agentme 0.35.2 → 0.36.0

package/.xdrs/agentme/edrs/principles/skills/400-pr-owner-assistant/SKILL.test.md

@@ -0,0 +1,174 @@
+---
+skill: 400-pr-owner-assistant
+skill-version: "2.3.0"
+---
+
+## Test Scenarios
+
+### Scenario 1: End-to-end GitHub PR review, happy path
+
+**Trigger / Input**
+
+"Let's review this PR: https://github.com/acme/widgets/pull/482" (run from a clean, up to
+date local clone of `acme/widgets`, which has 2 open comments).
+
+**Expected Behaviour**
+
+The skill: (1) parses the URL host as `github.com` and activates `github-connector`; (2)
+Phase 1 fetches PR #482 metadata and every comment via the connector's read commands; (3)
+Phase 2 confirms the local repo matches `acme/widgets` and offers to check out the PR
+branch; (4) Phase 3 creates `.tmp/review-pr-482.md` with one templated section per open
+comment, fully populated before any question is asked -- writing the summary automatically
+without asking for confirmation, rendering each section's `source` field as a clickable
+markdown link to the matching file in the local checkout (never a provider URL),
+populating `source-lines` with the commented line(s) plus padding read from the checked-out
+file, `diff-hunk-raw` verbatim from the connector, `author-raw` verbatim from the connector,
+`comment-url` verbatim from the connector, `possible-user-intention` (an under-20-word,
+silently generated read of the author's likely concern) alongside the existing `type`, and
+`possible-follow-ups` (2-4 candidate next actions), and recording the verbatim comment text
+and any existing replies under `comment-raw`/`replies-raw`; (5) Phase 4 opens noting every
+drafted item is only ever sent later, during Phase 5 -- never mid-walkthrough -- then walks
+each of the 2 comments one at a time, rendering its full focus card (comment, code,
+criticality/type/possible-user-intention, possible-follow-ups) before asking the human to
+choose an action for that single comment; (6) for each, drafts the reply/fix text and shows
+the mandatory confirmation titled with the comment's short title, author, and exact reply
+text, persisting it as `pending-reply: drafted` once confirmed -- nothing is sent at this
+point; (7) Phase 5 gathers both now-drafted comments, renders a consolidated preview table
+(id, title, action, resolve-on-apply) followed by each row's exact draft text, runs the
+pre-flight commit/push gate (finding the worktree and remote already clean, so it proceeds
+silently), then applies both together via a single apply-all batch confirmation -- resolving
+comment 1's thread as requested -- and reports the final summary by action taken and send
+status.
+
+**Simulated Human Responses**
+1. "Yes, check out the PR branch."
+2. "For comment 1: confirm criticality, action = reply. Yes, resolve the thread once
+   applied." (accepts the drafted text unedited)
+3. "For comment 2: confirm criticality, action = fix. Use this reply text instead:
+   'Renamed per your suggestion, thanks!'" (replaces the drafted text with free text)
+4. (Phase 5) "Apply all now."
+
+**Assertions**
+
+- [ ] Skill activates `github-connector` because the URL host is `github.com`.
+- [ ] Skill does not skip Phase 2 workspace validation before creating the tracking file.
+- [ ] Skill creates `.tmp/review-pr-482.md` with a templated section per fetched open
+      comment only -- already-resolved comments are never recorded.
+- [ ] Skill fully populates every comment's section -- including `possible-follow-ups` and
+      `diff-hunk-raw` -- before Phase 4 asks its first triage question.
+- [ ] Skill writes the tracking file's PR summary automatically, without asking the human to
+      confirm or edit it first.
+- [ ] Skill renders each section's `source` field as a markdown link to the matching local
+      file, relative to the tracking file's own location (file:line-range text for
+      file-scoped comments, `(PR conversation)` text with no link otherwise) -- never a link
+      to the provider's website.
+- [ ] Skill asks about exactly one comment at a time in Phase 4, never batching multiple
+      comments' triage questions into a single ask.
+- [ ] Skill shows the mandatory confirmation -- titled with the comment's short title,
+      author, and exact reply text -- before persisting each draft in Phase 4, and neither
+      applies nor posts anything during Phase 4.
+- [ ] Skill persists both comments as `pending-reply: drafted` at the end of Phase 4, with
+      neither one sent to the provider yet.
