agentme 0.35.2 → 0.37.0

package/.xdrs/agentme/edrs/principles/skills/resolve-pr-comments/SKILL.test.md

@@ -0,0 +1,165 @@
+---
+skill: resolve-pr-comments
+skill-version: "4.0.0"
+---
+
+## Test Scenarios
+
+### Scenario 1: End-to-end GitHub PR review, happy path with guided mode and a Phase 6 edit
+
+**Trigger / Input**
+
+"Let's review this PR: https://github.com/acme/widgets/pull/482" (run from a clean, up to
+date local clone of `acme/widgets`, which has 2 open comments).
+
+**Expected Behaviour**
+
+The skill: (1) parses the URL host as `github.com` and activates `github-connector`; (2)
+Phase 1 fetches PR #482 metadata and every comment, then confirms the local repo matches
+`acme/widgets` and offers to check out the PR branch; (3) Phase 2 calls `init` to write
+`.tmp/review-pr-482.md`'s header before analysing anything, then computes each comment's
+fields and calls `append-section` to write its section immediately, one comment at a time --
+rendering each section's `source` field as a clickable markdown link to the matching file in
+the local checkout (never a provider URL), `source-lines` with the commented line(s) plus
+padding, `diff-hunk-raw`/`author-raw`/`comment-url` verbatim from the connector,
+`possible-user-intention` (an under-20-word, silently generated read of the author's likely
+concern), and `possible-follow-ups` (2-4 candidate next actions); (4) Phase 3 renders the
+2-row summary table and asks the literal numbered 4-way automation-level question -- the
+human picks option 3 (guide all), so both comments use the guided flow; (5) Phase 4 walks
+each comment one at a time, rendering its full focus card before asking the human to choose
+an action, then drafts the reply/fix text, persists it as `pending-reply: drafted`, and shows
+one FYI outcome line -- no confirmation question, nothing sent yet; (6) Phase 6 gathers both
+now-drafted comments, renders a numbered consolidated preview table (`#`, `id`, title,
+action, resolve-on-apply) followed by each row's exact draft text, and the human uses a
+free-text instruction naming comment 2's `#` to change its reply text before applying both
+together in a single apply-all batch confirmation -- resolving comment 1's thread as
+requested -- then reports the final summary by action taken and send status.
+
+**Simulated Human Responses**
+1. "Yes, check out the PR branch."
+2. (Phase 3) "3. I want to guide all comments solutions."
+3. "For comment 1: confirm criticality, action = reply. Yes, resolve the thread once
+   applied." (accepts the drafted text unedited)
+4. "For comment 2: confirm criticality, action = fix." (drafted text left as-is at Phase 4)
+5. (Phase 6) "For comment 2, reply with 'Renamed per your suggestion, thanks!' instead, then
+   apply all now."
+
+**Assertions**
+
+- [ ] Skill activates `github-connector` because the URL host is `github.com`.
+- [ ] Skill calls `init` to write the tracking file's header before analysing any comment,
+      then calls `append-section` once per comment, immediately, one at a time -- never
+      accumulating every section in memory until the end.
+- [ ] Skill renders each section's `source` field as a markdown link to the matching local
+      file, relative to the tracking file's own location -- never a link to the provider's
+      website.
+- [ ] Skill's Phase 3 renders a summary table (`#`, title, author, automation-suggestion,
+      criticality) and asks the literal numbered 4-way automation-level question before
+      Phase 4 asks anything else.
+- [ ] Skill asks about exactly one comment at a time in Phase 4, posting each comment's full
+      focus card as its own chat message before the action question.
+- [ ] Skill shows no confirmation question in Phase 4 -- only a one-line FYI outcome after
+      each draft is persisted, for both comments.
+- [ ] Skill's Phase 6 renders a numbered consolidated preview table (`#`, `id`, title,
+      action, resolve-on-apply) followed by each row's exact draft text below the table.
+- [ ] Skill accepts a Phase 6 free-text instruction naming comment 2's preview `#` to change
+      its reply text before applying, persisting the change immediately.
+- [ ] Skill applies both comments' drafts together in a single apply-all batch confirmation
+      in Phase 6, resolving comment 1's thread as requested.
+- [ ] Skill suffixes both comment 1's reply (accepted as drafted) and comment 2's reply
+      (changed at Phase 6) with the identical `(resolve-pr-comments - guided)` literal --
+      no distinction between the two cases.
