@vypdev/copilot 3.9.1 → 3.9.2

package/build/cli/index.js

@@ -38002,6 +38002,23 @@ exports.TITLE = void 0;
 exports.TITLE = 'Copilot';
 
 
+/***/ }),
+
+/***/ 2396:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.SETUP_DOCUMENTATION = void 0;
+/** Public, source-controlled navigation. Never attach session, repository or credential data. */
+exports.SETUP_DOCUMENTATION = {
+    tutorial: 'https://docs.page/vypdev/copilot/setup-web',
+    firstWorkflow: 'https://docs.page/vypdev/copilot/first-workflow',
+    recovery: 'https://docs.page/vypdev/copilot/security-operations/operations/troubleshooting',
+};
+
+
 /***/ }),
 
 /***/ 75999:
@@ -45862,6 +45879,34 @@ function verifiedReadinessLink(snapshot, number) {
 }
 
 
+/***/ }),
+
+/***/ 59756:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.hasConventionalPullRequestTitle = hasConventionalPullRequestTitle;
+exports.generatedPullRequestTitle = generatedPullRequestTitle;
+/** Recognizes the conventional header shape; the consumer's CI owns its allowed types and subject rules. */
+function hasConventionalPullRequestTitle(title) {
+    return !title.includes('\n') && !title.includes('\r')
+        && /^\p{L}[\p{L}\p{N}_-]*(?:\([^()\r\n]+\))?!?: +\S[^\r\n]*$/u.test(title);
+}
+function generatedPullRequestTitle(sourceTitle, sanitizedSubject, issueNumber, labels) {
+    if (hasConventionalPullRequestTitle(sourceTitle))
+        return sourceTitle;
+    const type = labels.isHotfix || labels.isBugfix || labels.isBug ? 'fix'
+        : labels.isFeature || labels.isEnhancement ? 'feat'
+            : labels.isDocs || labels.isDocumentation ? 'docs' : 'chore';
+    const prefix = `${type}: `;
+    const suffix = ` (#${issueNumber})`;
+    const subject = (sanitizedSubject || 'Update linked issue').slice(0, 256 - prefix.length - suffix.length).trimEnd();
+    return `${prefix}${subject}${suffix}`;
+}
+
+
 /***/ }),
 
 /***/ 39410:
@@ -46053,6 +46098,12 @@ Do not add the \`${profile.deployment.launcherLabel}\` label, dispatch a deploym
 
 Never expose credentials, tokens, private keys, or other secrets in issues, commits, pull requests, logs, or diagnostic comments.
 
