Apply remaining changes

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

actions/setup/js/assign_work_item.cjs

@@ -0,0 +1,6 @@
+// @ts-check
+const { createAzureDevOpsWorkItemHandler } = require("./azure_devops_work_items.cjs");
+async function main(config = {}) {
+  return createAzureDevOpsWorkItemHandler("assign_work_item", config);
+}
+module.exports = { main };

actions/setup/js/azure_devops_work_items.cjs

@@ -0,0 +1,6 @@
+// @ts-check
+const { createAzureDevOpsWorkItemHandler } = require("./azure_devops_work_items.cjs");
+async function main(config = {}) {
+  return createAzureDevOpsWorkItemHandler("comment_on_work_item", config);
+}
+module.exports = { main };

actions/setup/js/comment_on_work_item.cjs

@@ -0,0 +1,6 @@
+// @ts-check
+const { createAzureDevOpsWorkItemHandler } = require("./azure_devops_work_items.cjs");
+async function main(config = {}) {
+  return createAzureDevOpsWorkItemHandler("create_work_item", config);
+}
+module.exports = { main };

actions/setup/js/create_work_item.cjs

@@ -0,0 +1,6 @@
+// @ts-check
+const { createAzureDevOpsWorkItemHandler } = require("./azure_devops_work_items.cjs");
+async function main(config = {}) {
+  return createAzureDevOpsWorkItemHandler("link_work_items", config);
+}
+module.exports = { main };

actions/setup/js/link_work_items.cjs

@@ -487,11 +487,15 @@ function loadToolHandlers(server, tools, basePath) {
  */
 function registerTool(server, tool) {
   const normalizedName = normalizeTool(tool.name);
+  const existing = server.tools[normalizedName];
+  if (existing && existing.name !== tool.name) {
+    throw new Error(`Tool name collision: '${existing.name}' and '${tool.name}' both normalize to '${normalizedName}'`);
+  }
   server.tools[normalizedName] = {
     ...tool,
-    name: normalizedName,
+    name: tool.name,
   };
-  server.debug(`Registered tool: ${normalizedName}`);
+  server.debug(`Registered tool: ${tool.name}`);
 }
 
 /**

actions/setup/js/mcp_server_core.cjs

@@ -83,6 +83,12 @@ const HANDLER_MAP = {
   report_incomplete: "./report_incomplete_handler.cjs",
   create_report_incomplete_issue: "./create_report_incomplete_issue.cjs",
   create_project: "./create_project.cjs",
+  create_work_item: "./create_work_item.cjs",
+  update_work_item: "./update_work_item.cjs",
+  comment_on_work_item: "./comment_on_work_item.cjs",
+  assign_work_item: "./assign_work_item.cjs",
+  link_work_items: "./link_work_items.cjs",
+  upload_workitem_attachment: "./upload_workitem_attachment.cjs",
   create_project_status_update: "./create_project_status_update.cjs",
   update_project: "./update_project.cjs",
   upload_artifact: "./upload_artifact.cjs",
@@ -145,6 +151,8 @@ const THREAT_WARNING_REVIEWABLE_TYPES = new Set([
   "missing_data",
   "create_report_incomplete_issue",
   "report_incomplete",
+  "create_work_item",
+  "comment_on_work_item",
 ]);
 
 /**
@@ -193,6 +201,10 @@ const THREAT_WARNING_ABORT_TYPES = new Set([
   "call_workflow",
   "autofix_code_scanning_alert",
   "create_agent_session",
+  "update_work_item",
+  "assign_work_item",
+  "link_work_items",
+  "upload_workitem_attachment",
 ]);
 
 /**
@@ -1095,6 +1107,11 @@ async function processMessages(messageHandlers, messages, onItemCreated = null)
         });
         core.info(`Registered temporary ID: ${result.temporaryId} -> ${result.repo}#${result.number}`);
       }
+      if (result && result.temporaryId && result.temporaryIdEntry) {
+        const normalizedTempId = normalizeTemporaryId(result.temporaryId);
+        temporaryIdMap.set(normalizedTempId, result.temporaryIdEntry);
+        core.info(`Registered Azure DevOps temporary ID: ${result.temporaryId}`);
+      }
 