+- [ ] Skill records the section's original comment text under `comment-raw` and any existing
+      thread replies under `replies-raw`.
+- [ ] Skill populates `possible-user-intention` with an under-20-word inference silently,
+      with no dedicated confirmation prompt of its own.
+
+### Scenario 2: Phase 3's "something else" free text drives a mixed fully-auto/guided run
+
+**Trigger / Input**
+
+Phase 2 populates 3 open comments: comment A (a simple, repetitive rename request with a
+clean `suggested-fix`, classified `automation-suggestion: fully-auto`), comment B (a vague
+architectural question, classified `automation-suggestion: guided`), and comment C (a minor
+style nitpick, classified `automation-suggestion: fully-auto`, not mentioned in the human's
+free text below). At Phase 3, the human answers option 4 with "automate everything, but
+guide comment B".
+
+**Expected Behaviour**
+
+Phase 4 reaches comment A and, matching the free text's "automate everything", skips its
+focus card and action question entirely: before starting, it shows one starting banner line
+(`Starting comment A of 3 (fix): "<short title>".`), then auto-chooses `fix`, applies the
+`suggested-fix` verbatim, defaults `resolve-on-apply` from `can_resolve` with no ask, drafts
+and persists `pending-reply: drafted` immediately, and shows one brief outcome line
+(`Auto-handled comment A (fix): ...`). The drafted text carries the
+`(resolve-pr-comments - fully-auto)` suffix unconditionally. Comment B, explicitly named for
+guidance, still gets its full focus card and action question exactly as documented, with the
+human choosing `reply` and editing the drafted text, earning the
+`(resolve-pr-comments - guided)` suffix. Comment C, not explicitly addressed by the free
+text, follows its own `automation-suggestion` (`fully-auto`) and is handled the same
+no-question way as comment A, each with its own starting banner and outcome line. Phase 6
+later gathers all three comments together and requires the same explicit apply confirmation
+for all of them -- no comment's fully-auto origin grants it a bypass of that gate.
+
+**Simulated Human Responses**
+1. (Phase 3) "4. Automate everything, but guide comment B."
+2. "For comment B: action = reply. Use this reply text instead: 'We considered that
+   approach; here's why we didn't take it...'" (replaces the drafted text with free text)
+3. (Phase 6) "Apply all now."
+
+**Assertions**
+
+- [ ] Skill's Phase 3 renders the summary table and asks the literal numbered 4-way
+      automation-level question before Phase 4 begins.
+- [ ] Skill interprets the free-text option-4 answer against the numbered table, applying the
+      no-question path to comments A and C and the guided path to comment B by name.
+- [ ] Skill never shows comment A's or comment C's focus card or an action question for
+      either, auto-choosing and applying each one's action with no human confirmation.
+- [ ] Skill shows one starting banner line before each of comment A's and comment C's work
+      begins, and one brief outcome line after, suffixing both with
+      `(resolve-pr-comments - fully-auto)` unconditionally.
+- [ ] Skill shows comment B's full focus card and action question, unaffected by comments A
+      and C's no-question handling.
+- [ ] Skill suffixes comment B's reply -- replaced with human-supplied free text -- with
+      `(resolve-pr-comments - guided)`.
+- [ ] Skill's Phase 6 requires the same explicit apply confirmation for all three comments --
+      being drafted via the no-question path grants no bypass of Phase 6's gate.
+
+### Scenario 3: Phase 2 writes the tracking file incrementally, surviving a mid-run interruption
+
+**Trigger / Input**
+
+A PR has 6 open comments. The session runs Phase 2 against a brand-new tracking file, then is
+interrupted (e.g. context compaction or a cancelled session) immediately after the 4th
+comment's section has been written, before the 5th comment's fields are computed.
+
+**Expected Behaviour**
+
+Phase 2 first calls `init` to durably write `.tmp/review-pr-<N>.md`'s header (PR link, raw
+summary, auto-generated summary) before analysing any single comment. It then computes
+comment 1's fields and calls `append-section` to write its section immediately, repeating
+this one-comment-at-a-time for comments 2, 3, and 4 -- never holding more than one comment's
+computed-but-unwritten section in memory at a time. When the interruption happens right
+after comment 4's `append-section` call returns, comments 1-4 are already durably present on
+disk. A fresh invocation re-reads the existing file, finds comments 1-4 already recorded (and
+does not recompute or rewrite them), and resumes by computing and appending comments 5 and 6
+the same incremental way.
