@fitlab-ai/agent-infra 0.9.15 → 0.11.0

package/dist/lib/platform/pr-summary.js

@@ -11,6 +11,7 @@ import { normalizeCommentContent } from './issue-comments.js';
 import { CONTROL_MARKER_PATTERN, escapeHtmlText, sanitizeMarkdownDocument, splitDocumentPlaceholder } from './comment-safety.js';
 import { platformResult } from './types.js';
 import { providerError, providerOperationContext, providerStatus, providerResourceToken, resourceIdentityNumber, unsupportedProviderOperation } from './provider-bridge.js';
+import { resourceIdentityEquals } from './resource-identity.js';
 import { buildPrChangeReport, CANONICAL_REPORT_PLACEHOLDER, readPrChangeReport, replaceCanonicalReportPlaceholder, runMechanicalChangeReport, taskIntentDigest, validateMechanicalReport, validatePrecheckCandidate, writePrChangeReportAtomic } from './pr-change-report.js';
 import { manualValidationFinalSummaryProjectionMatches } from '../task/manual-validation-receipt.js';
 import { readManualValidationCompletion } from '../task/manual-validation-completion.js';
@@ -48,7 +49,8 @@ function readBoundTaskSnapshot(taskMdPath) {
     const frontmatter = parseTypedTaskFrontmatter(taskContent);
     const fact = readPrDeliveryFact(frontmatter);
     const boundFact = fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact : null;
-    return { taskContent, boundFact };
+    const factError = fact.status === 'invalid' ? { code: fact.error.code, message: fact.error.message } : null;
+    return { taskContent, boundFact, factError };
 }
 function boundPrNumberForWarning(taskMdPath) {
     try {
@@ -117,7 +119,7 @@ function isHardSummaryFailure(error) {
 function inspectionError(error) {
     return error.retryable ? 'blocked' : 'failed';
 }
-async function inspectBoundPullRequest(context, repoRoot, prNumber, loadedContext) {
+async function inspectBoundPullRequest(context, repoRoot, prIdentity, loadedContext) {
     if (!context.platform.repository) {
         return { ok: false, status: context.status, error: context.error };
     }
@@ -126,16 +128,15 @@ async function inspectBoundPullRequest(context, repoRoot, prNumber, loadedContex
         : await resolvePlatformProviderContext({ cwd: repoRoot });
     if (!loaded.ok)
         return { ok: false, status: loaded.context.status, error: loaded.context.error };
-    const target = providerResourceToken(loaded.value.provider, 'pull-request', String(prNumber));
     const inspected = loaded.value.provider.changeRequests?.inspect
-        ? await loaded.value.provider.changeRequests.inspect({ context: providerOperationContext(loaded.value), target })
+        ? await loaded.value.provider.changeRequests.inspect({ context: providerOperationContext(loaded.value), target: prIdentity })
         : unsupportedProviderOperation(loaded.value.provider, 'changeRequests.inspect');
     if (!inspected.ok) {
         const error = providerError(inspected.error, 'PLATFORM_PROVIDER_OPERATION_FAILED');
         return { ok: false, status: inspectionError(error), error };
     }
     const remote = inspected.value;
-    const number = remote.number ?? resourceIdentityNumber(remote.identity) ?? prNumber;
+    const number = remote.number ?? resourceIdentityNumber(remote.identity) ?? resourceIdentityNumber(prIdentity) ?? 0;
     const head = remote.head || { repository: context.platform.repository, ref: '', sha: remote.headSha || '' };
     const base = remote.base || { repository: context.platform.repository, ref: '', sha: remote.baseSha || '' };
     return {
@@ -143,6 +144,7 @@ async function inspectBoundPullRequest(context, repoRoot, prNumber, loadedContex
         value: {
             repository: context.platform.repository,
             number,
+            identity: remote.identity ?? prIdentity,
             nodeId: remote.id,
             url: remote.displayUrl || '',
             state: remote.state === 'closed' ? 'closed' : 'open',
@@ -163,20 +165,22 @@ async function inspectBoundPullRequest(context, repoRoot, prNumber, loadedContex
 function sameIdentity(left, right) {
     return JSON.stringify({
         repository: left.repository,
-        number: left.number,
+        identity: left.identity ?? null,
         base: left.base,
         head: left.head
     }) === JSON.stringify({
         repository: right.repository,
-        number: right.number,
+        identity: right.identity ?? null,
         base: right.base,
         head: right.head
     });
 }
 function identityFromSnapshot(snapshot) {
+    if (!snapshot.identity)
+        throw new Error('pull-request snapshot has no canonical identity');
     return {
         repository: snapshot.repository,
-        number: snapshot.number,
+        resource: snapshot.identity,
         base: { ...snapshot.base },
         head: { ...snapshot.head }
     };
@@ -205,7 +209,7 @@ function currentReportCheck(report, snapshot, taskContent, repoRoot) {
     if (!digest.ok)
         return { ok: false, error: platformError(digest.error) };
     const reportIdentity = report.identity;
-    if (reportIdentity.repository !== snapshot.repository || reportIdentity.number !== snapshot.number ||
+    if (reportIdentity.repository !== snapshot.repository || !resourceIdentityEquals(reportIdentity.resource, snapshot.identity) ||
         JSON.stringify(reportIdentity.base) !== JSON.stringify(snapshot.base) || JSON.stringify(reportIdentity.head) !== JSON.stringify(snapshot.head))
         return {
             ok: false,
@@ -263,14 +267,23 @@ async function summaryContext(taskRef, options = {}) {
         };
     const taskContent = fs.readFileSync(resolved.taskMdPath, 'utf8');
     const frontmatter = parseTypedTaskFrontmatter(taskContent);
