@fitlab-ai/agent-infra 0.9.3 → 0.9.4

package/dist/lib/sandbox/workspace-identity.js

@@ -0,0 +1,95 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { isRemovedHashShortIdInput } from '../task/short-id.js';
+const TASK_ID_RE = /^TASK-\d{8}-\d{6}$/;
+const SHORT_ID_RE = /^\d+$/;
+function stripQuotes(value) {
+    return value.replace(/^(?:"([^"]*)"|'([^']*)')$/, '$1$2');
+}
+function taskBranch(taskMd, taskId) {
+    const content = fs.readFileSync(taskMd, 'utf8');
+    const value = content.match(/^branch:\s*(.+)$/m)?.[1]?.trim()
+        ?? content.match(/^- \*\*(?:分支|Branch)\*\*：[ \t]*`?([^`\n]+)`?$/m)?.[1]?.trim();
+    if (!value)
+        throw new Error(`Task ${taskId} has no branch field in task.md`);
+    return stripQuotes(value);
+}
+function activeRegistry(repoRoot) {
+    const registryPath = path.join(repoRoot, '.agents', 'workspace', 'active', '.short-ids.json');
+    if (!fs.existsSync(registryPath))
+        return {};
+    const value = JSON.parse(fs.readFileSync(registryPath, 'utf8'));
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error('Active task short-id registry is invalid');
+    }
+    const ids = 'ids' in value && value.ids && typeof value.ids === 'object' && !Array.isArray(value.ids)
+        ? value.ids
+        : value;
+    return Object.fromEntries(Object.entries(ids).filter((entry) => SHORT_ID_RE.test(entry[0]) && typeof entry[1] === 'string' && TASK_ID_RE.test(entry[1])));
+}
+function taskIdentity(repoRoot, taskId, registry) {
+    const taskMd = path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md');
+    if (!fs.existsSync(taskMd))
+        throw new Error(`Active task not found: ${taskId}`);
+    const shortIds = Object.entries(registry).filter(([, id]) => id === taskId).map(([shortId]) => shortId);
+    if (shortIds.length !== 1) {
+        throw new Error(`Task ${taskId} must have exactly one active short id`);
+    }
+    return { mode: 'task-bound', taskId, shortId: shortIds[0] };
+}
+export function resolveSandboxTarget(requestedRef, repoRoot) {
+    if (isRemovedHashShortIdInput(requestedRef)) {
+        throw new Error(`Invalid task short id '${requestedRef}': task short ids must use bare digits`);
+    }
+    const registry = activeRegistry(repoRoot);
+    if (SHORT_ID_RE.test(requestedRef)) {
+        const matchingShortIds = Object.keys(registry).filter((shortId) => shortId === requestedRef || Number(shortId) === Number(requestedRef));
+        if (matchingShortIds.length > 1) {
+            throw new Error(`Short id '${requestedRef}' is ambiguous in active task registry`);
+        }
+        const canonicalShortId = matchingShortIds[0];
+        const taskId = canonicalShortId ? registry[canonicalShortId] : undefined;
+        if (!taskId)
+            throw new Error(`Short id '${requestedRef}' not found in active task registry`);
+        const workspace = taskIdentity(repoRoot, taskId, registry);
+        return { requestedRef, branch: taskBranch(path.join(repoRoot, '.agents', 'workspace', 'active', taskId, 'task.md'), taskId), workspace };
+    }
+    if (TASK_ID_RE.test(requestedRef)) {
+        const workspace = taskIdentity(repoRoot, requestedRef, registry);
+        return { requestedRef, branch: taskBranch(path.join(repoRoot, '.agents', 'workspace', 'active', requestedRef, 'task.md'), requestedRef), workspace };
+    }
+    const activeRoot = path.join(repoRoot, '.agents', 'workspace', 'active');
+    const matches = fs.existsSync(activeRoot)
+        ? fs.readdirSync(activeRoot, { withFileTypes: true }).flatMap((entry) => {
+            if (!entry.isDirectory() || !TASK_ID_RE.test(entry.name))
+                return [];
+            const taskMd = path.join(activeRoot, entry.name, 'task.md');
+            if (!fs.existsSync(taskMd))
+                return [];
+            return taskBranch(taskMd, entry.name) === requestedRef ? [entry.name] : [];
+        })
+        : [];
