@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/internal/platform-pr-review.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { inspectPlatformPullRequestByNumber } from '../platform/pull-requests.js';
 import { listPrReviews, publishPrReview } from '../platform/pr-review.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal platform-pr-review inspect --pr <token> [--cwd <path>]
        agent-infra-internal platform-pr-review list --pr <token> [--cwd <path>]
        agent-infra-internal platform-pr-review publish --pr <token> --scope <taskId|pr{N}> --round <N> --commit <sha> --event <COMMENT|APPROVE|REQUEST_CHANGES> --body-file <path|-> [--dry-run] [--cwd <path>]
@@ -48,12 +49,18 @@ function readBodyFile(value, cwd) {
     return value === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(path.resolve(cwd, value), 'utf8');
 }
 async function platformPrReview(args = []) {
+    if (!ensureInternalHandlerRoute('platform-pr-review', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['inspect', 'list', 'publish'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('platform-pr-review', 'inspect', operation),
+        internalHandlerRoute('platform-pr-review', 'list', operation),
+        operation === 'publish'
+    ].some(Boolean)) {
         fail('a valid operation is required');
         return;
     }
@@ -79,15 +86,16 @@ async function platformPrReview(args = []) {
         fail(`${operation} requires --pr <token>`);
         return;
     }
-    if (operation === 'inspect') {
+    if (internalHandlerRoute('platform-pr-review', 'inspect', operation)) {
         finish(await inspectPlatformPullRequestByNumber(pr, { cwd }));
         return;
     }
-    if (operation === 'list') {
+    if (internalHandlerRoute('platform-pr-review', 'list', operation)) {
         finish(await listPrReviews(pr, { cwd }));
         return;
     }
     const scope = typeof values.scope === 'string' ? values.scope : '';
+    const publishSelector = /^TASK-\d{8}-\d{6}$/u.test(scope) ? 'publish-task' : /^pr\d+$/u.test(scope) ? 'publish-pr' : '';
     const round = Number(values.round);
     const commit = typeof values.commit === 'string' ? values.commit : '';
     const event = values.event;
@@ -95,6 +103,11 @@ async function platformPrReview(args = []) {
         fail('publish requires --scope <taskId|pr{N}>');
         return;
     }
+    if (!internalHandlerRoute('platform-pr-review', 'publish-task', publishSelector)
+        && !internalHandlerRoute('platform-pr-review', 'publish-pr', publishSelector)) {
+        fail('publish scope is not registered');
+        return;
+    }
     if (!Number.isInteger(round) || round <= 0) {
         fail('publish requires a positive --round');
         return;

package/dist/lib/internal/platform-pr.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { bindPlatformPullRequest, createPlatformPullRequest, inspectPlatformPullRequest, resolveExternalPullRequest, skipPlatformPullRequestFact, syncPlatformPullRequest, syncPlatformPullRequestInLabels } from '../platform/pull-requests.js';
 import { reportWrite, summaryContext, syncPullRequestSummary } from '../platform/pr-summary.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal platform-pr inspect <task-ref> [--cwd <path>]
        agent-infra-internal platform-pr resolve-external <task-ref> --agent <agent> [--pr <token>] [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr create <task-ref> --agent <agent> --base <branch> --head <branch> --title-file <path|-> --body-file <path|-> [--draft] [--dry-run] [--cwd <path>]
@@ -12,10 +13,10 @@ const USAGE = `Usage: agent-infra-internal platform-pr inspect <task-ref> [--cwd
        agent-infra-internal platform-pr sync-in-labels --pr <N> [--dry-run] [--cwd <path>]
        agent-infra-internal platform-pr summary-context <task-ref> [--cwd <path>]
        agent-infra-internal platform-pr change-report <task-ref> --agent <agent> --mechanical-file <path> --precheck-file <path> [--dry-run] [--cwd <path>]
-       agent-infra-internal platform-pr summary-sync <task-ref> --agent <agent> --body-file <path|-> --change-report-file <path> --result <pr_created|pr_reused|no_op> [--strict] [--dry-run] [--cwd <path>]
