@bragi-gmbh/codebus 1.2.0

package/dist/commands/repo.js

@@ -0,0 +1,1198 @@
+/**
+ * repo.ts — `codebus repo connect|status|list` (docs/plans/repo-intelligence.md
+ * Track A4).
+ *
+ * `repo connect <github-url> [--slug <s>] [--default-branch <b>] [--force]
+ *               [--write-workflow] [--build] [--no-pr-sync]`
+ *   (`--branch` is accepted as a deprecated alias for `--default-branch` —
+ *   round-11 review finding F6: the plan's own file spec names the flag
+ *   `--default-branch`, matching the RPC parameter it feeds.)
+ *   Parses <github-url> (https, ssh, or bare owner/repo — always normalized
+ *   to a canonical https://github.com/<owner>/<repo> URL before it reaches
+ *   the RPC, since 0070's trg_repos_enforce_remote_url_normalized only
+ *   accepts an https(s) scheme). The resolved default branch is validated
+ *   against git's OWN ref-format rules (round-12 review finding 7,
+ *   CONFIRMED) before anything else runs — see `isValidGitBranchName`.
+ *   Calls `repo_connect` (0070). If the caller is not this repo's authority
+ *   (workspace admin or designated curator — 0050 graph_repo_authority),
+ *   prints remediation and stops WITHOUT attempting a token mint
+ *   (re-runnable later once authority is granted). Otherwise mints a fresh
+ *   `ingest`-scope token (graph_ingest_token_mint, 0059) — round-12 review
+ *   finding 5 (CONFIRMED): minting now happens LAST among the fallible
+ *   steps below (after the workflow write/validate and the ci_wired
+ *   transition), immediately before the one remaining step that structurally
+ *   needs the plaintext (`--build`), so a failure in an EARLIER step never
+ *   wastes an unrecoverable token row; see repoConnectFull's own doc for the
+ *   residual `--build`-failure case and how it is covered. `--json` mode
+ *   prints the token ONLY as a field inside the single JSON object on
+ *   stdout — nothing else follows it (round-12 review finding 2: this now
+ *   also holds when `--build` is combined with `--json` — the child
+ *   process's own stdout no longer shares this process's stdout, see
+ *   repoConnectFull); human mode prints it exactly once, inline with the
+ *   `gh secret set` instructions (round-11 review finding F3: plaintext
+ *   token must never hit `--json` output mixed with free text; round-12
+ *   review finding 6, CONFIRMED: it must also never print twice within
+ *   human mode's own block — the `gh secret set` line now references the
+ *   token printed just above it rather than repeating it inline).
+ *   `--write-workflow` validates this cwd's own `origin` remote against the
+ *   connected repo and emits `.github/workflows/codebus.yml`, with the
+ *   resolved default branch single-quoted and escaped into the YAML (round-
+ *   12 review finding 7, CONFIRMED — a comma or `]` is legal in a git
+ *   branch name but breaks an UNQUOTED YAML flow sequence). Round-12 review
+ *   finding 1 (CONFIRMED, BLOCKER): `--write-workflow` no longer transitions
+ *   the attachment to `ci_wired` by itself. Round-13 review finding 2
+ *   (CONFIRMED, BLOCKER) fixed the underlying reusable workflow itself
+ *   (`.github/workflows/graphify-publish.yml` now checks out CodeBus's own
+ *   scripts/lockfiles into `.codebus-kit/` for a foreign caller, see that
+ *   file's own comment) — the emitted workflow CAN now actually run for a
+ *   foreign repo — but a file merely existing on disk still proves nothing
+ *   about whether IT ACTUALLY DID (secrets not yet added to the repo's
+ *   `graph-publish` environment, the environment itself not yet created, a
+ *   network blip, ...), so this command still does not claim `ci_wired`
+ *   just because the write succeeded. `ci_wired` must mean "CI actually
+ *   ran," not "a file was written" — writing the file is necessary but
+ *   never sufficient by itself. Two things now earn `ci_wired`: `--build`
+ *   transitions pending -> ci_wired BEFORE running (plan's own state-machine
+ *   trap: attachment must not sit `pending` while a build has already run),
+ *   then actually runs `scripts/graph-publish.mjs` locally against the
+ *   freshly minted token, surfacing a quarantine/25MB-reject verbatim — a
+ *   real, local, end-to-end proof that ingest works; and, round-13 review
+ *   finding 3 (CONFIRMED, MAJOR), a genuine CI-sourced ingest arriving while
+ *   still `pending` (0063's `graph_ingest_artifact`) now itself advances
+ *   pending -> ci_wired -> first_build_ok -> live in one call — equally
+ *   strong proof, since it is a REAL external caller authenticating with
+ *   this repo's own token and actually landing servable content. Nothing
+ *   else auto-promotes OUT of `pending`, and `--write-workflow` deliberately
+ *   still does not. Round-11 review finding F4 (CONFIRMED, still enforced):
+ *   the transition used to run BEFORE the origin-match validation and file
+ *   write, so a mismatched checkout or a filesystem failure could leave the
+ *   database falsely claiming CI is wired despite no workflow file ever
+ *   landing; validate-then-write still fully precedes the `--build`
+ *   transition. Round-13 review finding 3 additionally moved the MINT
+ *   ahead of that transition too (see `repoConnectFull`'s own doc) — minting
+ *   is itself fallible, and a false `ci_wired` claim on a failed mint would
+ *   be exactly the same class of bug this whole paragraph is about.
+ *
+ * `repo status <slug>`   — graph_status (0050) + a PR status aggregate.
+ * `repo list`            — every repo in this workspace + its attachment state.
+ */
+import { execFileSync, spawnSync, execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdirSync, writeFileSync, existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { resolveConfig } from "../config.js";
+import { makeCtx, workspaceId, repoId as resolveRepoIdBySlug } from "../client.js";
+import { render } from "../output.js";
+import { CodebusError, PostMintFailureError } from "../errors.js";
+import { redactUrlUserinfo } from "./plan-gh.js";
+const OWNER_REPO_TAIL = "([A-Za-z0-9._-]+)/([A-Za-z0-9._-]+?)(?:\\.git)?/?$";
+/**
+ * Accepts https://github.com/<owner>/<repo>[.git], git@github.com:<owner>/
+ * <repo>[.git], ssh://git@github.com[:port]/<owner>/<repo>[.git], and a bare
+ * <owner>/<repo>. Returns null (never throws) on anything else. Always
+ * returns the canonical https form — repo_connect's trigger requires it.
+ */
+export function parseGithubUrl(input) {
+    const s = input.trim();
+    const patterns = [
+        new RegExp(`^https?://(?:[^/@\\s]+@)?github\\.com(?::\\d+)?/${OWNER_REPO_TAIL}`, "i"),
+        new RegExp(`^git@github\\.com:${OWNER_REPO_TAIL}`, "i"),
+        new RegExp(`^ssh://git@github\\.com(?::\\d+)?/${OWNER_REPO_TAIL}`, "i"),
+    ];
+    for (const re of patterns) {
+        const m = s.match(re);
+        if (m)
+            return { owner: m[1], name: m[2], canonicalUrl: `https://github.com/${m[1]}/${m[2]}` };
+    }
+    // Bare "owner/repo" — only when the input doesn't already look like a URL
+    // or scp-style remote (no scheme separator, no '@').
+    if (!s.includes("://") && !s.includes("@")) {
+        const m = s.match(new RegExp(`^${OWNER_REPO_TAIL}`, "i"));
+        if (m)
+            return { owner: m[1], name: m[2], canonicalUrl: `https://github.com/${m[1]}/${m[2]}` };
+    }
+    return null;
+}
+/** `git remote get-url origin`, or null if there is no such remote / this
+ *  isn't a git checkout. Never throws. */
+export function getGitRemoteUrl(repoRoot) {
+    try {
+        const url = execFileSync("git", ["remote", "get-url", "origin"], { cwd: repoRoot, encoding: "utf-8" }).trim();
+        return url || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Round-16 review finding 1, part 2 (CONFIRMED, BLOCKER): this checkout's
+ * own git origin must match the connected repo before EITHER
+ * `--write-workflow` writes a file for it OR `--build` runs a local
+ * ingest against whatever code sits in it. The previous revision only ran
+ * this check for `--write-workflow` — `--build` alone (no
+ * `--write-workflow`) could run unchecked against ANY cwd, so an operator
+ * (or a script) that minted a token for repo A while sitting in an
+ * unrelated checkout B would locally build+ingest B's code into A's graph,
+ * using A's own credentials, with nothing catching the mismatch. Extracted
+ * so both flags run the IDENTICAL check rather than two copies that can
+ * drift; `flagName` only changes the error message's wording, never the
+ * logic.
+ */
+export function validateOriginMatchesConnectedRepo(repoRoot, owner, name, flagName) {
+    const originUrl = getGitRemoteUrl(repoRoot);
+    const originParsed = originUrl ? parseGithubUrl(originUrl) : null;
+    if (!originParsed || originParsed.owner.toLowerCase() !== owner.toLowerCase() || originParsed.name.toLowerCase() !== name.toLowerCase()) {
+        // Round-19 review finding (CONFIRMED, credential-leakage theme): this
+        // checkout's own 'origin' is fully local-environment-controlled, and a
+        // git remote legally embeds HTTP Basic-style userinfo
+        // (`https://token@github.com/...`) — never echo it raw.
