += cut;
   }
-  return chunks.length > 0 ? chunks : [''];
+  return chunks.length > 0 ? chunks : [{ content: '', start: 0, end: 0 }];
+}
+
+function longestFenceLineRun(content: string, character: '`' | '~'): number {
+  const pattern = new RegExp(`^ {0,3}(${character}+)[ \\t]*(?:\\n|$)`, 'gm');
+  let longest = 0;
+  for (const match of content.matchAll(pattern)) longest = Math.max(longest, match[1]!.length);
+  return longest;
+}
+
+function boundedFence(content: string, sourceCharacter: '`' | '~', maxBytes: number): { opening: string; closing: string } | null {
+  const candidates: Array<'`' | '~'> = sourceCharacter === '`' ? ['~', '`'] : ['`', '~'];
+  for (const character of candidates) {
+    const length = Math.max(3, longestFenceLineRun(content, character) + 1);
+    const delimiter = character.repeat(length);
+    if (Buffer.byteLength(delimiter, 'utf8') * 2 + 2 <= maxBytes) return { opening: `${delimiter}\n`, closing: `${delimiter}\n` };
+  }
+  return null;
+}
+
+function sourceSlice(piece: SourceChunk, start: number, end: number): string {
+  return piece.content.slice(Math.max(0, start - piece.start), Math.max(0, end - piece.start));
+}
+
+function renderOversizedFenceChunk(piece: SourceChunk, fences: readonly FenceRange[], maxBytes: number): string {
+  const insertions = new Map<number, Array<{ value: string; ensureLineStart: boolean }>>();
+  const omitted: Array<{ start: number; end: number }> = [];
+  const insert = (position: number, value: string, ensureLineStart = false) => {
+    const values = insertions.get(position) || [];
+    values.push({ value, ensureLineStart });
+    insertions.set(position, values);
+  };
+
+  for (const fence of fences) {
+    if (piece.end <= fence.start || piece.start >= fence.end) continue;
+    const oversized = Buffer.byteLength(fence.opening, 'utf8') > maxBytes
+      || Buffer.byteLength(fence.closing, 'utf8') > maxBytes;
+    if (!oversized) {
+      if (piece.start > fence.start && piece.start < fence.end) insert(piece.start, fence.opening);
+      if (piece.end > fence.start && piece.end < fence.end) insert(piece.end, fence.closing, true);
+      continue;
+    }
+
+    const code = sourceSlice(piece, Math.max(piece.start, fence.openingEnd), Math.min(piece.end, fence.closingStart));
+    const delimiter = boundedFence(code, fence.character, maxBytes);
+    if (!delimiter) return escapeHtmlText(piece.content);
+    insert(Math.max(piece.start, fence.start), delimiter.opening);
+    insert(Math.min(piece.end, fence.end), delimiter.closing, true);
+    const openingStart = Math.max(piece.start, fence.start);
+    const openingEnd = Math.min(piece.end, fence.openingEnd);
+    if (openingStart < openingEnd) omitted.push({ start: openingStart, end: openingEnd });
+    const closingStart = Math.max(piece.start, fence.closingStart);
+    const closingEnd = Math.min(piece.end, fence.end);
+    if (closingStart < closingEnd) omitted.push({ start: closingStart, end: closingEnd });
+  }
+
+  const boundaries = new Set<number>([piece.start, piece.end]);
+  for (const position of insertions.keys()) boundaries.add(position);
+  for (const range of omitted) {
+    boundaries.add(range.start);
+    boundaries.add(range.end);
+  }
+  const points = [...boundaries].sort((left, right) => left - right);
+  let content = '';
+  for (let index = 0; index < points.length; index += 1) {
+    const point = points[index]!;
+    for (const insertion of insertions.get(point) || []) {
+      if (insertion.ensureLineStart && content.length > 0 && !content.endsWith('\n')) content += '\n';
+      content += insertion.value;
+    }
+    const next = points[index + 1];
+    if (next === undefined) continue;
+    const skipped = omitted.some((range) => range.start <= point && next <= range.end);
+    if (!skipped) content += sourceSlice(piece, point, next);
+  }
+  return content;
+}
+
+function independentChunkContent(piece: SourceChunk, fences: readonly FenceRange[], maxBytes: number): string {
+  const oversizedFence = fences.some((fence) =>
+    piece.end > fence.start && piece.start < fence.end
+    && (Buffer.byteLength(fence.opening, 'utf8') > maxBytes || Buffer.byteLength(fence.closing, 'utf8') > maxBytes)
+  );
+  if (oversizedFence) return renderOversizedFenceChunk(piece, fences, maxBytes);
+  const openingFence = fences.find((fence) => piece.start > fence.start && piece.start < fence.end);
+  const closingFence = fences.find((fence) => piece.end > fence.start && piece.end < fence.end);
+  let content = piece.content;
+  if (openingFence) content = openingFence.opening + content;
+  if (closingFence) {
+    if (!content.endsWith('\n')) content += '\n';
+    content += closingFence.closing;
+  }
+  return content;
 }
 
