@fitlab-ai/agent-infra 0.9.14 → 0.9.15

package/dist/lib/internal/task-operation-registry.js

@@ -1,7 +1,9 @@
 import fs from 'node:fs';
+import path from 'node:path';
 import { accessSandboxTaskView, parseSandboxTaskView, taskViewFromStatus } from '../sandbox/control/task-view.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { PUBLIC_CLI_COMMAND_ALIASES, PUBLIC_CLI_SELECTOR_ALIASES, internalRouteSelector } from './cli-route-inventory.js';
+import { readSandboxControlIdentitySentinel } from '../sandbox/control/identity-sentinel.js';
 const descriptor = (dispatcher, command, selector, scope, effect, taskRefSource = scope === 'non-task' ? 'none' : 'argv') => ({ dispatcher, command, selector, scope, effect, taskRefSource, guardBeforeImport: true });
 function internalTaskRoutes() {
     return [
@@ -14,6 +16,10 @@ function internalTaskRoutes() {
         descriptor('internal', 'sandbox-control', 'execute', 'non-task', 'progress', 'none'),
         descriptor('internal', 'sandbox-control', 'recover', 'conditional', 'recovery', 'delegated'),
         descriptor('internal', 'sandbox-control', 'client', 'conditional', 'progress', 'delegated'),
+        descriptor('internal', 'host-control', 'serve', 'non-task', 'progress', 'none'),
+        descriptor('internal', 'host-control', 'status', 'non-task', 'diagnostic', 'none'),
+        descriptor('internal', 'host-control', 'install', 'non-task', 'progress', 'none'),
+        descriptor('internal', 'host-control', 'uninstall', 'non-task', 'progress', 'none'),
         descriptor('internal', 'agent-client', 'next-steps', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'agent-client', 'model-selection', 'non-task', 'diagnostic', 'none'),
         descriptor('internal', 'codex-lifecycle', 'preflight', 'non-task', 'diagnostic', 'none'),
@@ -110,7 +116,8 @@ function internalTaskRoutes() {
         descriptor('internal', 'task-snapshot', 'snapshot', 'conditional', 'diagnostic'),
         descriptor('internal', 'task-verify', 'event', 'task-bound', 'terminal-verdict'),
         descriptor('internal', 'task-validate', 'snapshot', 'conditional', 'diagnostic'),
-        descriptor('internal', 'task-validate', 'inplace', 'task-bound', 'progress')
+        descriptor('internal', 'task-validate', 'inplace', 'task-bound', 'progress'),
+        descriptor('internal', 'manual-validation', 'transaction', 'task-bound', 'remote-write')
     ];
 }
 function publicTaskRoutes() {
@@ -169,12 +176,12 @@ export const TASK_OPERATION_DESCRIPTORS = Object.freeze([
     ...PUBLIC_OPERATION_DESCRIPTORS
 ]);
 export const INTERNAL_DISPATCHER_ROUTES = Object.freeze([
-    'task-create', 'task-qualification', 'sandbox-control', 'agent-client', 'codex-lifecycle', 'codex-sandbox-controller',
+    'task-create', 'task-qualification', 'sandbox-control', 'host-control', 'agent-client', 'codex-lifecycle', 'codex-sandbox-controller',
     'git-workflow', 'task-delivery', 'release-workflow', 'platform-release-notes', 'platform-security', 'platform-metadata', 'platform-context',
     'platform-comment', 'platform-issue', 'platform-pr', 'platform-pr-review', 'pr-review-grade',
     'platform-checks', 'task-context', 'task-ledger', 'task-warning', 'task-activity', 'task-artifact',
     'task-orchestration', 'task-review', 'task-event', 'task-invalidation', 'task-lifecycle',
-    'task-finalization', 'task-override', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate'
+    'task-finalization', 'task-override', 'task-short-id', 'task-snapshot', 'task-verify', 'task-validate', 'manual-validation'
 ]);
 export const PUBLIC_DISPATCHER_ROUTES = Object.freeze([
     'agent-client', 'cp', 'data', 'decide', 'help', 'init', 'merge', 'run', 'sandbox', 'server', 'task', 'sync', 'update', 'version'
@@ -239,6 +246,33 @@ const TASK_CONTROL_MARKER_KEYS = [
     'AGENT_INFRA_CONTROL_DIR',
     'AGENT_INFRA_CONTROL_STATUS_DIR'
 ];
+const TASK_CONTROL_CONFIG_KEYS = [
+    'AGENT_INFRA_CONTROL_TOKEN',
+    'AGENT_INFRA_CONTROL_GENERATION',
+    'AGENT_INFRA_CONTROL_ROOT_ID',
+    'AGENT_INFRA_CONTROL_DIR',
+    'AGENT_INFRA_CONTROL_STATUS_DIR'
+];
+export const SANDBOX_CONTROL_STATUS_MOUNT = '/run/agent-infra/control-status';
+function nativeDirectoryProbe(candidate) {
+    try {
+        // The fixed mount is a trust anchor. Do not use a mutable node:fs export:
+        // a preload must not turn a mounted sandbox into the direct-host path by
+        // replacing the ordinary filesystem probe.
+        const binding = process.binding('fs');
+        if (!Function.prototype.toString.call(binding.internalModuleStat).includes('[native code]'))
+            return 'unknown';
+        const result = binding.internalModuleStat(candidate);
+        if (result === 1)
+            return 'present';
+        if (result === -2)
+            return 'absent';
+        return 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 function taskMarkerState(env) {
     const present = (key) => Boolean(env[key]);
     const taskId = present('AGENT_INFRA_TASK_ID');
@@ -253,6 +287,70 @@ function taskMarkerState(env) {
         return 'branch-only';
     return 'incomplete';
 }
+export function resolveSandboxControlTransport(env = process.env, options = {}) {
+    const configuredStatusDir = env.AGENT_INFRA_CONTROL_STATUS_DIR;
+    const fixedStatusDir = options.statusMountPath
+        ?? SANDBOX_CONTROL_STATUS_MOUNT;
+    const hasAnyMarker = TASK_MARKER_KEYS.some((key) => Boolean(env[key]))
+        || Boolean(env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING)
+        || Boolean(env.AGENT_INFRA_EXECUTOR_MANIFEST);
+    const fixedStatusProbe = !env.AGENT_INFRA_TEST_HOST_CONTROL_ENDPOINT && path.isAbsolute(fixedStatusDir)
+        ? nativeDirectoryProbe(fixedStatusDir) : 'absent';
+    if (fixedStatusProbe === 'unknown') {
+        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_UNAVAILABLE' };
+    }
+    const fixedStatusMounted = fixedStatusProbe === 'present';
+    const configuredStatusProbe = configuredStatusDir && path.isAbsolute(configuredStatusDir)
+        ? nativeDirectoryProbe(configuredStatusDir) : 'absent';
+    if (configuredStatusProbe === 'unknown') {
+        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_UNAVAILABLE' };
+    }
+    const statusDir = configuredStatusDir && path.isAbsolute(configuredStatusDir) && configuredStatusProbe === 'present'
+        ? configuredStatusDir
+        : fixedStatusMounted ? fixedStatusDir : null;
+    const statusMounted = statusDir !== null;
+    const hasCompleteConfig = TASK_CONTROL_CONFIG_KEYS.every((key) => Boolean(env[key]));
+    if (env.AGENT_INFRA_EXECUTOR_MANIFEST || env.AGENT_INFRA_CONTROL_CONTROLLER_BINDING) {
+        return { kind: 'fail-closed', reasonCode: 'TASK_CONTROL_TRANSPORT_INVALID' };
+    }
+    const taskBound = Boolean(env.AGENT_INFRA_TASK_ID);
+    const runtime = Boolean(env.AGENT_INFRA_RUNTIME_DIR);
+    if (statusMounted) {
+        let sentinel;
+        try {
+            sentinel = readSandboxControlIdentitySentinel(statusDir);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : '';
+            return { kind: 'fail-closed', reasonCode: message.endsWith('MISSING')
+                    ? 'SANDBOX_CONTROL_IDENTITY_MISSING'
+                    : 'SANDBOX_CONTROL_IDENTITY_MALFORMED' };
+        }
+        if (sentinel.generation !== env.AGENT_INFRA_CONTROL_GENERATION) {
+            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_GENERATION_MISMATCH' };
+        }
+        if (env.AGENT_INFRA_CONTROL_ROOT_ID && sentinel.controlRootId !== env.AGENT_INFRA_CONTROL_ROOT_ID) {
+            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_ROOT_ID_MISMATCH' };
+        }
+        if (sentinel.mode === 'task-bound'
+            && (sentinel.taskId !== env.AGENT_INFRA_TASK_ID || !runtime)) {
+            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
+        }
+        if (sentinel.mode === 'branch-only' && (taskBound || runtime)) {
+            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_IDENTITY_TOPOLOGY_MISMATCH' };
+        }
+        if (!hasCompleteConfig) {
+            return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
+        }
+        return { kind: 'broker-client', reasonCode: null };
+    }
+    if (!hasAnyMarker)
+        return { kind: 'direct-host', reasonCode: null };
+    if (!hasCompleteConfig || (taskBound && !runtime) || (!taskBound && runtime)) {
+        return { kind: 'fail-closed', reasonCode: 'SANDBOX_CONTROL_CONFIGURATION_INCOMPLETE' };
+    }
+    return { kind: 'broker-client', reasonCode: null };
+}
 export function hasTaskBoundMarker(env = process.env) {
     return taskMarkerState(env) === 'task-bound';
 }