+    if (matches.length > 1) {
+        throw new Error(`SANDBOX_TASK_IDENTITY_AMBIGUOUS: branch '${requestedRef}' is bound to multiple active tasks`);
+    }
+    if (matches.length === 1) {
+        const taskId = matches[0];
+        return { requestedRef, branch: requestedRef, workspace: taskIdentity(repoRoot, taskId, registry) };
+    }
+    return { requestedRef, branch: requestedRef, workspace: { mode: 'branch-only' } };
+}
+export function parseSandboxWorkspaceIdentity(labels, keys) {
+    const mode = labels[keys.mode];
+    const taskId = labels[keys.taskId];
+    if (mode === 'branch-only' && taskId === undefined)
+        return { mode: 'branch-only' };
+    if (mode === 'task-bound' && typeof taskId === 'string' && TASK_ID_RE.test(taskId)) {
+        return { mode: 'task-bound', taskId };
+    }
+    return { mode: 'legacy-invalid' };
+}
+export function sameSandboxWorkspaceIdentity(left, right) {
+    return left.mode === right.mode
+        && (left.mode !== 'task-bound' || (right.mode === 'task-bound' && left.taskId === right.taskId));
+}
+//# sourceMappingURL=workspace-identity.js.map

package/dist/lib/sandbox/workspace-view.js

@@ -0,0 +1,103 @@
+import { createHash, randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export function sandboxWorkspaceViewPaths(params) {
+    const identityKey = params.identity.mode === 'task-bound'
+        ? `task-bound:${params.identity.taskId}`
+        : 'branch-only';
+    const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
+    const projectRoot = path.resolve(params.base, params.project);
+    const root = path.resolve(projectRoot, params.container, digest);
+    return {
+        root,
+        taskMountPath: params.identity.mode === 'task-bound'
+            ? path.join(root, 'active', params.identity.taskId)
+            : null
+    };
+}
+export function sandboxControlPaths(params) {
+    const identityKey = params.identity.mode === 'task-bound'
+        ? `task-bound:${params.identity.taskId}`
+        : 'branch-only';
+    const digest = createHash('sha256').update(identityKey).digest('hex').slice(0, 16);
+    const root = path.resolve(params.base, params.project, params.container, digest);
+    return { root, channelDir: path.join(root, 'channel'), manifestPath: path.join(root, 'manifest.json') };
+}
+function assertSafeDirectory(directory, expectedBase) {
+    const relative = path.relative(expectedBase, directory);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Sandbox workspace view escapes its configured root: ${directory}`);
+    }
+    if (fs.existsSync(directory) && fs.lstatSync(directory).isSymbolicLink()) {
+        throw new Error(`Sandbox workspace view must not be a symbolic link: ${directory}`);
+    }
+}
+export function assertSandboxTaskSource(repoRoot, taskId) {
+    if (!/^TASK-\d{8}-\d{6}$/.test(taskId))
+        throw new Error('SANDBOX_TASK_SOURCE_INVALID');
+    const activeRoot = fs.realpathSync.native(path.join(repoRoot, '.agents', 'workspace', 'active'));
+    const source = path.join(activeRoot, taskId);
+    const stat = fs.lstatSync(source);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+        throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${source} must be a real directory`);
+    }
+    const canonical = fs.realpathSync.native(source);
+    if (path.dirname(canonical) !== activeRoot) {
+        throw new Error(`SANDBOX_TASK_SOURCE_INVALID: ${source} escapes the active workspace`);
+    }
+    return canonical;
+}
+export function materializeSandboxWorkspaceView(params) {
+    const projectRoot = path.resolve(params.base, params.project);
+    const { root, taskMountPath } = sandboxWorkspaceViewPaths(params);
+    assertSafeDirectory(projectRoot, path.resolve(params.base));
+    assertSafeDirectory(root, projectRoot);
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    for (const state of ['active', 'completed', 'blocked', 'archive']) {
