@askexenow/exe-os 0.9.407 → 0.9.409

package/dist/{chunk-BHKCSRJG.js → chunk-4M24XCTI.js}

@@ -7,17 +7,17 @@ import {
   supportProductSchema,
   supportTaskIdSchema,
   supportVersionSchema
-} from "./chunk-36QUBTID.js";
+} from "./chunk-HK7HIDXP.js";
 import {
   queueSupportStatusUpdateSync
-} from "./chunk-USZHUBHT.js";
+} from "./chunk-L4ISXVC5.js";
 import {
   assessAttribution,
   assessDisposition,
   buildVerificationArtifact,
   isPlaceholderIdentity,
   isUnresolvedIdentity
-} from "./chunk-RGPEUXOE.js";
+} from "./chunk-4MK6LOD6.js";
 import {
   SUPPORT_REPORT_SENT_MARKER
 } from "./chunk-MMRUBN3I.js";
@@ -34,14 +34,14 @@ import {
   sanitizeUpstreamId,
   sanitizeVersionField,
   sanitizedUpstreamBody
-} from "./chunk-T4IDLAZM.js";
+} from "./chunk-BYP3DOUU.js";
 import {
   getActiveAgent
-} from "./chunk-FEJK36FV.js";
+} from "./chunk-OISOA6NX.js";
 import {
   loadLicense,
   readCachedLicenseToken
-} from "./chunk-QHQW3VHV.js";
+} from "./chunk-DIKLSAJE.js";
 import {
   EXE_AI_DIR,
   loadConfig
@@ -51,8 +51,8 @@ import {
 import { z as z3 } from "zod";
 import { readFileSync } from "fs";
 import { readFile as readFile2 } from "fs/promises";
-import { join } from "path";
-import { homedir } from "os";
+import { join as join2 } from "path";
+import { homedir as homedir2 } from "os";
 
 // src/mcp/tools/update-bug-report.ts
 import { z as z2 } from "zod";
@@ -120,6 +120,7 @@ function resolveRef(ref, cwd) {
   }
 }
 var MODEL_HELP = "Set ANTHROPIC_MODEL (employee sessions get it automatically at launch) or pass attribution_model explicitly. It is NOT guessed: a wrong model on the record is worse than no record at all, because it points at the wrong suspect.";
+var ACCOUNTABILITY_PURPOSES = /* @__PURE__ */ new Set(["verdict", "routing_verdict"]);
 function resolveAttribution(purpose, input = {}) {
   const stated = input.agent?.trim() ?? "";
   let observed = "";
@@ -129,24 +130,24 @@ function resolveAttribution(purpose, input = {}) {
     observed = "";
   }
   let agent;
-  if (purpose === "verdict") {
+  if (ACCOUNTABILITY_PURPOSES.has(purpose)) {
     const observedIsReal = observed !== "" && !isUnresolvedIdentity(observed);
     if (observedIsReal && stated && stated.toLowerCase() !== observed.toLowerCase()) {
       return {
         ok: false,
         code: "attribution_agent_conflict",
-        message: `Refused locally [attribution_agent_conflict]: attribution_agent was given as "${stated}", but this session resolves to "${observed}". A verdict is signed by whoever actually made it \u2014 attribution_agent is a fallback for a session that cannot observe its own identity (the MCP daemon), not a way to record the call under another employee's name. Omit attribution_agent to sign as "${observed}", or make the call from that employee's session.`
+        message: `Refused locally [attribution_agent_conflict]: attribution_agent was given as "${stated}", but this session resolves to "${observed}". A ${purpose === "verdict" ? "verdict" : "close"} is signed by whoever actually made it \u2014 attribution_agent is a fallback for a session that cannot observe its own identity (the MCP daemon), not a way to record the call under another employee's name. Omit attribution_agent to sign as "${observed}", or make the call from that employee's session.`
       };
     }
     agent = observedIsReal ? observed : stated;
   } else {
     agent = stated || observed;
   }
-  if (purpose === "verdict" && isUnresolvedIdentity(agent)) {
+  if (ACCOUNTABILITY_PURPOSES.has(purpose) && isUnresolvedIdentity(agent)) {
     agent = "";
   }
   if (!agent) {
-    const message = purpose === "verdict" ? "Refused locally [attribution_agent_missing]: could not resolve which agent is producing this verdict, and it will not be invented. The MCP tools run in the launchd daemon, which carries no active-agent marker, no tmux session and no AGENT_ID, so the session identity is not observable from there. Pass attribution_agent with your own employee name exactly as it appears in the roster \u2014 never a role like 'admin'." : `Refused locally [attribution_agent_missing]: could not resolve which agent is producing this ${purpose}, and it will not be invented. Restore the active-agent marker or set AGENT_ID to your real employee name.`;
+    const message = ACCOUNTABILITY_PURPOSES.has(purpose) ? `Refused locally [attribution_agent_missing]: could not resolve which agent is producing this ${purpose === "verdict" ? "verdict" : "close"}, and it will not be invented. The MCP tools run in the launchd daemon, which carries no active-agent marker, no tmux session and no AGENT_ID, so the session identity is not observable from there. Pass attribution_agent with your own employee name exactly as it appears in the roster \u2014 never a role like 'admin'.` : `Refused locally [attribution_agent_missing]: could not resolve which agent is producing this ${purpose}, and it will not be invented. Restore the active-agent marker or set AGENT_ID to your real employee name.`;
     return {
       ok: false,
       code: "attribution_agent_missing",
@@ -225,11 +226,14 @@ var verificationArtifactInputSchema = {
   parent_result: z.enum(["fail", "pass", "error"]).optional().describe("regression_test only: the result you OBSERVED running that test at the parent commit. Must be 'fail' \u2014 a test that already passed does not detect the defect."),
   fix_result: z.enum(["fail", "pass", "error"]).optional().describe("regression_test only: the result you OBSERVED running that test at the fix commit. Must be 'pass'."),
   verifier: z.string().optional().describe("manual and ops_transcript: the identity of the person or employee who confirmed the defect is gone. Checked server-side against the bug's filer and assignee \u2014 it may not be either. Placeholders ('me', 'agent') are refused."),
-  disposition: z.enum(["fixed", "not_a_defect", "superseded", "wontfix"]).optional().describe(
-    "WHY the record is closing. Omit (or 'fixed') for the normal case: a defect was repaired, and a verification artifact is required. Use 'not_a_defect' when there was nothing to fix (a smoke-test record, a misfiled report), 'superseded' when another record covers it, 'wontfix' when it is a deliberate decline. Those three require NO fix_commit but DO require disposition_reason \u2014 and they are recorded as closed, not as fixed, because asserting a repair that never happened is its own kind of false record."