-    const fact = readPrDeliveryFact(frontmatter, options.runtimeVersion);
-    const prNumber = fact.status === 'valid' && fact.fact.state === 'bound' ? resourceIdentityNumber(fact.fact.identity.resource) : null;
     const reportPath = taskReportPath(resolved.taskDir);
+    const fact = readPrDeliveryFact(frontmatter, options.runtimeVersion);
+    if (fact.status === 'invalid')
+        return {
+            ...platformResult('failed', { error: { code: fact.error.code, message: fact.error.message, retryable: false } }),
+            task: { id: resolved.taskId, prNumber: null },
+            pullRequest: null,
+            changeReport: { status: 'invalid', path: reportPath, taskIntentSha256: null, reason: fact.error.message },
+            artifacts: []
+        };
+    const prIdentity = fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact.identity.resource : null;
+    const prNumber = resourceIdentityNumber(prIdentity);
     const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client: options.client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
     let pullRequest = null;
-    if (loaded.ok && prNumber && context.platform.repository && ['no-op', 'degraded'].includes(context.status)) {
-        const inspected = await inspectBoundPullRequest(context, resolved.repoRoot, prNumber, loaded.value);
+    if (loaded.ok && prIdentity && context.platform.repository && ['no-op', 'degraded'].includes(context.status)) {
+        const inspected = await inspectBoundPullRequest(context, resolved.repoRoot, prIdentity, loaded.value);
         if (inspected.ok)
             pullRequest = inspected.value;
     }
@@ -290,14 +303,15 @@ async function summaryContext(taskRef, options = {}) {
 }
 async function summaryCommentState(taskRef, options = {}) {
     const context = await summaryContext(taskRef, options);
-    if (!context.task.prNumber || !context.pullRequest)
+    const prIdentity = context.pullRequest?.identity;
+    if (!prIdentity)
         return { ...context, comment: null };
     const loaded = await resolvePlatformProviderContext({ cwd: options.cwd, client: options.client });
     if (!loaded.ok || !loaded.value.provider.comments?.list)
         return { ...context, comment: null };
     const listed = await loaded.value.provider.comments.list({
         context: providerOperationContext(loaded.value),
-        parent: providerResourceToken(loaded.value.provider, 'pull-request', String(context.task.prNumber))
+        parent: prIdentity
     });
     if (!listed.ok)
         return { ...context, comment: null };
@@ -311,6 +325,21 @@ async function reportWrite(taskRef, options) {
     const resolved = resolveTaskRef(taskRef, options.cwd ? { repoRoot: options.cwd } : {});
     if (!resolved.ok)
         return { ...platformResult('failed', { error: { code: resolved.code, message: resolved.message, retryable: false } }), report: null };
+    let preflight;
+    try {
+        preflight = readBoundTaskSnapshot(resolved.taskMdPath);
+    }
+    catch (error) {
+        return {
+            ...platformResult('failed', { error: { code: 'PR_CHANGE_REPORT_FAILED', message: error instanceof Error ? error.message : String(error), retryable: false } }),
+            report: null
+        };
+    }
+    if (preflight.factError)
+        return {
+            ...platformResult('failed', { error: { code: preflight.factError.code, message: preflight.factError.message, retryable: false } }),
+            report: null
+        };
     const loaded = await resolvePlatformProviderContext({ cwd: resolved.repoRoot, client: options.client });
     const context = loaded.ok ? loaded.value.context : loaded.context;
     if (!loaded.ok || !context.platform.repository || !['no-op', 'degraded'].includes(context.status))
@@ -318,20 +347,21 @@ async function reportWrite(taskRef, options) {
     let knownPrNumber = null;
     try {
         return await withTaskExecutionLock(resolved.repoRoot, resolved.taskId, options.agent, async () => {
-            const { taskContent, boundFact } = readBoundTaskSnapshot(resolved.taskMdPath);
-            if (!boundFact)
+            const { taskContent, boundFact, factError } = readBoundTaskSnapshot(resolved.taskMdPath);
+            if (factError)
                 return {
-                    ...basePlatformResult('failed', context, resolved.taskId, null, { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false }),
+                    ...basePlatformResult('failed', context, resolved.taskId, null, { code: factError.code, message: factError.message, retryable: false }),
                     report: null
                 };
-            const boundPrNumber = resourceIdentityNumber(boundFact.identity.resource);
-            if (!boundPrNumber)
+            if (!boundFact)
                 return {
-                    ...basePlatformResult('failed', context, resolved.taskId, null, { code: 'PR_NUMBER_INVALID', message: 'Bound pull request has no numeric identifier', retryable: false }),
+                    ...basePlatformResult('failed', context, resolved.taskId, null, { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false }),
                     report: null
                 };
+            const boundPrIdentity = boundFact.identity.resource;
+            const boundPrNumber = resourceIdentityNumber(boundPrIdentity);
             knownPrNumber = boundPrNumber;
-            const initial = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrNumber, loaded.value);
+            const initial = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrIdentity, loaded.value);
             if (!initial.ok)