+## Repository verification prerequisites
+
+The setup runner profile selects placement; it does not install the project's language runtimes. An operator must provision the project's required runtimes and dependencies in every job that runs file-changing or branch-sync verification, before the Copilot step. A separate application CI job does not prepare this job.
+
+Declare reviewed version prefixes in \`.copilot/verification-prerequisites.json\` (schemaVersion 1, runtimes such as java 17, node 24, pnpm 10). Copilot checks declared versions in the credential-free verification environment before each configured verification command; a missing or incompatible runtime blocks publication. Without this optional declaration, existing verification behavior remains and no language is inferred. Java provisioning may use \`actions/setup-java\`; \`JAVA_HOME\` and \`PATH\` survive isolation, while agent credentials and tool-option injection variables do not. Do not add an unreviewed bootstrap or weaken verification to work around a missing runtime. Read [verification prerequisites and same-job setup](https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites).
+
 For the full contributor flow, read [repository collaboration](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-collaboration.mdx). For drift and recovery, read [guidance troubleshooting](https://github.com/vypdev/copilot/blob/master/docs/agents/repository-guidance-troubleshooting.mdx).
 `;
 }
@@ -50159,13 +50210,16 @@ function validateDiscoveredProjectStatuses(configuration, discovery) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.setupQuestionDocumentation = setupQuestionDocumentation;
 const docs = {
-    features: { title: 'Copilot features and workflow triggers', url: 'https://docs.page/vypdev/copilot/features' },
-    issueWorkflows: { title: 'Copilot issue workflow setup', url: 'https://docs.page/vypdev/copilot/issues/workflow-setup' },
+    features: { title: 'Choose a Copilot goal', url: 'https://docs.page/vypdev/copilot/guides' },
+    issueWorkflows: { title: 'Select issue kinds and forms', url: 'https://docs.page/vypdev/copilot/issues/configurable-workflows' },
+    issuesGuide: { title: 'Manage issues and branches', url: 'https://docs.page/vypdev/copilot/guides/issues-and-branches' },
+    reviewGuide: { title: 'Review PRs and resolve findings', url: 'https://docs.page/vypdev/copilot/guides/review-pull-requests' },
+    botGuide: { title: 'Work with the bot', url: 'https://docs.page/vypdev/copilot/guides/work-with-the-bot' },
+    releaseGuide: { title: 'Release and hotfix guide', url: 'https://docs.page/vypdev/copilot/guides/releases-and-hotfixes' },
     branchManagement: { title: 'Issue branch management', url: 'https://docs.page/vypdev/copilot/issues/branch-management' },
     preBranchSdd: { title: 'Pre-branch design documents', url: 'https://docs.page/vypdev/copilot/issues/pre-branch-sdds' },
     issueLifecycle: { title: 'Issue notifications and automatic closure', url: 'https://docs.page/vypdev/copilot/issues/notifications-and-auto-close' },
     assignments: { title: 'Assignees and GitHub Projects', url: 'https://docs.page/vypdev/copilot/issues/assignees-and-projects' },
-    pullRequestWorkflows: { title: 'Pull-request workflow setup', url: 'https://docs.page/vypdev/copilot/pull-requests/workflow-setup' },
     pullRequestDescription: { title: 'AI pull-request descriptions', url: 'https://docs.page/vypdev/copilot/pull-requests/ai-description' },
     repositoryGuidance: { title: 'Repository guidance for agents', url: 'https://docs.page/vypdev/copilot/agents/repository-collaboration' },
     runtime: { title: 'Agent runtime selection', url: 'https://docs.page/vypdev/copilot/agents/runtime-selection' },
@@ -50180,7 +50234,7 @@ const docs = {
     projects: { title: 'Assignees and GitHub Projects', url: 'https://docs.page/vypdev/copilot/issues/assignees-and-projects' },
     githubProjects: { title: 'GitHub: About Projects', url: 'https://docs.github.com/en/issues/planning-and-tracking-with-projects/learning-about-projects/about-projects' },
     githubStatus: { title: 'GitHub: About single-select fields', url: 'https://docs.github.com/en/issues/planning-and-tracking-with-projects/understanding-fields/about-single-select-fields' },
-    provisioning: { title: 'Copilot setup and provisioning', url: 'https://docs.page/vypdev/copilot/how-to-use' },
+    provisioning: { title: 'Set up with the web assistant', url: 'https://docs.page/vypdev/copilot/setup-web' },
     storage: { title: 'GitHub Actions Secrets and Variables', url: 'https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets' },
 };
 /** Links are selected from source-controlled constants, never derived from answers or remote text. */
@@ -50190,10 +50244,14 @@ function setupQuestionDocumentation(question) {
         return { title: 'Runner profiles', url: 'https://docs.page/vypdev/copilot/configuration#runner-profiles' };
     if (id === 'issueWorkflows.enabled')
         return docs.issueWorkflows;
-    if (id === 'features.issues')
-        return docs.issueWorkflows;
+    if (id === 'features.issues' || id === 'features.commits')
+        return docs.issuesGuide;
     if (id === 'features.pullRequests')
-        return docs.pullRequestWorkflows;
+        return docs.reviewGuide;
+    if (id === 'features.issueComments' || id === 'features.pullRequestComments')
+        return docs.botGuide;
+    if (id === 'features.release' || id === 'features.hotfix')
+        return docs.releaseGuide;
     if (id === 'repository.issueManagedBranches' || /^repository\.(feature|bugfix|hotfix|release|docs|chore)Tree$/u.test(id))
         return docs.branchManagement;
     if (id === 'repository.preBranchSdd')
@@ -53048,6 +53106,87 @@ function projectCurrentNativeStatus(status, facts) {
 }
 