 function buildArtifactChunk(
@@ -132,7 +241,8 @@ function buildArtifactChunk(
   part: number,
   total: number,
   chunked: boolean,
-  backfill: boolean
+  backfill: boolean,
+  renderedContent = content
 ): RenderedChunk {
   const marker = chunked ? MARKERS.artifactChunk(taskId, stem, part, total) : MARKERS.artifact(taskId, stem);
   const heading = chunked ? `## ${title}（${part}/${total}）` : `## ${title}`;
@@ -144,7 +254,7 @@ function buildArtifactChunk(
     '',
     `> **${agent}** · ${taskId}`,
     '',
-    content,
+    renderedContent,
     '',
     footer(agent, taskId)
   ].join('\n'));
@@ -161,29 +271,44 @@ function chunkArtifactComment(input: {
 }): RenderedChunk[] {
   const byteLimit = input.byteLimit || 60_000;
   const identity = artifactIdentity(input.artifact);
+  const safeBody = sanitizeCommentBody(input.body, 'artifact body');
   const single = buildArtifactChunk(
-    input.taskId, identity.stem, identity.title, input.agent, input.body, 1, 1, false, Boolean(input.backfill)
+    input.taskId, identity.stem, identity.title, input.agent, safeBody, 1, 1, false, Boolean(input.backfill)
   );
   if (Buffer.byteLength(single.body, 'utf8') <= byteLimit) return [single];
 
   let total = 2;
-  let pieces: string[] = [];
+  let payloadLimit = Number.POSITIVE_INFINITY;
+  const ranges = fenceRanges(safeBody);
+  if (!ranges.ok) throw new Error(`${ranges.error.code}: artifact body: ${ranges.error.message} at offset ${ranges.error.offset}`);
   for (;;) {
     const probe = buildArtifactChunk(
       input.taskId, identity.stem, identity.title, input.agent, '', total, total, true, Boolean(input.backfill)
     );
     const available = byteLimit - Buffer.byteLength(probe.body, 'utf8');
-    pieces = chunkByUtf8(input.body, available);
-    if (pieces.length === total) break;
-    total = pieces.length;
+    const sourceLimit = Math.min(available, payloadLimit);
+    if (sourceLimit <= 0) throw new Error('comment byte limit is too small for an artifact chunk');
+    const pieces = chunkByUtf8(safeBody, sourceLimit);
+    if (pieces.length !== total) {
+      total = pieces.length;
+      continue;
+    }
+    const chunks = pieces.map((piece, index) => buildArtifactChunk(
+      input.taskId,
+      identity.stem,
+      identity.title,
+      input.agent,
+      piece.content,
+      index + 1,
+      total,
+      true,
+      Boolean(input.backfill),
+      independentChunkContent(piece, ranges.value, sourceLimit)
+    ));
+    const overflow = Math.max(...chunks.map((chunk) => Buffer.byteLength(chunk.body, 'utf8') - byteLimit));
+    if (overflow <= 0) return chunks;
+    payloadLimit = sourceLimit - overflow;
   }
-  return pieces.map((content, index) => {
-    const chunk = buildArtifactChunk(
-      input.taskId, identity.stem, identity.title, input.agent, content, index + 1, total, true, Boolean(input.backfill)
-    );
-    if (Buffer.byteLength(chunk.body, 'utf8') > byteLimit) throw new Error('rendered comment exceeds byte limit');
-    return chunk;
-  });
 }
 