+  disposition: z.enum(["fixed", "not_a_defect", "superseded", "wontfix", "migrated"]).optional().describe(
+    "WHY the record is closing. Omit (or 'fixed') for the normal case: a defect was repaired, and a verification artifact is required. Use 'not_a_defect' when there was nothing to fix (a smoke-test record, a misfiled report), 'superseded' when another record covers it, 'wontfix' when it is a deliberate decline, 'migrated' when the bug was moved to GitHub Issues (requires github_issue_url, NOT disposition_reason). All of these require NO fix_commit \u2014 and they are recorded as closed, not as fixed, because asserting a repair that never happened is its own kind of false record."
   ),
   disposition_reason: z.string().optional().describe(
-    "REQUIRED for any disposition other than 'fixed': what makes this record a non-defect. Explain the call \u2014 a bare label or a hedge is refused."
+    "REQUIRED for any disposition other than 'fixed'/'migrated': what makes this record a non-defect. Explain the call \u2014 a bare label or a hedge is refused."
+  ),
+  github_issue_url: z.string().optional().describe(
+    "REQUIRED for disposition='migrated': the GitHub Issue this bug was moved to, https://github.com/AskExe/<repo>/issues/<n>. Also usable on its own (no status/disposition at all) to back-link an ALREADY fixed/closed record to its GitHub issue without changing its status."
   ),
   superseded_by: z.string().optional().describe("REQUIRED for disposition='superseded': the id of the record that replaces this one, so the claim is checkable."),
   superseded_coverage: z.string().optional().describe(
@@ -262,7 +266,8 @@ var verificationArtifactInputSchema = {
   delivery_proof: z.string().optional().describe('Optional JSON delivery declaration, e.g. {"channel":"npm","version":"0.9.364","tarball_shasum":"\u2026","fix_path_published":true}. Recorded, not required \u2014 delivery does not gate closing. A declaration that is present must still be true.')
 };
 function buildVerdictAttribution(input) {
-  return resolveAttribution("verdict", {
+  const purpose = input.disposition === "migrated" ? "routing_verdict" : "verdict";
+  return resolveAttribution(purpose, {
     agent: input.attribution_agent,
     model: input.attribution_model,
     observed_at: input.observed_at,
@@ -295,6 +300,7 @@ var DEFERRAL_BLOCKING = {
   superseded_by: true,
   disposition_verifier: true,
   superseded_coverage: true,
+  github_issue_url: true,
   // Attribution inputs — the client turns these into `attribution`, which it likewise
   // does not build on the deferral branch.
   attribution_agent: true,
@@ -403,6 +409,7 @@ function resolveVerificationArtifact(status, input, context = {}) {
       superseded_by: input.superseded_by,
       disposition_verifier: input.disposition_verifier,
       superseded_coverage: input.superseded_coverage,
+      github_issue_url: input.github_issue_url,
       symptoms: input.symptoms,
       context
     });
@@ -705,7 +712,7 @@ function registerUpdateBugReport(server) {
           content: [{ type: "text", text: describeOversizeRefusal(oversize) }]
         };
       }
-      const attestsByIdentity = verification.verification_kind === "manual" || verification.verification_kind === "ops_transcript" || verification.disposition !== void 0 && verification.disposition !== "fixed";
+      const attestsByIdentity = verification.verification_kind === "manual" || verification.verification_kind === "ops_transcript" || verification.disposition !== void 0 && verification.disposition !== "fixed" && verification.disposition !== "migrated";
       let resolvedVerification = resolveVerificationArtifact(gatedStatus, verification, { sendUpstream: send_upstream });
       if (resolvedVerification.ok && isVerifiedStatus(gatedStatus) && attestsByIdentity) {
         const authorIdentities = await collectBugAuthorIdentities(id);
@@ -797,6 +804,7 @@ These do not match \u2014 not updating to avoid mutating the wrong bug. Verify t
         if (verification.superseded_by) payload.superseded_by = verification.superseded_by;
         if (verification.disposition_verifier) payload.disposition_verifier = verification.disposition_verifier;
         if (verification.superseded_coverage) payload.superseded_coverage = verification.superseded_coverage;
+        if (verification.github_issue_url) payload.github_issue_url = verification.github_issue_url;
         if (verification.symptoms) payload.symptoms = verification.symptoms;
         if (resolvedVerification.attribution) payload.attribution = resolvedVerification.attribution;