 
+/***/ }),
+
+/***/ 89347:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.VerificationPrerequisiteError = exports.VERIFICATION_RUNTIME_SPECS = exports.VERIFICATION_RUNTIME_HELP = exports.VERIFICATION_RUNTIME_MANIFEST = void 0;
+exports.parseVerificationRuntimeManifest = parseVerificationRuntimeManifest;
+exports.verificationRuntimeVersion = verificationRuntimeVersion;
+exports.verificationRuntimeMatches = verificationRuntimeMatches;
+exports.VERIFICATION_RUNTIME_MANIFEST = '.copilot/verification-prerequisites.json';
+exports.VERIFICATION_RUNTIME_HELP = 'https://docs.page/vypdev/copilot/security-operations/operations/verification#repository-verification-prerequisites';
+exports.VERIFICATION_RUNTIME_SPECS = {
+    java: { label: 'Java', program: 'java', args: ['-version'] },
+    node: { label: 'Node.js', program: 'node', args: ['--version'] },
+    pnpm: { label: 'pnpm', program: 'pnpm', args: ['--version'] },
+    python: { label: 'Python', program: 'python3', args: ['--version'] },
+    go: { label: 'Go', program: 'go', args: ['version'] },
+    dotnet: { label: '.NET SDK', program: 'dotnet', args: ['--version'] },
+    ruby: { label: 'Ruby', program: 'ruby', args: ['--version'] },
+    rust: { label: 'Rust', program: 'rustc', args: ['--version'] },
+};
+const VERSION_PREFIX = /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,2}$/u;
+/** Only reviewed, closed runtime/version facts enter user-visible diagnostics. Raw tool output never does. */
+class VerificationPrerequisiteError extends Error {
+    constructor(reason, requirement, observed, job) {
+        const jobLabel = job && /^[A-Za-z_][A-Za-z0-9_-]{0,99}$/u.test(job) ? ` in job ${job}` : ' in this job';
+        const runtime = requirement && Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, requirement.runtime)
+            ? exports.VERIFICATION_RUNTIME_SPECS[requirement.runtime].label : 'Required runtime';
+        const version = requirement && VERSION_PREFIX.test(requirement.version) ? requirement.version : 'declared version';
+        const actual = observed && /^[1-9]\d{0,2}(?:\.(?:0|[1-9]\d{0,2})){0,3}$/u.test(observed) ? observed : 'unavailable';
+        const cause = reason === 'manifest-invalid' ? `${exports.VERIFICATION_RUNTIME_MANIFEST} is invalid or unsafe`
+            : reason === 'version-mismatch' ? `${runtime} ${version} is required; observed ${actual}`
+                : reason === 'unreadable-version' ? `${runtime} ${version} could not be verified`
+                    : `${runtime} ${version} is unavailable`;
+        const action = reason === 'manifest-invalid' ? 'Correct the reviewed runtime declaration.'
+            : `Provision the declared runtime in the same job before Copilot, then retry.${requirement?.runtime === 'java' ? ' For Java, configure actions/setup-java or a managed JAVA_HOME.' : ''}`;
+        super(`Repository verification is blocked${jobLabel}: ${cause}. ${action} The repository verification command was not run. Help: ${exports.VERIFICATION_RUNTIME_HELP}`);
+        this.name = 'VerificationPrerequisiteError';
+    }
+}
+exports.VerificationPrerequisiteError = VerificationPrerequisiteError;
+function parseVerificationRuntimeManifest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    const object = value;
+    if (object.schemaVersion !== 1 || Object.keys(object).some(key => !['schemaVersion', 'runtimes'].includes(key))
+        || !object.runtimes || typeof object.runtimes !== 'object' || Array.isArray(object.runtimes)) {
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    }
+    const runtimes = object.runtimes;
+    if (Object.keys(runtimes).length > 8)
+        throw new VerificationPrerequisiteError('manifest-invalid');
+    return Object.entries(runtimes).map(([runtime, version]) => {
+        if (!Object.prototype.hasOwnProperty.call(exports.VERIFICATION_RUNTIME_SPECS, runtime) || typeof version !== 'string' || !VERSION_PREFIX.test(version)) {
+            throw new VerificationPrerequisiteError('manifest-invalid');
+        }
+        return Object.freeze({ runtime: runtime, version });
+    });
+}
+function verificationRuntimeVersion(runtime, output) {
+    const patterns = {
+        java: /^(?:openjdk|java) (?:version )?["']?(\d+(?:\.\d+){0,3})/imu,
+        node: /^v(\d+\.\d+\.\d+)/mu,
+        pnpm: /^(\d+\.\d+\.\d+)/mu,
+        python: /^Python (\d+\.\d+\.\d+)/mu,
+        go: /^go version go(\d+\.\d+(?:\.\d+)?)/mu,
+        dotnet: /^(\d+\.\d+\.\d+)/mu,
+        ruby: /^ruby (\d+\.\d+\.\d+)/mu,
+        rust: /^rustc (\d+\.\d+\.\d+)/mu,
+    };
+    const version = patterns[runtime].exec(output)?.[1];
+    return runtime === 'java' && version?.startsWith('1.') ? version.slice(2) : version;
+}
+function verificationRuntimeMatches(required, observed) {
+    return observed === required || observed.startsWith(`${required}.`);
+}
+
+
 /***/ }),
 