 function findMarkerComments(comments: RemoteComment[], marker: string): RemoteComment[] {
@@ -224,7 +349,7 @@ function hasResolvedPlatformContext(context: PlatformResult): boolean {
 
 function bodyEnvelope(marker: string, title: string, taskId: string, agent: string, body: string): string {
   return normalizeCommentContent([
-    marker, `## ${title}`, '', `> **${agent}** · ${taskId}`, '', body.replace(/\n+$/, ''), '', footer(agent, taskId)
+    marker, `## ${title}`, '', `> **${agent}** · ${taskId}`, '', sanitizeCommentBody(body, `${title} body`).replace(/\n+$/, ''), '', footer(agent, taskId)
   ].join('\n'));
 }
 
@@ -334,6 +459,15 @@ async function syncPlatformComment(taskRef: string, options: SyncOptions): Promi
       error: { code: 'ISSUE_NOT_LINKED', message: 'Task has no valid issue_number', retryable: false }
     });
   }
+  let desired: RenderedChunk[];
+  try {
+    desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, options);
+  } catch (error) {
+    return platformResult('failed', {
+      resource: { kind: 'issue', number: resourceIdentityNumber(issueIdentityFromTask) },
+      error: { code: 'COMMENT_PAYLOAD_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
+    });
+  }
   const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client: options.client });
   const context = loaded.ok ? loaded.value.context : loaded.context;
   if (!hasResolvedPlatformContext(context) || !loaded.ok) return context;
@@ -356,16 +490,6 @@ async function syncPlatformComment(taskRef: string, options: SyncOptions): Promi
     });
   }
 
-  let desired: RenderedChunk[];
-  try {
-    desired = expectedComments(resolved.taskId, taskContent, resolved.taskDir, options);
-  } catch (error) {
-    return platformResult('failed', {
-      ...contextFields(context),
-      resource: { kind: 'issue', number: issue },
-      error: { code: 'COMMENT_PAYLOAD_INVALID', message: error instanceof Error ? error.message : String(error), retryable: false }
-    });
-  }
   const existing = relatedComments(listed.value, markerPrefix(resolved.taskId, options));
   if (!validateRelatedMarkerSet(existing, markerPrefix(resolved.taskId, options)).ok) {
     return platformResult('failed', {

package/lib/platform/issues.ts

@@ -1,3 +1,5 @@
+import type { PlatformIssueSnapshot as IssueSnapshot } from './snapshots.ts';
+import type { IssueFieldSchema } from './github-data.ts';
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
@@ -38,26 +40,7 @@ import {
 import { resourceIdentityEquals, resourceIdentityNumber, resourceIdentityString, serializeResourceIdentity } from './resource-identity.ts';
 import { taskIssueIdentity, taskIssueIdentityError } from './task-identities.ts';
 import type { ResourceIdentity } from './resource-identity.ts';
-
-type GitHubClient = PlatformClient;
 import type { IssueSnapshot as ProviderIssueSnapshot, RepositoryMetadataSnapshot } from './provider-contract.ts';
-
-type IssueSnapshot = {
-  repository: string;
-  number: number;
-  identity?: ResourceIdentity;
-  databaseId: number | null;
-  nodeId: string;
-  url: string;
-  state: 'open' | 'closed';
-  title: string;
-  body: string;
-  labels: string[];
-  assignees: string[];
-  milestone: string | null;
-  issueType: string | null;
-  fields: Record<string, string | number | null>;
-};
 type IssueResult = PlatformResult & {
   task: { id: string | null; issueNumber: number | null };
   issue: IssueSnapshot | null;
@@ -80,33 +63,6 @@ type SyncOptions = SharedOptions & {
   dryRun?: boolean;
 };
 