+
+**Simulated Human Responses**
+(none -- Phase 2 asks nothing; the interruption and resume are session-level events, not
+human decisions)
+
+**Assertions**
+
+- [ ] Skill calls `init` once, before computing any comment's fields, to write the tracking
+      file's header (PR link, raw summary, auto-generated summary).
+- [ ] Skill calls `append-section` once per comment, immediately after that comment's fields
+      are computed, rather than batching multiple comments' sections into one write.
+- [ ] Skill's on-disk tracking file already contains comments 1 through 4's full sections at
+      the moment of interruption, before comment 5 is ever analysed.
+- [ ] Skill's fresh invocation after the interruption re-reads the existing file and does not
+      recompute or rewrite comments 1-4's already-written sections.
+- [ ] Skill's fresh invocation computes and appends comments 5 and 6 the same
+      one-comment-at-a-time way, completing the file.
+

package/.xdrs/agentme/edrs/principles/skills/resolve-pr-comments/scripts/post-replies-azure-devops.js

@@ -0,0 +1,219 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Applies resolve-pr-comments tracking-file drafts to a live Azure DevOps PR, using the
+ * `az rest` commands documented in azure-devops-connector's "Writing data" section.
+ * Delegates every tracking-file read/write to the sibling `update-section.js` script so
+ * there is exactly one place that understands the file format.
+ *
+ * Every write is verified by an independent read-back before the tracking file is ever
+ * marked `pending-reply: applied` -- a zero exit code from `az rest` alone is never treated
+ * as proof a write persisted (see azure-devops-connector's Known Issues: a POST/PATCH
+ * can exit 0 without the change actually landing on the server).
+ *
+ * Usage:
+ *   post-replies-azure-devops.js --pr-url <url> <tracking-file> [--dry-run] [--only <id>[,<id>...]]
+ *
+ * <url> is the PR's Azure DevOps URL (modern dev.azure.com or legacy *.visualstudio.com
+ * format); org/project/repo/PR number are all parsed from it.
+ * Processes every section whose `pending-reply:` is currently `drafted`, or exactly the
+ * `--only` ids (regardless of their current `pending-reply` state) when given. For each:
+ * skips posting if the exact reply text is already present on the live thread (verified
+ * idempotency, never assumed), otherwise POSTs `reply-draft` as a reply and verifies via
+ * GET; then, if `resolve-on-apply: true`, PATCHes the thread to "fixed" and verifies that
+ * too. Only after these checks pass does it mark `pending-reply: applied` (and
+ * `status: resolved`) via update-section.js. `AZ_BIN` (default `az`) overrides the CLI
+ * binary invoked, for testing with a stub.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { execFileSync } = require('child_process');
+
+const ADO_RESOURCE = '499b84ac-1321-427f-aa17-267ca6975798'; // Azure DevOps' well-known AAD resource id
+const UPDATE_SECTION = path.join(__dirname, 'update-section.js');
+const [AZ_BIN, ...AZ_PREFIX_ARGS] = (process.env.AZ_BIN || 'az').split(' ');
+
+function parsePrUrl(url) {
+  let m = /^https:\/\/dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/]+)\/pullrequest\/(\d+)/.exec(url);
+  if (m) return { org: m[1], project: m[2], repo: m[3], pr: m[4] };
+  m = /^https:\/\/([^./]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/]+)\/pullrequest\/(\d+)/.exec(url);
+  if (m) return { org: m[1], project: m[2], repo: m[3], pr: m[4] };
+  throw new Error(`unrecognized Azure DevOps PR URL: ${url}`);
+}
+
+// Rejoins hand-wrapped lines within a paragraph into one logical line, preserving genuine
+// blank-line paragraph breaks -- tolerant of drafts written either wrapped or unwrapped.