+       agent-infra-internal platform-pr summary-sync <task-ref> --agent <agent> --body-file <path|-> --change-report-file <path> --result <pr_created|pr_reused|no_op> [--manual-phase pending|final ...] [--strict] [--dry-run] [--cwd <path>]
 `;
 const BOOLEAN_FLAGS = new Set(['--draft', '--dry-run', '--metadata', '--closing-issue', '--strict']);
-const VALUE_FLAGS = new Set(['--cwd', '--agent', '--base', '--head', '--title-file', '--body-file', '--change-report-file', '--mechanical-file', '--precheck-file', '--pr', '--result']);
+const VALUE_FLAGS = new Set(['--cwd', '--agent', '--base', '--head', '--title-file', '--body-file', '--change-report-file', '--mechanical-file', '--precheck-file', '--pr', '--result', '--manual-phase', '--transaction-id', '--receipt-digest', '--pr-head-sha']);
 function key(flag) {
     return flag.slice(2).replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
 }
@@ -56,16 +57,29 @@ function readFile(value, cwd) {
     return value === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(path.resolve(cwd, value), 'utf8');
 }
 async function platformPr(args = []) {
+    if (!ensureInternalHandlerRoute('platform-pr', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['inspect', 'resolve-external', 'create', 'bind', 'skip', 'sync', 'sync-in-labels', 'summary-context', 'change-report', 'summary-sync'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('platform-pr', 'inspect', operation),
+        internalHandlerRoute('platform-pr', 'resolve-external', operation),
+        internalHandlerRoute('platform-pr', 'create', operation),
+        internalHandlerRoute('platform-pr', 'bind', operation),
+        internalHandlerRoute('platform-pr', 'skip', operation),
+        internalHandlerRoute('platform-pr', 'sync', operation),
+        internalHandlerRoute('platform-pr', 'sync-in-labels', operation),
+        internalHandlerRoute('platform-pr', 'summary-context', operation),
+        internalHandlerRoute('platform-pr', 'change-report', operation),
+        internalHandlerRoute('platform-pr', 'summary-sync', operation)
+    ].some(Boolean)) {
         fail('a valid operation is required');
         return;
     }
-    if (operation === 'sync-in-labels') {
+    if (internalHandlerRoute('platform-pr', 'sync-in-labels', operation)) {
         const parsed = parse(args, 1);
         if (parsed.error) {
             fail(parsed.error);
@@ -108,18 +122,18 @@ async function platformPr(args = []) {
         'sync-in-labels': ['cwd', 'pr', 'dryRun'],
         'summary-context': ['cwd'],
         'change-report': ['cwd', 'agent', 'mechanicalFile', 'precheckFile', 'dryRun'],
-        'summary-sync': ['cwd', 'agent', 'bodyFile', 'changeReportFile', 'result', 'dryRun', 'strict']
+        'summary-sync': ['cwd', 'agent', 'bodyFile', 'changeReportFile', 'result', 'manualPhase', 'transactionId', 'receiptDigest', 'prHeadSha', 'dryRun', 'strict']
     };
     const unexpected = Object.keys(values).find((name) => !allowed[operation].includes(name));
     if (unexpected) {
         fail(`${operation} does not accept --${unexpected}`);
         return;
     }
-    if (operation === 'inspect') {
+    if (internalHandlerRoute('platform-pr', 'inspect', operation)) {
         finish(await inspectPlatformPullRequest(taskRef, { cwd }));
         return;
     }
-    if (operation === 'summary-context') {
+    if (internalHandlerRoute('platform-pr', 'summary-context', operation)) {
         finish(await summaryContext(taskRef, { cwd }));
         return;
     }
@@ -133,7 +147,7 @@ async function platformPr(args = []) {
         return;
     }
     values.agent = agent;
-    if (operation === 'change-report') {
+    if (internalHandlerRoute('platform-pr', 'change-report', operation)) {
         if (typeof values.mechanicalFile !== 'string' || typeof values.precheckFile !== 'string') {
             fail('change-report requires --mechanical-file and --precheck-file');
             return;
@@ -143,7 +157,7 @@ async function platformPr(args = []) {