-type RemoteIssue = {
-  number?: number;
-  id?: number;
-  node_id?: string;
-  html_url?: string;
-  state?: string;
-  title?: string;
-  body?: string | null;
-  labels?: Array<string | { name?: string }>;
-  assignees?: Array<{ login?: string }>;
-  milestone?: { title?: string } | null;
-  type?: { name?: string } | null;
-  pull_request?: unknown;
-};
-
-type IssueFieldSchema = {
-  id: string;
-  name: string;
-  kind: 'single-select' | 'date' | 'text' | 'number';
-  options: Array<{ id: string; name: string }>;
-};
-type IssueTypeSchema = { id: string; name: string; fields: IssueFieldSchema[] };
-type CurrentField = { id: string; name: string; kind: IssueFieldSchema['kind']; value: string | number | null };
-
-const ISSUE_TYPES_QUERY = `query($owner:String!){organization(login:$owner){issueTypes(first:20){nodes{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}}}}}`;
-const ISSUE_FIELDS_QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){id issueType{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}} issueFieldValues(first:50){nodes{__typename ... on IssueFieldSingleSelectValue{name optionId field{... on IssueFieldSingleSelect{id name}}} ... on IssueFieldDateValue{value field{... on IssueFieldDate{id name}}} ... on IssueFieldTextValue{value field{... on IssueFieldText{id name}}} ... on IssueFieldNumberValue{value field{... on IssueFieldNumber{id name}}}}}}}}`;
-
 function result(
   status: PlatformResult['status'],
   taskId: string | null,
@@ -235,118 +191,6 @@ async function inspectExternalIssue(
   });
 }
 