                 return { ...basePlatformResult(initial.status, context, resolved.taskId, boundPrNumber, initial.error), report: null };
             const digest = taskIntentDigest(taskContent);
@@ -364,7 +394,7 @@ async function reportWrite(taskRef, options) {
             const built = buildPrChangeReport(identityFromSnapshot(initial.value), digest.value.sha256, mechanical.value, candidate.value);
             if (!built.ok)
                 return { ...basePlatformResult('failed', context, resolved.taskId, boundPrNumber, platformError(built.error)), report: null };
-            const final = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrNumber, loaded.value);
+            const final = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrIdentity, loaded.value);
             if (!final.ok)
                 return { ...basePlatformResult(final.status, context, resolved.taskId, boundPrNumber, final.error), report: null };
             if (!sameIdentity(initial.value, final.value))
@@ -466,7 +496,12 @@ async function syncPullRequestSummary(taskRef, options) {
     }
     try {
         const execute = async () => {
-            const { taskContent, boundFact } = readBoundTaskSnapshot(resolved.taskMdPath);
+            const { taskContent, boundFact, factError } = readBoundTaskSnapshot(resolved.taskMdPath);
+            if (factError)
+                return {
+                    ...platformResult('failed', { resource: { kind: 'pull-request', number: null }, error: { code: factError.code, message: factError.message, retryable: false } }),
+                    result: null, warnings: []
+                };
             if (!boundFact)
                 return {
                     ...platformResult('failed', { resource: { kind: 'pull-request', number: null }, error: { code: 'PR_NOT_LINKED', message: 'Task has no verified bound pull request', retryable: false } }),
@@ -474,14 +509,9 @@ async function syncPullRequestSummary(taskRef, options) {
                 };
             const prIdentity = boundFact.identity.resource;
             const boundPrNumber = resourceIdentityNumber(prIdentity);
-            if (!boundPrNumber)
-                return {
-                    ...platformResult('failed', { resource: { kind: 'pull-request', number: null }, error: { code: 'PR_NUMBER_INVALID', message: 'Bound pull request has no numeric identifier', retryable: false } }),
-                    result: null, warnings: []
-                };
             knownPrNumber = boundPrNumber;
             const prNumber = boundPrNumber;
-            const initial = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrNumber, loaded.value);
+            const initial = await inspectBoundPullRequest(context, resolved.repoRoot, prIdentity, loaded.value);
             if (!initial.ok)
                 return fail(initial.status, context, initial.error);
             const manual = options.manualValidation;
@@ -491,6 +521,8 @@ async function syncPullRequestSummary(taskRef, options) {
             if (manual && (manual.phase === 'pending' ? hasFinalManualValidation : !hasFinalManualValidation))
                 return fail('failed', context, { code: 'MANUAL_VALIDATION_SUMMARY_PHASE_INVALID', message: 'manual-validation summary phase does not match the requested writer phase', retryable: false }, prNumber);
             if (manual) {
+                if (prNumber === null)
+                    return fail('failed', context, { code: 'MANUAL_VALIDATION_PR_NUMBER_REQUIRED', message: 'manual-validation summary requires a numeric pull-request identity', retryable: false }, prNumber);
                 if (manual.phase === 'final' && (!manual.transactionId || !manual.receiptDigest || !manual.prHeadSha || manual.prHeadSha !== initial.value.head.sha))
                     return fail('failed', context, { code: 'MANUAL_VALIDATION_TRANSACTION_REQUIRED', message: 'final manual-validation summary requires transaction, receipt, and current head identity', retryable: false }, prNumber);
                 if (manual.phase === 'final') {
@@ -570,7 +602,7 @@ async function syncPullRequestSummary(taskRef, options) {
                 ? listed.value.find((comment) => comment.id === reconciliation.commentId)?.body ?? null
                 : null;
             const info = { precheckVerdict: report.value.precheck.verdict, nextAction: report.value.precheck.route };
-            const beforeWrite = await inspectBoundPullRequest(context, resolved.repoRoot, boundPrNumber, loaded.value);
+            const beforeWrite = await inspectBoundPullRequest(context, resolved.repoRoot, prIdentity, loaded.value);
             if (!beforeWrite.ok)
                 return fail(beforeWrite.status, context, beforeWrite.error, prNumber);
             if (!sameIdentity(initial.value, beforeWrite.value))
@@ -605,7 +637,7 @@ async function syncPullRequestSummary(taskRef, options) {
                 : unsupportedProviderOperation(loaded.value.provider, 'comments.write');
             if (!written.ok)
                 return fail(providerStatus(written.error) === 'blocked' ? 'blocked' : 'failed', context, providerError(written.error, 'PLATFORM_PROVIDER_OPERATION_FAILED'), prNumber);
-            const after = await inspectBoundPullRequest(context, resolved.repoRoot, prNumber, loaded.value);
+            const after = await inspectBoundPullRequest(context, resolved.repoRoot, prIdentity, loaded.value);
             const id = /^\d+$/.test(written.value.remoteId) ? Number(written.value.remoteId) : written.value.remoteId;
             const compensateWrittenSummary = async () => reconciliation.action === 'create'
                 ? written.value.remoteId && loaded.value.provider.comments?.delete