 /***/ 43193:
@@ -57143,7 +57282,7 @@ class SyncBranchUseCase {
         const commands = (0, verify_command_policy_1.limitVerifyCommands)([...context.verifyCommands]);
         if (commands.length === verify_command_policy_1.MAX_VERIFY_COMMANDS)
             (0, logging_ports_1.logInfo)(`Branch sync verification is capped at ${verify_command_policy_1.MAX_VERIFY_COMMANDS} commands.`);
-        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true }));
+        const verification = await (0, verify_command_runner_1.runVerifyCommands)(commands, (program, args) => this.git.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
         if (!verification.success) {
             return {
                 commandCount: commands.length,
@@ -65658,7 +65797,7 @@ async function runVerification(context, gitCommitPort) {
     if (verifyCommands.length === 0)
         return undefined;
     (0, logging_ports_1.logInfo)(`Running ${verifyCommands.length} verify ${verifyCommands.length === 1 ? 'command' : 'commands'}...`);
-    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true }));
+    const verify = await (0, verify_command_runner_1.runVerifyCommands)(verifyCommands, (program, args) => gitCommitPort.execute(program, args, { untrusted: true, verifyRuntimePrerequisites: true }));
     return verify.success
         ? undefined
         : verify.error ?? `Verify command failed: ${verify.failedCommand ?? "unknown"}.`;
@@ -67881,6 +68020,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.runVerifyCommands = runVerifyCommands;
 const logging_ports_1 = __nccwpck_require__(6152);
 const verify_command_policy_1 = __nccwpck_require__(96031);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
 async function runVerifyCommands(commands, execute) {
     for (const command of commands) {
         const result = await executeVerifyCommand(command, execute);
@@ -67899,7 +68039,11 @@ async function executeVerifyCommand(command, execute) {
             ? { success: true }
             : { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
-    catch {
+    catch (error) {
+        if (error instanceof verification_runtime_policy_1.VerificationPrerequisiteError) {
+            return { success: false, failedCommand: formatCommandForDiagnostics(parsed),
+                error: `${error.message} Verification command: ${formatCommandForDiagnostics(parsed)}.` };
+        }
         (0, logging_ports_1.logError)('Verify command failed.');
         return { success: false, failedCommand: formatCommandForDiagnostics(parsed) };
     }
@@ -70081,6 +70225,7 @@ exports.titleUpdateFailure = titleUpdateFailure;
 const result_1 = __nccwpck_require__(73817);
 const application_error_1 = __nccwpck_require__(75999);
 const positive_integer_policy_1 = __nccwpck_require__(19879);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 function projectUpdateTitleContext(source) {
     if (source.isIssue) {
         return Object.freeze({