+        const stateDir = path.join(root, state);
+        assertSafeDirectory(stateDir, root);
+        fs.rmSync(stateDir, { recursive: true, force: true });
+        fs.mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    }
+    const active = path.join(root, 'active');
+    const registry = {
+        version: 1,
+        ids: params.identity.mode === 'task-bound'
+            ? { [params.identity.shortId]: params.identity.taskId }
+            : {}
+    };
+    fs.writeFileSync(path.join(active, '.short-ids.json'), `${JSON.stringify(registry)}\n`, {
+        encoding: 'utf8',
+        mode: 0o600
+    });
+    if (taskMountPath) {
+        assertSafeDirectory(taskMountPath, active);
+        fs.mkdirSync(taskMountPath, { recursive: true, mode: 0o700 });
+    }
+    return { root, taskMountPath };
+}
+export function materializeSandboxControl(params) {
+    const { root, channelDir, manifestPath } = sandboxControlPaths(params);
+    assertSafeDirectory(root, path.resolve(params.base));
+    for (const queue of ['requests', 'responses']) {
+        const directory = path.join(channelDir, queue);
+        assertSafeDirectory(directory, root);
+        fs.rmSync(directory, { recursive: true, force: true });
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    }
+    const token = randomBytes(32).toString('hex');
+    const manifest = {
+        version: 1,
+        repoRoot: fs.realpathSync.native(params.repoRoot),
+        project: params.project,
+        container: params.container,
+        branch: params.branch,
+        mode: params.identity.mode,
+        taskId: params.identity.mode === 'task-bound' ? params.identity.taskId : null,
+        token,
+        channelDir
+    };
+    fs.writeFileSync(manifestPath, `${JSON.stringify(manifest)}\n`, { mode: 0o600 });
+    return { channelDir, manifestPath, token };
+}
+//# sourceMappingURL=workspace-view.js.map

package/dist/lib/task/activity-intent.js

@@ -1,73 +1,260 @@
 import fs from 'node:fs';
-import path from 'node:path';
+import { normalizeAgentToken } from '../agent-clients/tokens.js';
 import { resolveTaskRef } from './resolve-ref.js';
 import { locateActivityLog, appendActivityEntry } from './activity-log.js';
-import { buildArtifactLinkSection, parseArtifactName } from './artifact-lifecycle.js';
+import { assertWritableInventory, buildArtifactLinkSection, inspectTaskArtifacts, parseArtifactName } from './artifact-lifecycle.js';
+import { TaskExecutionLockError, withTaskExecutionLock } from './task-execution-lock.js';
 import { captureTaskWriteMetadata, writeTask } from './write.js';
+const HEAD_RE = /^[0-9a-f]{40}$/;
+const REVIEW_ACTION_RE = /^Review PR \(Round ([1-9]\d*)\)( \[started\])?$/;
+const VERDICTS = new Set(['approved', 'changes-requested', 'commented']);
+const OUTCOMES = new Set(['aborted', 'superseded']);
+const SUCCESS_STATUSES = new Set(['applied', 'no-op']);
+const ARTIFACT_STATUSES = new Set([
+    'pending', 'applied', 'no-op', 'blocked', 'failed', 'aborted', 'superseded'
+]);
 function failed(intent, code, message, taskId = null) {
     return {
-        status: 'failed', changed: false, intent: 'append', taskId,
-        artifact: intent.artifact ?? null, operations: [], error: { code, message }
+        status: 'failed', changed: false, intent: intent.kind, taskId,
+        artifact: intent.artifact, operations: [], error: { code, message }
     };
 }
-function oneLine(value) {
-    return value.replace(/\s*\r?\n\s*/g, ' ').trim();
+function inspectionFailed(code, message, taskId = null) {
+    return {
+        status: 'failed', changed: false, intent: 'pr-review-inspect', taskId,
+        snapshot: null, error: { code, message }
+    };
 }
-/**
- * Append an Activity Log entry (and, optionally, a `## 审查反馈` artifact link)
- * to an active task via the atomic `writeTask` path. `current_step` is never
- * touched (PL-2): review-pr does not join the standard stage chain.