         }));
         return;
     }
-    if (operation === 'skip') {
+    if (internalHandlerRoute('platform-pr', 'skip', operation)) {
         finish(await skipPlatformPullRequestFact(taskRef, { cwd, agent, dryRun: values.dryRun === true }));
         return;
     }
@@ -152,7 +166,7 @@ async function platformPr(args = []) {
         fail('--result must be pr_created, pr_reused, or no_op');
         return;
     }
-    if (operation === 'resolve-external') {
+    if (internalHandlerRoute('platform-pr', 'resolve-external', operation)) {
         const pr = values.pr === undefined ? undefined : values.pr;
         if (pr !== undefined && (typeof pr !== 'string' || !pr)) {
             fail('resolve-external requires --pr <token>');
@@ -161,7 +175,7 @@ async function platformPr(args = []) {
         finish(await resolveExternalPullRequest(taskRef, { cwd, agent: values.agent, pr, dryRun: values.dryRun === true }));
         return;
     }
-    if (operation === 'bind') {
+    if (internalHandlerRoute('platform-pr', 'bind', operation)) {
         const pr = values.pr;
         if (typeof pr !== 'string' || !pr) {
             fail('bind requires --pr <token>');
@@ -170,7 +184,7 @@ async function platformPr(args = []) {
         finish(await bindPlatformPullRequest(taskRef, { cwd, agent: values.agent, pr, dryRun: values.dryRun === true }));
         return;
     }
-    if (operation === 'sync') {
+    if (internalHandlerRoute('platform-pr', 'sync', operation)) {
         if (values.metadata !== true && values.closingIssue !== true) {
             fail('sync requires --metadata or --closing-issue');
             return;
@@ -182,7 +196,7 @@ async function platformPr(args = []) {
         finish(await syncPlatformPullRequest(taskRef, { cwd, agent: values.agent, metadata: values.metadata === true, closingIssue: values.closingIssue === true, primaryResult: primaryResult, dryRun: values.dryRun === true }));
         return;
     }
-    if (operation === 'summary-sync') {
+    if (internalHandlerRoute('platform-pr', 'summary-sync', operation)) {
         if (typeof values.bodyFile !== 'string') {
             fail('summary-sync requires --body-file');
             return;
@@ -196,7 +210,21 @@ async function platformPr(args = []) {
             return;
         }
         try {
-            finish(await syncPullRequestSummary(taskRef, { cwd, agent: values.agent, body: readFile(values.bodyFile, cwd), changeReportFile: values.changeReportFile, primaryResult: primaryResult, dryRun: values.dryRun === true, strict: values.strict === true }));
+            const manualPhase = values.manualPhase;
+            if (manualPhase !== undefined && manualPhase !== 'pending' && manualPhase !== 'final') {
+                fail('--manual-phase must be pending or final');
+                return;
+            }
+            finish(await syncPullRequestSummary(taskRef, {
+                cwd, agent: values.agent, body: readFile(values.bodyFile, cwd), changeReportFile: values.changeReportFile,
+                primaryResult: primaryResult, dryRun: values.dryRun === true, strict: values.strict === true,
+                ...(manualPhase ? { manualValidation: {
+                        phase: manualPhase,
+                        ...(typeof values.transactionId === 'string' ? { transactionId: values.transactionId } : {}),
+                        ...(typeof values.receiptDigest === 'string' ? { receiptDigest: values.receiptDigest } : {}),
+                        ...(typeof values.prHeadSha === 'string' ? { prHeadSha: values.prHeadSha } : {})
+                    } } : {})
+            }));
         }
         catch (error) {
             fail(`unable to read body file: ${error instanceof Error ? error.message : String(error)}`);

package/dist/lib/internal/platform-release-notes.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { publishReleaseNotes, releaseNoteContext, stageReleaseNotes } from '../platform/release-notes.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 function parseOptions(args, valueFlags, switchFlags = []) {
     const values = new Map();