+function joinReplyDraft(rawText) {
+  const paragraphs = [];
+  let cur = [];
+  for (const line of rawText.split('\n')) {
+    if (line.trim() === '') {
+      if (cur.length) {
+        paragraphs.push(cur.join(' '));
+        cur = [];
+      }
+    } else {
+      cur.push(line.trimEnd());
+    }
+  }
+  if (cur.length) paragraphs.push(cur.join(' '));
+  return paragraphs.join('\n\n');
+}
+
+function parseArgs(argv) {
+  const args = { file: null, prUrl: null, dryRun: false, only: null };
+  const rest = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--pr-url') args.prUrl = argv[++i];
+    else if (a === '--dry-run') args.dryRun = true;
+    else if (a === '--only') {
+      args.only = argv[++i]
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    } else rest.push(a);
+  }
+  [args.file] = rest;
+  return args;
+}
+
+function runUpdateSection(cmdArgs, input) {
+  return execFileSync('node', [UPDATE_SECTION, ...cmdArgs], { input, encoding: 'utf8' });
+}
+
+function listCandidateSections(file, only) {
+  const stdout = runUpdateSection(['list', file]);
+  const rows = [];
+  let cur = null;
+  for (const line of stdout.split('\n')) {
+    const idMatch = /^- id: (.*)$/.exec(line);
+    if (idMatch) {
+      if (cur) rows.push(cur);
+      cur = { id: idMatch[1] };
+      continue;
+    }
+    if (!cur) continue;
+    const fieldMatch = /^ {2}([\w-]+): ?(.*)$/.exec(line);
+    if (fieldMatch) cur[fieldMatch[1]] = fieldMatch[2];
+  }
+  if (cur) rows.push(cur);
+  return rows.filter((r) => (only ? only.includes(r.id) : r['pending-reply'] === 'drafted'));
+}
+
+function getThread(base, threadId) {
+  const uri = `${base}/threads/${threadId}?api-version=7.1`;
+  const out = execFileSync(AZ_BIN, [...AZ_PREFIX_ARGS, 'rest', '--resource', ADO_RESOURCE, '--method', 'GET', '--uri', uri], {
+    stdio: 'pipe',
+  });
+  return JSON.parse(out.toString());
+}
+
+function applySection(base, tmpDir, file, row) {
+  const m = /^thread-comment\/(\d+)\.(\d+)$/.exec(row.id);
+  if (!m) return { id: row.id, ok: false, error: `id is not a thread-comment/<threadId>.<commentId> value: ${row.id}` };
+  const [, threadId, commentId] = m;
+  const resolveOnApply = row['resolve-on-apply'] === 'true';
+  const rawDraft = runUpdateSection(['get', file, row.id, 'reply-draft']).replace(/\n$/, '');
+  const replyText = joinReplyDraft(rawDraft);
+
+  try {
+    const before = getThread(base, threadId);
+    const alreadyPosted = (before.comments || []).some((c) => c.content === replyText);
+    if (!alreadyPosted) {
+      const bodyFile = path.join(tmpDir, `body-${threadId}.json`);
+      fs.writeFileSync(bodyFile, JSON.stringify({ content: replyText, parentCommentId: Number(commentId) }));
+      const postUri = `${base}/threads/${threadId}/comments?api-version=7.1`;
+      execFileSync(AZ_BIN, [...AZ_PREFIX_ARGS, 'rest', '--resource', ADO_RESOURCE, '--method', 'POST', '--uri', postUri, '--body', `@${bodyFile}`], {
+        stdio: 'pipe',
+      });
+
+      // az exiting 0 is not proof the write persisted -- always read back to confirm.
+      const afterPost = getThread(base, threadId);
+      if (!(afterPost.comments || []).some((c) => c.content === replyText)) {
+        return { id: row.id, ok: false, error: 'POST exited 0 but reply missing on read-back verification' };
+      }
+    }
+
+    let resolved = false;
+    if (resolveOnApply) {
+      const current = getThread(base, threadId);
+      if (current.status === 'fixed') {
+        resolved = true;
+      } else {
+        const patchUri = `${base}/threads/${threadId}?api-version=7.1`;
+        execFileSync(AZ_BIN, [...AZ_PREFIX_ARGS, 'rest', '--resource', ADO_RESOURCE, '--method', 'PATCH', '--uri', patchUri, '--body', '{"status":"fixed"}'], {
+          stdio: 'pipe',
+        });
+        const afterPatch = getThread(base, threadId);
+        resolved = afterPatch.status === 'fixed';
+        if (!resolved) {
+          return { id: row.id, ok: false, error: 'PATCH exited 0 but status not "fixed" on read-back verification' };
+        }
+      }
+    }
+
+    // Only ever mark the tracking file after independent verification above, never on a
+    // bare `az rest` exit code.