+        throw new CodebusError(`${flagName} refused: this checkout's origin remote (${originUrl ? redactUrlUserinfo(originUrl) : "none"}) does not match the ` +
+            `connected repo (${owner}/${name}). Run this from a checkout of the connected repo.`);
+    }
+}
+const execFileP = promisify(execFile);
+const CODEBUS_ORG = "Bragi-GmbH";
+export function realRepoVisibilityChecker() {
+    return {
+        /* c8 ignore start -- shells out to the real `gh` binary/GitHub API,
+         * same irreducible-external-I/O exemption as plan-gh.ts's
+         * realGhRunner() (DEC-CB-009 EX-001 class) — every test below injects
+         * its own mock RepoVisibilityChecker instead. */
+        async visibility(owner, name) {
+            const { stdout } = await execFileP("gh", ["repo", "view", `${owner}/${name}`, "--json", "visibility"]);
+            const parsed = JSON.parse(stdout);
+            if (!parsed.visibility)
+                throw new Error(`\`gh repo view ${owner}/${name} --json visibility\` returned no visibility field`);
+            return parsed.visibility.toLowerCase();
+        },
+        /* c8 ignore stop */
+    };
+}
+/**
+ * Round-12 review finding F1 (CONFIRMED, MAJOR): the reusable workflow this
+ * CLI's own generated `codebus.yml` calls (`uses: Bragi-GmbH/CodeBus/
+ * .github/workflows/graphify-publish.yml@main`) lives in Bragi-GmbH/CodeBus
+ * — a PRIVATE repository (verified via `gh repo view Bragi-GmbH/CodeBus
+ * --json visibility` -> PRIVATE, round-14 review finding 1). GitHub's own
+ * reusable-workflow access rules (docs/actions/reference/workflows-and-
+ * actions/reusing-workflow-configurations#access-to-reusable-workflows,
+ * verified against the docs before writing this predicate) resolve the
+ * `uses:` reference BEFORE the calling workflow run's secrets — including
+ * this CLI's own emitted `CODEBUS_KIT_TOKEN` — are ever read:
+ *   - A PUBLIC caller repo can NEVER resolve a private called workflow, in
+ *     any configuration; no secret or token can retroactively authorize a
+ *     reference GitHub already refused to resolve.
+ *   - A PRIVATE or INTERNAL caller repo can resolve it only if it is owned
+ *     by the SAME organization as the called repo (here: Bragi-GmbH) AND
+ *     Bragi-GmbH/CodeBus's own Actions "Access" setting (Settings ->
+ *     Actions -> General -> "Access", on Bragi-GmbH/CodeBus itself) is set
+ *     to "Accessible from repositories in the Bragi-GmbH organization" (or
+ *     broader) rather than its more restrictive default ("Not
+ *     accessible"). This CLI cannot verify that second, CodeBus-side
+ *     setting remotely (it requires admin access to Bragi-GmbH/CodeBus,
+ *     which an arbitrary connecting repo's operator will not have) — the
+ *     error text below names it explicitly so an operator whose repo DOES
+ *     pass this predicate but still sees a dead workflow at push time knows
+ *     exactly which CodeBus-side setting to ask an admin about, rather than
+ *     assuming the CLI itself is broken.
+ *
+ * Before this fix, `--write-workflow` (and `--build`, which always follows
+ * the identical write-workflow gate in repoConnectFull) accepted ANY
+ * connected repo and silently emitted a workflow file that could never
+ * actually run for one owned outside Bragi-GmbH, or one that is public —
+ * GitHub itself would refuse the `uses:` resolution on the very first push,
+ * with no signal back to this CLI or its operator at connect time.
+ *
+ * `checker` is injectable (default: `realRepoVisibilityChecker()`) so tests
+ * never shell out to the real `gh` — matches plan-gh.ts's GhRunner
+ * injection convention.
+ */
+export async function assertEligibleForCodebusReusableWorkflow(owner, name, checker = realRepoVisibilityChecker()) {
+    // Round-13 review finding (CONFIRMED, MINOR): GitHub owner/org identities
+    // are case-INSENSITIVE (github.com/Bragi-GmbH and github.com/bragi-gmbh
+    // are the identical entity) — `validateOriginMatchesConnectedRepo` above
+    // already compares owner/name via `.toLowerCase()` for exactly this
+    // reason, but this check used a bare `!==`, so a perfectly valid,
+    // differently-cased reference to the SAME organization (e.g.
+    // `bragi-gmbh/repo`, or `BRAGI-GMBH/repo` — `parseGithubUrl` preserves
+    // whatever casing the caller typed, it does not itself normalize) was
+    // incorrectly rejected as "not owned by Bragi-GmbH". Fixed by comparing
+    // lowercase-normalized values, matching the origin check's own
+    // convention. `name` is never compared against anything in this
+    // function (only interpolated into messages and passed through to
+    // `checker.visibility`, which — like `gh repo view`/GitHub itself — is
+    // already case-insensitive), so no equivalent fix is needed for it.
+    if (owner.toLowerCase() !== CODEBUS_ORG.toLowerCase()) {
+        throw new CodebusError(`--write-workflow refused: '${owner}/${name}' is not owned by ${CODEBUS_ORG}. The generated workflow calls a ` +
+            `PRIVATE reusable workflow (${CODEBUS_ORG}/CodeBus/.github/workflows/graphify-publish.yml) — GitHub's own ` +
+            "reusable-workflow access rules mean a repo outside that organization can never resolve this reference at " +
+            "all, regardless of any secret this repo supplies (CODEBUS_KIT_TOKEN arrives only after GitHub would already " +
+            `have refused the resolution). Connect a repo owned by ${CODEBUS_ORG}, or omit --write-workflow/--build.`);
+    }
+    let vis;
+    try {
+        vis = await checker.visibility(owner, name);
+    }
+    catch (e) {
+        throw new CodebusError(`--write-workflow refused: could not determine '${owner}/${name}'s visibility via \`gh repo view\` (required ` +
+            `to confirm it is eligible to call ${CODEBUS_ORG}/CodeBus's private reusable workflow) — ` +
+            `${e instanceof Error ? e.message : String(e)}`);
+    }
+    if (vis !== "private" && vis !== "internal") {
+        throw new CodebusError(`--write-workflow refused: '${owner}/${name}' is ${vis}, but ${CODEBUS_ORG}/CodeBus's reusable workflow ` +
+            "(graphify-publish.yml) is PRIVATE. GitHub only allows a private or internal caller repository to resolve a " +
+            "private called workflow — a public caller can never resolve it, in any configuration. Make this repository " +
+            `private or internal within ${CODEBUS_ORG}, or omit --write-workflow/--build. Even once private/internal, ` +
+            `${CODEBUS_ORG}/CodeBus's own Settings -> Actions -> General -> "Access" setting must ALSO be configured to ` +
+            `"Accessible from repositories in the ${CODEBUS_ORG} organization" (or broader) — this CLI cannot verify that ` +
+            "setting remotely; ask a CodeBus admin to confirm it if the emitted workflow still cannot resolve the " +
+            "reusable workflow after this repo is made private/internal.");
+    }
+}
+/**
+ * Round-16 review finding 1, part 1 (CONFIRMED, BLOCKER): `--build` used to
+ * execute `<opts.repoRoot>/scripts/graph-publish.mjs` — a path INSIDE the
+ * repo the operator just connected. For any repo other than CodeBus itself
+ * that script normally does not exist at all (the build simply fails) —
+ * but far worse, it is a path a malicious or merely-compromised connected
+ * repo fully controls: planting its OWN file there would hand it the
+ * freshly-minted ingest token plus SUPABASE_URL/SUPABASE_ANON_KEY, in full,
+ * the instant `--build` ran. Fixed: `--build` now ALWAYS resolves and runs
+ * a TRUSTED copy of `graph-publish.mjs` shipped alongside the CLI's OWN
+ * installation — never anything inside the connected repo's checkout,
+ * regardless of what that checkout contains.
+ *
+ * Resolution walks up from the CURRENTLY RUNNING module's own file
+ * location (`moduleUrl`, always this file's own `import.meta.url` at the
+ * real call site — never `opts.repoRoot`) to this CLI package's own root:
+ * exactly three levels up from `<pkg>/src/commands/repo.ts` (dev, tsx) or
+ * `<pkg>/dist/commands/repo.js` (compiled) lands at `<pkg>/` either way,
+ * since `src/` and `dist/` are each exactly one level under the package
+ * root and `commands/` is exactly one level under EACH of those — the
+ * level count is identical for both the dev-worktree layout and the
+ * installed-npm-package layout (cli/package.json's own `files: ["bin",
+ * "dist"]`). From there, the ONLY path ever trusted is
+ * `<pkg>/dist/kit/graph-publish.mjs` — the copy `npm run build` places
+ * there from this monorepo's own `scripts/graph-publish.mjs` (see
+ * cli/package.json's `build` script), which `files: ["dist"]` therefore
+ * already ships inside the published npm package too (no `files` entry
+ * change needed — the whole `dist/` tree, `kit/` included, is already
+ * covered).