+- [ ] Skill's Phase 5 renders a consolidated preview table (one row per drafted comment:
+      id, title, action, resolve-on-apply) followed by each row's exact draft text shown
+      below the table.
+- [ ] Skill's Phase 5 runs the pre-flight commit/push gate and, finding the worktree and
+      remote clean, proceeds straight to applying without asking anything about git.
+- [ ] Skill applies both comments' drafts together in a single apply-all batch confirmation
+      in Phase 5, resolving comment 1's thread as requested.
+- [ ] Skill suffixes comment 1's reply -- accepted unedited -- with
+      `(pr-owner-assistant skill - using defaults)` before posting it.
+- [ ] Skill suffixes comment 2's reply -- replaced with human-supplied free text -- with
+      `(pr-owner-assistant skill - guided)` before posting it.
+- [ ] Skill records the section's original comment text under `comment-raw` and any existing
+      thread replies under `replies-raw`, never under the old `comment`/`replies` names.
+- [ ] Skill populates `source-lines` with the commented line(s) padded +-3 lines, each line
+      prefixed with its absolute line number.
+- [ ] Skill populates `author-raw` and `comment-url` verbatim from the connector.
+- [ ] Skill populates `possible-user-intention` with an under-20-word inference silently,
+      with no dedicated confirmation prompt of its own.
+
+### Scenario 2: Suggested-fix detection drives accept/evolve/decline framing
+
+**Trigger / Input**
+
+Phase 3 populates 3 comments, each containing a fenced `suggestion` block in `comment-raw`:
+comment 1 proposes a correct rename with no side effects; comment 2 proposes a fix that is
+right in direction but leaves an edge case unhandled; comment 3 proposes a change that would
+silently break an unrelated caller.
+
+**Expected Behaviour**
+
+Phase 3 extracts each `suggested-fix` verbatim from its fenced block and records a
+`suggested-fix-assessment` with rationale: `accept-as-is` for comment 1, `evolve-with-changes`
+for comment 2, `not-recommended` for comment 3. In Phase 4, each focus card renders the
+`suggested-fix`/`suggested-fix-assessment` pair right after `diff-hunk-raw`/`source-lines`.
+For comment 1, the human applies the suggestion verbatim as a `fix` with no inline code
+comment (the rename is self-evident, no rationale needed). For comment 2, the human applies
+an evolved fix that also handles the edge case, and the skill adds a short inline code
+comment at the changed lines explaining why the fix goes beyond the original suggestion.
+For comment 3, the human declines with `wontfix`, and the skill's drafted rationale
+explains why the suggestion isn't safe to apply, plus a short inline code comment at the
+affected lines pointing back to that rationale.
+
+**Simulated Human Responses**
+1. "For comment 1: action = fix, apply the suggestion as-is."
+2. "For comment 2: action = fix, but also handle the empty-input case the suggestion
+   missed."
+3. "For comment 3: action = wontfix -- that suggestion would break the other caller of this
+   function."
+
+**Assertions**
+
+- [ ] Skill records a `suggested-fix` verbatim from each comment's fenced `suggestion`
+      block, independent of which connector fetched it.
+- [ ] Skill records `suggested-fix-assessment: accept-as-is` for comment 1,
+      `evolve-with-changes` for comment 2, and `not-recommended` for comment 3, each with a
+      short rationale.
+- [ ] Skill renders `suggested-fix` and `suggested-fix-assessment` in the focus card right
+      after `diff-hunk-raw`/`source-lines`, for all 3 comments.
+- [ ] Skill applies comment 1's fix verbatim with no added inline code comment, since the
+      rationale is self-evident.
+- [ ] Skill adds a short inline code comment at comment 2's changed lines explaining why the
+      fix evolves beyond the original suggestion.
+- [ ] Skill adds a short inline code comment at comment 3's affected lines explaining why
+      the suggested fix was declined, matching the `wontfix` rationale.
+
+### Scenario 3: Phase 5 preview table, apply-all batch, and the commit/push gate
+
+**Trigger / Input**
+
+Phase 5 begins with 3 comments at `pending-reply: drafted` (2 `reply`, 1 `fix`). The local
+worktree has one uncommitted change and 2 local commits not yet on the remote tracking
+branch. The human chooses apply-all; the connector reports a transient failure applying the
+2nd item only.