package/dist/lib/internal/task-review.js

@@ -1,8 +1,9 @@
+import { parseReviewCommand } from '../task/review-command.js';
 import { finalizeReviewSummary } from '../task/review-finalization.js';
 import { consumeHumanOverride, failureId, overrideDryRunConflict } from '../task/human-override.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
-import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
+import { ensureInternalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal task-review <task-ref> finalize-summary --stage <analysis|plan|code> --artifact <review-*.md> [--orchestrated] [--dry-run] [--override-ticket <ticket> --override-target <target> --override-scope <scope>]\n';
 function failUsage(message) {
     process.stdout.write(`${JSON.stringify({
@@ -21,61 +22,15 @@ async function taskReview(args = []) {
         process.stdout.write(USAGE);
         return;
     }
-    if (args.length < 2) {
-        failUsage('task ref and intent are required');
-        return;
-    }
-    if (!internalHandlerRoute('task-review', 'finalize-summary', args[1] ?? '')) {
-        failUsage(`unknown intent '${args[1]}'`);
-        return;
-    }
-    let stage = '';
-    let artifact = '';
-    let dryRun = false;
-    let orchestrated = false;
-    let overrideTicket = '';
-    let overrideTarget = '';
-    let overrideScope = '';
-    const seen = new Set();
-    for (let index = 2; index < args.length; index += 1) {
-        const flag = args[index];
-        if (!['--stage', '--artifact', '--orchestrated', '--dry-run', '--override-ticket', '--override-target', '--override-scope'].includes(flag)) {
-            failUsage(`unknown option '${flag}'`);
-            return;
-        }
-        if (seen.has(flag)) {
-            failUsage(`duplicate option '${flag}'`);
-            return;
-        }
-        seen.add(flag);
-        if (flag === '--dry-run') {
-            dryRun = true;
-            continue;
-        }
-        if (flag === '--orchestrated') {
-            orchestrated = true;
-            continue;
-        }
-        const value = args[++index];
-        if (!value || value.startsWith('--')) {
-            failUsage(`option '${flag}' requires a value`);
-            return;
-        }
-        if (flag === '--stage')
-            stage = value;
-        else if (flag === '--artifact')
-            artifact = value;
-        else if (flag === '--override-ticket')
-            overrideTicket = value;
-        else if (flag === '--override-target')
-            overrideTarget = value;
-        else if (flag === '--override-scope')
-            overrideScope = value;
+    let request;
+    try {
+        request = parseReviewCommand(args);
     }
-    if (!stage || !artifact) {
-        failUsage("options '--stage' and '--artifact' are required");
+    catch (error) {
+        failUsage(error instanceof Error ? error.message : String(error));
         return;
     }
+    const { stage, artifact, dryRun, orchestrated, overrideTicket, overrideTarget, overrideScope } = request;
     const dryRunConflict = overrideDryRunConflict({ dryRun, overrideTicket, overrideTarget, overrideScope });
     if (dryRunConflict) {
         failUsage(dryRunConflict.message);