+ *
+ * Deliberately NO fallback to any monorepo-relative path (e.g.
+ * `<pkg>/../scripts/...`) — that would reintroduce exactly the kind of
+ * "resolve relative to something outside the CLI's own trusted
+ * installation" hazard this fix exists to close, for a dev-convenience
+ * savings that is not worth it. A dev worktree run without `npm run build`
+ * having populated `dist/kit/` first fails loudly here instead — the
+ * correct, safe behavior; never a silent wrong-file execution.
+ */
+export function resolveTrustedGraphPublishScript(moduleUrl) {
+    const packageRoot = dirname(dirname(dirname(fileURLToPath(moduleUrl))));
+    const trustedPath = join(packageRoot, "dist", "kit", "graph-publish.mjs");
+    if (!existsSync(trustedPath)) {
+        throw new CodebusError(`--build cannot find its trusted graph-publish.mjs at ${trustedPath} — this CLI installation looks ` +
+            "incomplete (run `npm run build` in the CodeBus monorepo, or reinstall the @bragi-gmbh/codebus package). " +
+            "Refusing to fall back to any script inside the connected repo's own checkout.");
+    }
+    return trustedPath;
+}
+/**
+ * Round-12 review finding 7 (CONFIRMED): the previous revision interpolated
+ * `p_default_branch` straight into the emitted workflow's flow-style YAML
+ * (`branches: [${branch}]`) with no quoting and no validation. Two DISTINCT
+ * problems, fixed independently, neither one a substitute for the other:
+ *
+ *   1. Git's own ref-format rules are far more permissive than the set of
+ *      characters that are safe to drop unquoted into a YAML flow sequence
+ *      — a comma (`release,prod`) or a `]` are both perfectly legal git
+ *      branch names, yet either one changes the meaning (or breaks the
+ *      parse) of an unquoted `[...]` list. `renderCodebusWorkflow` fixes
+ *      this half by always emitting the branch as a single-quoted YAML
+ *      scalar with embedded `'` doubled — the one escaping rule single-
+ *      quoted YAML scalars need — regardless of what this function decides.
+ *   2. Separately, a caller can still pass a string that is not a legal git
+ *      branch name AT ALL (stray whitespace, a leading `-`, a control
+ *      character, `..`, a leading `/`, etc.) — quoting alone would make that
+ *      syntactically safe YAML but semantically useless (a push trigger
+ *      naming a branch nothing can ever push to). This function rejects
+ *      those outright, BEFORE `repo_connect` ever writes `p_default_branch`
+ *      to the database or `renderCodebusWorkflow` ever emits it.
+ *
+ * Delegates the actual rule set to git's own `check-ref-format` rather than
+ * re-deriving it by regex (git's rules — no ASCII control chars/space/
+ * `~^:?*[`, no leading/trailing/doubled `/`, no leading `.` component, no
+ * trailing `.lock`, no `@{`, not bare `@`, no `\`, no trailing `.`, no `..`
+ * — are exactly the kind of detail a hand-rolled pattern drifts out of sync
+ * with over time). Deliberately validates `refs/heads/<name>` rather than
+ * using `check-ref-format --branch <name>` directly: `--branch` mode ALSO
+ * expands shorthand like a bare `@` or `@{-1}` (git's "previous branch"
+ * syntax) into a different, expanded ref — useful for a human typing at a
+ * shell, actively wrong here, where the input is expected to be an exact,
+ * literal branch name and any shorthand-expansion behavior would validate
+ * (and silently rewrite the meaning of) a string this function should
+ * simply accept-or-reject as-is.
+ */
+export function isValidGitBranchName(name) {
+    if (!name)
+        return false;
+    try {
+        execFileSync("git", ["check-ref-format", `refs/heads/${name}`], { stdio: "pipe" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Round-9 review finding (CONFIRMED, MINOR): `isValidGitBranchName` only
+ * enforces git's OWN ref-format rules, which are far more permissive than
+ * what GitHub Actions treats as safe once that same string is dropped into
+ * a `branches:` push filter or interpolated into a workflow file GitHub
+ * itself parses and evaluates. `yamlSingleQuoted` (below) protects the YAML
+ * *parse* — it does not, and cannot, protect against GitHub's OWN
+ * downstream interpretation of the parsed value. Two concrete failure
+ * modes, both using perfectly legal git branch names `isValidGitBranchName`
+ * happily accepts:
+ *
+ *   1. A branch named `!release` (or anything else starting with `!`) is
+ *      valid to git, but GitHub's `on.push.branches` filter treats a
+ *      leading `!` as a NEGATION glob, not a literal branch name — the
+ *      emitted workflow would simply never trigger for that branch,
+ *      silently, with no error anywhere.
+ *   2. A branch named `${{github.actor}}` is also valid to git
+ *      (`check-ref-format` does not forbid `$`, `{`, or `}`), but GitHub
+ *      evaluates `${{ ... }}` as an expression wherever it appears in a
+ *      workflow file — regardless of YAML quoting, since quoting only
+ *      determines the parsed STRING value, and GitHub's expression
+ *      evaluator runs on that value afterward. This is an expression
+ *      injection into the emitted CI file itself.
+ *
+ * Such default-branch names are vanishingly rare in practice (git's own
+ * rules already reject the far more common `*`, `?`, and `[` for unrelated
+ * reasons — see `isValidGitBranchName`'s doc above), so this rejects
+ * outright with a clear, specific error naming the offending character
+ * rather than attempting to escape GitHub's own branch-filter glob syntax,
+ * which GitHub documents inconsistently across `branches:`/
+ * `branches-ignore:`/`paths:` filters. Rejection is a strictly more honest
+ * contract than escaping semantics this codebase would then be on the hook
+ * to keep exactly right forever.
+ *
+ * Round-14 review finding (CONFIRMED, MINOR): `+` was missing from this
+ * list — `release+prod` is a perfectly legal git branch name
+ * (`check-ref-format` does not forbid `+`) but GitHub's branch/tag/path
+ * filter glob syntax treats `+` as a special pattern character exactly
+ * like `*`/`?`/`[]`/`!`, so the emitted workflow would silently never
+ * trigger for that branch — the identical failure mode as the `!release`
+ * case above, just via a different character. Cross-checked GitHub's own
+ * enumeration of branch-filter special characters again against this
+ * list (docs/actions/reference/workflows-and-actions/workflow-syntax's
+ * filter pattern cheat sheet, and the on.push.branches section, both
+ * verified via direct fetch and independent search before this fix): the
+ * complete documented set is `* ? + [ ] !` plus `\` for escaping any of
+ * them literally. Accounting for every one of those against this list:
+ *   - `*`, `?`, `!`, `[`, `]` — already present above.
+ *   - `+` — was missing; added by this fix.
+ *   - `]` alone is git-legal (only `[` is git-banned) and was already
+ *     covered before this fix.
+ *   - `\` (backslash) needs NO entry here: git's OWN ref-format rules
+ *     (`check-ref-format`, enforced by `isValidGitBranchName` BEFORE this
+ *     function ever runs — see `repoConnectCore`) already reject any raw
+ *     backslash outright (verified: `git check-ref-format
+ *     refs/heads/back\slash` rejects), so a branch name reaching this
+ *     function can never contain one in the first place — nothing here
+ *     would ever see it.
+ * `{`/`}` are kept even though GitHub's branch-glob cheat sheet itself
+ * does not list them as glob metacharacters — they exist for the
+ * SEPARATE `${{...}}` expression-injection concern above, not the glob
+ * syntax, and the explicit `${{` substring check just below already
+ * covers that case more precisely than a bare `{`/`}` would.
+ */
+const GITHUB_ACTIONS_UNSAFE_BRANCH_CHARS = ["!", "*", "?", "+", "[", "]", "{", "}"];
+/** Returns the first GitHub-Actions-unsafe character (or the `${{`
+ *  expression-start sequence) found in `name`, or `null` if none is
+ *  present. Checked SEPARATELY from — and in addition to —
+ *  `isValidGitBranchName`: a name can pass git's own ref-format rules and
+ *  still be unsafe to drop into a `branches:` filter or workflow
+ *  expression. */
+export function findGithubActionsUnsafeBranchChar(name) {
+    // Checked before the single-character scan below: `${{` on its own does
+    // not contain any character this function would otherwise flag (`$` is
+    // not in GITHUB_ACTIONS_UNSAFE_BRANCH_CHARS), yet it is the exact
+    // substring GitHub's workflow parser treats as the start of an
+    // expression — naming it specifically produces a far clearer error than
+    // reporting a bare `{`.