       } else {
@@ -932,6 +940,487 @@ Upstream status: ${upstreamStatus}`
   );
 }
 
+// src/lib/support-github-issue.ts
+import { execFile } from "child_process";
+import { closeSync, mkdirSync, openSync, statSync, unlinkSync, writeSync } from "fs";
+import { randomUUID } from "crypto";
+import { homedir } from "os";
+import { join } from "path";
+var GITHUB_ORG = "AskExe";
+var PRODUCT_REPO_ROUTE = {
+  "exe-os": "exe-os",
+  "exe-create": "exe-create",
+  "exe-wiki": "exe-wiki",
+  "exe-gateway": "exe-gateway",
+  "exe-build": "exe-build",
+  "exe-chat": "exe-chat",
+  "exe-auth": "exe-auth",
+  "exe-monitor": "exe-monitor",
+  "exe-db": "exe-db",
+  "exe-crm": "exe-infra",
+  "exe-erp": "exe-infra"
+};
+var EXE_INFRA_REPO = `${GITHUB_ORG}/exe-infra`;
+function routeRepoForProduct(product) {
+  if (!product) return null;
+  const repo = PRODUCT_REPO_ROUTE[product];
+  return repo ? `${GITHUB_ORG}/${repo}` : null;
+}
+var EMAIL_RE = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+function scrubEmail(value) {
+  return value == null ? "" : String(value).replace(EMAIL_RE, "[redacted-email]");
+}
+function sanitizeIssueText(value) {
+  const raw = value == null ? "" : String(value);
+  const { text } = redactSecrets(raw);
+  return neutralizeHtmlComments(scrubEmail(text));
+}
+function neutralizeHtmlComments(value) {
+  return value.replaceAll("<!--", "&lt;!--").replaceAll("-->", "--&gt;");
+}
+function neutralizeBody(body, repo, product) {
+  const parts = body.split(/(```[\s\S]*?```|`[^`\n]*`)/g);
+  return parts.map((seg, i) => {
+    if (i % 2 === 1) return seg;
+    let out = seg.replace(/(^|[^\w`/.])@([A-Za-z0-9][A-Za-z0-9-]{0,38})/g, (_m, pre, name) => `${pre}\`@${name}\``);
+    if (repo === EXE_INFRA_REPO && product) {
+      out = out.replace(/(^|[^\w/])#(\d+)\b/g, (_m, pre, n) => `${pre}${GITHUB_ORG}/${product}#${n}`);
+    }
+    return out;
+  }).join("");
+}
+function truncateTitle(title) {
+  const t = String(title || "Untitled bug report").trim();
+  return t.length > 250 ? `${t.slice(0, 249)}\u2026` : t;
+}
+function fmt(d) {
+  return d ? String(d).replace("T", " ").replace(/\.\d+Z$/, " UTC") : "\u2014";
+}
+function issueMarker(bugId) {
+  return `<!-- exe-support-bug-id: ${bugId} -->`;
+}
+function bodyOwnedBy(body, bugId) {
+  return typeof body === "string" && body.trimEnd().endsWith(issueMarker(bugId));
+}
+function cell(v) {
+  const s = sanitizeIssueText(v == null ? "" : String(v)).replace(/\|/g, "\\|").replace(/\r?\n/g, " ").trim();
+  return s || "\u2014";
+}
+function jsonArray(v) {
+  if (Array.isArray(v)) return v;
+  if (typeof v !== "string" || !v.trim()) return [];
+  try {
+    const parsed = JSON.parse(v);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [v];
+  }
+}
+function entryText(e) {
+  if (e == null) return "";
+  if (typeof e === "string") return e;
+  if (typeof e === "object") {
+    const o = e;
+    const when = typeof o.at === "string" ? o.at : typeof o.timestamp === "string" ? o.timestamp : "";
+    const text = typeof o.note === "string" ? o.note : typeof o.text === "string" ? o.text : JSON.stringify(o);
+    return when ? `${when}: ${text}` : text;
+  }
+  return String(e);
+}
+function section(L, heading, value) {
+  const text = sanitizeIssueText(value == null ? "" : String(value)).trim();
+  if (text) L.push(`### ${heading}`, "", "```", text, "```", "");
+}
+function persistedIssueNumber(url, repo) {
+  if (typeof url !== "string") return null;
+  const m = /^https:\/\/github\.com\/([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+)\/issues\/([1-9][0-9]*)$/.exec(url);
+  if (!m || m[1] !== repo) return null;
+  return Number(m[2]);
+}
+function renderIssueBody(bug) {
+  const L = [];
+  L.push("## Summary", "", sanitizeIssueText(bug.summary) || "_No summary recorded._", "");
+  L.push(`Reported via exe-support (${cell(bug.license_plan || "unknown")} plan)`, "");
+  pushFactsTable(L, bug);
+  pushEvidenceSections(L, bug);
+  L.push("---", "", `Migrated from exe-support bug ${bug.id}`, "", issueMarker(bug.id));
+  return L.join("\n");
+}
+async function recheckCanonical(repo, canonical, bug) {
+  const view = JSON.parse(await gh(["issue", "view", String(canonical.number), "-R", repo, "--json", "state"]) || "{}");
+  const state = String(view.state ?? "").toUpperCase();
+  if (state !== "OPEN" && state !== "CLOSED") {
+    throw new Error(`Could not verify GitHub issue ${repo}#${canonical.number} before migrating (state: ${state || "unknown"}). The support record was left untouched.`);
+  }
+  if (state !== "CLOSED") return canonical;
+  const fresh = await searchMarkerIssues(repo, bug.id);
+  const others = fresh.filter((i) => i.number !== canonical.number);
+  if (others.length === 0) {
+    await gh(["issue", "reopen", String(canonical.number), "-R", repo]);
+    return { ...canonical, state: "OPEN" };
+  }
+  const survivor = await reconcileMarkerIssues(repo, others);
+  await syncTriageToIssue(repo, survivor, bug);
+  return survivor;
+}
+function pushFactsTable(L, bug) {
+  L.push("### Facts", "", "| Field | Value |", "| --- | --- |");
+  L.push(`| Severity | ${cell(bug.severity)} |`);
+  L.push(`| Product | ${cell(bug.product)} |`);
+  L.push(`| Classification | ${cell(bug.classification)} |`);
+  L.push(`| Cluster | ${cell(bug.cluster)} |`);
+  L.push(`| Reported | ${cell(fmt(bug.created_at))} |`);
+  L.push(`| Triaged | ${cell(fmt(bug.triaged_at))} |`);
+  L.push(`| Fixed version | ${cell(bug.fixed_version)} |`);
+  L.push(`| Package version | ${cell(bug.package_version)} |`);
+  L.push("");
+}
+var MANAGED_LABEL_PREFIXES = ["cluster:", "severity:", "product:"];
+async function syncLabels(repo, issueNumber, bug) {
+  const want = buildLabels(bug, repo);
+  const view = JSON.parse(await gh(["issue", "view", String(issueNumber), "-R", repo, "--json", "labels"]) || "{}");
+  const have = (view.labels ?? []).map((l) => l.name ?? "").filter(Boolean);
+  const add = want.filter((l) => !have.includes(l));
+  const remove = have.filter((l) => MANAGED_LABEL_PREFIXES.some((p) => l.startsWith(p)) && !want.includes(l));
+  if (add.length === 0 && remove.length === 0) return;
+  if (add.length) await ensureLabelsExist(repo, add);
+  const args = ["issue", "edit", String(issueNumber), "-R", repo];
+  if (add.length) args.push("--add-label", add.join(","));
+  if (remove.length) args.push("--remove-label", remove.join(","));
+  await gh(args);
+}
+function pushEvidenceSections(L, bug) {
+  if (bug.observed_kind || bug.evidence_pointer) {
+    section(L, "Filing evidence", `${bug.observed_kind ? `Kind: ${bug.observed_kind}
+` : ""}${bug.evidence_pointer ? `Pointer: ${bug.evidence_pointer}` : ""}`);
+  }
+  section(L, "Customer impact", bug.customer_impact);
+  section(L, "Local patch supplied by the reporter", bug.local_patch_diff);
+  const steps = jsonArray(bug.reproduction_steps).map(entryText).filter((s) => s.trim());
+  if (steps.length) {
+    L.push("### Reproduction steps", "", "```", sanitizeIssueText(steps.map((s, i) => `${i + 1}. ${s}`).join("\n")), "```", "");
+  }
+  section(L, "Expected", bug.expected);
+  section(L, "Actual", bug.actual);
+  section(L, "Workaround", bug.workaround);
+  section(L, "Triage notes", bug.triage_notes);
+  const progress = jsonArray(bug.progress_log).map(entryText).filter((s) => s.trim());
+  if (progress.length) section(L, "Progress log", progress.join("\n"));
+  section(L, "Triage note (this triage)", bug.add_note);
+}
+function buildLabels(bug, repo) {
+  const labels = ["bug", "from:exe-support", `severity:${bug.severity || "p3"}`, "status:triaged"];
+  if (bug.cluster) labels.push(`cluster:${bug.cluster}`);
+  if (repo === EXE_INFRA_REPO && bug.product) labels.push(`product:${bug.product}`);
+  return labels;
+}
+var GithubCliUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GithubCliUnavailableError";
+  }
+};
+function execGh(args, stdin) {
+  return new Promise((resolve, reject) => {
+    const child = execFile(
+      "gh",
+      args,
+      { maxBuffer: 16 * 1024 * 1024 },
+      (err, stdout, stderr) => {
+        if (err) {
+          const e = err;
+          e.stdout = stdout;
+          e.stderr = stderr;
+          reject(e);
+          return;
+        }
+        resolve(stdout);
+      }
+    );
+    child.stdin?.on?.("error", (streamErr) => {
+      const e = streamErr;
+      e.message = `gh stdin write failed: ${streamErr.message}`;
+      reject(e);
+    });
+    if (stdin !== void 0) child.stdin?.end(stdin);
+    else child.stdin?.end();
+  });
+}
+async function gh(args, stdin) {
+  try {
+    return await execGh(args, stdin);
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      throw new GithubCliUnavailableError(
+        "GitHub CLI (`gh`) is not installed. Install it from https://cli.github.com to push triaged bugs to GitHub, or pass push_to_github: false to skip."
+      );
+    }
+    const out = `${e.stderr || ""}${e.stdout || ""}`;
+    if (/not logged into any github hosts|gh auth login|authentication required|http 401/i.test(out)) {
+      throw new GithubCliUnavailableError(
+        "GitHub CLI (`gh`) is not authenticated. Run `gh auth login`, or pass push_to_github: false to skip."
+      );
+    }
+    throw new Error(`gh ${args[0] ?? ""} failed: ${(out || e.message || String(err)).slice(0, 2e3)}`);
+  }
+}
+async function searchMarkerIssues(repo, bugId) {
+  const out = await gh([
+    "issue",
+    "list",
+    "-R",
+    repo,
+    "--state",
+    "all",
+    "--search",
+    `"${bugId}" in:body`,
+    "--json",
+    "number,url,body,state",
+    "--limit",
+    "20"
+  ]);
+  let issues;
+  try {
+    issues = JSON.parse(out || "[]");
+  } catch {
+    issues = [];
+  }
+  return issues.filter((i) => bodyOwnedBy(i.body, bugId)).map((i) => ({ number: i.number, url: i.url, state: i.state }));
+}
+async function verifyPersistedIssueMarker(repo, number, url, bugId) {
+  let out;
+  try {
+    out = await gh(["issue", "view", String(number), "-R", repo, "--json", "number,url,state,body"]);
+  } catch (err) {
+    process.stderr.write(
+      `[support-github-issue] persisted github_issue_url ${url} (issue #${number} in ${repo}) could not be verified (${err instanceof Error ? err.message : String(err)}) \u2014 dropped as a reconciliation candidate.
+`
+    );
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(out);
+  } catch {
+    process.stderr.write(
+      `[support-github-issue] persisted github_issue_url ${url} (issue #${number} in ${repo}) returned unparseable JSON from \`gh issue view\` \u2014 dropped as a reconciliation candidate.
+`
+    );
+    return null;
+  }
+  if (!bodyOwnedBy(parsed.body, bugId)) {
+    process.stderr.write(
+      `[support-github-issue] persisted github_issue_url ${url} does not carry bug ${bugId}'s exact marker as its final content \u2014 dropped as a reconciliation candidate (it may have been set to an unrelated issue, e.g. via an admin back-link).
+`
+    );
+    return null;
+  }
+  return { number: parsed.number, url: parsed.url, state: parsed.state };
+}
+async function closeDuplicateIssue(repo, number, canonicalNumber) {
+  await gh([
+    "issue",
+    "close",
+    String(number),
+    "-R",
+    repo,
+    "--reason",
+    "not planned",
+    "--comment",
+    `Duplicate of #${canonicalNumber} (concurrent triage)`
+  ]);
+}
+async function reconcileMarkerIssues(repo, candidates) {
+  const byNumber = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) if (!byNumber.has(candidate.number)) byNumber.set(candidate.number, candidate);
+  const unique = [...byNumber.values()];
+  const canonical = unique.reduce((lowest, hit) => hit.number < lowest.number ? hit : lowest, unique[0]);
+  for (const candidate of unique) {
+    if (candidate.number === canonical.number) continue;
+    try {
+      await closeDuplicateIssue(repo, candidate.number, canonical.number);
+    } catch {
+    }
+  }
+  return canonical;
+}
+async function createIssue(repo, title, body, labels) {
+  const out = await gh(
+    ["issue", "create", "-R", repo, "--title", title, "--body-file", "-", "--label", labels.join(",")],
+    body
+  );
+  const url = out.trim().split("\n").filter(Boolean).pop() || "";
+  const number = Number(url.match(/\/issues\/(\d+)/)?.[1]);
+  if (!url || !Number.isFinite(number)) {
+    throw new Error(`gh issue create returned an unexpected result: ${out.slice(0, 300)}`);
+  }
+  return { number, url, state: "OPEN" };
+}
+var knownRepoLabels = /* @__PURE__ */ new Map();
+var LABEL_COLORS = {
+  bug: "d73a4a",
+  "from:exe-support": "fbca04",
+  "severity:p0": "b60205",
+  "severity:p1": "d93f0b",
+  "severity:p2": "fbca04",
+  "severity:p3": "cccccc",
+  "status:triaged": "1d76db",
+  default: "5319e7"
+};
+function labelColor(label) {
+  return LABEL_COLORS[label] ?? LABEL_COLORS.default;
+}
+function labelDescription(label) {
+  if (label.startsWith("cluster:")) return "exe-support cluster";
+  if (label.startsWith("product:")) return "exe-support product";
+  return "created by exe-support triage";
+}
+async function listRepoLabels(repo) {
+  const out = await gh(["label", "list", "-R", repo, "--limit", "1000", "--json", "name"]);
+  let items;
+  try {
+    items = JSON.parse(out || "[]");
+  } catch {
+    items = [];
+  }
+  return new Set(items.map((i) => i.name));
+}
+async function ensureLabelsExist(repo, labels) {
+  let known = knownRepoLabels.get(repo);
+  if (!known) {
+    known = await listRepoLabels(repo);
+    knownRepoLabels.set(repo, known);
+  }
+  for (const label of labels) {
+    if (known.has(label)) continue;
+    try {
+      await gh(["label", "create", label, "-R", repo, "--color", labelColor(label), "--description", labelDescription(label)]);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (!/already exists/i.test(message)) throw err;
+    }
+    known.add(label);
+  }
+}
+async function syncTriageToIssue(repo, canonical, bug) {
+  const wasClosed = !!canonical.state && canonical.state.toUpperCase() === "CLOSED";
+  if (wasClosed) await gh(["issue", "reopen", String(canonical.number), "-R", repo]);
+  const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const summary = sanitizeIssueText(bug.summary) || "_No summary recorded._";
+  const lines = [