+
+**Expected Behaviour**
+
+Phase 5 renders the consolidated preview table (3 rows) with each row's exact draft text
+shown below it, then runs the pre-flight git check. Finding both the uncommitted change and
+the 2 unpushed commits, it shows a reminder that other participants won't see this code
+until pushed, advises the human to add/commit/push manually -- never running any git command
+itself -- and waits for explicit confirmation before applying anything. Once confirmed, it
+applies item 1 successfully, hits the transient failure on item 2 (reporting it plainly
+without losing item 1's already-applied state), and continues on to apply item 3
+successfully.
+
+**Simulated Human Responses**
+1. "Apply all now."
+2. "I've committed and pushed -- go ahead."
+
+**Assertions**
+
+- [ ] Skill renders all 3 items in the preview table with exact draft text shown below it,
+      before asking how to proceed.
+- [ ] Skill's pre-flight git check detects both the uncommitted change and the 2 unpushed
+      local commits, and shows a reminder plus advice to add/commit/push manually.
+- [ ] Skill never runs `git add`, `git commit`, or `git push` itself, regardless of what the
+      check finds.
+- [ ] Skill waits for explicit human confirmation after the reminder before applying any
+      item.
+- [ ] Skill's mid-batch failure on item 2 does not discard or reapply item 1's
+      already-applied result.
+- [ ] Skill continues on to apply item 3 after item 2's failure, and reports a per-item
+      outcome (applied, applied, failed) at the end.

package/.xdrs/agentme/edrs/principles/skills/400-pr-owner-assistant/scripts/post-replies-azure-devops.js

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Applies pr-owner-assistant tracking-file drafts to a live Azure DevOps PR, using the
+ * `az rest` commands documented in 251-azure-devops-connector's "Writing data" section.
+ * Delegates every tracking-file read/write to the sibling `update-section.js` script so
+ * there is exactly one place that understands the file format.
+ *
+ * Every write is verified by an independent read-back before the tracking file is ever
+ * marked `pending-reply: applied` -- a zero exit code from `az rest` alone is never treated
+ * as proof a write persisted (see 251-azure-devops-connector's Known Issues: a POST/PATCH
+ * can exit 0 without the change actually landing on the server).
+ *
+ * Usage:
+ *   post-replies-azure-devops.js --pr-url <url> <tracking-file> [--dry-run] [--only <id>[,<id>...]]
+ *
+ * <url> is the PR's Azure DevOps URL (modern dev.azure.com or legacy *.visualstudio.com
+ * format); org/project/repo/PR number are all parsed from it.
+ * Processes every section whose `pending-reply:` is currently `drafted`, or exactly the
+ * `--only` ids (regardless of their current `pending-reply` state) when given. For each:
+ * skips posting if the exact reply text is already present on the live thread (verified
+ * idempotency, never assumed), otherwise POSTs `reply-draft` as a reply and verifies via
+ * GET; then, if `resolve-on-apply: true`, PATCHes the thread to "fixed" and verifies that
+ * too. Only after these checks pass does it mark `pending-reply: applied` (and
+ * `status: resolved`) via update-section.js. `AZ_BIN` (default `az`) overrides the CLI
+ * binary invoked, for testing with a stub.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execFileSync } = require('child_process');
+
+const ADO_RESOURCE = '499b84ac-1321-427f-aa17-267ca6975798'; // Azure DevOps' well-known AAD resource id
+const UPDATE_SECTION = path.join(__dirname, 'update-section.js');
+const [AZ_BIN, ...AZ_PREFIX_ARGS] = (process.env.AZ_BIN || 'az').split(' ');
+
+function parsePrUrl(url) {
+  let m = /^https:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)\/pullrequest\/(\d+)/.exec(url);
+  if (m) return { org: m[1], project: m[2], repo: m[3], pr: m[4] };
+  m = /^https:\/\/([^./]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+)\/pullrequest\/(\d+)/.exec(url);
+  if (m) return { org: m[1], project: m[2], repo: m[3], pr: m[4] };
+  throw new Error(`unrecognized Azure DevOps PR URL: ${url}`);
+}
+
+// Rejoins hand-wrapped lines within a paragraph into one logical line, preserving genuine
+// blank-line paragraph breaks -- tolerant of drafts written either wrapped or unwrapped.
+function joinReplyDraft(rawText) {
+  const paragraphs = [];
+  let cur = [];
+  for (const line of rawText.split('\n')) {
+    if (line.trim() === '') {
+      if (cur.length) {
+        paragraphs.push(cur.join(' '));
+        cur = [];
+      }
+    } else {
+      cur.push(line.trimEnd());
+    }
+  }
+  if (cur.length) paragraphs.push(cur.join(' '));
+  return paragraphs.join('\n\n');
+}
+
+function parseArgs(argv) {
+  const args = { file: null, prUrl: null, dryRun: false, only: null };
+  const rest = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--pr-url') args.prUrl = argv[++i];
+    else if (a === '--dry-run') args.dryRun = true;
+    else if (a === '--only') {
+      args.only = argv[++i]
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    } else rest.push(a);
+  }
+  [args.file] = rest;
+  return args;
+}
+
+function runUpdateSection(cmdArgs, input) {
+  return execFileSync('node', [UPDATE_SECTION, ...cmdArgs], { input, encoding: 'utf8' });
+}
+
+function listCandidateSections(file, only) {
+  const stdout = runUpdateSection(['list', file]);
+  const rows = [];
+  let cur = null;
+  for (const line of stdout.split('\n')) {
+    const idMatch = /^- id: (.*)$/.exec(line);
+    if (idMatch) {
+      if (cur) rows.push(cur);
+      cur = { id: idMatch[1] };
+      continue;
+    }
+    if (!cur) continue;
+    const fieldMatch = /^ {2}([\w-]+): ?(.*)$/.exec(line);
+    if (fieldMatch) cur[fieldMatch[1]] = fieldMatch[2];
+  }
+  if (cur) rows.push(cur);
+  return rows.filter((r) => (only ? only.includes(r.id) : r['pending-reply'] === 'drafted'));
+}
+
+function getThread(base, threadId) {
+  const uri = `${base}/threads/${threadId}?api-version=7.1`;
+  const out = execFileSync(AZ_BIN, [...AZ_PREFIX_ARGS, 'rest', '--resource', ADO_RESOURCE, '--method', 'GET', '--uri', uri], {
+    stdio: 'pipe',
+  });
+  return JSON.parse(out.toString());
+}
+
+function applySection(base, tmpDir, file, row) {
+  const m = /^thread-comment\/(\d+)\.(\d+)$/.exec(row.id);
+  if (!m) return { id: row.id, ok: false, error: `id is not a thread-comment/<threadId>.<commentId> value: ${row.id}` };
+  const [, threadId, commentId] = m;
+  const resolveOnApply = row['resolve-on-apply'] === 'true';
+  const rawDraft = runUpdateSection(['get', file, row.id, 'reply-draft']).replace(/\n$/, '');
+  const replyText = joinReplyDraft(rawDraft);
+
+  try {
+    const before = getThread(base, threadId);
+    const alreadyPosted = (before.comments || []).some((c) => c.content === replyText);
+    if (!alreadyPosted) {
+      const bodyFile = path.join(tmpDir, `body-${threadId}.json`);
+      fs.writeFileSync(bodyFile, JSON.stringify({ content: replyText, parentCommentId: Number(commentId) }));
+      const postUri = `${base}/threads/${threadId}/comments?api-version=7.1`;
+      execFileSync(AZ_BIN, [...AZ_PREFIX_ARGS, 'rest', '--resource', ADO_RESOURCE, '--method', 'POST', '--uri', postUri, '--body', `@${bodyFile}`], {
+        stdio: 'pipe',
+      });
+
+      // az exiting 0 is not proof the write persisted -- always read back to confirm.
+      const afterPost = getThread(base, threadId);
+      if (!(afterPost.comments || []).some((c) => c.content === replyText)) {
+        return { id: row.id, ok: false, error: 'POST exited 0 but reply missing on read-back verification' };
+      }
+    }
+
+    let resolved = false;
+    if (resolveOnApply) {
+      const current = getThread(base, threadId);
+      if (current.status === 'fixed') {
+        resolved = true;
+      } else {
+        const patchUri = `${base}/threads/${threadId}?api-version=7.1`;
+        execFileSync(AZ_BIN, [...AZ_PREFIX_ARGS, 'rest', '--resource', ADO_RESOURCE, '--method', 'PATCH', '--uri', patchUri, '--body', '{"status":"fixed"}'], {
+          stdio: 'pipe',
+        });
+        const afterPatch = getThread(base, threadId);
+        resolved = afterPatch.status === 'fixed';
+        if (!resolved) {
+          return { id: row.id, ok: false, error: 'PATCH exited 0 but status not "fixed" on read-back verification' };
+        }
+      }
+    }
+
+    // Only ever mark the tracking file after independent verification above, never on a
+    // bare `az rest` exit code.
+    runUpdateSection(['set', file, row.id, 'pending-reply', 'applied']);
+    if (resolved) runUpdateSection(['set', file, row.id, 'status', 'resolved']);
+    return { id: row.id, ok: true, resolved };
+  } catch (e) {
+    return { id: row.id, ok: false, error: String(e.stderr || e.message) };
+  }
+}
+
+function main(argv) {
+  const args = parseArgs(argv);
+  if (!args.file || !args.prUrl) {
+    console.error('Usage: post-replies-azure-devops.js --pr-url <url> <tracking-file> [--dry-run] [--only <id>[,<id>...]]');
+    process.exit(1);
+    return;
+  }
+  const { org, project, repo, pr } = parsePrUrl(args.prUrl);
+  const base = `https://dev.azure.com/${org}/${project}/_apis/git/repositories/${repo}/pullRequests/${pr}`;
+
+  const rows = listCandidateSections(args.file, args.only);
+  if (rows.length === 0) {
+    console.log('No sections to apply (nothing pending-reply: drafted).');
+    return;
+  }
+
+  const results = [];
+  if (args.dryRun) {
+    for (const row of rows) {
+      const rawDraft = runUpdateSection(['get', args.file, row.id, 'reply-draft']).replace(/\n$/, '');
+      console.log(`\n=== ${row.id} (resolve=${row['resolve-on-apply'] === 'true'}) ===\n${joinReplyDraft(rawDraft)}`);
+      results.push({ id: row.id, ok: true, dryRun: true });
+    }
+  } else {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'post-replies-'));
+    for (const row of rows) {
+      const result = applySection(base, tmpDir, args.file, row);
+      results.push(result);
+      if (result.ok) {
+        console.log(`OK   ${result.id} replied+verified${result.resolved ? ' + resolved+verified' : ''}`);
+      } else {
+        console.error(`FAIL ${result.id}: ${result.error}`);
+      }
+    }
+  }
+
+  console.log('\n--- SUMMARY ---');
+  console.log(JSON.stringify(results, null, 2));
+  if (results.some((r) => !r.ok)) process.exit(1);
+}
+
+if (require.main === module) {
+  try {
+    main(process.argv.slice(2));
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+module.exports = { parsePrUrl, joinReplyDraft };

package/.xdrs/agentme/edrs/principles/skills/400-pr-owner-assistant/scripts/post-replies-azure-devops.test.js

@@ -0,0 +1,253 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const SCRIPT = path.join(__dirname, 'post-replies-azure-devops.js');
+const { parsePrUrl, joinReplyDraft } = require('./post-replies-azure-devops.js');
+
+const PR_URL = 'https://dev.azure.com/nn-bank/mortgage-loan/_git/mortgage-loan/pullrequest/43556';
+
+// Fake `az` used via AZ_BIN: reads/writes a JSON file (FAKE_ADO_STATE) to simulate thread
+// state, so tests never touch the network. Supports the same `rest --method GET|POST|PATCH
+// --uri <url> [--body <json|@file>]` shape the real script calls.
+const FAKE_AZ_SRC = `
+'use strict';
+const fs = require('fs');
+const statePath = process.env.FAKE_ADO_STATE;
+const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+const argv = process.argv.slice(2);
+const method = argv[argv.indexOf('--method') + 1];
+const uri = argv[argv.indexOf('--uri') + 1];
+let body = null;
+const bodyIdx = argv.indexOf('--body');
+if (bodyIdx !== -1) {
+  let raw = argv[bodyIdx + 1];
+  if (raw.startsWith('@')) raw = fs.readFileSync(raw.slice(1), 'utf8');
+  body = JSON.parse(raw);
+}
+const commentsMatch = /threads\\/(\\d+)\\/comments/.exec(uri);
+const threadMatch = /threads\\/(\\d+)/.exec(uri);
+const threadId = (commentsMatch || threadMatch)[1];
+const thread = state.threads[threadId];
+if (!thread) { console.error('unknown thread ' + threadId); process.exit(1); }
+if (method === 'GET') {
+  process.stdout.write(JSON.stringify(thread));
+} else if (method === 'POST' && commentsMatch) {
+  if (state.failPost && state.failPost.includes(threadId)) {
+    console.error('simulated hard POST failure for ' + threadId);
+    process.exit(1);
+  }
+  if (!(state.postBehavior && state.postBehavior[threadId] === 'false-positive')) {
+    thread.comments.push({ id: thread.comments.length + 1, content: body.content, parentCommentId: body.parentCommentId });
+  }
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  process.stdout.write(JSON.stringify({ id: thread.comments.length }));
+} else if (method === 'PATCH') {
+  if (!(state.patchBehavior && state.patchBehavior[threadId] === 'false-positive')) {
+    thread.status = body.status;
+  }
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  process.stdout.write(JSON.stringify(thread));
+} else {
+  console.error('unsupported fake az call: ' + method + ' ' + uri);
+  process.exit(1);
+}
+`;
+
+const FIXTURE = `# PR #43556
+
+### Reusing atlas service principal for unrelated pipeline
+id: thread-comment/100.1
+status: open
+source: (PR conversation)
+comment-raw: |
+  Should we really use atlas service principal even when it is not atlas doing the action?
+replies-raw:
+possible-follow-ups:
+  - fix: create a dedicated service connection
+action: fix
+resolve-on-apply: false
+pending-reply: drafted
+reply-draft: |
+  Agreed -- good catch. Renamed the parameter to a dedicated codeowners-app service
+  connection. Leaving this thread open until it is created. (pr-owner-assistant - with user
+  guidance)
+
+### Split run() into smaller functions
+id: thread-comment/200.1
+status: open
+source: (PR conversation)
+comment-raw: |
+  Can we split this into smaller functions?
+replies-raw:
+possible-follow-ups:
+action: fix
+resolve-on-apply: true
+pending-reply: drafted
+reply-draft: |
+  Fixed -- split run() into named single-purpose functions. (pr-owner-assistant - with
+  defaults)
+
+### Already handled comment, should never be touched
+id: thread-comment/300.1
+status: open
+source: (PR conversation)
+comment-raw: |
+  Unrelated comment still awaiting triage.
+replies-raw:
+possible-follow-ups:
+action:
+resolve-on-apply: false
+pending-reply: none
+reply-draft: |
+`;
+
+function setup(state) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'post-replies-test-'));
+  const file = path.join(dir, 'review-pr-43556.md');
+  fs.writeFileSync(file, FIXTURE);
+  const fakeAz = path.join(dir, 'fake-az.js');
+  fs.writeFileSync(fakeAz, FAKE_AZ_SRC);
+  const statePath = path.join(dir, 'state.json');
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  return { file, statePath, env: { ...process.env, AZ_BIN: `node ${fakeAz}`, FAKE_ADO_STATE: statePath } };
+}
+
+function run(args, env) {
+  try {
+    const stdout = execFileSync('node', [SCRIPT, ...args], { encoding: 'utf8', env });
+    return { status: 0, stdout };
+  } catch (err) {
+    return { status: err.status, stdout: err.stdout, stderr: err.stderr };
+  }
+}
+
+function getField(file, id, field) {
+  return execFileSync('node', [path.join(__dirname, 'update-section.js'), 'get', file, id, field], { encoding: 'utf8' }).trim();
+}
+
+test('parsePrUrl extracts org/project/repo/pr from a modern dev.azure.com URL', () => {
+  assert.deepEqual(parsePrUrl(PR_URL), { org: 'nn-bank', project: 'mortgage-loan', repo: 'mortgage-loan', pr: '43556' });
+});
+
+test('parsePrUrl extracts org/project/repo/pr from a legacy *.visualstudio.com URL', () => {
+  assert.deepEqual(parsePrUrl('https://contoso.visualstudio.com/Widgets/_git/widgets-api/pullrequest/1029'), {
+    org: 'contoso',
+    project: 'Widgets',
+    repo: 'widgets-api',
+    pr: '1029',
+  });
+});
+
+test('parsePrUrl rejects an unrecognized URL rather than guessing', () => {
+  assert.throws(() => parsePrUrl('https://example.com/not/ado'), /unrecognized Azure DevOps PR URL/);
+});
+
+test('joinReplyDraft rejoins hand-wrapped lines within a paragraph, preserving paragraph breaks', () => {
+  const raw = 'Line one\nstill line one.\n\nSecond paragraph\non two lines.';
+  assert.equal(joinReplyDraft(raw), 'Line one still line one.\n\nSecond paragraph on two lines.');
+});
+
+test('posts a drafted reply, verifies via read-back, and marks pending-reply applied', () => {
+  const { file, env } = setup({
+    threads: {
+      100: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, '--only', 'thread-comment/100.1', file], env);
+  assert.equal(status, 0, stdout);
+  assert.match(stdout, /OK {3}thread-comment\/100\.1 replied\+verified$/m);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'applied');
+  assert.equal(getField(file, 'thread-comment/100.1', 'status'), 'open'); // resolve-on-apply: false
+});
+
+test('resolves the thread and marks status resolved when resolve-on-apply is true', () => {
+  const { file, env } = setup({
+    threads: {
+      200: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, '--only', 'thread-comment/200.1', file], env);
+  assert.equal(status, 0, stdout);
+  assert.match(stdout, /replied\+verified \+ resolved\+verified/);
+  assert.equal(getField(file, 'thread-comment/200.1', 'pending-reply'), 'applied');
+  assert.equal(getField(file, 'thread-comment/200.1', 'status'), 'resolved');
+});
+
+test('REGRESSION: does not mark pending-reply applied when POST exits 0 but the reply never persists', () => {
+  const { file, env } = setup({
+    threads: {
+      100: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+    postBehavior: { 100: 'false-positive' },
+  });
+  const { status, stderr } = run(['--pr-url', PR_URL, '--only', 'thread-comment/100.1', file], env);
+  assert.equal(status, 1);
+  assert.match(stderr, /FAIL thread-comment\/100\.1: POST exited 0 but reply missing on read-back verification/);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'drafted');
+});
+
+test('REGRESSION: does not mark status resolved when PATCH exits 0 but status never persists', () => {
+  const { file, env } = setup({
+    threads: {
+      200: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+    patchBehavior: { 200: 'false-positive' },
+  });
+  const { status, stderr } = run(['--pr-url', PR_URL, '--only', 'thread-comment/200.1', file], env);
+  assert.equal(status, 1);
+  assert.match(stderr, /FAIL thread-comment\/200\.1: PATCH exited 0 but status not "fixed" on read-back verification/);
+  assert.equal(getField(file, 'thread-comment/200.1', 'pending-reply'), 'drafted');
+  assert.equal(getField(file, 'thread-comment/200.1', 'status'), 'open');
+});
+
+test('skips re-posting when the exact reply is already present on the live thread, but still marks applied', () => {
+  const alreadyPostedText =
+    'Agreed -- good catch. Renamed the parameter to a dedicated codeowners-app service connection. Leaving this thread open until it is created. (pr-owner-assistant - with user guidance)';
+  const { file, env } = setup({
+    threads: {
+      100: {
+        status: 'active',
+        comments: [
+          { id: 1, content: 'orig comment' },
+          { id: 2, content: alreadyPostedText },
+        ],
+      },
+    },
+    // If the script incorrectly tries to POST again, this makes it fail loudly.
+    failPost: ['100'],
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, '--only', 'thread-comment/100.1', file], env);
+  assert.equal(status, 0, stdout);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'applied');
+});
+
+test('never processes a section whose pending-reply is not drafted, when --only is not given', () => {
+  const { file, env } = setup({
+    threads: {
+      100: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+      200: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+      // 300 deliberately absent: pending-reply is 'none' for it, so a correct run never
+      // references thread 300 at all -- if it did, the fake az would fail with "unknown
+      // thread 300" and this test would catch it.
+    },
+    failPost: ['300'],
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, file], env);
+  assert.equal(status, 0, stdout);
+  assert.equal(getField(file, 'thread-comment/300.1', 'pending-reply'), 'none');
+});
+
+test('--dry-run prints drafts without invoking az or changing the tracking file', () => {
+  const { file, env } = setup({ threads: {} }); // no threads defined: any az call would throw
+  const { status, stdout } = run(['--pr-url', PR_URL, '--dry-run', file], env);
+  assert.equal(status, 0, stdout);
+  assert.match(stdout, /=== thread-comment\/100\.1 \(resolve=false\) ===/);
+  assert.match(stdout, /=== thread-comment\/200\.1 \(resolve=true\) ===/);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'drafted');
+});