package/dist/lib/internal/task-validate.js

@@ -16,13 +16,15 @@ import { readSandboxControlManifest } from '../sandbox/control/lifecycle.js';
 import { SANDBOX_CONTROL_FUTURE_SKEW_MS, SANDBOX_CONTROL_STATUS_STALE_MS } from '../sandbox/control/protocol.js';
 import { getProcessStartTime } from '../server/process-state.js';
 import { assertGitWorktreeBinding } from '../git/worktree-identity.js';
+import { createManualValidationEvidence, manualValidationEvidenceSummary } from '../task/manual-validation-evidence.js';
+import { writeJsonAtomic } from '../task/manual-validation-shared.js';
 import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
-const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] -- <command> [args...]`;
+const USAGE = `Usage: agent-infra-internal task-validate <branch | TASK-id | N> [--scope snapshot|inplace] [--timeout <ms>] [--format text|json] [--evidence-file <path>] -- <command> [args...]`;
 const MAX_TIMEOUT_MS = 60 * 60 * 1000;
 const RECOVERY_GRACE_MS = 30_000;
 export function parseValidateArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
-        return { target: '', scope: 'snapshot', timeoutMs: 300_000, format: 'text', command: [], help: true };
+        return { target: '', scope: 'snapshot', timeoutMs: 300_000, format: 'text', evidenceFile: null, command: [], help: true };
     }
     const separator = args.indexOf('--');
     if (separator < 0)
@@ -32,6 +34,7 @@ export function parseValidateArgs(args) {
     let scope = 'snapshot';
     let timeoutMs = 300_000;
     let format = 'text';
+    let evidenceFile = null;
     const positionals = [];
     for (let index = 0; index < optionArgs.length; index += 1) {
         const arg = optionArgs[index];
@@ -53,6 +56,12 @@ export function parseValidateArgs(args) {
                 throw new Error('validate --format must be text or json');
             format = value;
         }
+        else if (arg === '--evidence-file') {
+            const value = optionArgs[++index];
+            if (!value || value.startsWith('-'))
+                throw new Error('validate --evidence-file requires a path');
+            evidenceFile = value;
+        }
         else if (arg.startsWith('-')) {
             throw new Error(`Unknown option: ${arg}`);
         }
@@ -62,7 +71,7 @@ export function parseValidateArgs(args) {
     }
     if (positionals.length !== 1 || command.length === 0)
         throw new Error(USAGE);
-    return { target: positionals[0], scope, timeoutMs, format, command, help: false };
+    return { target: positionals[0], scope, timeoutMs, format, evidenceFile, command, help: false };
 }
 function runValidationCommand(command, cwd, scope, timeoutMs, json) {
     const [file, ...args] = command;
@@ -298,24 +307,35 @@ function taskValidate(args) {
             : internalHandlerRoute('task-validate', 'inplace', options.scope)
                 ? inplaceValidation(config, target, options)
                 : (() => { throw new Error('TASK_VALIDATE_SCOPE_UNREGISTERED'); })();
-        const evidence = {
-            version: 1,
+        const cleanup = result.cleanup();
+        const evidence = createManualValidationEvidence({
+            mode: target.workspace.mode,
             taskId: target.workspace.mode === 'task-bound' ? target.workspace.taskId : null,
             branch: target.branch,
-            scope: options.scope,
             commit,
+            recoverable: target.workspace.mode === 'task-bound',
+            scope: options.scope,
             command: path.basename(options.command[0]),
             startedAt,
             completedAt: new Date().toISOString(),
             exitCode: result.exitCode,
             signal: result.signal,
-            cleanup: result.cleanup()
-        };
+            cleanup
+        });
+        if (options.evidenceFile) {
+            try {
+                writeJsonAtomic(path.resolve(options.evidenceFile), evidence);
+            }
+            catch (error) {
+                throw new Error(`MANUAL_VALIDATION_EVIDENCE_WRITE_FAILED: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        const evidenceSummary = manualValidationEvidenceSummary(evidence);
         if (options.format === 'json') {
-            process.stdout.write(`${JSON.stringify({ status: 'applied', changed: false, evidence, error: null })}\n`);
+            process.stdout.write(`${JSON.stringify({ status: 'applied', changed: false, evidence: evidenceSummary, evidenceFile: options.evidenceFile, error: null })}\n`);
         }
         else {
-            process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidence.command}, cleanup=${evidence.cleanup}).\n`);
+            process.stdout.write(`Validation ${result.exitCode === 0 ? 'passed' : 'failed'} (${options.scope}, ${evidenceSummary.command}, cleanup=${evidenceSummary.cleanup}).\n`);
         }
         process.exitCode = result.exitCode;
     }