+    wasClosed ? `Re-triaged from exe-support on ${date} \u2014 reported again, reopening.` : `Re-triaged from exe-support on ${date} \u2014 updated triage details.`,
+    "",
+    "### Summary",
+    "",
+    summary
+  ];
+  lines.push("");
+  pushFactsTable(lines, bug);
+  pushEvidenceSections(lines, bug);
+  const commentBody = neutralizeBody(lines.join("\n"), repo, bug.product ?? null);
+  await syncLabels(repo, canonical.number, bug);
+  await gh(["issue", "comment", String(canonical.number), "-R", repo, "--body-file", "-"], commentBody);
+}
+async function pushBugToGithub(bug) {
+  const repo = routeRepoForProduct(bug.product);
+  if (!repo) {
+    throw new Error(
+      `No GitHub route configured for product '${bug.product ?? "unknown"}'. Pass push_to_github: false to skip, or triage with a supported product.`
+    );
+  }
+  const persistedNumber = persistedIssueNumber(bug.github_issue_url, repo);
+  const persistedCandidate = persistedNumber !== null ? await verifyPersistedIssueMarker(repo, persistedNumber, bug.github_issue_url, bug.id) : null;
+  const markerIssues = await searchMarkerIssues(repo, bug.id);
+  const preCreateCandidates = persistedCandidate ? [persistedCandidate, ...markerIssues] : markerIssues;
+  if (preCreateCandidates.length > 0) {
+    const canonical2 = await reconcileMarkerIssues(repo, preCreateCandidates);
+    await syncTriageToIssue(repo, canonical2, bug);
+    const settled2 = await recheckCanonical(repo, canonical2, bug);
+    return { issueUrl: settled2.url, issueNumber: settled2.number, repo, adopted: true };
+  }
+  const body = neutralizeBody(renderIssueBody(bug), repo, bug.product ?? null);
+  const title = truncateTitle(sanitizeIssueText(bug.title || bug.summary));
+  const labels = buildLabels(bug, repo);
+  await ensureLabelsExist(repo, labels);
+  const created = await createIssue(repo, title, body, labels);
+  const postCreateMarkerIssues = await searchMarkerIssues(repo, bug.id);
+  const canonical = await reconcileMarkerIssues(repo, [...postCreateMarkerIssues, created]);
+  if (canonical.number !== created.number) await syncTriageToIssue(repo, canonical, bug);
+  const settled = await recheckCanonical(repo, canonical, bug);
+  return { issueUrl: settled.url, issueNumber: settled.number, repo, adopted: settled.number !== created.number };
+}
+function locksDir() {
+  return join(process.env.EXE_OS_DIR ?? join(homedir(), ".exe-os"), "locks");
+}
+function lockPath(bugId) {
+  const safe = bugId.replace(/[^A-Za-z0-9_-]/g, "_");
+  return join(locksDir(), `support-github-${safe}.lock`);
+}
+var LOCK_WAIT_TIMEOUT_MS = 6e4;
+var LOCK_POLL_MS = 250;
+var GithubLockTimeoutError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GithubLockTimeoutError";
+  }
+};
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function acquireBugLock(bugId) {
+  mkdirSync(locksDir(), { recursive: true });
+  const path2 = lockPath(bugId);
+  const deadline = Date.now() + LOCK_WAIT_TIMEOUT_MS;
+  const myToken = `${process.pid}:${randomUUID()}`;
+  for (; ; ) {
+    try {
+      const fd = openSync(path2, "wx");
+      try {
+        writeSync(fd, myToken);
+      } finally {
+        closeSync(fd);
+      }
+      return () => {
+        try {
+          unlinkSync(path2);
+        } catch (err) {
+          const e = err;
+          if (e.code !== "ENOENT") {
+            process.stderr.write(
+              `[support-github-issue] could not release bug lock for bug ${bugId} at ${path2}: ${e.code ?? e.message}
+`
+            );
+          }
+        }
+      };
+    } catch (err) {
+      const e = err;
+      if (e.code !== "EEXIST") throw err;
+      if (Date.now() >= deadline) {
+        let ageText;
+        try {
+          ageText = `${Math.round((Date.now() - statSync(path2).mtimeMs) / 1e3)}s old`;
+        } catch {
+          ageText = "age unknown";
+        }
+        throw new GithubLockTimeoutError(
+          `Could not push bug ${bugId} to GitHub: the per-bug lock ${path2} (${ageText}) was still held after ${LOCK_WAIT_TIMEOUT_MS / 1e3}s. Either another triage call for this bug is in progress on this host \u2014 wait for it to finish and retry \u2014 or a previous call crashed and left its lock behind, in which case delete that file and retry. Nothing was changed here.`
+        );
+      }
+      await sleep(Math.min(LOCK_POLL_MS, Math.max(0, deadline - Date.now())));
+    }
+  }
+}
+async function withBugGithubLock(bugId, fn) {
+  const release = await acquireBugLock(bugId);
+  try {
+    return await fn();
+  } finally {
+    release();
+  }
+}
+
 // src/mcp/tools/support-inbox.ts
 var DEFAULT_ENDPOINT = "https://api.askexe.com/admin/support/bug-reports";
 var DEFAULT_OWNER_ENDPOINT = "https://api.askexe.com/v1/support/bug-reports";
@@ -948,7 +1437,7 @@ function adminToken() {
   if (process.env.ASKEXE_SUPPORT_ADMIN_TOKEN) return process.env.ASKEXE_SUPPORT_ADMIN_TOKEN;
   if (process.env.EXE_SUPPORT_ADMIN_TOKEN) return process.env.EXE_SUPPORT_ADMIN_TOKEN;
   try {
-    const configPath = join(process.env.EXE_OS_DIR ?? join(homedir(), ".exe-os"), "config.json");
+    const configPath = join2(process.env.EXE_OS_DIR ?? join2(homedir2(), ".exe-os"), "config.json");