     const switches = new Set();
@@ -29,8 +30,10 @@ function finish(result) {
     process.exitCode = result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
 }
 async function platformReleaseNotes(args = []) {
+    if (!ensureInternalHandlerRoute('platform-release-notes', args))
+        return;
     const [action, ...rest] = args;
-    if (action === 'context') {
+    if (internalHandlerRoute('platform-release-notes', 'context', action ?? '')) {
         const parsed = parseOptions(rest, ['--cwd', '--history-limit', '--from-tag', '--to-tag', '--branch']);
         if (!parsed)
             return finish(invalidInput('invalid context options'));
@@ -44,7 +47,7 @@ async function platformReleaseNotes(args = []) {
         }, { cwd }));
         return;
     }
-    if (action === 'stage') {
+    if (internalHandlerRoute('platform-release-notes', 'stage', action ?? '')) {
         const parsed = parseOptions(rest, ['--cwd', '--notes-file']);
         if (!parsed)
             return finish(invalidInput('invalid stage options'));
@@ -54,7 +57,7 @@ async function platformReleaseNotes(args = []) {
         finish(stageReleaseNotes({ notesFile }, { cwd: path.resolve(parsed.values.get('--cwd') || process.cwd()) }));
         return;
     }
-    if (action === 'publish') {
+    if (internalHandlerRoute('platform-release-notes', 'publish', action ?? '')) {
         const parsed = parseOptions(rest, ['--cwd', '--notes-file', '--tag', '--title', '--expected-sha256'], ['--dry-run']);
         if (!parsed)
             return finish(invalidInput('invalid publish options'));

package/dist/lib/internal/platform-security.js

@@ -0,0 +1,93 @@
+import path from 'node:path';
+import { dismissSecurityAlert, readCommentFile, readSecurityAlert } from '../platform/security-alerts.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+const USAGE = `Usage: agent-infra-internal platform-security read --kind <dependabot|code-scanning> --number <number> [--cwd <path>]
+       agent-infra-internal platform-security dismiss --kind <dependabot|code-scanning> --number <number> --reason <reason> --comment-file <path> [--cwd <path>]
+`;
+function fail(message) {
+    process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'SECURITY_INPUT_INVALID', message, retryable: false } })}\n`);
+    process.stderr.write(USAGE);
+    process.exitCode = 1;
+}
+function finish(result) {
+    process.stdout.write(`${JSON.stringify(result)}\n`);
+    process.exitCode = result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0;
+}
+function parseOptions(args) {
+    const values = new Map();
+    const switches = new Set();
+    const valueFlags = new Set(['--cwd', '--kind', '--number', '--reason', '--comment-file']);
+    for (let index = 0; index < args.length; index += 1) {
+        const flag = args[index];
+        if (flag === '--help' || flag === '-h')
+            return null;
+        if (!valueFlags.has(flag) || values.has(flag) || switches.has(flag))
+            return null;
+        const value = args[++index];
+        if (!value || value.startsWith('--'))
+            return null;
+        values.set(flag, value);
+    }
+    return { values, switches };
+}
+function required(values, flag) {
+    const value = values.get(flag);
+    return value && !value.startsWith('--') ? value : null;
+}
+async function platformSecurity(args = []) {
+    if (!ensureInternalHandlerRoute('platform-security', args))
+        return;
+    if (args[0] === '--help' || args[0] === '-h') {
+        process.stdout.write(USAGE);
+        return;
+    }
+    const action = args[0];
+    if (!internalHandlerRoute('platform-security', 'read', action ?? '')
+        && !internalHandlerRoute('platform-security', 'dismiss', action ?? '')) {
+        fail('a valid operation is required');
+        return;
+    }
+    if (action !== 'read' && action !== 'dismiss') {
+        fail('a valid operation is required');
+        return;
+    }
+    const parsed = parseOptions(args.slice(1));
+    if (!parsed) {
+        fail('invalid security alert options');
+        return;
+    }