       // If this was a successful upload_artifact, register the artifact URL so that
       // subsequent messages can have '#aw_ID' references replaced with the real URL.
@@ -1285,6 +1302,10 @@ async function processMessages(messageHandlers, messages, onItemCreated = null)
                 originalTempIdMapSize: tempIdMapSizeBefore,
               });
             }
+            if (result && result.temporaryId && result.temporaryIdEntry) {
+              const normalizedTempId = normalizeTemporaryId(result.temporaryId);
+              temporaryIdMap.set(normalizedTempId, result.temporaryIdEntry);
+            }
           }
 
           // Update the result to success

actions/setup/js/safe_output_handler_manager.cjs

@@ -20,7 +20,7 @@ const { getErrorMessage } = require("./error_helpers.cjs");
 const { ERR_CONFIG, ERR_PARSE, ERR_SYSTEM, ERR_VALIDATION } = require("./error_codes.cjs");
 const { findRepoCheckout } = require("./find_repo_checkout.cjs");
 const { resolveTargetRepoConfig, resolveAndValidateRepo } = require("./repo_helpers.cjs");
-const { getOrGenerateTemporaryId } = require("./temporary_id.cjs");
+const { generateTemporaryId, getOrGenerateTemporaryId } = require("./temporary_id.cjs");
 const { parseAllowedExtensionsEnv } = require("./allowed_extensions_helpers.cjs");
 const { getStagedPatchDiffSizeBytes } = require("./git_patch_utils.cjs");
 const { sanitizeTitle, applyTitlePrefix } = require("./sanitize_title.cjs");
@@ -101,7 +101,7 @@ function readJSONFile(filePath) {
 
 const safeOutputsTools = readJSONFile(path.join(__dirname, "safe_outputs_tools.json"));
 
-const safeOutputsToolMap = new Map(safeOutputsTools.map(tool => [tool.name, tool]));
+const safeOutputsToolMap = new Map(safeOutputsTools.map(tool => [tool.name.replace(/-/g, "_"), tool]));
 