     const config = JSON.parse(readFileSync(configPath, "utf-8"));
     return config.support?.adminToken || config.support?.admin_token;
   } catch {
@@ -962,7 +1451,7 @@ function ownerEndpoint() {
   const routerUrl = process.env.API_ROUTER_URL?.replace(/\/+$/, "");
   let configured;
   try {
-    const configPath = join(process.env.EXE_OS_DIR ?? join(homedir(), ".exe-os"), "config.json");
+    const configPath = join2(process.env.EXE_OS_DIR ?? join2(homedir2(), ".exe-os"), "config.json");
     const config = JSON.parse(readFileSync(configPath, "utf-8"));
     configured = config.support?.bugReportEndpoint;
   } catch {
@@ -973,7 +1462,7 @@ function ownerEndpoint() {
 function ownerAuthHeaders() {
   let cloudApiKey;
   try {
-    const configPath = join(process.env.EXE_OS_DIR ?? join(homedir(), ".exe-os"), "config.json");
+    const configPath = join2(process.env.EXE_OS_DIR ?? join2(homedir2(), ".exe-os"), "config.json");
     const config = JSON.parse(readFileSync(configPath, "utf-8"));
     cloudApiKey = config.cloud?.apiKey;
   } catch {
@@ -1356,63 +1845,169 @@ function registerTriageBugReport(server) {
           "unclear"
         ]).optional().describe("Triage classification: upstream_bug, customer_customization, emergency_hotfix, unclear"),
         cluster: supportClusterClearableSchema.optional().describe("Root-cause class this bug belongs to \u2014 a kebab-case slug (feature d0970342). Fixes are dispatched per cluster; use list_bugs(cluster=...) to find every bug sharing one. Pass an empty string to CLEAR a mis-triaged cluster back to unset."),
+        push_to_github: z3.boolean().optional().describe(
+          "Feature d7ea536b: when status is set to 'triaged' (the moment a bug moves from the untriaged inbox onto the roadmap), file (or adopt) a GitHub Issue in the routed AskExe repo and immediately close this support record with disposition='migrated' + the issue URL \u2014 GitHub becomes the system of record. Defaults to true whenever status='triaged'. Pass false to just set status='triaged' the old way, with no GitHub push."
+        ),
         ...verificationArtifactInputSchema
       }
     },
-    async ({ id, status, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product, classification, cluster, ...verification }) => {
+    async ({ id, status, triage_notes, add_note, linked_task_id, linked_commit, fixed_version, product, classification, cluster, push_to_github, ...verification }) => {
       const bugUrl = `${endpoint()}/${encodeURIComponent(sanitizeUpstreamId(id))}`;
-      const attestsByIdentity = verification.verification_kind === "manual" || verification.verification_kind === "ops_transcript" || verification.disposition !== void 0 && verification.disposition !== "fixed";
-      let authorIdentities = [];
-      if (isVerifiedStatus(status) && attestsByIdentity) {
-        try {
-          const row = await requestJson(bugUrl);
-          authorIdentities = [row?.agent_id, row?.license_email];
-        } catch {
+      const wantsGithubPush = status === "triaged" && push_to_github !== false;
+      const errorResult = (text) => ({ isError: true, content: [{ type: "text", text }] });
+      const finishClose = async (effectiveStatus, verificationFinal, githubPush) => {
+        const attestsByIdentity = verificationFinal.verification_kind === "manual" || verificationFinal.verification_kind === "ops_transcript" || verificationFinal.disposition !== void 0 && verificationFinal.disposition !== "fixed" && verificationFinal.disposition !== "migrated";
+        let authorIdentities = [];
+        if (isVerifiedStatus(effectiveStatus) && attestsByIdentity) {
+          try {
+            const row = await requestJson(bugUrl);
+            authorIdentities = [row?.agent_id, row?.license_email];
+          } catch {
+          }
+        }
+        const resolved = resolveVerificationArtifact(effectiveStatus, verificationFinal, { authorIdentities });
+        if (!resolved.ok) {
+          return errorResult(resolved.message);
+        }
+        const attribution = assertVerdictAttribution(effectiveStatus, resolved);
+        if (!attribution.ok) {
+          return errorResult(attribution.message);
+        }
+        const delivery = parseDeliveryProof(verificationFinal.delivery_proof);
+        if (!delivery.ok) {
+          return errorResult(delivery.message);
+        }
+        const data = await requestJson(bugUrl, {
+          method: "PATCH",
+          body: sanitizedUpstreamBody({
+            status: effectiveStatus,
+            triage_notes,
+            add_note,
+            linked_task_id,
+            linked_commit,
+            fixed_version,
+            product,
+            classification,
+            cluster,
+            verification_artifact: resolved.artifact,
+            delivery_proof: delivery.value,
+            // The disposition travels with the close: the server gates on it, and stores
+            // it so the record reads as "closed because there was nothing to fix" rather
+            // than as an unexplained close.
+            disposition: verificationFinal.disposition,
+            disposition_reason: verificationFinal.disposition_reason,
+            superseded_by: verificationFinal.superseded_by,
+            disposition_verifier: verificationFinal.disposition_verifier,
+            superseded_coverage: verificationFinal.superseded_coverage,
+            github_issue_url: verificationFinal.github_issue_url,
+            symptoms: verificationFinal.symptoms,
+            attribution: resolved.attribution
+          }, "support-inbox:triage_bug")
+        });
+        let response = fixed_version && !status ? withStatusNotice(
+          data,
+          `fixed_version ${fixed_version} recorded. Status was not changed and the bug was NOT closed. To close it, pass status: "closed" explicitly.`
+        ) : data;
+        if (githubPush && response && typeof response === "object" && !Array.isArray(response)) {
+          response = {
+            ...response,
+            github_issue_url: githubPush.issueUrl,
+            github_issue_repo: githubPush.repo,
+            github_issue_adopted: githubPush.adopted
+          };
         }
+        return { content: [{ type: "text", text: JSON.stringify(response, null, 2) }] };
+      };
+      if (!wantsGithubPush) {
+        return finishClose(status, verification);
       }
-      const resolved = resolveVerificationArtifact(status, verification, { authorIdentities });
-      if (!resolved.ok) {
-        return { isError: true, content: [{ type: "text", text: resolved.message }] };
+      let row1;
+      try {
+        row1 = await requestJson(bugUrl);
+      } catch (err) {
+        return errorResult(
+          `Could not push bug ${id} to GitHub: failed to fetch the bug record first (${err instanceof Error ? err.message : String(err)}). Nothing was changed.`
+        );
       }
-      const attribution = assertVerdictAttribution(status, resolved);
-      if (!attribution.ok) {
-        return { isError: true, content: [{ type: "text", text: attribution.message }] };
+      const canonicalId = row1.id?.trim() || id;
+      const effectiveProduct = product ?? row1.product;
+      const repo = routeRepoForProduct(effectiveProduct);
+      if (!repo) {
+        return errorResult(
+          `No GitHub route configured for product '${effectiveProduct ?? "unknown"}'. Pass push_to_github: false to skip, or triage with a supported product.`
+        );
       }
-      const delivery = parseDeliveryProof(verification.delivery_proof);
-      if (!delivery.ok) {
-        return { isError: true, content: [{ type: "text", text: delivery.message }] };
+      const placeholderIssueUrl = `https://github.com/${repo}/issues/1`;
+      const precheckVerification = { ...verification };
+      precheckVerification.disposition = "migrated";
+      precheckVerification.github_issue_url = placeholderIssueUrl;
+      const precheckResolved = resolveVerificationArtifact("closed", precheckVerification, { authorIdentities: [] });
+      if (!precheckResolved.ok) {
+        return errorResult(precheckResolved.message);
+      }
+      const precheckAttribution = assertVerdictAttribution("closed", precheckResolved);
+      if (!precheckAttribution.ok) {
+        return errorResult(precheckAttribution.message);
+      }
+      const precheckDelivery = parseDeliveryProof(verification.delivery_proof);
+      if (!precheckDelivery.ok) {
+        return errorResult(precheckDelivery.message);
+      }
+      try {
+        return await withBugGithubLock(canonicalId, async () => {
+          let row2;
+          try {
+            row2 = await requestJson(bugUrl);
+          } catch (err) {
+            return errorResult(
+              `Could not push bug ${id} to GitHub: failed to re-fetch the bug record inside the lock (${err instanceof Error ? err.message : String(err)}). Nothing was changed.`
+            );
+          }
+          const bugForIssue = {
+            id: canonicalId,
+            title: row2.title ?? void 0,
+            summary: row2.summary ?? void 0,
+            severity: row2.severity ?? void 0,
+            product: product ?? row2.product,
+            classification: classification ?? row2.classification,
+            cluster: cluster ?? row2.cluster,
+            created_at: row2.created_at ?? void 0,
+            triaged_at: row2.triaged_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+            fixed_version: fixed_version ?? row2.fixed_version,
+            package_version: row2.package_version ?? void 0,
+            license_plan: row2.license_plan ?? void 0,
+            triage_notes: triage_notes ?? row2.triage_notes,
+            github_issue_url: row2.github_issue_url ?? void 0,
+            customer_impact: row2.customer_impact ?? void 0,
+            reproduction_steps: row2.reproduction_steps_json ?? void 0,
+            expected: row2.expected ?? void 0,
+            actual: row2.actual ?? void 0,
+            workaround: row2.workaround ?? void 0,
+            progress_log: row2.progress_log ?? void 0,
+            add_note: add_note ?? void 0,
+            observed_kind: row2.observed_kind ?? void 0,
+            evidence_pointer: row2.evidence_pointer ?? void 0,
+            local_patch_diff: row2.local_patch_diff ?? void 0
+          };
+          let githubPush;
+          try {
+            githubPush = await pushBugToGithub(bugForIssue);
+          } catch (err) {
+            return errorResult(
+              `Could not push bug ${id} to GitHub: ${err instanceof Error ? err.message : String(err)}. The record was left at its current status; nothing was closed.`
+            );
+          }
+          const finalVerification = { ...verification };
+          finalVerification.disposition = "migrated";
+          finalVerification.github_issue_url = githubPush.issueUrl;
+          return finishClose("closed", finalVerification, githubPush);
+        });
+      } catch (err) {
+        if (err instanceof GithubLockTimeoutError) {
+          return errorResult(err.message);
+        }
+        throw err;
       }
-      const data = await requestJson(bugUrl, {
-        method: "PATCH",
-        body: sanitizedUpstreamBody({
-          status,
-          triage_notes,
-          add_note,
-          linked_task_id,
-          linked_commit,
-          fixed_version,
-          product,
-          classification,
-          cluster,
-          verification_artifact: resolved.artifact,
-          delivery_proof: delivery.value,
-          // The disposition travels with the close: the server gates on it, and stores
-          // it so the record reads as "closed because there was nothing to fix" rather
-          // than as an unexplained close.
-          disposition: verification.disposition,
-          disposition_reason: verification.disposition_reason,
-          superseded_by: verification.superseded_by,
-          disposition_verifier: verification.disposition_verifier,
-          superseded_coverage: verification.superseded_coverage,
-          symptoms: verification.symptoms,
-          attribution: resolved.attribution
-        }, "support-inbox:triage_bug")
-      });
-      const response = fixed_version && !status ? withStatusNotice(
-        data,
-        `fixed_version ${fixed_version} recorded. Status was not changed and the bug was NOT closed. To close it, pass status: "closed" explicitly.`
-      ) : data;
-      return { content: [{ type: "text", text: JSON.stringify(response, null, 2) }] };
     }
   );
 }