-function normalizeIssue(remote: RemoteIssue, repository: string, fallbackNumber?: number): IssueSnapshot | null {
-  const number = Number.isInteger(remote.number) && Number(remote.number) > 0
-    ? Number(remote.number)
-    : fallbackNumber;
-  if (!number || !Number.isSafeInteger(number) || remote.pull_request) return null;
-  return {
-    repository,
-    number,
-    databaseId: Number.isInteger(remote.id) ? Number(remote.id) : null,
-    nodeId: remote.node_id || `issue-${number}`,
-    url: remote.html_url || `https://github.com/${repository}/issues/${number}`,
-    state: String(remote.state || '').toLowerCase() === 'closed' ? 'closed' : 'open',
-    title: remote.title || '',
-    body: remote.body || '',
-    labels: (remote.labels || []).map((label) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
-    assignees: (remote.assignees || []).map((assignee) => assignee.login || '').filter(Boolean).sort(),
-    milestone: remote.milestone?.title || null,
-    issueType: remote.type?.name || null,
-    fields: {}
-  };
-}
-
-function fieldKind(value: { __typename?: string }): IssueFieldSchema['kind'] | null {
-  if (value.__typename === 'IssueFieldSingleSelect' || value.__typename === 'IssueFieldSingleSelectValue') return 'single-select';
-  if (value.__typename === 'IssueFieldDate' || value.__typename === 'IssueFieldDateValue') return 'date';
-  if (value.__typename === 'IssueFieldText' || value.__typename === 'IssueFieldTextValue') return 'text';
-  if (value.__typename === 'IssueFieldNumber' || value.__typename === 'IssueFieldNumberValue') return 'number';
-  return null;
-}
-
-function normalizeFieldSchemas(value: unknown): IssueFieldSchema[] {
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((raw) => {
-    const item = raw as { id?: string; name?: string; __typename?: string; options?: Array<{ id?: string; name?: string }> };
-    const kind = fieldKind(item);
-    return item.id && item.name && kind ? [{
-      id: item.id,
-      name: item.name,
-      kind,
-      options: (item.options || []).flatMap((option) => option.id && option.name ? [{ id: option.id, name: option.name }] : [])
-    }] : [];
-  });
-}
-
-function normalizeIssueTypes(value: unknown): IssueTypeSchema[] {
-  const nodes = (value as { data?: { organization?: { issueTypes?: { nodes?: unknown[] } } } })?.data?.organization?.issueTypes?.nodes;
-  return (nodes || []).flatMap((raw) => {
-    const item = raw as { id?: string; name?: string; pinnedFields?: unknown[] };
-    return item.id && item.name ? [{ id: item.id, name: item.name, fields: normalizeFieldSchemas(item.pinnedFields) }] : [];
-  });
-}
-
-function normalizeCurrentFields(value: unknown): { issueId: string | null; type: IssueTypeSchema | null; values: CurrentField[] } {
-  const issue = (value as { data?: { repository?: { issue?: {
-    id?: string;
-    issueType?: { id?: string; name?: string; pinnedFields?: unknown[] } | null;
-    issueFieldValues?: { nodes?: unknown[] };
-  } } } })?.data?.repository?.issue;
-  const type = issue?.issueType?.name ? {
-    id: issue.issueType.id || issue.issueType.name,
-    name: issue.issueType.name,
-    fields: normalizeFieldSchemas(issue.issueType.pinnedFields)
-  } : null;
-  const values = (issue?.issueFieldValues?.nodes || []).flatMap((raw) => {
-    const item = raw as { __typename?: string; name?: string; value?: string | number; field?: { id?: string; name?: string } };
-    const kind = fieldKind(item);
-    const value = kind === 'single-select' ? item.name : item.value;
-    return item.field?.name && kind && value !== undefined
-      ? [{ id: item.field.id || item.field.name, name: item.field.name, kind, value: value ?? null }]
-      : [];
-  });
-  return { issueId: issue?.id || null, type, values };
-}
-
-function graphState(client: GitHubClient, repository: string, issue: number, cwd: string) {
-  const [owner, name] = repository.split('/');
-  if (!owner || !name) return null;
-  const current = client.json<unknown>([
-    'api', 'graphql', '-f', `query=${ISSUE_FIELDS_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${issue}`
-  ], { cwd });
-  if (!current.ok) return null;
-  return normalizeCurrentFields(current.value);
-}
-
-function fetchIssue(client: GitHubClient, repository: string, issue: number, cwd: string) {
-  return client.json<RemoteIssue>(['api', `repos/${repository}/issues/${issue}`], { cwd });
-}
-
-function inspectGitHubIssue(client: GitHubClient, repository: string, issue: number, cwd: string) {
-  const fetched = fetchIssue(client, repository, issue, cwd);
-  if (!fetched.ok) return fetched;
-  const snapshot = normalizeIssue(fetched.value, repository, issue);
-  return snapshot
-    ? { ok: true as const, value: snapshot }
-    : { ok: false as const, error: { code: 'ISSUE_IDENTITY_INVALID', message: 'Remote resource is not a valid Issue', retryable: false } };
-}
-
-function inspectGitHubIssueMetadata(client: GitHubClient, repository: string, issue: number, cwd: string) {
-  const fetched = fetchIssue(client, repository, issue, cwd);
-  if (!fetched.ok) return fetched;
-  const remote = fetched.value;
-  return {
-    ok: true as const,
-    value: {
-      state: String(remote.state || '').toLowerCase() === 'closed' ? 'closed' as const : 'open' as const,
-      labels: (remote.labels || []).map((label: string | { name?: string }) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
-      body: remote.body || '',
-      milestone: remote.milestone?.title || null
-    }
-  };
-}
-
 async function inspectPlatformIssue(taskRef: string, options: SharedOptions = {}): Promise<IssueResult> {
   const base = await resolvedContext(taskRef, options);
   if (!base.ok) return base.output;
@@ -543,14 +387,6 @@ function requirementsFromTask(content: string): Requirement[] {
   }));
 }
 
-function flattenPages(value: unknown): unknown[] {
-  return Array.isArray(value) ? value.flatMap((item) => Array.isArray(item) ? item : [item]) : [];
-}
-
-function listNames(value: unknown): string[] {
-  return flattenPages(value).map((item) => typeof item === 'string' ? item : String((item as { name?: string }).name || '')).filter(Boolean);
-}
-
 function milestoneBasis(repoRoot: string, current: string | null): string | null {
   if (!current || !/^\d+\.\d+\.x$/.test(current)) return current;
   try {
@@ -642,73 +478,6 @@ function desiredFieldValues(frontmatter: Record<string, string>, fields: IssueFi
   return desired;
 }
 