+    if (name.includes("${{"))
+        return "${{";
+    for (const ch of GITHUB_ACTIONS_UNSAFE_BRANCH_CHARS) {
+        if (name.includes(ch))
+            return ch;
+    }
+    return null;
+}
+/** Emits `s` as a single-quoted YAML scalar — the one escaping rule
+ *  single-quoted YAML needs (embedded `'` doubled to `''`). Used for the
+ *  branch name in `renderCodebusWorkflow` (round-12 review finding 7): a
+ *  git branch name may legally contain a comma, `]`, or `'`, any of which
+ *  would corrupt an unquoted flow-sequence `[...]` entry. */
+function yamlSingleQuoted(s) {
+    return `'${s.replace(/'/g, "''")}'`;
+}
+/** The workflow content emitted by --write-workflow. Exported for a
+ *  snapshot test. `pr-sync` calls B2's own reusable workflow
+ *  (.github/workflows/codebus-pr-sync.yml, this repo,
+ *  0072_github_ingestion.sql) — B2 has now landed, so this job is emitted
+ *  LIVE, per the plan's own unified-caller-workflow design (one caller
+ *  workflow file per connected repo, one job per active track, never a
+ *  second commented-out revision waiting on a later chunk).
+ *
+ *  Round-11 review finding F2 (repo review a4-r1, BLOCKER, CONFIRMED,
+ *  A4-era): a LIVE `pull_request:` trigger with no push-only guard on the
+ *  `graphify-publish` job would have let a pull_request-triggered run
+ *  invoke graph-publish's reusable workflow, handing PR-controlled code the
+ *  ingest-scope token secret. `graphify-publish` has carried its own
+ *  explicit `if: github.event_name == 'push'` guard as defense-in-depth
+ *  ever since — kept unchanged now that `pull_request`/`pull_request_review`
+ *  are themselves live triggers too, for the identical reason: a future
+ *  edit to `on:` must never silently widen which events graphify-publish
+ *  runs on merely by adding a new trigger alongside it. `pr-sync` (below)
+ *  carries the mirror-image guard, `github.event_name == 'pull_request' ||
+ *  github.event_name == 'pull_request_review'`, so the two jobs can never
+ *  cross-fire onto each other's event either. */
+export function renderCodebusWorkflow(opts) {
+    // Round-11 review finding F6 (CONFIRMED): the previous revision always
+    // emitted `branches: [main]` here regardless of what default_branch this
+    // repo was actually connected with — a repo using another default branch
+    // recorded that branch in the database but received CI that could never
+    // run (no push to `main` ever happens there). The push trigger now uses
+    // the SAME resolved default branch repo_connect itself was called with.
+    // Round-12 review finding 7 (CONFIRMED): always emitted as a single-quoted
+    // YAML scalar (never bare inside the flow sequence) — see
+    // `yamlSingleQuoted`'s own doc for why quoting alone (not merely the
+    // caller-side `isValidGitBranchName` check) is required here.
+    const branch = yamlSingleQuoted(opts.defaultBranch ?? "main");
+    // B2 landed: `includePrSyncStub` (the constructor parameter name is kept
+    // for call-site compatibility — every existing call site still passes
+    // `includePrSyncStub: opts.prSync !== false`, cli/src/commands/repo.ts's
+    // repoConnectFull — see below) now means "emit the pr-sync job LIVE",
+    // never "emit a commented-out stub". `--no-pr-sync` still fully omits
+    // both the trigger and the job, unchanged.
+    //
+    // Round-2 (Sol) review finding F4 (CONFIRMED, MAJOR): the original type
+    // list (opened/synchronize/reopened/closed/edited) omitted every event
+    // that changes reviewer presence or draft state —
+    // `review_requested`/`review_request_removed` (the ONLY events GitHub
+    // fires when a PR's requested-reviewers set changes at all) and
+    // `converted_to_draft`/`ready_for_review` (the draft flag's own
+    // transitions). Without these, `requested_reviewers_present`,
+    // `review_state`, and the derived `draft`/PR `status` (0064) never get a
+    // CI-push sync when ONLY one of these things changes with no other edit.
+    // github-sync's own reconcile poll now ALSO covers requested-reviewer
+    // presence (github-sync/logic.mjs's mapPullToPollPayload maps the
+    // pulls-list endpoint's `requested_reviewers`/`requested_teams`) AND, for
+    // a fork-origin PR specifically, `review_decision` too (PR review, Luna,
+    // comment 3839437819, F2 — github-sync/index.ts spends one extra,
+    // budget-bounded `/pulls/{number}/reviews` call per fork PR to derive
+    // it, since that class never gets a CI-push sync at all — see the
+    // fork-origin `if:` guard below). For a SAME-repo PR, these CI-only
+    // trigger types remain the richer, more timely path for `review_decision`
+    // — the poll only spends its bounded reviews-fetch budget on fork PRs,
+    // never on one already covered by CI-push. Added below — this is not
+    // "every possible pull_request type" (labeled/assigned/milestoned/etc.
+    // map to no CodeBus PR field and are deliberately still omitted), it is
+    // every type that changes a field pr_upsert_synced (0064) actually
+    // tracks.
+    const pullRequestTrigger = opts.includePrSyncStub
+        ? "  pull_request:\n" +
+            "    types: [opened, synchronize, reopened, closed, edited, ready_for_review, converted_to_draft, review_requested, review_request_removed]\n" +
+            "  pull_request_review:\n" +
+            "    types: [submitted, edited, dismissed]\n"
+        : "";
+    const graphify = `# codebus: emitted by \`codebus repo connect --write-workflow\`.
+#
+# Round-12 review finding F1 (CONFIRMED, MAJOR): the graphify-publish job
+# below calls a REUSABLE workflow that lives in Bragi-GmbH/CodeBus, a
+# PRIVATE repository. GitHub's own reusable-workflow access rules mean this
+# file can only ever run if THIS repo is (a) owned by Bragi-GmbH and (b)
+# itself private or internal — \`codebus repo connect --write-workflow\`
+# already checked both of those before emitting this file, so if you are
+# reading this file inside such a repo, this half already holds. The
+# remaining half is NOT something the CLI can verify remotely: Bragi-GmbH/
+# CodeBus's own Settings -> Actions -> General -> "Access" setting must
+# ALSO be configured to "Accessible from repositories in the Bragi-GmbH
+# organization" (or broader) — ask a CodeBus admin to confirm this if
+# graphify-publish still fails to resolve on the first real push.
+name: codebus
+
+on:
+  push:
+    branches: [${branch}]
+${pullRequestTrigger}
+permissions:
+  contents: read
+
+jobs:
+  graphify-publish:
+    # Defense-in-depth (round-11 review finding F2): now that pull_request/
+    # pull_request_review are LIVE triggers alongside push (B2 landed),
+    # this guard is what actually keeps graphify-publish (and its
+    # ingest-token secret) from ever running on a PR-controlled event —
+    # never merely "always true because nothing else triggers this
+    # workflow" the way it was before B2's own triggers existed.
+    if: github.event_name == 'push'
+    # Cross-repo reusable-workflow reference, pinned to a ref. Round-13
+    # review finding 2 (CONFIRMED, BLOCKER, fixed): this job used to fail at
+    # \`npm ci\` for any repo other than CodeBus itself, since the graphify
+    # script/lockfile only existed in the CodeBus repo — the reusable
+    # workflow (.github/workflows/graphify-publish.yml, CodeBus side) now
+    # checks its OWN scripts/lockfiles out into \`.codebus-kit/\` for any
+    # caller, so this job can actually run once the operator has also added
+    # the required secrets to this repo's \`graph-publish\` environment
+    # (docs/plans/repo-intelligence.md A4, "Open questions" — RESOLVED,
+    # round-19 PR #55 review: the reusable workflow's own second checkout
+    # stays pinned to \`main\`, matching THIS \`uses:\` line just below —
+    # this CLI always emits \`@main\` here, so a caller already trusts
+    # CodeBus's \`main\` wholesale; SHA-pinning only the inner checkout would
+    # protect nothing while adding a silent-staleness hazard. See that
+    # checkout step's own comment in graphify-publish.yml for the full
+    # argument).
+    # Round-14 review finding 1 (CONFIRMED, BLOCKER): Bragi-GmbH/CodeBus is
+    # PRIVATE — the reusable workflow's own \`github.token\` cannot check it
+    # out for any caller other than CodeBus itself, so THIS (foreign)
+    # caller must supply CODEBUS_KIT_TOKEN below (a GitHub PAT/App token
+    # with read access to Bragi-GmbH/CodeBus) or the reusable workflow's
+    # own fail-fast check refuses with a clear, actionable error naming
+    # exactly this secret.
+    uses: Bragi-GmbH/CodeBus/.github/workflows/graphify-publish.yml@main
+    # Round-8 review finding (CONFIRMED, MAJOR): the reusable workflow's own
+    # branch gate is driven by this \`default-branch\` input, not a hardcoded
+    # \`main\` — pass the SAME resolved default branch this repo was
+    # connected with (the identical value used for \`on: push: branches:\`
+    # above) so a repo whose default branch isn't \`main\` can actually
+    # publish, instead of the reusable workflow silently no-op'ing forever.
+    with:
+      default-branch: ${branch}
+    secrets:
+      SUPABASE_URL: \${{ secrets.SUPABASE_URL }}
+      SUPABASE_ANON_KEY: \${{ secrets.SUPABASE_ANON_KEY }}
+      GRAPH_INGEST_TOKEN: \${{ secrets.GRAPH_INGEST_TOKEN }}
+      ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
+      CODEBUS_KIT_TOKEN: \${{ secrets.CODEBUS_KIT_TOKEN }}
+`;
+    const prSyncJob = opts.includePrSyncStub
+        ? `
+  pr-sync:
+    # Mirror-image guard of graphify-publish's own \`if\` above — this job
+    # must never fire on a push event either, even though only pull_request/
+    # pull_request_review currently trigger it. The second clause skips a
+    # fork-origin PR specifically: GitHub never grants \`id-token: write\` to
+    # a pull_request run whose head lives in a fork — a documented platform
+    # restriction, not something this job's own permissions block can
+    # override — so left ungated, every fork PR would reach codebus-pr-
+    # sync.yml's OIDC-minting step and fail it red permanently (never
+    # resolves by retrying, looks identical to a real incident). Skipping
+    # is safe for what the reconcile poller (github-sync) actually covers:
+    # it independently re-derives every PR's title/branches/head sha/draft/
+    # open-closed-merged state AND requested-reviewer presence, fork-origin
+    # included, within 15 minutes (github-sync/logic.mjs's
+    # mapPullToPollPayload). review_decision (approved/changes_requested)
+    # is also covered for exactly this class now (PR review, Luna,
+    # comment 3839437819, F2): the pulls-list endpoint itself can't return
+    # it, but for a PR the poll identifies as fork-origin, github-sync/
+    # index.ts spends one extra, budget-bounded \`/pulls/{number}/reviews\`
+    # call to derive it — a same-repo PR never spends that budget, since
+    # its CI-push sync (pull_request_review events, reaching this job
+    # normally) is the richer, more timely source already. The one
+    # remaining honest gap: that per-sweep budget is finite, so a
+    # fork-origin PR's review_decision update can lag by a poll cycle or
+    # two under heavy load rather than update instantly — never a
+    # permanent zero the way it used to be.
+    if: |
+      (github.event_name == 'pull_request' || github.event_name == 'pull_request_review') &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    # id-token: write at the JOB level (not just the workflow-level
+    # \`permissions:\` above, which deliberately stays contents:read-only for
+    # graphify-publish's sake) is what actually lets codebus-pr-sync.yml's
+    # own OIDC-token-minting step succeed once this job calls it via
+    # \`uses:\` — a reusable-workflow-calling job only passes down the
+    # permissions IT ITSELF declares, not merely whatever the calling
+    # workflow's top-level \`permissions:\` block happens to list.
+    # pull-requests: read is equally load-bearing (proven live by the
+    # CodeBus dogfood caller's own first run, PR #67): the reusable
+    # workflow's \`gh pr view\` reads PR metadata with THIS caller's token,
+    # and caller permissions can never be elevated by the callee — without
+    # it the job dies with "Resource not accessible by integration".
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: read
+      checks: read
+      statuses: read
+      actions: read
+    # Cross-repo reusable-workflow reference, pinned to a ref — same \`uses:\`
+    # shape as graphify-publish above. No secrets at all (unlike
+    # graphify-publish's GRAPH_INGEST_TOKEN): this job's ENTIRE credential is
+    # the OIDC token it mints for itself inside codebus-pr-sync.yml — see
+    # that file's own header for the full auth model. B2's own "Blast
+    # radius" note (docs/plans/repo-intelligence.md) is explicit that OIDC
+    # tokens are minted per-request and never stored, which is exactly why
+    # this job needs no secrets block.
+    uses: Bragi-GmbH/CodeBus/.github/workflows/codebus-pr-sync.yml@main
+`
+        : "";
+    return graphify + prSyncJob;
+}
+export async function repoConnectCore(ctx, url, opts) {
+    const parsed = parseGithubUrl(url);
+    if (!parsed) {
+        // Round-19 review finding (CONFIRMED, credential-leakage theme — Luna
+        // PR #55 review, comment 3826839028): `url` is the caller-supplied
+        // argument to `codebus repo connect <url>` — parseGithubUrl's own
+        // accepted forms include userinfo (`https://token@github.com/...`,
+        // one of its own documented https-form matches), so a URL that fails
+        // to parse for some OTHER reason (a malformed owner/repo tail, say)
+        // still had that credential echoed back here verbatim.
+        throw new CodebusError(`could not parse a GitHub owner/repo from '${redactUrlUserinfo(url)}' — expected an https://github.com/<owner>/<repo> URL, ` +
+            "a git@github.com:<owner>/<repo>.git SSH URL, or a bare <owner>/<repo>.");
+    }
+    // Round-15 review finding (CONFIRMED, MINOR): named `requestedSlug` (not
+    // `slug`) deliberately — this is only what the CALLER asked to connect
+    // as. repo_connect (0070) can resolve it, via the retired_into chain or
+    // the normalized-url fallback (round-11 review finding F5), onto a row
+    // whose OWN current slug differs (the real collapse script renames a
+    // retired loser's slug and frees the original name). The RPC's own
+    // returned `slug` field (spread from `result` below, never shadowed by
+    // this variable) is the CANONICAL slug the CLI must actually surface —
+    // `repo status` only ever resolves that one, never a stale request.
+    const requestedSlug = opts.slug ?? parsed.name;
+    const branch = opts.branch ?? "main";
+    // Round-12 review finding 7 (CONFIRMED): validated BEFORE anything is
+    // written — a syntactically illegal branch name must never reach
+    // `repos.default_branch` (repo_connect's own p_default_branch) even when
+    // no workflow is ever emitted for it.
+    if (!isValidGitBranchName(branch)) {
+        throw new CodebusError(`'${branch}' is not a legal git branch name (checked via 'git check-ref-format') — refusing to connect ` +
+            "with an unusable default branch.");
+    }
+    // Round-9 review finding (CONFIRMED, MINOR): a name can pass git's own
+    // ref-format check above and STILL be unsafe once dropped into the
+    // emitted workflow's `branches:` filter or interpolated as a raw
+    // expression by GitHub itself — see `findGithubActionsUnsafeBranchChar`'s
+    // own doc for the two concrete failure modes (`!release` silently never
+    // triggers; `${{github.actor}}` is expression-injected). Checked
+    // separately, before `repo_connect` ever writes `p_default_branch`.
+    const unsafeChar = findGithubActionsUnsafeBranchChar(branch);
+    if (unsafeChar) {
+        throw new CodebusError(`'${branch}' is a legal git branch name but contains '${unsafeChar}', which GitHub Actions treats specially ` +
+            "in a push-trigger branch filter or as the start of a workflow expression (not as a literal character) — " +
+            "refusing to connect with a default branch that would silently corrupt or hijack the emitted CI workflow.");
+    }
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase.rpc("repo_connect", {
+        p_workspace: ws,
+        p_slug: requestedSlug,
+        p_remote_url: parsed.canonicalUrl,
+        p_default_branch: branch,
+        p_force: !!opts.force,
+    });
+    if (error)
+        throw new CodebusError(error.message);
+    const result = data;
+    // `...result` carries the RPC's own canonical `slug` — deliberately NOT
+    // overridden by `requestedSlug` here (see this function's own doc above).
+    return { ...result, canonicalUrl: parsed.canonicalUrl, owner: parsed.owner, name: parsed.name, requestedSlug };
+}
+/**
+ * Full `repo connect` side effects: the repo_connect RPC, `--write-workflow`,
+ * the pending -> ci_wired transition, the ingest-token mint (authority
+ * only), and `--build` — in that order. Exported for unit testing (round-11
+ * review findings F3/F4/F6 and round-12 review findings 1/2/5 regression
+ * coverage) and reuse.
+ *
+ * Deliberately returns a plain result object and does NOT print the
+ * connect/token/transition/workflow summary itself — `connectAction` below
+ * is a thin CLI wrapper that does ALL of that printing, exactly once, after
+ * this function has fully resolved. That split is what round-11 review
+ * finding F3 requires: in `--json` mode the caller must be able to print
+ * the finished result as a single JSON object with nothing before or after
+ * it, which is only possible if transitioning/writing/minting/building have
+ * already happened by the time anything is printed.
+ *
+ * Round-11 review finding F4 (CONFIRMED, still enforced): the previous
+ * revision transitioned pending -> ci_wired BEFORE validating the origin
+ * match and writing the workflow file, so a mismatched checkout or a
+ * filesystem failure could leave the database falsely claiming CI is wired
+ * with no file to show for it. Validate-then-write still fully precedes the
+ * transition below it, never in parallel with it and never ahead of it.