package/dist/lib/platform/pull-requests.js

@@ -252,7 +252,7 @@ async function resolvedContext(taskRef, options) {
     const fact = factRead.status === 'valid' ? factRead.fact : null;
     let issueIdentity;
     try {
-        issueIdentity = taskIssueIdentity(frontmatter, undefined, options.runtimeVersion);
+        issueIdentity = taskIssueIdentity(frontmatter);
     }
     catch (error) {
         return { ok: false, output: result('failed', resolved.taskId, null, null, { error: { ...taskIssueIdentityError(error), retryable: false } }) };
@@ -776,7 +776,7 @@ async function resolveExternalPullRequest(taskRef, options) {
         return externalResult(result('failed', base.resolved.taskId, null, base.prNumber, {
             platform: base.context.platform,
             capabilities: base.context.capabilities,
-            error: { code: 'EXTERNAL_DELIVERY_ISSUE_REQUIRED', message: 'External delivery requires a valid issue_number', retryable: false }
+            error: { code: 'EXTERNAL_DELIVERY_ISSUE_REQUIRED', message: 'External delivery requires a valid platform issue identity', retryable: false }
         }));
     const inspected = base.provider.changeRequests?.listClosing
         ? await base.provider.changeRequests.listClosing({
@@ -1285,7 +1285,7 @@ function skipPlatformPullRequestFactUnlocked(resolved, options) {
     }
     let issueIdentity;
     try {
-        issueIdentity = taskIssueIdentity(frontmatter, undefined, options.runtimeVersion);
+        issueIdentity = taskIssueIdentity(frontmatter);
     }
     catch (error) {
         return result('failed', resolved.taskId, null, null, { error: { ...taskIssueIdentityError(error), retryable: false } });

package/dist/lib/platform/task-comment-projection.js

@@ -0,0 +1,70 @@
+import { createHash } from 'node:crypto';
+const SNAPSHOT_FRONTMATTER = new Set([
+    'id', 'type', 'branch', 'workflow', 'status', 'created_at', 'updated_at',
+    'priority', 'effort', 'start_date', 'target_date', 'current_step', 'assigned_to',
+    'platform_issue_identity', 'delivery_remote', 'delivery_base_ref', 'pr_delivery_fact'
+]);
+const PROCESS_SECTION_ALIASES = new Set([
+    '活动日志', 'activity log',
+    '产物生命周期收据', 'artifact lifecycle receipts',
+    '审查分歧账本', 'review dispute ledger', 'review disagreement ledger',
+    '人工裁决', '人工裁决待办', 'human decisions', 'human decision pending', 'human decisions pending',
+    '实现输入', 'implementation input', 'implementation inputs',
+    '工作流告警', 'workflow warning', 'workflow warnings', 'warnings',
+    '返工意图', 'rework intent', 'rework intents',
+    '产物失效记录', 'artifact invalidation', 'artifact invalidation records',
+    '实现备注', 'implementation notes',
+    '审查反馈', 'review feedback'
+]);
+function normalize(content) {
+    return content.replace(/\r\n/g, '\n').replace(/\n+$/, '\n');
+}
+function splitFrontmatter(content) {
+    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+    if (!match)
+        throw new Error('task comment projection requires task frontmatter');
+    return { frontmatter: match[1], body: content.slice(match[0].length) };
+}
+function projectFrontmatter(frontmatter) {
+    const lines = frontmatter.replace(/\r\n/g, '\n').split('\n');
+    const selected = lines.filter((line) => {
+        if (!line.trim() || line.trimStart().startsWith('#'))
+            return false;
+        const match = /^([^:\s][^:]*):/.exec(line);
+        return Boolean(match && SNAPSHOT_FRONTMATTER.has(match[1].trim()));
+    });
+    if (!selected.some((line) => /^id:/.test(line)))
+        throw new Error('task comment projection requires frontmatter id');
+    return selected.join('\n');
+}
+function projectBody(body) {
+    const lines = body.replace(/\r\n/g, '\n').split('\n');
+    const kept = [];
+    let excludedLevel = null;
+    for (const line of lines) {
+        const heading = /^(#{1,6})\s+(.+?)\s*$/.exec(line);
+        if (heading) {
+            const level = heading[1].length;
+            if (excludedLevel !== null && level <= excludedLevel)
+                excludedLevel = null;
+            if (PROCESS_SECTION_ALIASES.has(heading[2].trim().toLowerCase())) {
+                excludedLevel = level;
+                continue;
+            }
+        }
+        if (excludedLevel === null)
+            kept.push(line);
+    }
+    return kept.join('\n').replace(/\n{3,}/g, '\n\n').trimEnd();
+}
+function projectTaskComment(content) {
+    const split = splitFrontmatter(content);
+    const projected = normalize(`---\n${projectFrontmatter(split.frontmatter)}\n---\n\n${projectBody(split.body)}`);
+    return {
+        content: projected,
+        byteLength: Buffer.byteLength(projected, 'utf8'),
+        sha256: createHash('sha256').update(projected, 'utf8').digest('hex')
+    };
+}
+export { projectTaskComment };
+//# sourceMappingURL=task-comment-projection.js.map

package/dist/lib/platform/task-identities.js

@@ -1,7 +1,6 @@
 import { parseResourceIdentity } from './resource-identity.js';
-import { isLegacyCompatibilityEnabled, legacyCompatibilityError, VERSION } from '../version.js';
 import { parse as parseYaml } from 'yaml';
-function taskIssueIdentity(frontmatter, _declaration, runtimeVersion = VERSION) {
+function taskIssueIdentity(frontmatter) {
     const serialized = frontmatter.platform_issue_identity;
     if (typeof serialized === 'string' && serialized.trim()) {
         try {
@@ -12,13 +11,7 @@ function taskIssueIdentity(frontmatter, _declaration, runtimeVersion = VERSION)
             return null;
         }
     }
-    const legacy = frontmatter.issue_number;
-    const number = typeof legacy === 'number' ? legacy : typeof legacy === 'string' && /^[1-9]\d*$/u.test(legacy) ? Number(legacy) : NaN;
-    // TODO(compat): Remove the numeric issue_number fallback before the first stable v1.0.0 release.
-    if (Number.isSafeInteger(number) && number > 0 && !isLegacyCompatibilityEnabled(runtimeVersion)) {
-        throw legacyCompatibilityError('issue_number', runtimeVersion);
-    }
-    return Number.isSafeInteger(number) && number > 0 ? { kind: 'number', value: number } : null;
+    return null;
 }
 function taskIssueIdentityError(error) {
     const value = error && typeof error === 'object' ? error : {};

package/dist/lib/platform/task-recovery.js

@@ -0,0 +1,55 @@
+import { parseActivityRecoveryMetadata } from './activity-recovery.js';
+function normalized(body) {
+    return body.replace(/\r\n/g, '\n').replace(/\n+$/, '\n');
+}
+function decodeRenderedText(value) {
+    return value
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&#39;/g, "'")
+        .replace(/&amp;/g, '&');
+}
+function taskSnapshot(taskId, body) {
+    const marker = `<!-- sync-issue:${taskId}:task -->`;
+    if (normalized(body).split('\n', 1)[0] !== marker)
+        throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot marker is invalid');
+    const frontmatter = body.match(/<details><summary>[^<]*<\/summary>\n\n```yaml\n---\n([\s\S]*?)\n---\n```\n\n<\/details>/);
+    if (!frontmatter)
+        throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot frontmatter is invalid');
+    const afterDetails = (frontmatter.index ?? 0) + frontmatter[0].length;
+    const footer = body.lastIndexOf('\n\n---\n*由 ');
+    if (footer <= afterDetails)
+        throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot envelope is invalid');
+    const projectedBody = body.slice(afterDetails, footer).replace(/^\n+|\n+$/g, '');
+    return `---\n${decodeRenderedText(frontmatter[1])}\n---\n\n${decodeRenderedText(projectedBody)}\n`;
+}
+function activityLine(entry) {
+    return `- ${entry.time} — **${entry.step}** by ${entry.agent} — ${entry.note}`;
+}
+function recoverTaskFromComments(input) {
+    const marker = `<!-- sync-issue:${input.taskId}:task -->`;
+    const snapshots = input.comments.filter((comment) => normalized(comment.body).split('\n', 1)[0] === marker);
+    if (snapshots.length !== 1)
+        throw new Error('RECOVERY_EVIDENCE_MISSING: exactly one task snapshot comment is required');
+    const author = snapshots[0].user?.login;
+    if (!author)
+        throw new Error('RECOVERY_EVIDENCE_MISSING: task snapshot author is unavailable');
+    const content = taskSnapshot(input.taskId, normalized(snapshots[0].body));
+    const entries = new Map();
+    for (const comment of input.comments) {
+        if (comment.user?.login !== author)
+            continue;
+        const record = parseActivityRecoveryMetadata(comment.body);
+        if (!record)
+            continue;
+        if (record.taskId !== input.taskId)
+            throw new Error('RECOVERY_EVIDENCE_MISSING: activity metadata task identity is invalid');
+        for (const entry of record.entries)
+            entries.set(JSON.stringify(entry), entry);
+    }
+    const restored = [...entries.values()].sort((left, right) => left.time.localeCompare(right.time));
+    return `${content.replace(/\n+$/, '')}\n\n## 活动日志\n\n${restored.map(activityLine).join('\n')}\n`;
+}
+export { recoverTaskFromComments };
+//# sourceMappingURL=task-recovery.js.map

package/dist/lib/platform/verification-sync.js

@@ -10,6 +10,7 @@ import { planInLabelUpdate, validateInLabelMapping } from "./in-label-sync.js";
 import { readPrDeliveryFact } from "../task/pr-delivery-fact.js";
 import { providerError, providerOperationContext, resourceIdentityNumber, unsupportedProviderOperation } from "./provider-bridge.js";
 import { taskIssueIdentity } from "./task-identities.js";
+import { renderTaskCommentResult } from "./issue-comments.js";
 import { CONTROL_MARKER_PATTERN, canonicalizeCommentBody, renderSafeCodeFence, sanitizeMarkdownDocument } from "./comment-safety.js";
 const CHECK_TYPE = "platform-sync";
 const VERSION_LINE_REGEX = /^[0-9]+\.[0-9]+\.x$/;
@@ -96,8 +97,8 @@ async function buildSyncContext({ taskDir, config, artifactFile }, shared) {
     }
     const prIdentity = fact.status === "valid" && fact.fact.state === "bound" ? fact.fact.identity.resource : null;
     const prNumber = resourceIdentityNumber(prIdentity);
-    if (config.when === "issue_number_exists" && !issueIdentity) {
-        return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no issue_number") };
+    if (config.when === "platform_issue_identity_exists" && !issueIdentity) {
+        return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no platform_issue_identity") };
     }
     if (config.when === "pr_fact_bound" && !prIdentity) {
         return { earlyReturn: shared.passResult(CHECK_TYPE, "Skipped: task has no verified bound pull request") };
@@ -432,11 +433,17 @@ function checkTaskCommentContent(context, remoteData, shared) {
     if (!comment) {
         return shared.failResult(CHECK_TYPE, `Expected comment marker '${taskMarker}' not found on Issue #${context.issueNumber}`, "check_failed");
     }
-    const expectedTaskBody = buildExpectedTaskBody(context.task.content, shared);
-    if (expectedTaskBody === null) {
+    let renderedTask;
+    try {
+        renderedTask = renderTaskCommentResult(context.task.content, context.task.metadata.id, loadProjectLanguage(shared));
+    }
+    catch {
         return shared.failResult(CHECK_TYPE, "Task content cannot be rendered safely for comment verification", "check_failed");
     }
-    const expectedBody = shared.normalizeContent(expectedTaskBody);
+    if (renderedTask.byteLength > 60_000) {
+        return shared.failResult(CHECK_TYPE, "Task comment exceeds the platform byte limit", "check_failed");
+    }
+    const expectedBody = shared.normalizeContent(extractCommentBody(renderedTask.body));
     const commentBody = shared.normalizeContent(extractCommentBody(comment.body || ""));
     if (expectedBody === commentBody) {
         return null;
@@ -608,12 +615,21 @@ function extractCommentBody(commentBody) {
     while (start < lines.length && lines[start].trim() === "") {
         start += 1;
     }
-    if (start < lines.length && /^> \*\*.+\*\* · .+$/.test(lines[start].trim())) {
+    if (start < lines.length && (/^> \*\*.+\*\* · .+$/.test(lines[start].trim()) || /^> 任务同步 · .+$/.test(lines[start].trim()))) {
         start += 1;
     }
     while (start < lines.length && lines[start].trim() === "") {
         start += 1;
     }
+    if (lines[start]?.trim() === "<details><summary>恢复元数据</summary>") {
+        const metadataEnd = lines.indexOf("</details>", start + 1);
+        if (metadataEnd >= 0) {
+            start = metadataEnd + 1;
+            while (start < lines.length && lines[start].trim() === "") {
+                start += 1;
+            }
+        }
+    }
     let end = lines.length;
     for (let index = lines.length - 1; index >= start; index -= 1) {
         const trimmed = lines[index].trim();
@@ -785,7 +801,9 @@ function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, sha
     if (!baseRef) {
         return { ok: false, type: "check_failed", message: "Task has no delivery_base_ref for in-label evidence" };
     }
-    const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], taskDir);
+    const branch = typeof task.metadata?.branch === "string" ? task.metadata.branch.trim() : "";
+    const gitCwd = branch ? worktreeForBranch(shared.repoRoot, branch) ?? taskDir : taskDir;
+    const changedFilesResult = gitText(["diff", `${baseRef}...HEAD`, "--name-only"], gitCwd);
     if (!changedFilesResult.ok) {
         return { ...changedFilesResult, type: "network_error" };
     }
@@ -808,6 +826,26 @@ function computeExpectedInLabels(taskDir, repositoryLabels, mappingOverride, sha
     }
     return { ok: true, labels: planned.target, mode: "mapped" };
 }
+function worktreeForBranch(repositoryRoot, branch) {
+    try {
+        const records = execFileSync("git", ["worktree", "list", "--porcelain"], {
+            cwd: repositoryRoot,
+            encoding: "utf8",
+            stdio: ["pipe", "pipe", "pipe"]
+        }).trim().split(/\r?\n\r?\n/);
+        const expectedRef = `refs/heads/${branch}`;
+        for (const record of records) {
+            const worktree = /^worktree (.+)$/m.exec(record)?.[1];
+            const branchRef = /^branch (.+)$/m.exec(record)?.[1];
+            if (worktree && branchRef === expectedRef)
+                return worktree;
+        }
+    }
+    catch {
+        // Fall back to taskDir so ordinary in-repository task workspaces retain their behavior.
+    }
+    return null;
+}
 function loadInLabelMapping(shared) {
     const configPath = path.join(shared.repoRoot, ".agents", ".airc.json");
     if (!fs.existsSync(configPath)) {

package/dist/lib/pr-review/evidence-grading.js

@@ -12,10 +12,6 @@ export class HostResolutionError extends Error {
         this.code = code;
     }
 }
-function toPositiveNumber(value) {
-    const n = Number(value);
-    return Number.isInteger(n) && n > 0 ? n : null;
-}
 /**
  * Parse the PR body for closing-issue references. Handles the conventional
  * `Closes #1` / `Fixes: #2, #3` shapes (case-insensitive, comma/space
@@ -41,7 +37,7 @@ export function extractClosingIssueNumbers(body) {
 /**
  * Scan `.agents/workspace/active/{task-id}/task.md` files for tasks bound to the
  * PR number or to one of the PR's closing issues. A task is emitted at most once;
- * a verified fact identity hit takes priority over the issue-number reverse lookup.
+ * a verified fact identity hit takes priority over the issue-identity reverse lookup.
  */
 export function collectHostCandidates(input) {
     const activeRoot = path.join(input.workspaceRoot, '.agents', 'workspace', 'active');
@@ -73,7 +69,7 @@ export function collectHostCandidates(input) {
             continue;
         }
         const issueIdentity = taskIssueIdentity(frontmatter);
-        const issueNumber = resourceIdentityNumber(issueIdentity) ?? toPositiveNumber(frontmatter.issue_number);
+        const issueNumber = resourceIdentityNumber(issueIdentity);
         const fact = readPrDeliveryFact(frontmatter);
         const prIdentity = fact.status === 'valid' && fact.fact.state === 'bound' ? fact.fact.identity.resource : null;
         const prNumber = resourceIdentityNumber(prIdentity);
@@ -133,8 +129,8 @@ function isTrusted(head) {
 /**
  * Derive the S1(a) trust factor `taskIssueMatches` (PL-3) mechanically from
  * resolved data: a unique host is trusted on the issue dimension only when the
- * task's bound issue_number is among the PR's closing issues. Ambiguous/none
- * hosts and tasks without a positive issue_number cannot be confirmed -> false
+ * task's bound issue identity is among the PR's closing issues. Ambiguous/none
+ * hosts and tasks without a numeric issue identity cannot be confirmed -> false
  * (fail closed to S2/audit). `resolve-host` emits this value so the prompt layer
  * does not derive the trust factor ad hoc (CD-2).
  */

package/dist/lib/sandbox/commands/rm.js

@@ -2,11 +2,27 @@ import { parseArgs } from 'node:util';
 import { loadConfig } from '../config.js';
 import { createSandboxCapabilityPlan } from '../agent-client-reconciler.js';
 import { resolveSandboxCleanupTarget } from '../workspace-identity.js';
+import { detectEngine } from '../engine.js';
+import { sandboxBranchLabel, sandboxLabel, sandboxTaskIdLabel, sandboxWorkspaceModeLabel } from '../constants.js';
+import { fetchSandboxRows } from './list-running.js';
 import { rmOne, rmPurge, rmUnbound } from '../removal.js';
 const USAGE = `Usage:
   ai sandbox rm <branch | TASK-id | short id> Remove one sandbox; use a full TASK-id for a task-bound sandbox and a branch for branch-only sandboxes
-  ai sandbox rm --unbound [--dry-run] [--yes] Remove completed task-bound and branch-only sandboxes and verified auxiliary state; active, blocked, and archive tasks are protected
+  ai sandbox rm --unbound [--dry-run] [--yes] Remove discovered task-bound and branch-only sandboxes
   ai sandbox rm --purge                     Tear down ALL sandboxes for the project (containers, worktrees, image, VM)`;
+function resolveMissingTaskSandboxBranch(taskId, config) {
+    const engine = detectEngine(config);
+    const listed = fetchSandboxRows(engine, sandboxLabel(config), sandboxBranchLabel(config), { mode: sandboxWorkspaceModeLabel(config), taskId: sandboxTaskIdLabel(config) });
+    const branches = new Set([...listed.running, ...listed.nonRunning]
+        .filter((row) => row.workspaceMode === 'task-bound' && row.taskId === taskId && row.branch)
+        .map((row) => row.branch));
+    if (branches.size === 0)
+        return null;
+    if (branches.size > 1) {
+        throw new Error(`SANDBOX_CLEANUP_TASK_ID_AMBIGUOUS: task ${taskId} matches multiple sandbox branches`);
+    }
+    return branches.values().next().value ?? null;
+}
 export async function rm(args) {
     const { values, positionals } = parseArgs({
         args,
@@ -53,7 +69,10 @@ export async function rm(args) {
         });
         return;
     }
-    const cleanupTarget = resolveSandboxCleanupTarget(positionals[0] ?? '', config.repoRoot);
+    const cleanupTarget = resolveSandboxCleanupTarget(positionals[0] ?? '', config.repoRoot, {
+        allowProtected: true,
+        resolveMissingTask: (taskId) => resolveMissingTaskSandboxBranch(taskId, config)
+    });
     await rmOne(config, tools, cleanupTarget.branch, { cleanupTarget });
 }
 //# sourceMappingURL=rm.js.map

package/dist/lib/sandbox/control/executor.js

@@ -125,7 +125,9 @@ export async function prepareSandboxControlExecution(params) {
                 owner: gateOwner,
                 requestId: params.request.id,
                 operationId: authority?.operationId ?? params.request.id,
-                phase: authority?.phase ?? (params.request.family === 'task-workflow' ? 'artifact.finalize-local' : 'orchestration.prepare'),
+                phase: authority?.phase ?? (params.request.family === 'task-workflow'
+                    && params.request.workflow?.operation === 'artifact-preflight' ? 'artifact.preflight'
+                    : params.request.family === 'task-workflow' ? 'artifact.finalize-local' : 'orchestration.prepare'),
                 authority
             });
         },
@@ -163,7 +165,7 @@ function waitForGate(nonce, timeoutMs = 2_000) {
                 return;
             }
             if (typeof value.requestId !== 'string' || typeof value.operationId !== 'string'
-                || !['orchestration.prepare', 'artifact.finalize-local', 'task-event.completed'].includes(value.phase)
+                || !['orchestration.prepare', 'artifact.preflight', 'artifact.finalize-local', 'task-event.completed'].includes(value.phase)
                 || (value.authority !== null && value.authority !== undefined && (() => {
                     try {
                         validateLifecycleRecoveryAttestation(value.authority);