-function planGraphMetadata(
-  client: GitHubClient,
-  repository: string,
-  issue: number,
-  cwd: string,
-  frontmatter: Record<string, string>,
-  options: Pick<SyncOptions, 'issueType' | 'fields'>,
-  capabilities: PlatformResult['capabilities']
-): { operations: PlannedOperation[]; issueId: string | null } {
-  if (!options.issueType && !options.fields) return { operations: [], issueId: null };
-  if (!capabilities.push) return {
-    operations: [
-      ...(options.issueType ? [{ name: 'issue-type', status: 'skipped' as const, reasonCode: 'PUSH_REQUIRED' }] : []),
-      ...(options.fields ? [{ name: 'fields', status: 'skipped' as const, reasonCode: 'PUSH_REQUIRED' }] : [])
-    ], issueId: null
-  };
-  const [owner] = repository.split('/');
-  const typesResult = client.json<unknown>(['api', 'graphql', '-f', `query=${ISSUE_TYPES_QUERY}`, '-F', `owner=${owner}`], { cwd });
-  if (!typesResult.ok) return { operations: [{ name: 'issue-schema', status: 'failed', reasonCode: typesResult.error.code }], issueId: null };
-  const types = normalizeIssueTypes(typesResult.value);
-  if (types.length === 0) return {
-    operations: [
-      ...(options.issueType ? [{ name: 'issue-type', status: 'skipped' as const, reasonCode: 'ISSUE_TYPES_UNSUPPORTED' }] : []),
-      ...(options.fields ? [{ name: 'fields', status: 'skipped' as const, reasonCode: 'ISSUE_TYPES_UNSUPPORTED' }] : [])
-    ], issueId: null
-  };
-  const current = graphState(client, repository, issue, cwd);
-  if (!current?.issueId) return { operations: [{ name: 'issue-schema', status: 'failed', reasonCode: 'ISSUE_GRAPH_IDENTITY_INVALID' }], issueId: null };
-  const target = types.find((type) => type.name === desiredIssueType(frontmatter.type || ''));
-  if (!target) return { operations: [{ name: 'issue-type', status: 'failed', reasonCode: 'ISSUE_TYPE_NOT_FOUND' }], issueId: current.issueId };
-  const operations: PlannedOperation[] = [];
-  if (options.issueType) operations.push(current.type?.id === target.id
-    ? { name: 'issue-type', status: 'no-op', reasonCode: null }
-    : { name: 'issue-type', status: 'planned', reasonCode: null, value: { issueTypeId: target.id } });
-  if (options.fields) {
-    const desired = desiredFieldValues(frontmatter, target.fields);
-    const inputs = desired.filter((field) => current.values.find((value) => value.name === field.name)?.value !== field.value).map((field) => field.input);
-    if (current.type?.id !== target.id) {
-      const targetNames = new Set(target.fields.map((field) => field.name));
-      for (const old of current.values) if (!targetNames.has(old.name)) inputs.push({ fieldId: old.id, delete: true });
-    }
-    operations.push(inputs.length === 0
-      ? { name: 'fields', status: 'no-op', reasonCode: null }
-      : { name: 'fields', status: 'planned', reasonCode: null, value: inputs });
-  }
-  return { operations, issueId: current.issueId };
-}
-
-function executeGraphOperation(
-  client: GitHubClient,
-  cwd: string,
-  issueId: string,
-  operation: PlannedOperation
-) {
-  if (operation.name === 'issue-type') {
-    const query = 'mutation($issueId:ID!,$issueTypeId:ID){updateIssueIssueType(input:{issueId:$issueId,issueTypeId:$issueTypeId}){issue{id}}}';
-    const typeId = (operation.value as { issueTypeId: string }).issueTypeId;
-    return client.json(['api', 'graphql', '--input', '-'], {
-      cwd, method: 'POST', input: JSON.stringify({ query, variables: { issueId, issueTypeId: typeId } })
-    });
-  }
-  const query = 'mutation($issueId:ID!,$issueFields:[IssueFieldCreateOrUpdateInput!]!){setIssueFieldValue(input:{issueId:$issueId,issueFields:$issueFields}){issue{id}}}';
-  return client.json(['api', 'graphql', '--input', '-'], {
-    cwd, method: 'POST', input: JSON.stringify({ query, variables: { issueId, issueFields: operation.value } })
-  });
-}
-
 async function syncPlatformIssue(taskRef: string, options: SyncOptions): Promise<IssueResult> {
   const base = await resolvedContext(taskRef, options);
   if (!base.ok) return base.output;
@@ -849,15 +618,5 @@ async function syncPlatformIssue(taskRef: string, options: SyncOptions): Promise
   });
 }
 