 /**
  * @param {string} error
@@ -2063,6 +2063,89 @@ function createHandlers(server, appendSafeOutput, config = {}) {
         ],
         isError: true,
       };
+
+      const createWorkItemHandler = args => {
+        const temporaryId = `#${generateTemporaryId()}`;
+        const entry = { ...(args || {}), type: "create_work_item", temporary_id: temporaryId };
+        appendSafeOutputCounted(entry);
+        const output = { result: "success", temporary_id: temporaryId };
+        return {
+          content: [{ type: "text", text: JSON.stringify(output) }],
+          structuredContent: output,
+        };
+      };
+
+      const createAzureDevOpsWorkItemHandler = type => args => {
+        const entry = { ...(args || {}), type };
+        appendSafeOutputCounted(entry);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ result: "success" }) }],
+        };
+      };
+
+      const uploadWorkItemAttachmentHandler = args => {
+        const entry = { ...(args || {}), type: "upload_workitem_attachment" };
+        const rawPath = typeof entry.file_path === "string" ? entry.file_path.trim() : "";
+        if (!rawPath || path.isAbsolute(rawPath) || rawPath.includes(":")) {
+          return buildIntentErrorResponse("upload-workitem-attachment file_path must be a workspace-relative path without ':'");
+        }
+
+        const segments = rawPath.split(/[\\/]+/);
+        if (segments.some(segment => !segment || segment === "." || segment === "..")) {
+          return buildIntentErrorResponse("upload-workitem-attachment file_path must not contain empty, '.' or '..' path segments");
+        }
+
+        const workspace = path.resolve(process.env.GITHUB_WORKSPACE || process.cwd());
+        const sourcePath = path.resolve(workspace, ...segments);
+        if (sourcePath !== workspace && !sourcePath.startsWith(workspace + path.sep)) {
+          return buildIntentErrorResponse("upload-workitem-attachment file_path resolves outside the workspace");
+        }
+
+        let current = workspace;
+        let sourceStat;
+        try {
+          for (const segment of segments) {
+            current = path.join(current, segment);
+            sourceStat = lstatGuard(current);
+            if (!sourceStat) {
+              return buildIntentErrorResponse("upload-workitem-attachment does not accept symbolic links");
+            }
+          }
+        } catch (error) {
+          return buildIntentErrorResponse(`upload-workitem-attachment could not read file_path: ${getErrorMessage(error)}`);
+        }
+        if (!sourceStat?.isFile()) {
+          return buildIntentErrorResponse("upload-workitem-attachment file_path must identify one regular file");
+        }
+
+        const attachmentConfig = getSafeOutputsToolConfig(config, "upload_workitem_attachment");
+        const maxFileSize = Number(attachmentConfig.max_file_size || 5 * 1024 * 1024);
+        if (!Number.isSafeInteger(maxFileSize) || maxFileSize < 1 || sourceStat.size > maxFileSize) {
+          return buildIntentErrorResponse(`upload-workitem-attachment file exceeds the configured max-file-size of ${maxFileSize} bytes`);
+        }
+        const allowedExtensions = Array.isArray(attachmentConfig.allowed_extensions) ? attachmentConfig.allowed_extensions : [];
+        if (allowedExtensions.length > 0 && !allowedExtensions.some(extension => rawPath.toLowerCase().endsWith(String(extension).toLowerCase()))) {
+          return buildIntentErrorResponse("upload-workitem-attachment file extension is not allowed by the workflow configuration");
+        }
+
+        try {
+          const stagingRoot = path.join(process.env.RUNNER_TEMP || "/tmp", "gh-aw", "safeoutputs", "upload-artifacts");
+          const stagingDirectory = path.join(stagingRoot, "azure-devops-work-items");
+          fs.mkdirSync(stagingDirectory, { recursive: true, mode: 0o700 });
+          const stagedName = `${crypto.randomUUID()}-${path.basename(rawPath)}`;
+          const stagedPath = path.join(stagingDirectory, stagedName);
+          fs.copyFileSync(sourcePath, stagedPath, fs.constants.COPYFILE_EXCL);
+          fs.chmodSync(stagedPath, 0o600);
+          entry.staged_file = path.posix.join("azure-devops-work-items", stagedName);
+        } catch (error) {
+          throw new Error(`${ERR_SYSTEM}: Failed to stage Azure DevOps work-item attachment: ${getErrorMessage(error)}`, { cause: error });
+        }
+
+        appendSafeOutputCounted(entry);
+        return {
+          content: [{ type: "text", text: JSON.stringify({ result: "success", file_path: rawPath }) }],
+        };
+      };
     }
     const resolvedRepo = repoResult.repo;
 
@@ -3117,6 +3200,12 @@ function createHandlers(server, appendSafeOutput, config = {}) {
     pushToPullRequestBranchHandler,
     pushRepoMemoryHandler,
     createIssueHandler,
+    createWorkItemHandler,
+    updateWorkItemHandler: createAzureDevOpsWorkItemHandler("update_work_item"),
+    commentOnWorkItemHandler: createAzureDevOpsWorkItemHandler("comment_on_work_item"),
+    assignWorkItemHandler: createAzureDevOpsWorkItemHandler("assign_work_item"),
+    linkWorkItemsHandler: createAzureDevOpsWorkItemHandler("link_work_items"),
+    uploadWorkItemAttachmentHandler,
     createProjectHandler,
     addCommentHandler,
     createPullRequestReviewCommentHandler,

actions/setup/js/safe_outputs_handlers.cjs

@@ -2082,5 +2082,146 @@
         "anyOf": ["pull_request_number", "pr_number", "pr", "pull_number"]
       }
     }
+  },
+  {
+    "name": "create-work-item",
+    "description": "Create an Azure DevOps work item and return a temporary #aw_ ID for later work-item tools in this run.",
+    "inputSchema": {
+      "type": "object",
+      "required": ["title", "description"],
+      "properties": {
+        "title": {
+          "type": "string",
+          "minLength": 6,
+          "maxLength": 255,
+          "description": "Concise work-item title."
+        },
+        "description": {
+          "type": "string",
+          "minLength": 31,
+          "maxLength": 65000,
+          "description": "Detailed work-item description in Markdown."
+        },
+        "tags": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1, "maxLength": 256 },
+          "description": "Optional tags. Tags cannot contain semicolons and may be restricted by allowed-tags."
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  {
+    "name": "update-work-item",
+    "description": "Update explicitly enabled fields on an Azure DevOps work item.",
+    "inputSchema": {
+      "type": "object",
+      "required": ["id"],
+      "properties": {
+        "id": {
+          "type": ["number", "string"],
+          "description": "Positive work-item ID or a temporary #aw_ ID returned by create-work-item."
+        },
+        "title": { "type": "string", "minLength": 1, "maxLength": 255 },
+        "body": { "type": "string", "maxLength": 65000 },
+        "state": { "type": "string", "minLength": 1, "maxLength": 128 },
+        "area_path": { "type": "string", "minLength": 1, "maxLength": 512 },
+        "iteration_path": { "type": "string", "minLength": 1, "maxLength": 512 },
+        "assignee": { "type": "string", "minLength": 1, "maxLength": 256 },
+        "tags": {
+          "type": "array",
+          "items": { "type": "string", "minLength": 1, "maxLength": 256 }
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  {
+    "name": "comment-on-work-item",
+    "description": "Add a Markdown comment to an explicitly scoped Azure DevOps work item.",
+    "inputSchema": {
+      "type": "object",
+      "required": ["work_item_id", "body"],
+      "properties": {
+        "work_item_id": {
+          "type": ["number", "string"],
+          "description": "Positive work-item ID or a temporary #aw_ ID returned by create-work-item."
+        },
+        "body": {
+          "type": "string",
+          "minLength": 10,
+          "maxLength": 65000,
+          "description": "Comment text in Markdown."
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  {
+    "name": "assign-work-item",
+    "description": "Assign an allowed Azure DevOps identity to a work item.",
+    "inputSchema": {
+      "type": "object",
+      "required": ["work_item_id", "assignee"],
+      "properties": {
+        "work_item_id": {
+          "type": ["number", "string"],
+          "description": "Positive work-item ID or a temporary #aw_ ID returned by create-work-item."
+        },
+        "assignee": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "description": "Azure DevOps identity, such as an email address or display name."
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  {
+    "name": "link-work-items",
+    "description": "Create a relationship between two explicitly scoped Azure DevOps work items.",
+    "inputSchema": {
+      "type": "object",
+      "required": ["source_id", "target_id", "link_type"],
+      "properties": {
+        "source_id": {
+          "type": ["number", "string"],
+          "description": "Positive source work-item ID or a temporary #aw_ ID."
+        },
+        "target_id": {
+          "type": ["number", "string"],
+          "description": "Positive target work-item ID or a temporary #aw_ ID."
+        },
+        "link_type": {
+          "type": "string",
+          "enum": ["parent", "child", "related", "predecessor", "successor", "duplicate", "duplicate-of"]
+        },
+        "comment": { "type": "string", "minLength": 5, "maxLength": 1024 }
+      },
+      "additionalProperties": false
+    }
+  },
+  {
+    "name": "upload-workitem-attachment",
+    "description": "Upload one workspace file and attach it to an Azure DevOps work item.",
+    "inputSchema": {
+      "type": "object",
+      "required": ["work_item_id", "file_path"],
+      "properties": {
+        "work_item_id": {
+          "type": ["number", "string"],
+          "description": "Positive work-item ID or a temporary #aw_ ID returned by create-work-item."
+        },
+        "file_path": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 1024,
+          "description": "Workspace-relative file path. Absolute paths, traversal, colons, and symbolic links are rejected."
+        },
+        "comment": { "type": "string", "minLength": 3, "maxLength": 1024 }
+      },
+      "additionalProperties": false
+    }
   }
 ]