- */
-export function applyActivityAppendIntent(intent, options = {}) {
-    if (intent.kind !== 'append')
-        return failed(intent, 'ACTIVITY_INTENT_INVALID', 'intent kind must be append');
-    const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
+function parseArtifactRecord(identity) {
+    let content;
+    try {
+        content = fs.readFileSync(identity.path, 'utf8');
+    }
+    catch (error) {
+        return { code: 'ACTIVITY_ARTIFACT_READ_FAILED', message: error instanceof Error ? error.message : String(error) };
+    }
+    const heads = [...content.matchAll(/^- \*\*(?:被审 head SHA|Reviewed Head SHA)\*\*[:：]\s*([0-9a-f]{40})\s*$/gm)];
+    if (heads.length !== 1) {
+        return { code: 'ACTIVITY_ARTIFACT_INVALID', message: `${identity.name} must contain exactly one reviewed head SHA` };
+    }
+    const statuses = [...content.matchAll(/^- \*\*(?:正式 Review 状态|Formal Review Status)\*\*[:：][ \t]*([a-z-]+)[^\r\n]*$/gm)];
+    const status = statuses[0]?.[1];
+    if (statuses.length !== 1 || !status || !ARTIFACT_STATUSES.has(status)) {
+        return { code: 'ACTIVITY_ARTIFACT_INVALID', message: `${identity.name} must contain exactly one supported formal review status` };
+    }
+    return { identity, head: heads[0][1], status: status };
+}
+function toIdentity(state, terminal = false) {
+    return {
+        round: state.identity.round,
+        artifact: state.identity.name,
+        head: state.head,
+        agent: terminal ? state.terminalAgent : state.startedAgent,
+        artifactStatus: state.status,
+        note: terminal ? state.terminalNote : null
+    };
+}
+function readSnapshot(taskRef, repoRoot) {
+    const resolved = resolveTaskRef(taskRef, { repoRoot });
     if (!resolved.ok)
-        return failed(intent, resolved.code, resolved.message, resolved.taskId);
+        return { ok: false, code: resolved.code, message: resolved.message, taskId: resolved.taskId };
     if (resolved.state !== 'active') {
-        return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
+        return { ok: false, code: 'TASK_STATE_MISMATCH', message: `task ${resolved.taskId} is ${resolved.state}, expected active`, taskId: resolved.taskId };
     }
-    const step = oneLine(intent.step);
-    const agent = oneLine(intent.agent);
-    const note = oneLine(intent.note);
-    if (!step || !agent || !note || /[\r\n]/.test(intent.step) || /[\r\n]/.test(intent.agent) || /[\r\n]/.test(intent.note)) {
-        return failed(intent, 'ACTIVITY_INTENT_INVALID', 'step, agent and note must be non-empty single-line values', resolved.taskId);
-    }
-    let artifact = null;
-    if (intent.artifact !== undefined) {
-        artifact = parseArtifactName(intent.artifact);
-        if (!artifact || artifact.family !== 'pr-review') {
-            return failed(intent, 'ACTIVITY_ARTIFACT_INVALID', `artifact '${intent.artifact}' is not a canonical pr-review artifact`, resolved.taskId);
-        }
+    const inventory = inspectTaskArtifacts(taskRef, 'pr-review', { repoRoot: resolved.repoRoot });
+    if (inventory.status === 'failed') {
+        return { ok: false, code: inventory.error?.code ?? 'ACTIVITY_ARTIFACT_INVALID', message: inventory.error?.message ?? 'artifact inspection failed', taskId: resolved.taskId };
     }
+    const topology = assertWritableInventory(inventory);
+    if (topology)
+        return { ok: false, code: topology.code, message: topology.message, taskId: resolved.taskId };
     let content;
     try {
         content = fs.readFileSync(resolved.taskMdPath, 'utf8');
     }
     catch (error) {
-        return failed(intent, 'TASK_READ_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
+        return { ok: false, code: 'TASK_READ_FAILED', message: error instanceof Error ? error.message : String(error), taskId: resolved.taskId };
+    }
+    const activity = locateActivityLog(content);
+    if (!activity)
+        return { ok: false, code: 'ACTIVITY_SECTION_MISSING', message: 'task has no unique Activity Log section', taskId: resolved.taskId };
+    const knownRounds = new Set(inventory.artifacts.map((artifact) => artifact.round));
+    for (const entry of activity.entries) {
+        const match = REVIEW_ACTION_RE.exec(entry.step);