+    runUpdateSection(['set', file, row.id, 'pending-reply', 'applied']);
+    if (resolved) runUpdateSection(['set', file, row.id, 'status', 'resolved']);
+    return { id: row.id, ok: true, resolved };
+  } catch (e) {
+    return { id: row.id, ok: false, error: String(e.stderr || e.message) };
+  }
+}
+
+function main(argv) {
+  const args = parseArgs(argv);
+  if (!args.file || !args.prUrl) {
+    console.error('Usage: post-replies-azure-devops.js --pr-url <url> <tracking-file> [--dry-run] [--only <id>[,<id>...]]');
+    process.exit(1);
+    return;
+  }
+  const { org, project, repo, pr } = parsePrUrl(args.prUrl);
+  const base = `https://dev.azure.com/${org}/${project}/_apis/git/repositories/${repo}/pullRequests/${pr}`;
+
+  const rows = listCandidateSections(args.file, args.only);
+  if (rows.length === 0) {
+    console.log('No sections to apply (nothing pending-reply: drafted).');
+    return;
+  }
+
+  const results = [];
+  if (args.dryRun) {
+    for (const row of rows) {
+      const rawDraft = runUpdateSection(['get', args.file, row.id, 'reply-draft']).replace(/\n$/, '');
+      console.log(`\n=== ${row.id} (resolve=${row['resolve-on-apply'] === 'true'}) ===\n${joinReplyDraft(rawDraft)}`);
+      results.push({ id: row.id, ok: true, dryRun: true });
+    }
+  } else {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'post-replies-'));
+    for (const row of rows) {
+      const result = applySection(base, tmpDir, args.file, row);
+      results.push(result);
+      if (result.ok) {
+        console.log(`OK   ${result.id} replied+verified${result.resolved ? ' + resolved+verified' : ''}`);
+      } else {
+        console.error(`FAIL ${result.id}: ${result.error}`);
+      }
+    }
+  }
+
+  console.log('\n--- SUMMARY ---');
+  console.log(JSON.stringify(results, null, 2));
+  if (results.some((r) => !r.ok)) process.exit(1);
+}
+
+if (require.main === module) {
+  try {
+    main(process.argv.slice(2));
+  } catch (err) {
+    console.error(`Error: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+module.exports = { parsePrUrl, joinReplyDraft };

package/.xdrs/agentme/edrs/principles/skills/resolve-pr-comments/scripts/post-replies-azure-devops.test.js

@@ -0,0 +1,253 @@
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+
+const SCRIPT = path.join(__dirname, 'post-replies-azure-devops.js');
+const { parsePrUrl, joinReplyDraft } = require('./post-replies-azure-devops.js');
+
+const PR_URL = 'https://dev.azure.com/nn-bank/mortgage-loan/_git/mortgage-loan/pullrequest/43556';
+
+// Fake `az` used via AZ_BIN: reads/writes a JSON file (FAKE_ADO_STATE) to simulate thread
+// state, so tests never touch the network. Supports the same `rest --method GET|POST|PATCH
+// --uri <url> [--body <json|@file>]` shape the real script calls.
+const FAKE_AZ_SRC = `
+'use strict';
+const fs = require('fs');
+const statePath = process.env.FAKE_ADO_STATE;
+const state = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+const argv = process.argv.slice(2);
+const method = argv[argv.indexOf('--method') + 1];
+const uri = argv[argv.indexOf('--uri') + 1];
+let body = null;
+const bodyIdx = argv.indexOf('--body');
+if (bodyIdx !== -1) {
+  let raw = argv[bodyIdx + 1];
+  if (raw.startsWith('@')) raw = fs.readFileSync(raw.slice(1), 'utf8');
+  body = JSON.parse(raw);
+}
+const commentsMatch = /threads\\/(\\d+)\\/comments/.exec(uri);
+const threadMatch = /threads\\/(\\d+)/.exec(uri);
+const threadId = (commentsMatch || threadMatch)[1];
+const thread = state.threads[threadId];
+if (!thread) { console.error('unknown thread ' + threadId); process.exit(1); }
+if (method === 'GET') {
+  process.stdout.write(JSON.stringify(thread));
+} else if (method === 'POST' && commentsMatch) {
+  if (state.failPost && state.failPost.includes(threadId)) {
+    console.error('simulated hard POST failure for ' + threadId);
+    process.exit(1);
+  }
+  if (!(state.postBehavior && state.postBehavior[threadId] === 'false-positive')) {
+    thread.comments.push({ id: thread.comments.length + 1, content: body.content, parentCommentId: body.parentCommentId });
+  }
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  process.stdout.write(JSON.stringify({ id: thread.comments.length }));
+} else if (method === 'PATCH') {
+  if (!(state.patchBehavior && state.patchBehavior[threadId] === 'false-positive')) {
+    thread.status = body.status;
+  }
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  process.stdout.write(JSON.stringify(thread));
+} else {
+  console.error('unsupported fake az call: ' + method + ' ' + uri);
+  process.exit(1);
+}
+`;
+
+const FIXTURE = `# PR #43556
+
+### Reusing atlas service principal for unrelated pipeline
+id: thread-comment/100.1
+status: open
+source: (PR conversation)
+comment-raw: |
+  Should we really use atlas service principal even when it is not atlas doing the action?