@@ -70131,19 +70276,27 @@ async function runPullRequestTitleUpdate(param, taskId, issueRepository) {
     if (!linkedIssueNumber || linkedIssueNumber === param.pullRequestNumber) {
         return [skippedResult(taskId)];
     }
+    const currentTitle = await issueRepository.getTitle(param.pullRequestNumber);
+    if (currentTitle === undefined) {
+        return [new result_1.Result({ id: taskId, success: false, executed: true,
+                steps: ['The current pull request title could not be read. No title change was attempted.'],
+                errors: [new application_error_1.ApplicationError('provider.unavailable', 'Unable to read the current pull request title.')] })];
+    }
+    if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(currentTitle))
+        return [skippedResult(taskId)];
     const issueTitle = await issueRepository.getTitle(linkedIssueNumber);
     if (issueTitle === undefined) {
         return [new result_1.Result({ id: taskId, success: false, executed: true, steps: ['Tried to update title, but there was a problem.'] })];
     }
     const title = await issueRepository.updatePullRequestTitle({
-        pullRequestTitle: param.pullRequestTitle,
+        pullRequestTitle: currentTitle,
         issueTitle,
         issueNumber: linkedIssueNumber,
         pullRequestNumber: param.pullRequestNumber,
         labelFacts: param.labelFacts,
     });
     return title
-        ? [updatedResult(taskId, `The pull request's title was updated from \`${param.pullRequestTitle}\` to \`${title}\`.`)]
+        ? [updatedResult(taskId, `The pull request's title was updated from \`${currentTitle}\` to \`${title}\`.`)]
         : [skippedResult(taskId)];
 }
 function titleUpdateFailure(taskId, error) {
@@ -73494,6 +73647,7 @@ exports.registerSetupCommand = registerSetupCommand;
 const product_identity_1 = __nccwpck_require__(18739);
 const setup_command_options_1 = __nccwpck_require__(99254);
 const setup_execution_1 = __nccwpck_require__(51293);
+const setup_documentation_1 = __nccwpck_require__(2396);
 function registerSetupCommand(program) {
     program
         .command('setup')
@@ -73527,6 +73681,7 @@ function registerSetupCommand(program) {
         .option('--update-workflows', 'Allow setup-managed workflows already in the repository to be updated', false)
         .option('--workflow-pat <token>', 'Workflow PAT for the bot account (prefer the hidden interactive prompt)')
         .option('--secret <name=value>', 'Secret value for non-interactive setup; repeat for each API key', setup_command_options_1.collectSecret, {})
+        .addHelpText('after', `\nGuides (open only when you choose):\n  Web setup tutorial: ${setup_documentation_1.SETUP_DOCUMENTATION.tutorial}\n  First issue-to-PR workflow: ${setup_documentation_1.SETUP_DOCUMENTATION.firstWorkflow}\n  Troubleshooting: ${setup_documentation_1.SETUP_DOCUMENTATION.recovery}\n\nDuring interactive setup, type ? for question help and :back to revisit an answer.\n`)
         .action(setup_execution_1.executeSetupCommand);
 }
 