+        if (match && !knownRounds.has(Number(match[1]))) {
+            return { ok: false, code: 'ACTIVITY_STATE_CONFLICT', message: `Activity Log round ${match[1]} has no canonical pr-review artifact`, taskId: resolved.taskId };
+        }
+    }
+    const states = [];
+    for (const identity of inventory.artifacts) {
+        const parsed = parseArtifactRecord(identity);
+        if ('code' in parsed)
+            return { ok: false, ...parsed, taskId: resolved.taskId };
+        const base = `Review PR (Round ${identity.round})`;
+        const started = activity.entries.filter((entry) => entry.step === `${base} [started]`);
+        const terminal = activity.entries.filter((entry) => entry.step === base);
+        if (started.length > 1 || terminal.length > 1) {
+            return { ok: false, code: 'ACTIVITY_STATE_CONFLICT', message: `${base} has duplicate started or terminal rows`, taskId: resolved.taskId };
+        }
+        if (terminal.length === 1 && started.length === 0 && !terminal[0].note.startsWith('receipt ')) {
+            return { ok: false, code: 'ACTIVITY_STATE_CONFLICT', message: `${base} has a terminal row without a matching started row`, taskId: resolved.taskId };
+        }
+        if (terminal.length === 1) {
+            const note = terminal[0].note;
+            const terminalMatchesStatus = (note.startsWith('Verdict: ') && SUCCESS_STATUSES.has(parsed.status))
+                || (note.startsWith('Outcome: Aborted, ') && parsed.status === 'aborted')
+                || (note.startsWith('Outcome: Superseded, ') && parsed.status === 'superseded')
+                || (note.startsWith('receipt ') && SUCCESS_STATUSES.has(parsed.status));
+            if (!terminalMatchesStatus) {
+                return { ok: false, code: 'ACTIVITY_STATE_CONFLICT', message: `${base} terminal note conflicts with artifact status ${parsed.status}`, taskId: resolved.taskId };
+            }
+        }
+        states.push({
+            ...parsed,
+            startedAgent: started[0]?.agent ?? null,
+            terminalAgent: terminal[0]?.agent ?? null,
+            terminalNote: terminal[0]?.note ?? null
+        });
     }
-    const section = locateActivityLog(content);
-    if (!section) {
-        return failed(intent, 'ACTIVITY_SECTION_MISSING', 'task has no unique Activity Log section', resolved.taskId);
+    const openStates = states.filter((state) => state.startedAgent !== null && state.terminalNote === null);
+    const preparedStates = states.filter((state) => state.status === 'pending' && state.startedAgent === null && state.terminalNote === null);
+    if (openStates.length > 1 || preparedStates.length > 1) {
+        return { ok: false, code: 'ACTIVITY_STATE_CONFLICT', message: 'multiple prepared or open PR review rounds exist', taskId: resolved.taskId };
+    }
+    const terminalStates = states.filter((state) => state.terminalNote !== null);
+    const successfulStates = states.filter((state) => SUCCESS_STATUSES.has(state.status));
+    const latestTerminal = terminalStates.at(-1) ?? null;
+    const latestSuccessful = successfulStates.at(-1) ?? null;
+    return {
+        ok: true,
+        taskId: resolved.taskId,
+        taskDir: resolved.taskDir,
+        taskMdPath: resolved.taskMdPath,
+        repoRoot: resolved.repoRoot,
+        content,
+        states,
+        snapshot: {
+            nextRound: inventory.next?.round ?? 1,
+            prepared: preparedStates[0] ? toIdentity(preparedStates[0]) : null,
+            open: openStates[0] ? toIdentity(openStates[0]) : null,
+            latestTerminal: latestTerminal ? toIdentity(latestTerminal, true) : null,
+            latestSuccessful: latestSuccessful ? toIdentity(latestSuccessful, true) : null
+        }
+    };
+}
+export function inspectPrReviewActivity(intent, options = {}) {
+    const state = readSnapshot(intent.taskRef, options.repoRoot);
+    if (!state.ok)
+        return inspectionFailed(state.code, state.message, state.taskId);
+    return { status: 'ready', changed: false, intent: intent.kind, taskId: state.taskId, snapshot: state.snapshot, error: null };
+}
+function validateIntent(intent) {
+    const agent = normalizeAgentToken(intent.agent);
+    if (!agent)
+        return { code: 'ACTIVITY_INTENT_INVALID', message: 'agent must be a supported collaborator token' };
+    const artifact = parseArtifactName(intent.artifact);
+    if (!artifact || artifact.family !== 'pr-review') {
+        return { code: 'ACTIVITY_ARTIFACT_INVALID', message: `artifact '${intent.artifact}' is not a canonical pr-review artifact` };
+    }
+    if (!HEAD_RE.test(intent.head))
+        return { code: 'ACTIVITY_INTENT_INVALID', message: 'head must be a lowercase 40-character SHA' };
+    if (intent.kind === 'pr-review-complete') {
+        if (!VERDICTS.has(intent.verdict))
+            return { code: 'ACTIVITY_INTENT_INVALID', message: 'verdict is invalid' };
+        if (![intent.blockers, intent.major, intent.minor].every((value) => Number.isSafeInteger(value) && value >= 0)) {
+            return { code: 'ACTIVITY_INTENT_INVALID', message: 'finding counts must be non-negative safe integers' };
+        }
+    }
+    if (intent.kind === 'pr-review-terminate') {
+        if (!OUTCOMES.has(intent.outcome))
+            return { code: 'ACTIVITY_INTENT_INVALID', message: 'outcome is invalid' };
+        if (!intent.reason.trim() || /[\r\n]/.test(intent.reason) || intent.reason !== intent.reason.trim()) {
+            return { code: 'ACTIVITY_INTENT_INVALID', message: 'reason must be a non-empty trimmed single-line value' };
+        }
+    }
+    return { agent, artifact };
+}
+function verdictLabel(verdict) {
+    if (verdict === 'approved')
+        return 'Approved';
+    if (verdict === 'changes-requested')
+        return 'Changes Requested';
+    return 'Commented';
+}
+function outcomeLabel(outcome) {
+    return outcome === 'aborted' ? 'Aborted' : 'Superseded';
+}
+function terminalNote(intent) {
+    if (intent.kind === 'pr-review-complete') {
+        return `Verdict: ${verdictLabel(intent.verdict)}, blockers: ${intent.blockers}, major: ${intent.major}, minor: ${intent.minor} → ${intent.artifact}`;
+    }
+    return `Outcome: ${outcomeLabel(intent.outcome)}, reason: ${intent.reason} → ${intent.artifact}`;
+}
+function applyLocked(intent, normalizedAgent, options) {
+    const state = readSnapshot(intent.taskRef, options.repoRoot);
+    if (!state.ok)
+        return failed(intent, state.code, state.message, state.taskId);
+    const parsed = parseArtifactName(intent.artifact);
+    const roundState = state.states.find((item) => item.identity.name === parsed.name);
+    if (!roundState)
+        return failed(intent, 'ACTIVITY_ARTIFACT_INVALID', `artifact '${intent.artifact}' is not landed`, state.taskId);
+    if (roundState.head !== intent.head) {
+        return failed(intent, 'ACTIVITY_IDENTITY_MISMATCH', `head does not match ${intent.artifact}`, state.taskId);
+    }
+    const base = `Review PR (Round ${parsed.round})`;
+    let step;
+    let note;
+    let linkArtifact = false;
+    if (intent.kind === 'pr-review-start') {
+        if (roundState.terminalNote !== null) {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${base} is already terminal`, state.taskId);
+        }
+        if (roundState.startedAgent !== null) {
+            return { status: 'no-op', changed: false, intent: intent.kind, taskId: state.taskId, artifact: intent.artifact, operations: [], error: null };
+        }
+        if (roundState.status !== 'pending') {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${intent.artifact} must be pending before start`, state.taskId);
+        }
+        if (state.snapshot.open && state.snapshot.open.artifact !== intent.artifact) {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `another PR review round is open: ${state.snapshot.open.artifact}`, state.taskId);
+        }
+        step = `${base} [started]`;
+        note = 'started';
+    }
+    else {
+        note = terminalNote(intent);
+        if (roundState.terminalNote !== null) {
+            if (roundState.terminalNote === note) {
+                return { status: 'no-op', changed: false, intent: intent.kind, taskId: state.taskId, artifact: intent.artifact, operations: [], error: null };
+            }
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${base} has a different terminal payload`, state.taskId);