package/dist/lib/owned-path.js

@@ -0,0 +1,33 @@
+import fs from 'node:fs';
+import path from 'node:path';
+// Inspect descendants without following symlinks. The caller supplies the trusted root.
+export function inspectOwnedPath(rootInput, targetInput, expect) {
+    const root = path.resolve(rootInput);
+    const target = path.resolve(targetInput);
+    const relative = path.relative(root, target);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+        return null;
+    try {
+        const rootStat = fs.lstatSync(root);
+        if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
+            return null;
+        let current = root;
+        for (const segment of relative.split(path.sep)) {
+            current = path.join(current, segment);
+            const stat = fs.lstatSync(current);
+            if (stat.isSymbolicLink())
+                return null;
+            if (process.platform !== 'win32' && typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                return null;
+            if (current === target)
+                return (expect === 'file' ? stat.isFile() : stat.isDirectory()) ? stat : null;
+            if (!stat.isDirectory())
+                return null;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+//# sourceMappingURL=owned-path.js.map

package/dist/lib/platform/check-status.js

@@ -0,0 +1,11 @@
+export function checkStatusBucket(status) {
+    const value = status.toLowerCase();
+    if (['pass', 'success', 'successful', 'neutral'].includes(value))
+        return 'pass';
+    if (['fail', 'failure', 'failed', 'error', 'timed_out', 'action_required'].includes(value))
+        return 'fail';
+    if (['cancel', 'cancelled', 'canceled', 'skipped', 'stale'].includes(value))
+        return 'cancel';
+    return 'pending';
+}
+//# sourceMappingURL=check-status.js.map

package/dist/lib/platform/comment-safety.js

@@ -168,6 +168,9 @@ function sanitizeMarkdownDocument(value, options = {}) {
         return tail;
     return ok(result + tail.value);
 }
+function canonicalizeCommentBody(value) {
+    return sanitizeMarkdownDocument(value, { reservedMarkers: [CONTROL_MARKER_PATTERN] });
+}
 function renderSafeCodeFence(value, language = '', reservedMarkers = [CONTROL_MARKER_PATTERN]) {
     const content = markerSafe(normalized(value), reservedMarkers);
     const longestRun = Math.max(0, ...(content.match(/`+/g) || []).map((run) => run.length));
@@ -222,5 +225,5 @@ function splitDocumentPlaceholder(value, placeholder) {
     }
     return ok({ prefix: source.slice(0, position), suffix: source.slice(position + placeholder.length) });
 }
-export { CONTROL_MARKER_PATTERN, escapeHtmlAttribute, escapeHtmlText, escapeMarkdownLiteral, fenceRanges, renderSafeCodeFence, sanitizeMarkdownDocument, splitDocumentPlaceholder };
+export { CONTROL_MARKER_PATTERN, escapeHtmlAttribute, escapeHtmlText, escapeMarkdownLiteral, fenceRanges, renderSafeCodeFence, canonicalizeCommentBody, sanitizeMarkdownDocument, splitDocumentPlaceholder };
 //# sourceMappingURL=comment-safety.js.map

package/dist/lib/platform/completion-backfill.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { COMPLETION_BACKFILL_FAMILIES, inspectCompletionArtifacts } from '../task/finalization-artifacts.js';
-import { parseArtifactName } from '../task/artifact-lifecycle.js';
+import { parseArtifactName } from '../task/artifact-name.js';
 import { parseTaskFrontmatter } from '../task/frontmatter.js';
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { getOpenWorkflowWarnings } from '../task/workflow-warnings.js';