-export {
-  bindPlatformIssue,
-  createPlatformIssue,
-  graphState,
-  inspectGitHubIssue,
-  inspectGitHubIssueMetadata,
-  inspectPlatformIssue,
-  normalizeIssue,
-  requirementSectionAnchors,
-  syncPlatformIssue
-};
-export type { BindOptions, CreateOptions, IssueResult, IssueSnapshot, SyncOptions };
+export { bindPlatformIssue, createPlatformIssue, inspectPlatformIssue, requirementSectionAnchors, syncPlatformIssue };
+export type { BindOptions, CreateOptions, IssueResult, SyncOptions };

package/lib/platform/pr-change-report.ts

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
+import { escapeHtmlText } from './comment-safety.ts';
 
 const REPORT_FILE_NAME = 'pr-change-report.json';
 const REPORT_VERSION = 1 as const;
@@ -483,22 +484,15 @@ function representativePath(file: ChangeFile): string {
   return file.newPath || file.oldPath || '';
 }
 
-function escapeHtml(value: string): string {
-  return value
-    .replaceAll('&', '&')
-    .replaceAll('<', '&lt;')
-    .replaceAll('>', '&gt;')
-    .replaceAll('"', '&quot;')
-    .replaceAll("'", '&#39;')
-    .replaceAll('\r', '\\r')
-    .replaceAll('\n', '\\n');
+function escapeReportText(value: string): string {
+  return escapeHtmlText(value).replaceAll('\r', '\\r').replaceAll('\n', '\\n');
 }
 
 function renderRepresentativePath(file: ChangeFile): string {
   const paths = file.oldPath && file.newPath && file.oldPath !== file.newPath
     ? [file.oldPath, file.newPath]
     : [representativePath(file)];
-  return paths.map((filePath) => `<code>${escapeHtml(filePath)}</code>`).join(' → ');
+  return paths.map((filePath) => `<code>${escapeReportText(filePath)}</code>`).join(' → ');
 }
 
 function representativeScore(file: ChangeFile, metric: 'lines' | 'bytes'): number {
@@ -551,12 +545,12 @@ function renderEvidence(evidence: Evidence): string {
         ? `:${evidence.startLine}`
         : `:${evidence.startLine}-${evidence.endLine}`
       : `:${evidence.startLine ?? evidence.endLine}`;
-  return `  - 证据：<code>${escapeHtml(evidence.path)}</code>${location}：${escapeHtml(evidence.detail)}`;
+  return `  - 证据：<code>${escapeReportText(evidence.path)}</code>${location}：${escapeReportText(evidence.detail)}`;
 }
 
 function renderPrechecks(checks: Precheck[]): string[] {
   return checks.flatMap((check) => [
-    `- **${PRECHECK_LABELS[check.id]}（${check.id}）**：${check.verdict === 'pass' ? '通过' : '需复核'}。${escapeHtml(check.rationale)}`,
+    `- **${PRECHECK_LABELS[check.id]}（${check.id}）**：${check.verdict === 'pass' ? '通过' : '需复核'}。${escapeReportText(check.rationale)}`,
     ...check.evidence.slice(0, 1).map(renderEvidence)
   ]);
 }