+    const kind = required(parsed.values, '--kind');
+    const numberRaw = required(parsed.values, '--number');
+    const cwd = path.resolve(required(parsed.values, '--cwd') || process.cwd());
+    if (!kind || !numberRaw) {
+        fail(`${action} requires --kind and --number`);
+        return;
+    }
+    const number = Number(numberRaw);
+    if (!Number.isSafeInteger(number) || number <= 0) {
+        fail('--number must be a positive integer');
+        return;
+    }
+    if (action === 'read') {
+        if ([...parsed.values.keys()].some((flag) => !['--kind', '--number', '--cwd'].includes(flag))) {
+            fail('read does not accept dismissal options');
+            return;
+        }
+        finish(await readSecurityAlert({ kind: kind, number }, { cwd }));
+        return;
+    }
+    const reason = required(parsed.values, '--reason');
+    const commentFile = required(parsed.values, '--comment-file');
+    if (!reason || !commentFile) {
+        fail('dismiss requires --reason and --comment-file');
+        return;
+    }
+    const comment = readCommentFile(commentFile, cwd);
+    if (!comment.ok) {
+        finish({ status: 'failed', changed: false, error: comment.error });
+        return;
+    }
+    finish(await dismissSecurityAlert({ kind: kind, number, reason, comment: comment.value }, { cwd }));
+}
+export { platformSecurity };
+//# sourceMappingURL=platform-security.js.map

package/dist/lib/internal/pr-review-grade.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { collectHostCandidates, decide, deriveTaskIssueMatches, extractClosingIssueNumbers, resolveHostFromCandidates } from '../pr-review/evidence-grading.js';
 import { inspectPlatformPullRequestByNumber } from '../platform/pull-requests.js';
 import { verifyInProcess } from '../task/verification-engine.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = `Usage: agent-infra-internal pr-review-grade decide --input-file <path|-> [--cwd <path>]
        agent-infra-internal pr-review-grade resolve-host --pr <token> [--cwd <path>]
        agent-infra-internal pr-review-grade verify-artifact --artifact-file <path> [--cwd <path>]
@@ -39,12 +40,18 @@ function readInput(value, cwd) {
     return value === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(path.resolve(cwd, value), 'utf8');
 }
 async function prReviewGrade(args = []) {
+    if (!ensureInternalHandlerRoute('pr-review-grade', args))
+        return;
     if (args[0] === '--help' || args[0] === '-h') {
         process.stdout.write(USAGE);
         return;
     }
     const operation = args[0];
-    if (!operation || !['decide', 'resolve-host', 'verify-artifact'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('pr-review-grade', 'decide', operation),
+        internalHandlerRoute('pr-review-grade', 'resolve-host', operation),
+        internalHandlerRoute('pr-review-grade', 'verify-artifact', operation)
+    ].some(Boolean)) {
         fail('a valid operation is required');
         return;
     }
@@ -65,7 +72,7 @@ async function prReviewGrade(args = []) {
         fail(`${operation} does not accept '--${unexpected}'`);
         return;
     }
-    if (operation === 'decide') {
+    if (internalHandlerRoute('pr-review-grade', 'decide', operation)) {
         if (typeof values.inputFile !== 'string') {
             fail('decide requires --input-file');
             return;
@@ -88,7 +95,7 @@ async function prReviewGrade(args = []) {
         }
         return;
     }
-    if (operation === 'resolve-host') {
+    if (internalHandlerRoute('pr-review-grade', 'resolve-host', operation)) {
         const pr = typeof values.pr === 'string' ? values.pr : '';
         if (!pr) {
             fail('resolve-host requires --pr <token>');
@@ -115,6 +122,10 @@ async function prReviewGrade(args = []) {
         });
         return;
     }
+    if (!internalHandlerRoute('pr-review-grade', 'verify-artifact', operation)) {
+        fail('operation is not registered');
+        return;
+    }
     if (typeof values.artifactFile !== 'string') {
         fail('verify-artifact requires --artifact-file');
         return;