package/dist/lib/platform/github-data.js

@@ -0,0 +1,241 @@
+import { checkStatusBucket } from './check-status.js';
+const ISSUE_FIELDS_QUERY = `query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){issue(number:$number){id issueType{id name pinnedFields{__typename ... on IssueFieldSingleSelect{id name options{id name}} ... on IssueFieldDate{id name} ... on IssueFieldText{id name} ... on IssueFieldNumber{id name}}} issueFieldValues(first:50){nodes{__typename ... on IssueFieldSingleSelectValue{name optionId field{... on IssueFieldSingleSelect{id name}}} ... on IssueFieldDateValue{value field{... on IssueFieldDate{id name}}} ... on IssueFieldTextValue{value field{... on IssueFieldText{id name}}} ... on IssueFieldNumberValue{value field{... on IssueFieldNumber{id name}}}}}}}}`;
+function normalizeIssue(remote, repository, fallbackNumber) {
+    const number = Number.isInteger(remote.number) && Number(remote.number) > 0
+        ? Number(remote.number)
+        : fallbackNumber;
+    if (!number || !Number.isSafeInteger(number) || remote.pull_request)
+        return null;
+    return {
+        repository,
+        number,
+        databaseId: Number.isInteger(remote.id) ? Number(remote.id) : null,
+        nodeId: remote.node_id || `issue-${number}`,
+        url: remote.html_url || `https://github.com/${repository}/issues/${number}`,
+        state: String(remote.state || '').toLowerCase() === 'closed' ? 'closed' : 'open',
+        title: remote.title || '',
+        body: remote.body || '',
+        labels: (remote.labels || []).map((label) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
+        assignees: (remote.assignees || []).map((assignee) => assignee.login || '').filter(Boolean).sort(),
+        milestone: remote.milestone?.title || null,
+        issueType: remote.type?.name || null,
+        fields: {}
+    };
+}
+function fieldKind(value) {
+    if (value.__typename === 'IssueFieldSingleSelect' || value.__typename === 'IssueFieldSingleSelectValue')
+        return 'single-select';
+    if (value.__typename === 'IssueFieldDate' || value.__typename === 'IssueFieldDateValue')
+        return 'date';
+    if (value.__typename === 'IssueFieldText' || value.__typename === 'IssueFieldTextValue')
+        return 'text';
+    if (value.__typename === 'IssueFieldNumber' || value.__typename === 'IssueFieldNumberValue')
+        return 'number';
+    return null;
+}
+function normalizeFieldSchemas(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((raw) => {
+        const item = raw;
+        const kind = fieldKind(item);
+        return item.id && item.name && kind ? [{
+                id: item.id,
+                name: item.name,
+                kind,
+                options: (item.options || []).flatMap((option) => option.id && option.name ? [{ id: option.id, name: option.name }] : [])
+            }] : [];
+    });
+}
+function normalizeCurrentFields(value) {
+    const issue = value?.data?.repository?.issue;
+    const type = issue?.issueType?.name ? {
+        id: issue.issueType.id || issue.issueType.name,
+        name: issue.issueType.name,
+        fields: normalizeFieldSchemas(issue.issueType.pinnedFields)
+    } : null;
+    const values = (issue?.issueFieldValues?.nodes || []).flatMap((raw) => {
+        const item = raw;
+        const kind = fieldKind(item);
+        const value = kind === 'single-select' ? item.name : item.value;
+        return item.field?.name && kind && value !== undefined
+            ? [{ id: item.field.id || item.field.name, name: item.field.name, kind, value: value ?? null }]
+            : [];
+    });
+    return { issueId: issue?.id || null, type, values };
+}
+function graphState(client, repository, issue, cwd) {
+    const [owner, name] = repository.split('/');
+    if (!owner || !name)
+        return null;
+    const current = client.json([
+        'api', 'graphql', '-f', `query=${ISSUE_FIELDS_QUERY}`, '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `number=${issue}`
+    ], { cwd });
+    if (!current.ok)
+        return null;
+    return normalizeCurrentFields(current.value);
+}
+function fetchIssue(client, repository, issue, cwd) {