@@ -75440,9 +75595,19 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ConsoleSetupJourneyPresenter = void 0;
 exports.renderSetupJourney = renderSetupJourney;
 const setup_prompt_rendering_1 = __nccwpck_require__(76673);
+const setup_documentation_1 = __nccwpck_require__(2396);
 class ConsoleSetupJourneyPresenter {
     present(view) {
         console.log(renderSetupJourney(view));
+        if (view.outcome === 'complete') {
+            console.log(`Next: install the reviewed files, then verify your first workflow: ${setup_documentation_1.SETUP_DOCUMENTATION.firstWorkflow}`);
+        }
+        else if (view.outcome === 'blocked' || view.outcome === 'partial') {
+            console.log(`Inspect the result before retrying. Troubleshooting: ${setup_documentation_1.SETUP_DOCUMENTATION.recovery}`);
+        }
+        else if (view.current === 'Repository' || view.outcome === 'dry-run') {
+            console.log(`Setup tutorial (opens only when you choose): ${setup_documentation_1.SETUP_DOCUMENTATION.tutorial}`);
+        }
     }
 }
 exports.ConsoleSetupJourneyPresenter = ConsoleSetupJourneyPresenter;
@@ -84736,6 +84901,7 @@ exports.IssueProgressTrackingRepository = IssueProgressTrackingRepository;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.IssueTitleRepository = void 0;
 const issue_emoji_policy_1 = __nccwpck_require__(81201);
+const pull_request_title_policy_1 = __nccwpck_require__(59756);
 const issue_title_policy_1 = __nccwpck_require__(83179);
 const issue_title_update_1 = __nccwpck_require__(9229);
 class IssueTitleRepository {
@@ -84753,10 +84919,12 @@ class IssueTitleRepository {
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, issueTitle, formattedTitle, issueNumber, token);
             });
         };
-        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, branchManagementEmoji, labels, token) => {
+        this.updateTitlePullRequestFormat = async (owner, repository, pullRequestTitle, issueTitle, issueNumber, pullRequestNumber, _branchManagementEmoji, labels, token) => {
             return (0, issue_title_update_1.withTitleUpdateLogging)(() => {
-                const emoji = (0, issue_emoji_policy_1.resolvePullRequestTitleEmoji)(labels, branchManagementEmoji);
-                const formattedTitle = `[#${issueNumber}] ${emoji} - ${(0, issue_title_policy_1.sanitizePullRequestTitle)((0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber))}`;
+                if ((0, pull_request_title_policy_1.hasConventionalPullRequestTitle)(pullRequestTitle))
+                    return Promise.resolve(undefined);
+                const sourceTitle = (0, issue_title_policy_1.normalizePullRequestSourceTitle)(issueTitle, issueNumber);
+                const formattedTitle = (0, pull_request_title_policy_1.generatedPullRequestTitle)(sourceTitle, (0, issue_title_policy_1.sanitizePullRequestTitle)(sourceTitle), issueNumber, labels);
                 return (0, issue_title_update_1.updateIssueTitle)(this.issueTitleClient, owner, repository, pullRequestTitle, formattedTitle, pullRequestNumber, token);
             });
         };
@@ -96391,6 +96559,7 @@ const exec = __importStar(__nccwpck_require__(18538));
 const git_authentication_environment_1 = __nccwpck_require__(16535);
 const untrusted_command_environment_1 = __nccwpck_require__(2304);
 const git_hook_isolation_1 = __nccwpck_require__(39764);
+const verification_runtime_preflight_1 = __nccwpck_require__(23100);
 class GitCommitAdapter {
     constructor(executeCommand = (program, args, options) => options
         ? exec.exec(program, args, {
@@ -96400,16 +96569,21 @@ class GitCommitAdapter {
             ...(options.stdout ? { listeners: { stdout: options.stdout } } : {}),
             ...(options.env ? { env: options.env } : {}),
         })
-        : exec.exec(program, args)) {
+        : exec.exec(program, args), checkPrerequisites = verification_runtime_preflight_1.assertVerificationRuntimePrerequisites) {
         this.executeCommand = executeCommand;
+        this.checkPrerequisites = checkPrerequisites;
     }
     async execute(program, args, options) {
+        if (options?.verifyRuntimePrerequisites && !options.untrusted)
+            throw new Error('Runtime preflight requires credential-free verification.');
         if (!options?.untrusted)
             return options ? this.executeCommand(program, args, options) : this.executeCommand(program, args);
         if (options.env)
             throw new Error('Untrusted command execution does not accept a caller-supplied environment.');
         const runtime = (0, untrusted_command_environment_1.prepareUntrustedCommandEnvironment)();
         try {
+            if (options.verifyRuntimePrerequisites)
+                this.checkPrerequisites(runtime.environment);
             return await this.executeCommand(program, args, {
                 ...(options.stdout ? { stdout: options.stdout } : {}),
                 env: runtime.environment,
@@ -101890,6 +102064,7 @@ const node_path_1 = __nccwpck_require__(49411);
 const agent_private_install_root_1 = __nccwpck_require__(44640);
 const ALLOWED_VARIABLES = [
     'PATH',
+    'JAVA_HOME',
     'LANG',
     'LANGUAGE',
     'LC_ALL',
@@ -101949,6 +102124,132 @@ function prepareUntrustedCommandEnvironment(source = process.env, platform = pro
 }
 
