feat: link-work-items safe output

[jamesadevine]

Summary

Add a link-work-items safe output that allows agents to create relationships between Azure DevOps work items (parent/child, related, predecessor/successor, duplicate, etc.).

ADO API

PATCH /_apis/wit/workitems/{id}?api-version=7.1 with JSON Patch relation operations:

[
  {
    "op": "add",
    "path": "/relations/-",
    "value": {
      "rel": "System.LinkTypes.Hierarchy-Forward",
      "url": "https://dev.azure.com/{org}/{project}/_apis/wit/workitems/{targetId}"
    }
  }
]

Agent Parameters

• source-id (required) — Source work item ID
• target-id (required) — Target work item ID to link to
• link-type (required) — Relationship type: parent, child, related, predecessor, successor, duplicate, duplicate-of, tested-by, tests, affects, affected-by
• comment (optional) — Comment describing the relationship

Front Matter Configuration (safe-outputs.link-work-items)

• allowed-link-types — Restrict which relationship types can be created (default: all)
• max-links — Maximum number of links per agent invocation

Use Cases

• Planning agents decomposing scenarios into features/stories (parent-child)
• Dependency tracking agents creating predecessor/successor links
• Duplicate detection agents linking duplicate items
• Test planning agents linking test cases to user stories

Security Considerations

• Link type allow-list prevents unwanted relationship types
• Work item IDs must reference existing items
• Standard text sanitization on comment field
• Rate limiting via max-links config

Priority

Tier 1 — High value, common agent pattern. Medium complexity (JSON Patch relation operations).