+        }
+        if (roundState.startedAgent === null) {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${base} has no matching started row`, state.taskId);
+        }
+        if (intent.kind === 'pr-review-complete' && !SUCCESS_STATUSES.has(roundState.status)) {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${intent.artifact} must be applied or no-op before completion`, state.taskId);
+        }
+        if (intent.kind === 'pr-review-terminate' && roundState.status !== intent.outcome) {
+            return failed(intent, 'ACTIVITY_STATE_CONFLICT', `${intent.artifact} status must match outcome ${intent.outcome}`, state.taskId);
+        }
+        step = base;
+        linkArtifact = true;
     }
     let metadata;
     try {
         metadata = (options.metadataProvider ?? captureTaskWriteMetadata)();
     }
     catch (error) {
-        return failed(intent, 'METADATA_CAPTURE_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
-    }
-    const mutations = [];
-    const activityBody = appendActivityEntry(section, { time: metadata.timestamp, step, agent, note });
-    mutations.push({ kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: section.heading, body: activityBody });
-    if (artifact) {
-        const link = buildArtifactLinkSection(content, {
-            ...artifact,
-            path: path.join(resolved.taskDir, artifact.name),
-            size: 0,
-            mtimeMs: 0
-        });
+        return failed(intent, 'METADATA_CAPTURE_FAILED', error instanceof Error ? error.message : String(error), state.taskId);
+    }
+    const section = locateActivityLog(state.content);
+    const mutations = [{
+            kind: 'section', aliases: ['活动日志', 'Activity Log'], heading: section.heading,
+            body: appendActivityEntry(section, { time: metadata.timestamp, step, agent: normalizedAgent, note })
+        }];
+    if (linkArtifact) {
+        const link = buildArtifactLinkSection(state.content, roundState.identity);
         mutations.push({ kind: 'section', aliases: link.aliases, heading: link.heading, body: link.body });
     }
     const writeResult = writeTask({
@@ -78,10 +265,10 @@ export function applyActivityAppendIntent(intent, options = {}) {
     }, {
         ...options,
         taskLocation: {
-            repoRoot: resolved.repoRoot,
-            taskId: resolved.taskId,
-            taskMdPath: resolved.taskMdPath,
-            state: resolved.state
+            repoRoot: state.repoRoot,
+            taskId: state.taskId,
+            taskMdPath: state.taskMdPath,
+            state: 'active'
         },
         metadataProvider: () => metadata
     });
@@ -91,11 +278,30 @@ export function applyActivityAppendIntent(intent, options = {}) {
     return {
         status: writeResult.status,
         changed: writeResult.changed,
-        intent: 'append',
+        intent: intent.kind,
         taskId: writeResult.taskId,
-        artifact: intent.artifact ?? null,
+        artifact: intent.artifact,
         operations: writeResult.operations,
         error: null
     };
 }
+export function applyPrReviewActivityIntent(intent, options = {}) {
+    const validated = validateIntent(intent);
+    if ('code' in validated)
+        return failed(intent, validated.code, validated.message);
+    const resolved = resolveTaskRef(intent.taskRef, { repoRoot: options.repoRoot });
+    if (!resolved.ok)
+        return failed(intent, resolved.code, resolved.message, resolved.taskId);
+    if (resolved.state !== 'active') {
+        return failed(intent, 'TASK_STATE_MISMATCH', `task ${resolved.taskId} is ${resolved.state}, expected active`, resolved.taskId);
+    }
+    try {
+        return withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-activity:${intent.kind}`, () => applyLocked(intent, validated.agent, { ...options, repoRoot: resolved.repoRoot }), options.lockOptions);
+    }
+    catch (error) {
+        if (error instanceof TaskExecutionLockError)
+            return failed(intent, error.code, error.message, resolved.taskId);
+        return failed(intent, 'ACTIVITY_LOCK_FAILED', error instanceof Error ? error.message : String(error), resolved.taskId);
+    }
+}
 //# sourceMappingURL=activity-intent.js.map