+replies-raw:
+possible-follow-ups:
+  - fix: create a dedicated service connection
+action: fix
+resolve-on-apply: false
+pending-reply: drafted
+reply-draft: |
+  Agreed -- good catch. Renamed the parameter to a dedicated codeowners-app service
+  connection. Leaving this thread open until it is created. (resolve-pr-comments -
+  guided)
+
+### Split run() into smaller functions
+id: thread-comment/200.1
+status: open
+source: (PR conversation)
+comment-raw: |
+  Can we split this into smaller functions?
+replies-raw:
+possible-follow-ups:
+action: fix
+resolve-on-apply: true
+pending-reply: drafted
+reply-draft: |
+  Fixed -- split run() into named single-purpose functions. (resolve-pr-comments -
+  guided)
+
+### Already handled comment, should never be touched
+id: thread-comment/300.1
+status: open
+source: (PR conversation)
+comment-raw: |
+  Unrelated comment still awaiting triage.
+replies-raw:
+possible-follow-ups:
+action:
+resolve-on-apply: false
+pending-reply: none
+reply-draft: |
+`;
+
+function setup(state) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'post-replies-test-'));
+  const file = path.join(dir, 'review-pr-43556.md');
+  fs.writeFileSync(file, FIXTURE);
+  const fakeAz = path.join(dir, 'fake-az.js');
+  fs.writeFileSync(fakeAz, FAKE_AZ_SRC);
+  const statePath = path.join(dir, 'state.json');
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  return { file, statePath, env: { ...process.env, AZ_BIN: `node ${fakeAz}`, FAKE_ADO_STATE: statePath } };
+}
+
+function run(args, env) {
+  try {
+    const stdout = execFileSync('node', [SCRIPT, ...args], { encoding: 'utf8', env });
+    return { status: 0, stdout };
+  } catch (err) {
+    return { status: err.status, stdout: err.stdout, stderr: err.stderr };
+  }
+}
+
+function getField(file, id, field) {
+  return execFileSync('node', [path.join(__dirname, 'update-section.js'), 'get', file, id, field], { encoding: 'utf8' }).trim();
+}
+
+test('parsePrUrl extracts org/project/repo/pr from a modern dev.azure.com URL', () => {
+  assert.deepEqual(parsePrUrl(PR_URL), { org: 'nn-bank', project: 'mortgage-loan', repo: 'mortgage-loan', pr: '43556' });
+});
+
+test('parsePrUrl extracts org/project/repo/pr from a legacy *.visualstudio.com URL', () => {
+  assert.deepEqual(parsePrUrl('https://contoso.visualstudio.com/Widgets/_git/widgets-api/pullrequest/1029'), {
+    org: 'contoso',
+    project: 'Widgets',
+    repo: 'widgets-api',
+    pr: '1029',
+  });
+});
+
+test('parsePrUrl rejects an unrecognized URL rather than guessing', () => {
+  assert.throws(() => parsePrUrl('https://example.com/not/ado'), /unrecognized Azure DevOps PR URL/);
+});
+
+test('joinReplyDraft rejoins hand-wrapped lines within a paragraph, preserving paragraph breaks', () => {
+  const raw = 'Line one\nstill line one.\n\nSecond paragraph\non two lines.';
+  assert.equal(joinReplyDraft(raw), 'Line one still line one.\n\nSecond paragraph on two lines.');
+});
+
+test('posts a drafted reply, verifies via read-back, and marks pending-reply applied', () => {
+  const { file, env } = setup({
+    threads: {
+      100: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, '--only', 'thread-comment/100.1', file], env);
+  assert.equal(status, 0, stdout);
+  assert.match(stdout, /OK {3}thread-comment\/100\.1 replied\+verified$/m);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'applied');
+  assert.equal(getField(file, 'thread-comment/100.1', 'status'), 'open'); // resolve-on-apply: false
+});
+
+test('resolves the thread and marks status resolved when resolve-on-apply is true', () => {
+  const { file, env } = setup({
+    threads: {
+      200: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, '--only', 'thread-comment/200.1', file], env);