+    return client.json(['api', `repos/${repository}/issues/${issue}`], { cwd });
+}
+function inspectGitHubIssue(client, repository, issue, cwd) {
+    const fetched = fetchIssue(client, repository, issue, cwd);
+    if (!fetched.ok)
+        return fetched;
+    const snapshot = normalizeIssue(fetched.value, repository, issue);
+    return snapshot
+        ? { ok: true, value: snapshot }
+        : { ok: false, error: { code: 'ISSUE_IDENTITY_INVALID', message: 'Remote resource is not a valid Issue', retryable: false } };
+}
+const CLOSING_PULL_REQUESTS_QUERY = `query($owner:String!,$name:String!,$issue:Int!,$cursor:String){repository(owner:$owner,name:$name){issue(number:$issue){closedByPullRequestsReferences(first:100,after:$cursor){nodes{number id url state title body isDraft headRefName headRefOid headRepository{nameWithOwner} baseRefName baseRefOid baseRepository{nameWithOwner} mergedAt mergeCommit{oid} labels(first:100){nodes{name}} assignees(first:100){nodes{login}} milestone{title}} pageInfo{hasNextPage endCursor}}}}}`;
+function normalizePullRequest(remote, repository) {
+    const number = Number(remote.number);
+    const headRepository = remote.head?.repo?.full_name;
+    const baseRepository = remote.base?.repo?.full_name;
+    if (!Number.isInteger(number) || number <= 0 || !remote.node_id || !remote.html_url ||
+        !remote.head?.ref || !remote.head.sha || !headRepository || !remote.base?.ref || !baseRepository)
+        return null;
+    const mergeabilityDetail = remote.mergeable_state?.trim().toLowerCase() || null;
+    const mergeability = remote.mergeable === false
+        ? { state: 'conflicting', detail: mergeabilityDetail }
+        : remote.mergeable === true && mergeabilityDetail !== 'dirty'
+            ? { state: 'mergeable', detail: mergeabilityDetail }
+            : { state: 'unknown', detail: mergeabilityDetail };
+    return {
+        repository,
+        number,
+        nodeId: remote.node_id,
+        url: remote.html_url,
+        state: remote.state === 'closed' ? 'closed' : 'open',
+        title: remote.title || '',
+        body: remote.body || '',
+        draft: Boolean(remote.draft),
+        head: { repository: headRepository, ref: remote.head.ref, sha: remote.head.sha },
+        base: { repository: baseRepository, ref: remote.base.ref, sha: remote.base.sha || '' },
+        mergedAt: remote.merged_at || null,
+        mergeCommitSha: remote.merge_commit_sha || null,
+        labels: (remote.labels || []).map((label) => typeof label === 'string' ? label : label.name || '').filter(Boolean).sort(),
+        assignees: (remote.assignees || []).map((assignee) => assignee.login || '').filter(Boolean).sort(),
+        milestone: remote.milestone?.title || null,
+        mergeability
+    };
+}
+function normalizeClosingPullRequest(node, repository) {
+    return normalizePullRequest({
+        number: node.number,
+        node_id: node.id,
+        html_url: node.url,
+        state: node.state === 'OPEN' ? 'open' : 'closed',
+        title: node.title,
+        body: node.body,
+        draft: node.isDraft,
+        head: { ref: node.headRefName, sha: node.headRefOid, repo: node.headRepository ? { full_name: node.headRepository.nameWithOwner } : null },
+        base: { ref: node.baseRefName, sha: node.baseRefOid, repo: node.baseRepository ? { full_name: node.baseRepository.nameWithOwner } : null },
+        merged_at: node.mergedAt,
+        merge_commit_sha: node.mergeCommit?.oid,
+        labels: node.labels?.nodes,
+        assignees: node.assignees?.nodes,
+        milestone: node.milestone
+    }, repository);
+}
+function inspectGitHubIssueClosingChangeRequests(client, repository, issueNumber, cwd) {
+    const [owner, name] = repository.split('/');
+    if (!owner || !name || !Number.isInteger(issueNumber) || issueNumber <= 0)
+        return {
+            ok: false,
+            error: { code: 'PR_IDENTITY_INVALID', message: 'Repository or Issue identity is invalid', retryable: false }
+        };
+    const candidates = [];
+    let cursor = null;
+    for (;;) {
+        const args = [
+            'api', 'graphql', '-f', `query=${CLOSING_PULL_REQUESTS_QUERY}`,
+            '-F', `owner=${owner}`, '-F', `name=${name}`, '-F', `issue=${issueNumber}`
+        ];
+        if (cursor)
+            args.push('-F', `cursor=${cursor}`);
+        const response = client.json(args, { cwd });
+        if (!response.ok)
+            return response;
+        const connection = response.value?.data?.repository?.issue?.closedByPullRequestsReferences;
+        if (!connection || !Array.isArray(connection.nodes) || !connection.pageInfo)
+            return {
+                ok: false,
+                error: { code: 'PR_IDENTITY_INVALID', message: 'Closing pull request response is incomplete', retryable: false }
+            };
+        for (const node of connection.nodes) {
+            const normalized = normalizeClosingPullRequest(node, repository);
+            if (!normalized)
+                return {
+                    ok: false,
+                    error: { code: 'PR_IDENTITY_INVALID', message: 'Closing pull request identity is incomplete', retryable: false }
+                };
+            candidates.push(normalized);
+        }
+        if (!connection.pageInfo.hasNextPage)
+            return { ok: true, value: candidates };
+        if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor)
+            return {
+                ok: false,
+                error: { code: 'PR_IDENTITY_INVALID', message: 'Closing pull request pagination cursor is invalid', retryable: false }
+            };
+        cursor = connection.pageInfo.endCursor;
+    }
+}
+function inspectGitHubPullRequest(client, repository, number, cwd) {
+    const fetched = client.json(['api', `repos/${repository}/pulls/${number}`], { cwd });
+    if (!fetched.ok)
+        return fetched;
+    const pullRequest = normalizePullRequest(fetched.value, repository);
+    return pullRequest
+        ? { ok: true, value: pullRequest }
+        : { ok: false, error: { code: 'PR_IDENTITY_INVALID', message: 'Remote resource is not a valid pull request', retryable: false } };
+}
+function normalizeGitHubChecks(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.flatMap((raw) => {
+        const item = raw;
+        const name = String(item.name || item.context || '');
+        return name ? [{
+                name,
+                status: checkStatusBucket(String(item.bucket || item.status || item.conclusion || item.state || '')),
+                conclusion: item.conclusion ? String(item.conclusion) : item.state ? String(item.state) : null,
+                detailsUrl: item.link ? String(item.link) : item.detailsUrl ? String(item.detailsUrl) : null
+            }] : [];
+    });
+}
+function inspectGitHubRequiredChecks(client, repository, number, cwd) {
+    const inspected = client.json([
+        'pr', 'checks', String(number), '--repo', repository,
+        '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
+    ], { cwd });
+    return inspected.ok
+        ? { ok: true, value: normalizeGitHubChecks(inspected.value) }
+        : { ok: false, error: inspected.error };
+}
+function parseRunJobIdentity(detailsUrl) {
+    try {
+        const url = new URL(detailsUrl);
+        if (url.hostname !== 'github.com')
+            return null;
+        const match = url.pathname.match(/\/actions\/runs\/(\d+)(?:\/job\/(\d+))?/);
+        if (!match)
+            return null;
+        return { runId: Number(match[1]), jobId: match[2] ? Number(match[2]) : null };
+    }
+    catch {
+        return null;
+    }
+}
+function fetchCheckLogText(client, args, cwd) {
+    if (!client.text)
+        return { ok: false, error: { code: 'PLATFORM_CLIENT_TEXT_UNAVAILABLE', message: 'Platform client does not support text responses', retryable: false } };
+    const fetched = client.text(args, { cwd });
+    if (fetched.ok || args[0] !== 'api' || !/response contains terminal escape sequences/i.test(fetched.error.message)) {
+        return fetched;
+    }
+    return client.text([...args, '--allow-escape-sequences'], { cwd });
+}
+export { ISSUE_FIELDS_QUERY, graphState, inspectGitHubIssue, normalizePullRequest, inspectGitHubIssueClosingChangeRequests, inspectGitHubPullRequest, inspectGitHubRequiredChecks, parseRunJobIdentity, fetchCheckLogText };
+//# sourceMappingURL=github-data.js.map