+ *
+ * Round-12 review finding 1 (CONFIRMED, BLOCKER): `--write-workflow` no
+ * longer makes the transition happen — a file landing on disk is not
+ * evidence CI actually ran, even now that round-13 review finding 2 fixed
+ * the underlying workflow so it CAN run for a foreign repo (see
+ * `renderCodebusWorkflow`'s own comment) — the operator's GitHub-side setup
+ * (secrets, the `graph-publish` environment) is still unverified at the
+ * moment this file is written. `--build`'s own transition-before-build
+ * state-machine requirement (plan's own "Blast radius" note — the
+ * attachment must not sit `pending` while a build has already run) is
+ * unaffected: `--build` transitions unconditionally before it runs, since a
+ * `--build` run is a real, local, end-to-end proof that ingest works, not
+ * merely that a file exists. (Round-13 review finding 3: a genuine CI
+ * ingest arriving while still `pending` now ALSO advances the attachment —
+ * see 0063_graph_content.sql's `graph_ingest_artifact` — which is what
+ * actually closes the loop for the foreign-repo case this fix targets.)
+ *
+ * Round-12 review finding 5 (CONFIRMED, MAJOR): the previous revision
+ * minted the ingest token FIRST, before the workflow validate/write and the
+ * transition — either one failing afterward threw past the point where the
+ * token could ever be printed, leaving an active, unrecoverable plaintext
+ * token that no caller ever saw. Fixed by moving the mint to LAST among the
+ * fallible steps that do not themselves need it — after the workflow write
+ * and the transition, both of which can fail for reasons having nothing to
+ * do with the token, so neither one can waste a mint anymore. The one step
+ * that still runs AFTER the mint is `--build` itself, which cannot run
+ * without a live token to authenticate as — an unavoidable ordering, not an
+ * oversight, so a `--build` failure past this point still throws with the
+ * token embedded directly in the thrown error's message (see below) rather
+ * than silently discarding the only copy the way a bare re-throw would.
+ */
+export async function repoConnectFull(ctx, cfg, url, opts, visibilityChecker = realRepoVisibilityChecker()) {
+    const core = await repoConnectCore(ctx, url, opts);
+    const defaultBranch = opts.branch ?? "main";
+    const result = { ...core, defaultBranch };
+    if (!result.is_authority)
+        return result;
+    // (F4) Validate + write BEFORE transitioning — see the function doc above.
+    if (opts.writeWorkflow) {
+        // Round-12 review finding F1 (CONFIRMED, MAJOR): checked BEFORE the
+        // origin check below (and, transitively, before mint/transition) —
+        // this is a property of the CONNECTED repo alone (owner + GitHub
+        // visibility), independent of the local checkout, so it belongs with
+        // the other fallible-but-side-effect-free preflight checks per the
+        // round-12 "mint last" rule. See assertEligibleForCodebusReusableWorkflow's
+        // own doc for why an ineligible repo's emitted workflow can never
+        // actually run.
+        await assertEligibleForCodebusReusableWorkflow(result.owner, result.name, visibilityChecker);
+        validateOriginMatchesConnectedRepo(opts.repoRoot, result.owner, result.name, "--write-workflow");
+        const workflowPath = join(opts.repoRoot, ".github", "workflows", "codebus.yml");
+        mkdirSync(dirname(workflowPath), { recursive: true });
+        writeFileSync(workflowPath, renderCodebusWorkflow({
+            owner: result.owner,
+            name: result.name,
+            includePrSyncStub: opts.prSync !== false,
+            defaultBranch, // (F6) the workflow's push trigger uses the resolved default branch, not a hardcoded 'main'.
+        }));
+        result.workflowWritten = workflowPath;
+    }
+    // Round-16 review finding 1, part 2 (CONFIRMED, BLOCKER): --build gets
+    // the IDENTICAL origin check, independently of --write-workflow — see
+    // `validateOriginMatchesConnectedRepo`'s own doc for why this must not
+    // be conditioned on --write-workflow having also been passed. Runs here
+    // (before mint, like the --write-workflow check above) so a mismatched
+    // checkout never wastes a mint either.
+    //
+    // Round-17 review finding 1 (CONFIRMED, MAJOR): `resolveTrustedGraph
+    // PublishScript` used to run INSIDE the `if (opts.build)` block below —
+    // i.e. AFTER the mint and the ci_wired transition — so a CLI installation
+    // missing its shipped `dist/kit/graph-publish.mjs` artifact threw a
+    // plain, token-free `CodebusError` at that point, silently discarding the
+    // token the mint just above it had already produced (the exact class of
+    // bug round-14 finding 4 and round-15 finding 2 already closed for the
+    // transition/build-execution failure sites — this was the one remaining
+    // pre-mint-eligible check that hadn't been moved yet). It is a PURE
+    // filesystem check with no side effects of its own, so — like the origin
+    // check immediately above — it belongs here, with the other fallible-
+    // but-safe pre-flight validations, per the round-12 "mint last" rule
+    // (repoConnectFull's own doc above): nothing after this point up to the
+    // mint call itself can still fail for a reason having nothing to do with
+    // the token. `trustedScriptPath` is resolved ONCE here and reused by the
+    // `if (opts.build)` block further below — never re-resolved there — so
+    // there is exactly one call site, not two that could disagree.
+    let trustedScriptPath;
+    if (opts.build) {
+        validateOriginMatchesConnectedRepo(opts.repoRoot, result.owner, result.name, "--build");
+        trustedScriptPath = resolveTrustedGraphPublishScript(import.meta.url);
+    }
+    // Round-12 review finding 5 (CONFIRMED): mint the token BEFORE the
+    // transition below — see the function doc above for why the ordering
+    // among these fallible steps that don't yet need `--build` itself is
+    // (workflow write) -> (mint) -> (transition) -> (build). Round-13 review
+    // finding 3 (CONFIRMED, MAJOR) is exactly why mint now precedes the
+    // transition rather than following it as an earlier revision had it:
+    // minting is itself fallible, and transitioning to `ci_wired` BEFORE a
+    // mint that then fails would leave the database claiming CI is wired
+    // while the operator never received a token to prove it — a second,
+    // narrower instance of the same "don't claim ci_wired for something that
+    // didn't actually succeed" principle round-12 finding 1 established for
+    // `--write-workflow`. `--build` itself still needs a real token to run,
+    // so mint must precede it either way; the only question this fix
+    // answers is mint-vs-transition order, and the answer is mint first.
+    const { data: token, error: tokenErr } = await ctx.supabase.rpc("graph_ingest_token_mint", {
+        p_repo_id: result.repo_id,
+        p_scope: "ingest",
+    });
+    if (tokenErr)
+        throw new CodebusError(`repo connected, but minting an ingest token failed: ${tokenErr.message}`);
+    result.token = String(token);
+    // Round-12 review finding 1 (CONFIRMED): --write-workflow alone no longer
+    // drives this transition — only --build does, since only --build is real
+    // evidence CI (or a local stand-in for it) can actually run. See the
+    // function doc above. Round-13 review finding 3: now gated on the mint
+    // above having already succeeded (see that comment).
+    const wantsTransition = !!opts.build;
+    if (wantsTransition && result.attachment_state === "pending") {
+        const { error: transErr } = await ctx.supabase.rpc("graph_attachment_transition", {
+            p_repo_id: result.repo_id, p_to_state: "ci_wired", p_note: "codebus repo connect",
+        });
+        // Round-14 review finding 4 (CONFIRMED, MAJOR): this throw used to be a
+        // plain, token-free CodebusError — but it runs AFTER the mint above
+        // already succeeded, the exact same "a later failure must never lose
+        // the operator's only copy of the plaintext" hazard PostMintFailureError
+        // exists for. Every post-mint failure site uses it now, not just
+        // --build's.
+        if (transErr)
+            throw new PostMintFailureError(`repo connected and minted an ingest token, but the pending -> ci_wired transition failed: ${transErr.message}`, result.token, "transition");
+        result.transitioned = true;
+    }
+    if (opts.build) {
+        // Suppressed under --json (not one of the raw child-process bytes below,
+        // which stdio:'inherit' cannot redirect without a scope change): this is
+        // OUR OWN informational line, and a --json caller piping stdout to a
+        // parser must see nothing but the final JSON object.
+        if (!opts.json)
+            console.log("\nrunning graphify locally (trusted graph-publish.mjs)...");
+        // Round-16 review finding 1, part 1: the trusted, CLI-shipped script —
+        // never anything inside opts.repoRoot. Round-17 review finding 1:
+        // resolved BEFORE mint now (see above) — the non-null assertion here is
+        // safe by construction: `trustedScriptPath` is only ever left
+        // `undefined` when `opts.build` is falsy, and this whole block only
+        // runs when it's truthy (the SAME condition, checked just above).
+        const scriptPath = trustedScriptPath;
+        const buildEnv = {
+            ...process.env,
+            SUPABASE_URL: cfg.url,
+            SUPABASE_ANON_KEY: cfg.anonKey ?? "",
+            GRAPH_INGEST_TOKEN: result.token,
+            // Round-16 review finding 1: explicit, not inherited — the trusted
+            // script's own boundary/containment check (round-15 review finding 1)
+            // must be anchored at opts.repoRoot regardless of whatever
+            // GITHUB_WORKSPACE/GRAPHIFY_ROOT_BOUNDARY this PROCESS'S OWN
+            // environment happens to carry (`...process.env` above would
+            // otherwise let a stray inherited value leak through unchallenged).
+            // There is no separate "kit" directory to keep graphify away from in
+            // this LOCAL --build path — the trusted script itself lives inside
+            // the CLI's own installation, nowhere near opts.repoRoot — so
+            // workspace root, boundary, and target are all simply opts.repoRoot.
+            GITHUB_WORKSPACE: opts.repoRoot,
+            GRAPHIFY_ROOT_BOUNDARY: opts.repoRoot,
+            GRAPHIFY_REPO_ROOT: ".",
+        };
+        if (opts.json) {
+            // Round-12 review finding 2 (CONFIRMED, BLOCKER): stdio:'inherit' here
+            // let graph-publish.mjs's OWN stdout writes land directly on THIS
+            // process's stdout, ahead of (and mixed into) the single JSON object
+            // connectAction prints once repoConnectFull returns — breaking the
+            // "stdout is exactly one JSON object" contract F3 established the
+            // instant --build was combined with --json. Fixed by piping the
+            // child's stdio instead of inheriting it, capturing everything it
+            // writes, and re-emitting that capture on OUR OWN stderr (never
+            // stdout) — visible to a human watching the terminal, invisible to a
+            // parser reading stdout — while also attaching it to the result as
+            // `buildLog` so a --json caller gets it back structurally too.
+            //
+            // `spawnSync` (not `execFileSync`) deliberately: execFileSync's return
+            // value on a SUCCESSFUL run only ever carries stdout — anything the
+            // child wrote to stderr on a zero exit is not retrievable from it at
+            // all (only a THROWN execFileSync error carries `.stderr`, i.e. only
+            // on a non-zero exit). spawnSync instead always returns
+            // `{stdout, stderr, status}` uniformly regardless of exit code, so a
+            // future warning graph-publish.mjs writes to stderr on an otherwise
+            // successful run is captured here too, not silently dropped.
+            const spawnResult = spawnSync(process.execPath, [scriptPath], { cwd: opts.repoRoot, env: buildEnv, encoding: "utf-8" });
+            const captured = (spawnResult.stdout ?? "") + (spawnResult.stderr ?? "");
+            if (captured)
+                process.stderr.write(captured);
+            result.buildLog = captured || undefined;
+            // Round-13 review finding 7 (CONFIRMED, MAJOR): `spawnResult.status`
+            // is `null` — never `0` — when the child was terminated by a signal
+            // rather than exiting normally (Node sets `.signal` instead, and does
+            // NOT set `.error` for this case; `.error` is reserved for the SPAWN
+            // itself failing, e.g. ENOENT). The previous `(spawnResult.status ??
+            // 0) !== 0` check coalesced that `null` to `0`, so a build killed by
+            // SIGKILL/SIGTERM (OOM, a CI job timeout sending SIGTERM, an operator
+            // Ctrl-C) was reported as a SUCCESSFUL build with `buildRan = true`.
+            // Signal termination is exactly as much a failure as a non-zero exit
+            // code — checked explicitly here, never coalesced away.
+            const buildFailed = !!spawnResult.error || spawnResult.status === null || spawnResult.status !== 0;
+            if (buildFailed) {
+                const reason = spawnResult.error
+                    ? spawnResult.error.message
+                    : spawnResult.status === null
+                        ? `terminated by signal ${spawnResult.signal ?? "unknown"}`
+                        : `exited with status ${spawnResult.status}`;
+                // Round-13 review finding 8 (CONFIRMED, MAJOR): the token is no
+                // longer embedded in this error's `message` — see
+                // `PostMintFailureError`'s own doc (errors.ts) for why. The
+                // mint above already ran, so the token must not disappear silently
+                // just because --json mode's own success path (a single stdout
+                // object) never gets a chance to run; it is carried as structured
+                // data instead, for the caller to render deliberately.
+                throw new PostMintFailureError(`--build failed (${reason}) — see graphify output above (stderr).`, result.token, "build");
+            }
+        }
+        else {
+            try {
+                execFileSync(process.execPath, [scriptPath], { cwd: opts.repoRoot, stdio: "inherit", env: buildEnv });
+            }
+            catch (e) {
+                // graph-publish.mjs already printed its own error (quarantined /
+                // 25MB-reject / build failure) to inherited stdio — surface a plain
+                // non-zero exit rather than re-wrapping and hiding that detail.
+                // execFileSync itself already throws correctly for BOTH a non-zero
+                // exit AND signal termination (round-13 review finding 7 is a
+                // spawnSync-specific bug — execFileSync's own throw-on-any-abnormal-
+                // exit behavior was never affected by it), so no separate signal
+                // check is needed on this branch.
+                const err = e;
+                const reason = err.signal ? `terminated by signal ${err.signal}` : `exited with status ${err.status}`;
+                // (Round-13 review finding 8, see above.)
+                throw new PostMintFailureError(`--build failed (${reason}) — see graphify output above.`, result.token, "build");
+            }
+        }
+        result.buildRan = true;
+    }
+    return result;
+}
+/**
+ * All of `repo connect`'s console output, split out from `connectAction`
+ * (round-12 review finding 6 regression coverage) purely so it can be unit
+ * tested without a live `makeCtx`/network round-trip — `repoConnectFull`
+ * above is the piece that does real work; this is a pure function of an
+ * already-resolved result, exactly parallel to why `repoConnectFull` itself
+ * does no printing (round-11 review finding F3's doc above).
+ */
+export function printConnectResult(result, cfg, json) {
+    // Round-11 review finding F3 (BLOCKER, CONFIRMED): the previous revision
+    // printed the JSON summary FIRST, then unconditionally printed the
+    // plaintext token + gh-secret-set instructions (and, on --build, the
+    // graphify wrapper line) AFTER it regardless of --json — contaminating
+    // machine-readable stdout with free text and never actually including the
+    // token in the JSON object it claimed to be. Fixed: in --json mode this is
+    // the ONLY line ever printed, the token (if any) lives INSIDE this single
+    // object, and nothing follows it. Human mode is entirely separate, below.
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`${result.created ? "created" : "connected"}: ${result.owner}/${result.name} (slug '${result.slug}', ` +
+        `attachment ${result.attachment_state})`);
+    // Round-15 review finding (CONFIRMED, MINOR): `result.slug` above is
+    // ALWAYS the canonical slug repo_connect actually resolved to (never the
+    // requested one echoed back verbatim — see RepoConnectRpcResult's own
+    // doc). When it differs from what was requested, `repo status
+    // <requestedSlug>` would silently find nothing — surface the resolution
+    // explicitly so the operator knows which slug to actually use.
+    if (result.requestedSlug !== result.slug) {
+        console.log(`(requested slug '${result.requestedSlug}' resolved to canonical slug '${result.slug}' — use '${result.slug}' with \`codebus repo status\`)`);
+    }
+    if (!result.is_authority) {
+        console.error("\nrepo connected, but you are not this repo's authority (workspace admin or its designated curator) — " +
+            "cannot mint an ingest token or wire CI from here. Ask an admin to run `codebus repo connect` again, or to " +
+            "grant you curator status, then re-run this command (it is safe to repeat).");
+        return;
+    }
+    // One-time ingest token: printed here, in human mode, exactly once.
+    // Round-12 review finding 6 (CONFIRMED, MAJOR): the previous revision
+    // printed the SAME plaintext token a second time, inline inside the
+    // `gh secret set --body '<token>'` command immediately below it — two
+    // appearances in the same block, contradicting the "print once" contract
+    // round-11 review finding F3 established (that finding was about
+    // --json-vs-human duplication; this is a second, distinct duplication
+    // entirely within human mode's own output). Fixed: the token is shown
+    // exactly once, standalone, and the `gh secret set` line for it references
+    // that value with a placeholder + a stdin pipe (`printf '%s' ... | gh
+    // secret set ... --repo ... --env ...`, no `--body`) rather than repeating
+    // the literal secret inline in a second command.
+    // Round-14 review finding 1 (CONFIRMED, BLOCKER): Bragi-GmbH/CodeBus is a
+    // PRIVATE repo, so the emitted workflow's kit checkout cannot rely on
+    // github.token for any caller other than CodeBus itself — every operator
+    // running --write-workflow against a foreign repo must ALSO set a
+    // CODEBUS_KIT_TOKEN secret (a GitHub PAT/App token with read access to
+    // Bragi-GmbH/CodeBus), or the reusable workflow's own fail-fast check
+    // refuses the run outright. Named here alongside the other required
+    // secrets so an operator sees the complete list in one place, not just
+    // the subset the token-mint step itself happens to produce.
+    console.log("\nOne-time ingest token (store it now — it cannot be retrieved again):\n" +
+        `  ${result.token}\n\n` +
+        "Add it (and the connection details below) as GitHub Environment secrets named 'graph-publish' — pipe the " +
+        "token shown above in rather than pasting it into another command's argv:\n" +
+        `  printf '%s' '<TOKEN-ABOVE>' | gh secret set GRAPH_INGEST_TOKEN --repo ${result.owner}/${result.name} --env graph-publish\n` +
+        `  gh secret set SUPABASE_URL --body '${cfg.url}' --repo ${result.owner}/${result.name} --env graph-publish\n` +
+        `  gh secret set SUPABASE_ANON_KEY --body '${cfg.anonKey ?? "<your anon key>"}' --repo ${result.owner}/${result.name} --env graph-publish\n\n` +
+        "Bragi-GmbH/CodeBus is a PRIVATE repo, so the emitted workflow ALSO needs a GitHub PAT or App token with read " +
+        "access to it (used only to check out CodeBus's own scripts/lockfiles) — set this too, or the workflow refuses to run:\n" +
+        `  gh secret set CODEBUS_KIT_TOKEN --body '<a PAT/App token that can read Bragi-GmbH/CodeBus>' --repo ${result.owner}/${result.name} --env graph-publish`);
+    if (result.transitioned)
+        console.log("attachment: pending -> ci_wired");
+    if (result.workflowWritten)
+        console.log(`wrote ${result.workflowWritten}`);
+}
+/**
+ * Round-13 review finding 8 (CONFIRMED, MAJOR): the ONLY place a
+ * `PostMintFailureError`'s token may ever be rendered — deliberately,
+ * exactly once, matching `printConnectResult`'s own print-once discipline.
+ * If `e` is not this specific error type, it is returned UNCHANGED for the
+ * caller to rethrow as-is (this function performs no printing in that
+ * case, so the generic handler in `cli/src/index.ts` remains the ONLY
+ * thing that ever prints an ordinary error's message).
+ *
+ * In `--json` mode the token still lands on stdout — but wrapped in a
+ * fresh, single JSON object (never free text), so a caller piping stdout
+ * to a JSON parser still sees exactly one parseable object, now shaped as
+ * an error result instead of a success result. In human mode it prints as
+ * a clearly-marked, standalone block, exactly like the success path's own
+ * one-time token block above.
+ *
+ * Round-15 review finding 2 (CONFIRMED, MINOR): the human-mode block used
+ * to hardcode "--build failed" regardless of which post-mint step actually
+ * threw — wrong for the transition-failure site (round-14 finding 4 added
+ * that site; it fails before any build ever starts). The diagnostic is now
+ * built from `e.stage`.
+ *
+ * Always returns a plain `CodebusError` carrying the ORIGINAL message
+ * (never the token) for the caller to throw — that is what reaches
+ * `index.ts`'s generic `console.error(\`error: ${e.message}\`)` handler,
+ * which must never see the plaintext token in anything it prints.
+ */
+export function handleConnectError(e, json) {
+    if (!(e instanceof PostMintFailureError))
+        return e;
+    const stageDescription = e.stage === "transition" ? "the pending -> ci_wired transition failed" : "--build failed";
+    if (json) {
+        console.log(JSON.stringify({ error: e.message, token: e.token, stage: e.stage }, null, 2));
+    }
+    else {
+        console.log(`\n${stageDescription}, but an ingest token WAS minted for this connection before the failure — ` +
+            "store it now, it cannot be retrieved again:\n" +
+            `  ${e.token}\n`);
+    }
+    return new CodebusError(e.message, e.exitCode);
+}
+async function connectAction(url, o) {
+    const cfg = resolveConfig(o);
+    const ctx = await makeCtx(cfg);
+    const repoRoot = o.repoRoot ?? process.cwd();
+    try {
+        const result = await repoConnectFull(ctx, cfg, url, { ...o, repoRoot });
+        printConnectResult(result, cfg, !!o.json);
+    }
+    catch (e) {
+        throw handleConnectError(e, !!o.json);
+    }
+}
+// ── repo status ─────────────────────────────────────────────────────────
+async function statusAction(slug, o) {
+    const ctx = await makeCtx(resolveConfig(o));
+    const ws = await workspaceId(ctx);
+    const rid = await resolveRepoIdBySlug(ctx, ws, slug);
+    if (!rid)
+        throw new CodebusError(`unknown repo: ${slug}`);
+    const { data: statusRows, error: statusErr } = await ctx.supabase
+        .from("graph_status")
+        .select("*")
+        .eq("project_id", rid)
+        .maybeSingle();
+    if (statusErr)
+        throw new CodebusError(statusErr.message);
+    const { data: prRows, error: prErr } = await ctx.supabase
+        .from("pull_requests")
+        .select("status")
+        .eq("repo_id", rid);
+    if (prErr)
+        throw new CodebusError(prErr.message);
+    const prCounts = {};
+    for (const r of prRows ?? [])
+        prCounts[r.status] = (prCounts[r.status] ?? 0) + 1;
+    const result = { slug, graph: statusRows ?? null, pull_requests: prCounts };
+    if (o.json) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    else {
+        console.log(render([{
+                slug,
+                attachment_state: statusRows?.attachment_state ?? "(no attachment)",
+                freshness: statusRows?.freshness ?? "(no graph)",
+                grade: statusRows?.grade ?? "(ungraded)",
+                prs: Object.entries(prCounts).map(([k, v]) => `${k}:${v}`).join(" ") || "(none)",
+            }], { json: false }));
+    }
+}
+// ── repo list ───────────────────────────────────────────────────────────
+/**
+ * Shapes one raw `repos` (+ joined `graph_attachments`) row into `repo
+ * list`'s output row — used for BOTH --json and human-mode, since `render`
+ * (below) feeds the exact same `rows` array to either presentation.
+ *
+ * Round-19 review finding (CONFIRMED, PR #55 comment 3827524459):
+ * `remote_url` used to reach this row (and therefore a terminal or a
+ * --json consumer) verbatim. 0070's own migration deliberately AUDITS
+ * (reports) pre-existing userinfo-bearing remote_url rows rather than
+ * rewriting them in place — a silent server-side rewrite of a column an
+ * operator's own tooling may still expect verbatim was judged the worse
+ * hazard — so its trigger only REJECTS *new* writes; a legacy
+ * `https://token@github.com/...` row from before 0070 existed can
+ * genuinely still be sitting in this table today. `repo list` was the one
+ * remaining place that echoed such a row unredacted. Extracted to its own
+ * function (rather than an inline `.map()` lambda) specifically so this
+ * redaction has a direct unit test against a credential-bearing fixture —
+ * `listAction` itself follows this file's usual convention of being
+ * covered by the real-subprocess integration suite instead, since it does
+ * nothing beyond wiring this shape to a live query and `render`.
+ */
+export function shapeRepoListRow(r) {
+    return {
+        slug: r.slug,
+        remote_url: r.remote_url ? redactUrlUserinfo(r.remote_url) : "(none)",
+        default_branch: r.default_branch,
+        attachment_state: (Array.isArray(r.graph_attachments) ? r.graph_attachments[0]?.state : r.graph_attachments?.state) ?? "(none)",
+    };
+}
+async function listAction(o) {
+    const ctx = await makeCtx(resolveConfig(o));
+    const ws = await workspaceId(ctx);
+    const { data, error } = await ctx.supabase
+        .from("repos")
+        .select("slug, remote_url, default_branch, retired_into, graph_attachments(state)")
+        .eq("workspace_id", ws)
+        .order("slug");
+    if (error)
+        throw new CodebusError(error.message);
+    const rows = (data ?? [])
+        .filter((r) => !r.retired_into)
+        .map(shapeRepoListRow);
+    console.log(render(rows, { json: !!o.json }));
+}
+// ── registration ────────────────────────────────────────────────────────
+export function registerRepo(program, g) {
+    const repo = program.command("repo").description("connect and inspect GitHub repos (CB repo-intelligence)");
+    g(repo.command("connect").argument("<github-url>", "https/ssh GitHub URL, or bare owner/repo"))
+        .option("--slug <slug>", "repo slug within this workspace (default: the repo name)")
+        // Round-11 review finding F6 (CONFIRMED): the plan's own file spec
+        // (docs/plans/repo-intelligence.md A4) names this flag `--default-branch`
+        // — matching the `p_default_branch` RPC parameter it feeds and the
+        // `repos.default_branch` column it lands in — not `--branch`. `--branch`
+        // is kept as a deprecated alias rather than a breaking rename; whichever
+        // is given wins (both given: --default-branch wins), neither given
+        // defaults to 'main' exactly as before.
+        .option("--default-branch <branch>", "default branch (default: main)")
+        .option("--branch <branch>", "deprecated alias for --default-branch")
+        .option("--force", "overwrite an existing, different remote_url (requires workspace admin or curator)")
+        .option("--write-workflow", "write .github/workflows/codebus.yml (only when cwd's origin matches) — does NOT by itself mark the attachment ci_wired; run --build (or a real successful CI ingest, once available) to earn that")
+        .option("--build", "run graphify locally against the freshly minted token — the only thing that transitions the attachment to ci_wired")
+        .option("--no-pr-sync", "omit the (currently disabled) pr-sync job stub from the emitted workflow")
+        .action((url, o) => connectAction(url, { ...o, branch: o.defaultBranch ?? o.branch ?? "main" }));
+    g(repo.command("status").argument("<slug>", "repo slug"))
+        .action((slug, o) => statusAction(slug, o));
+    g(repo.command("list")).action((o) => listAction(o));
+}
+//# sourceMappingURL=repo.js.map