+  assert.equal(status, 0, stdout);
+  assert.match(stdout, /replied\+verified \+ resolved\+verified/);
+  assert.equal(getField(file, 'thread-comment/200.1', 'pending-reply'), 'applied');
+  assert.equal(getField(file, 'thread-comment/200.1', 'status'), 'resolved');
+});
+
+test('REGRESSION: does not mark pending-reply applied when POST exits 0 but the reply never persists', () => {
+  const { file, env } = setup({
+    threads: {
+      100: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+    postBehavior: { 100: 'false-positive' },
+  });
+  const { status, stderr } = run(['--pr-url', PR_URL, '--only', 'thread-comment/100.1', file], env);
+  assert.equal(status, 1);
+  assert.match(stderr, /FAIL thread-comment\/100\.1: POST exited 0 but reply missing on read-back verification/);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'drafted');
+});
+
+test('REGRESSION: does not mark status resolved when PATCH exits 0 but status never persists', () => {
+  const { file, env } = setup({
+    threads: {
+      200: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+    },
+    patchBehavior: { 200: 'false-positive' },
+  });
+  const { status, stderr } = run(['--pr-url', PR_URL, '--only', 'thread-comment/200.1', file], env);
+  assert.equal(status, 1);
+  assert.match(stderr, /FAIL thread-comment\/200\.1: PATCH exited 0 but status not "fixed" on read-back verification/);
+  assert.equal(getField(file, 'thread-comment/200.1', 'pending-reply'), 'drafted');
+  assert.equal(getField(file, 'thread-comment/200.1', 'status'), 'open');
+});
+
+test('skips re-posting when the exact reply is already present on the live thread, but still marks applied', () => {
+  const alreadyPostedText =
+    'Agreed -- good catch. Renamed the parameter to a dedicated codeowners-app service connection. Leaving this thread open until it is created. (resolve-pr-comments - guided)';
+  const { file, env } = setup({
+    threads: {
+      100: {
+        status: 'active',
+        comments: [
+          { id: 1, content: 'orig comment' },
+          { id: 2, content: alreadyPostedText },
+        ],
+      },
+    },
+    // If the script incorrectly tries to POST again, this makes it fail loudly.
+    failPost: ['100'],
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, '--only', 'thread-comment/100.1', file], env);
+  assert.equal(status, 0, stdout);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'applied');
+});
+
+test('never processes a section whose pending-reply is not drafted, when --only is not given', () => {
+  const { file, env } = setup({
+    threads: {
+      100: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+      200: { status: 'active', comments: [{ id: 1, content: 'orig comment' }] },
+      // 300 deliberately absent: pending-reply is 'none' for it, so a correct run never
+      // references thread 300 at all -- if it did, the fake az would fail with "unknown
+      // thread 300" and this test would catch it.
+    },
+    failPost: ['300'],
+  });
+  const { status, stdout } = run(['--pr-url', PR_URL, file], env);
+  assert.equal(status, 0, stdout);
+  assert.equal(getField(file, 'thread-comment/300.1', 'pending-reply'), 'none');
+});
+
+test('--dry-run prints drafts without invoking az or changing the tracking file', () => {
+  const { file, env } = setup({ threads: {} }); // no threads defined: any az call would throw
+  const { status, stdout } = run(['--pr-url', PR_URL, '--dry-run', file], env);
+  assert.equal(status, 0, stdout);
+  assert.match(stdout, /=== thread-comment\/100\.1 \(resolve=false\) ===/);
+  assert.match(stdout, /=== thread-comment\/200\.1 \(resolve=true\) ===/);
+  assert.equal(getField(file, 'thread-comment/100.1', 'pending-reply'), 'drafted');
+});