 
+/***/ }),
+
+/***/ 91053:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.readVerificationRuntimeManifest = readVerificationRuntimeManifest;
+const node_fs_1 = __nccwpck_require__(87561);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const MAX_MANIFEST_BYTES = 16 * 1024;
+function readVerificationRuntimeManifest(root) {
+    const path = (0, node_path_1.resolve)(root, verification_runtime_policy_1.VERIFICATION_RUNTIME_MANIFEST);
+    let descriptor;
+    try {
+        let directory;
+        try {
+            directory = (0, node_fs_1.lstatSync)((0, node_path_1.join)(root, '.copilot'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!directory.isDirectory() || directory.isSymbolicLink()
+            || (0, node_fs_1.realpathSync)((0, node_path_1.join)(root, '.copilot')) !== (0, node_path_1.join)((0, node_fs_1.realpathSync)(root), '.copilot'))
+            throw new Error('Unsafe manifest parent');
+        let entry;
+        try {
+            entry = (0, node_fs_1.lstatSync)(path, { bigint: true });
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        }
+        if (!entry.isFile() || entry.isSymbolicLink() || entry.nlink !== 1n || entry.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Unsafe manifest');
+        descriptor = (0, node_fs_1.openSync)(path, node_fs_1.constants.O_RDONLY | (node_fs_1.constants.O_NOFOLLOW ?? 0));
+        const opened = (0, node_fs_1.fstatSync)(descriptor, { bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.dev !== entry.dev || opened.ino !== entry.ino
+            || opened.size > BigInt(MAX_MANIFEST_BYTES))
+            throw new Error('Manifest changed');
+        const bytes = Buffer.alloc(MAX_MANIFEST_BYTES + 1);
+        const size = (0, node_fs_1.readSync)(descriptor, bytes, 0, bytes.length, 0);
+        if (size > MAX_MANIFEST_BYTES)
+            throw new Error('Oversized manifest');
+        return (0, verification_runtime_policy_1.parseVerificationRuntimeManifest)(JSON.parse(bytes.subarray(0, size).toString('utf8')));
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('manifest-invalid');
+    }
+    finally {
+        if (descriptor !== undefined)
+            (0, node_fs_1.closeSync)(descriptor);
+    }
+}
+
+
+/***/ }),
+
+/***/ 23100:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertVerificationRuntimePrerequisites = assertVerificationRuntimePrerequisites;
+const node_child_process_1 = __nccwpck_require__(17718);
+const node_path_1 = __nccwpck_require__(49411);
+const verification_runtime_manifest_1 = __nccwpck_require__(91053);
+const verification_runtime_policy_1 = __nccwpck_require__(89347);
+const probe = (program, args, environment) => {
+    const result = (0, node_child_process_1.spawnSync)(program, [...args], { env: environment, encoding: 'utf8', shell: false,
+        windowsHide: true, timeout: 5000, maxBuffer: 8192, stdio: ['ignore', 'pipe', 'pipe'] });
+    return { status: result.status, output: `${result.stdout ?? ''}\n${result.stderr ?? ''}`, failed: !!result.error };
+};
+const hasControlCharacter = (value) => [...value].some(character => character.charCodeAt(0) < 32);
+/** Fixed version probes only; never installs a runtime or executes a repository-provided bootstrap. */
+function assertVerificationRuntimePrerequisites(environment, root = process.cwd(), run = probe, platform = process.platform, job = process.env.GITHUB_JOB) {
+    for (const requirement of (0, verification_runtime_manifest_1.readVerificationRuntimeManifest)(root)) {
+        checkRuntime(requirement, environment, run, platform, job);
+    }
+}
+function checkRuntime(requirement, environment, run, platform, job) {
+    const spec = verification_runtime_policy_1.VERIFICATION_RUNTIME_SPECS[requirement.runtime];
+    let program = spec.program;
+    let args = spec.args;
+    if (requirement.runtime === 'java' && environment.JAVA_HOME) {
+        const paths = platform === 'win32' ? node_path_1.win32 : node_path_1.posix;
+        if (!paths.isAbsolute(environment.JAVA_HOME) || hasControlCharacter(environment.JAVA_HOME)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = paths.join(environment.JAVA_HOME, 'bin', platform === 'win32' ? 'java.exe' : 'java');
+    }
+    else if (requirement.runtime === 'python' && platform === 'win32')
+        program = 'python';
+    else if (requirement.runtime === 'pnpm' && platform === 'win32') {
+        const systemRoot = environment.SystemRoot;
+        if (!systemRoot || !node_path_1.win32.isAbsolute(systemRoot) || hasControlCharacter(systemRoot)) {
+            throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+        }
+        program = node_path_1.win32.join(systemRoot, 'System32', 'cmd.exe');
+        args = ['/d', '/s', '/c', 'pnpm --version'];
+    }
+    let result;
+    try {
+        result = run(program, args, environment);
+    }
+    catch {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    if (result.failed || result.status !== 0 || result.output.length > 8192) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unavailable', requirement, undefined, job);
+    }
+    const observed = (0, verification_runtime_policy_1.verificationRuntimeVersion)(requirement.runtime, result.output);
+    if (!observed)
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('unreadable-version', requirement, undefined, job);
+    if (!(0, verification_runtime_policy_1.verificationRuntimeMatches)(requirement.version, observed)) {
+        throw new verification_runtime_policy_1.VerificationPrerequisiteError('version-mismatch', requirement, observed, job);
+    }
+}
+
+
 /***/ }),
 
 /***/ 92540: