@bugmole/cli 0.4.0

package/src/registry-worker/feedback/routes.ts

@@ -0,0 +1,386 @@
+// In-product bug reports and feedback: stored in the registry (screenshots in
+// the artifacts bucket), and filed as GitHub issues on the product repo from
+// the outbox. A repeat of the same problem within a week comments on the
+// existing issue instead of opening another.
+import { githubAppConfigured, githubRequest, GithubAppError, type GithubAppEnv } from "../../integrations/github-app.js";
+import type { Env, Principal } from "../core.js";
+import { constantTimeEqual, newId, requestJson, response, sha256 } from "../core.js";
+import { getWorkspacePlan } from "../billing/entitlements.js";
+import { flagOn } from "../flags.js";
+import { recordAudit } from "../org/audit.js";
+import { drainSoon, enqueue, PermanentDeliveryError, registerOutboxHandler } from "../notifications/outbox.js";
+import { matchPath, registerPublicRoutes, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import { cleanConsole, cleanNetwork, fingerprintOf, formatIssue, redactSecrets, redactUrl, type IssueReport } from "./format.js";
+
+export type FeedbackEnv = GithubAppEnv & {
+  /** The product repository issues are filed on, e.g. "theaiinc/bugmole". */
+  BUGMOLE_FEEDBACK_REPO?: string;
+  /** The Bugmole GitHub App's installation id on that repository. */
+  BUGMOLE_FEEDBACK_INSTALLATION_ID?: string;
+  /** Comma-separated Aegis ids allowed to triage reports. */
+  PLATFORM_STAFF_IDS?: string;
+  /** Comma-separated emails allowed to triage reports, once Aegis has verified them. */
+  PLATFORM_STAFF_EMAILS?: string;
+  SECRETS_ENCRYPTION_KEY?: string;
+};
+
+export const RATE_LIMIT_PER_HOUR = 10;
+export const IP_LIMIT_PER_HOUR = 30;
+const MAX_TEXT = 5_000;
+const MAX_IMAGE_BYTES = 5 * 1024 * 1024;
+const MAX_IMAGES = 4;
+const DUPLICATE_WINDOW_MS = 7 * 86_400_000;
+const SCREENSHOT_LINK_TTL_MS = 180 * 86_400_000;
+
+function feedbackEnv(env: Env): Env & FeedbackEnv {
+  return env as Env & FeedbackEnv;
+}
+
+function text(value: unknown, max = MAX_TEXT): string {
+  return typeof value === "string" ? value.trim().slice(0, max) : "";
+}
+
+function isPerson(principal: Principal): boolean {
+  // Reports come from people signed in on the dashboard, not keys or runners.
+  return principal.scopes.includes("*") && !principal.apiKeyId && !principal.runner && principal.aegisId !== "bugmole-dashboard-service";
+}
+
+function listOf(value: string | undefined): string[] {
+  return (value ?? "").split(",").map((item) => item.trim().toLowerCase()).filter(Boolean);
+}
+
+function staff(env: Env, principal: Principal): boolean {
+  if (!isPerson(principal)) return false;
+  if (listOf(feedbackEnv(env).PLATFORM_STAFF_IDS).includes(principal.aegisId.toLowerCase())) return true;
+  return Boolean(principal.email && principal.emailVerified
+    && listOf(feedbackEnv(env).PLATFORM_STAFF_EMAILS).includes(principal.email.toLowerCase()));
+}
+
+type DecodedImage = { bytes: Uint8Array; type: string };
+
+export function decodeImage(value: unknown): DecodedImage | null {
+  if (typeof value !== "string") return null;
+  const match = /^data:(image\/(?:png|jpeg|webp|gif));base64,([A-Za-z0-9+/=]+)$/.exec(value);
+  if (!match) return null;
+  if ((match[2].length * 3) / 4 > MAX_IMAGE_BYTES) return null;
+  try {
+    return { type: match[1], bytes: Uint8Array.from(atob(match[2]), (char) => char.charCodeAt(0)) };
+  } catch {
+    return null;
+  }
+}
+
+async function screenshotSignature(env: Env, key: string, expires: number): Promise<string> {
+  const secret = feedbackEnv(env).SECRETS_ENCRYPTION_KEY;
+  if (!secret) throw new Error("SECRETS_ENCRYPTION_KEY is not configured");
+  return (await sha256(`feedback-image:${secret}:${key}:${expires}`)).slice(0, 40);
+}
+
+/** A link GitHub can load (it proxies images), without making the bucket public. */
+export async function signedScreenshotUrl(env: Env, reportId: string, index: number, now = Date.now()): Promise<string> {
+  const expires = now + SCREENSHOT_LINK_TTL_MS;
+  const signature = await screenshotSignature(env, `${reportId}/${index}`, expires);
+  const base = (feedbackEnv(env).REGISTRY_PUBLIC_URL || "https://api.bugmole.com").replace(/\/$/, "");
+  return `${base}/api/feedback/${encodeURIComponent(reportId)}/images/${index}?${new URLSearchParams({ expires: String(expires), sig: signature })}`;
+}
+
+async function submit({ env, principal, request, ctx }: AuthedRouteContext): Promise<Response> {
+  if (!isPerson(principal)) return response({ error: "Sign in on the dashboard to send feedback" }, 403);
+  const body = await requestJson(request);
+  const kind = body?.kind;
+  if (kind !== "bug" && kind !== "feedback") return response({ error: "kind must be bug or feedback" }, 422);
+  const payload = (body?.payload ?? {}) as Record<string, unknown>;
+  const message = text(kind === "bug" ? payload.description : payload.comment);
+  if (!message) return response({ error: kind === "bug" ? "Describe what happened" : "Write a comment" }, 422);
+  const rating = kind === "feedback" ? Number(payload.rating) : null;
+  if (kind === "feedback" && (!Number.isInteger(rating) || rating! < 1 || rating! > 5)) return response({ error: "rating must be 1 to 5" }, 422);
+
+  const ip = (request.headers.get("x-forwarded-for") ?? "").split(",")[0].trim() || null;
+  const hourAgo = new Date(Date.now() - 3_600_000).toISOString().replace("T", " ").slice(0, 19);
+  const recent = await env.DB.prepare(`
+    SELECT SUM(CASE WHEN aegis_id = ? THEN 1 ELSE 0 END) AS mine, SUM(CASE WHEN ip IS NOT NULL AND ip = ? THEN 1 ELSE 0 END) AS fromIp
+    FROM feedback_reports WHERE created_at > ?
+  `).bind(principal.aegisId, ip, hourAgo).first<{ mine: number | null; fromIp: number | null }>();
+  if ((recent?.mine ?? 0) >= RATE_LIMIT_PER_HOUR || (ip && (recent?.fromIp ?? 0) >= IP_LIMIT_PER_HOUR)) {
+    return response({ error: "Thanks — that's a lot of reports in an hour. Please try again a bit later." }, 429);
+  }
+
+  const images = (kind === "bug" ? [payload.screenshot] : Array.isArray(payload.images) ? payload.images : []).filter(Boolean).slice(0, MAX_IMAGES);
+  const decoded = images.map(decodeImage);
+  if (decoded.some((image) => image === null)) return response({ error: "Images must be PNG, JPEG, WebP or GIF, up to 5 MB each" }, 422);
+
+  const workspaceId = text(body?.workspaceId, 100) || null;
+  const projectId = text(body?.projectId, 100) || null;
+  const runId = text(body?.runId, 100) || null;
+  // Context is only recorded for things the reporter can actually see.
+  const workspace = workspaceId
+    ? await env.DB.prepare(`
+        SELECT w.id, w.name FROM workspaces w JOIN workspace_memberships m ON m.workspace_id = w.id
+        WHERE w.id = ? AND m.aegis_id = ? AND m.status = 'active'
+      `).bind(workspaceId, principal.aegisId).first<{ id: string; name: string }>()
+    : null;
+  const project = projectId && workspace
+    ? await env.DB.prepare("SELECT id FROM projects WHERE id = ? AND workspace_id = ?").bind(projectId, workspace.id).first<{ id: string }>()
+    : null;
+  const run = runId && project
+    ? await env.DB.prepare("SELECT id FROM runs WHERE id = ? AND project_id = ?").bind(runId, project.id).first<{ id: string }>()
+    : null;
+  const plan = workspace ? (await getWorkspacePlan(env, workspace.id)).plan : null;
+
+  const consoleLogs = cleanConsole(payload.consoleLogs);
+  const networkLogs = cleanNetwork(payload.networkLogs);
+  const page = text(body?.page, 2_000) ? redactUrl(text(body?.page, 2_000)) : null;
+  const environment = payload.environment && typeof payload.environment === "object" ? payload.environment as Record<string, unknown> : null;
+  const id = newId("fb");
+  const fingerprint = await fingerprintOf(kind, message, page, consoleLogs);
+  const screenshotKeys: string[] = [];
+  // Without a bucket the report still matters more than its pictures.
+  const imagesDropped = decoded.length > 0 && !env.ARTIFACTS;
+  if (decoded.length && env.ARTIFACTS) {
+    for (const [index, image] of decoded.entries()) {
+      const key = `feedback/${id}/${index}`;
+      await env.ARTIFACTS.put(key, image!.bytes, { httpMetadata: { contentType: image!.type } });
+      screenshotKeys.push(key);
+    }
+  }
+  const data = {
+    ...(imagesDropped ? { imagesDropped: decoded.length } : {}),
+    expectation: kind === "bug" ? redactSecrets(text(payload.expectation)) || undefined : undefined,
+    console: consoleLogs,
+    network: networkLogs,
+    environment: environment ? {
+      url: typeof environment.url === "string" ? redactUrl(environment.url) : undefined,
+      userAgent: text(environment.userAgent, 300) || undefined,
+      platform: text(environment.platform, 50) || undefined,
+      language: text(environment.language, 20) || undefined,
+      windowWidth: Number(environment.windowWidth) || undefined,
+      windowHeight: Number(environment.windowHeight) || undefined,
+    } : undefined,
+    annotations: Array.isArray(payload.annotations)
+      ? (payload.annotations as Array<Record<string, unknown>>).slice(0, 20).map((note) => ({ number: Number(note.number) || 0, note: text(note.note, 500) || undefined }))
+      : undefined,
+  };
+  await env.DB.prepare(`
+    INSERT INTO feedback_reports (id, aegis_id, workspace_id, project_id, run_id, kind, rating, category, message, page, plan, contact, data_json, screenshot_keys_json, fingerprint, ip)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).bind(
+    id, principal.aegisId, workspace?.id ?? null, project?.id ?? null, run?.id ?? null, kind, rating,
+    kind === "feedback" ? text(payload.category, 100) || null : null,
+    redactSecrets(message), page, plan,
+    kind === "feedback" ? redactSecrets(text(payload.contactInfo, 300)) || null : null,
+    JSON.stringify(data), JSON.stringify(screenshotKeys), fingerprint, ip,
+  ).run();
+  if (workspace) {
+    await recordAudit(env, { type: "user", id: principal.aegisId }, { workspaceId: workspace.id, projectId: project?.id ?? null, action: "feedback.submitted", targetType: "feedback", targetId: id, data: { kind } }, request);
+  }
+
+  if (await flagOn(env, workspace?.id ?? null, "feedback")) {
+    const since = new Date(Date.now() - DUPLICATE_WINDOW_MS).toISOString().replace("T", " ").slice(0, 19);
+    const original = await env.DB.prepare(`
+      SELECT id, github_issue_number AS issue FROM feedback_reports
+      WHERE fingerprint = ? AND id != ? AND duplicate_of IS NULL AND created_at > ? AND status != 'closed'
+      ORDER BY created_at ASC LIMIT 1
+    `).bind(fingerprint, id, since).first<{ id: string; issue: number | null }>();
+    if (original) {
+      await env.DB.prepare("UPDATE feedback_reports SET duplicate_of = ? WHERE id = ?").bind(original.id, id).run();
+      await enqueue(env, "feedback.issue.comment", { reportId: id, originalId: original.id }, { dedupeKey: `feedback-comment:${id}` });
+    } else {
+      await enqueue(env, "feedback.issue.create", { reportId: id }, { dedupeKey: `feedback-issue:${id}` });
+    }
+    drainSoon(env, ctx);
+  }
+  return response({ id }, 201);
+}
+
+async function mine({ env, principal }: AuthedRouteContext): Promise<Response> {
+  if (!isPerson(principal)) return response({ error: "Not allowed" }, 403);
+  const rows = await env.DB.prepare(`
+    SELECT r.id, r.kind, r.message, r.created_at AS createdAt,
+           COALESCE(o.status, r.status) AS status, COALESCE(o.closed_at, r.closed_at) AS closedAt
+    FROM feedback_reports r LEFT JOIN feedback_reports o ON o.id = r.duplicate_of
+    WHERE r.aegis_id = ? ORDER BY r.created_at DESC LIMIT 50
+  `).bind(principal.aegisId).all();
+  return response({ reports: rows.results });
+}
+
+async function triage({ env, principal, url }: AuthedRouteContext): Promise<Response> {
+  if (!staff(env, principal)) return response({ error: "Not found" }, 404);
+  const status = url.searchParams.get("status");
+  const kind = url.searchParams.get("kind");
+  const rows = await env.DB.prepare(`
+    SELECT r.id, r.kind, r.rating, r.category, r.message, r.page, r.plan, r.status, r.duplicate_of AS duplicateOf,
+           r.github_issue_url AS issueUrl, r.created_at AS createdAt, w.name AS workspaceName
+    FROM feedback_reports r LEFT JOIN workspaces w ON w.id = r.workspace_id
+    WHERE (? IS NULL OR r.status = ?) AND (? IS NULL OR r.kind = ?)
+    ORDER BY r.created_at DESC LIMIT 200
+  `).bind(status, status, kind, kind).all();
+  return response({ reports: rows.results });
+}
+
+async function issueState({ env, principal, request }: AuthedRouteContext): Promise<Response> {
+  if (principal.aegisId !== "bugmole-dashboard-service" || !principal.scopes.includes("*")) return response({ error: "Not allowed" }, 403);
+  const body = await requestJson(request);
+  const repo = text(body?.repo, 200).toLowerCase();
+  const issueNumber = Number(body?.issueNumber);
+  const state = body?.state === "closed" ? "closed" : body?.state === "open" ? "open" : null;
+  const configured = (feedbackEnv(env).BUGMOLE_FEEDBACK_REPO ?? "").toLowerCase();
+  if (!state || !Number.isInteger(issueNumber) || !configured || repo !== configured) return response({ updated: 0 });
+  const rows = await env.DB.prepare("SELECT id, aegis_id AS aegisId, status, kind, message, duplicate_of AS duplicateOf FROM feedback_reports WHERE github_issue_number = ?")
+    .bind(issueNumber).all<{ id: string; aegisId: string; status: string; kind: string; message: string; duplicateOf: string | null }>();
+  for (const report of rows.results) {
+    const next = state === "closed" ? "closed" : "open";
+    if (report.status === next) continue;
+    await env.DB.prepare("UPDATE feedback_reports SET status = ?, closed_at = ? WHERE id = ?")
+      .bind(next, next === "closed" ? new Date().toISOString() : null, report.id).run();
+    if (next === "closed" && !report.duplicateOf) {
+      // Everyone who reported it (the original and its duplicates) hears it was dealt with.
+      const people = await env.DB.prepare(`
+        SELECT DISTINCT u.email FROM feedback_reports r JOIN aegis_users u ON u.id = r.aegis_id
+        WHERE (r.id = ? OR r.duplicate_of = ?) AND u.email IS NOT NULL
+      `).bind(report.id, report.id).all<{ email: string }>();
+      for (const person of people.results) {
+        await enqueue(env, "email.message", {
+          to: [{ email: person.email }],
+          subject: report.kind === "bug" ? "The bug you reported has been fixed or closed" : "Thanks — we've acted on your feedback",
+          text: `You wrote: "${report.message.slice(0, 200)}"\n\nWe've closed it. If the problem is still there, report it again from the dashboard.`,
+          html: `<p>You wrote: “${report.message.slice(0, 200).replace(/[&<>"]/g, (char) => `&#${char.charCodeAt(0)};`)}”</p><p>We've closed it. If the problem is still there, report it again from the dashboard.</p>`,
+          tag: "feedback-closed",
+        }, { dedupeKey: `feedback-closed:${report.id}:${person.email}` });
+      }
+    }
+  }
+  return response({ updated: rows.results.length });
+}
+
+registerRoutes(async (context) => {
+  const { request, url } = context;
+  if (url.pathname === "/api/feedback" && request.method === "POST") return submit(context);
+  if (url.pathname === "/api/feedback/mine" && request.method === "GET") return mine(context);
+  if (url.pathname === "/api/admin/feedback" && request.method === "GET") return triage(context);
+  if (url.pathname === "/api/feedback/issue-state" && request.method === "POST") return issueState(context);
+  return null;
+});
+
+// GitHub fetches screenshots from the issue body; the signature is the only key.
+registerPublicRoutes(async ({ request, env, url }) => {
+  const params = matchPath(url.pathname, "/api/feedback/:reportId/images/:index");
+  if (!params || request.method !== "GET") return null;
+  const expires = Number(url.searchParams.get("expires"));
+  const signature = url.searchParams.get("sig") ?? "";
+  const key = `${params.reportId}/${params.index}`;
+  if (!Number.isFinite(expires) || expires < Date.now() || !feedbackEnv(env).SECRETS_ENCRYPTION_KEY
+    || !constantTimeEqual(signature, await screenshotSignature(env, key, expires))) {
+    return new Response("Not found", { status: 404 });
+  }
+  const object = await env.ARTIFACTS?.get(`feedback/${key}`);
+  if (!object) return new Response("Not found", { status: 404 });
+  return new Response(object.body, {
+    headers: {
+      "content-type": object.httpMetadata?.contentType ?? "image/png",
+      "cache-control": "private, max-age=86400",
+      "x-content-type-options": "nosniff",
+      "content-security-policy": "default-src 'none'",
+    },
+  });
+});
+
+// --- Filing issues ---------------------------------------------------------------------------
+
+function target(env: Env): { repo: string; installationId: number } {
+  const repo = feedbackEnv(env).BUGMOLE_FEEDBACK_REPO;
+  const installationId = Number(feedbackEnv(env).BUGMOLE_FEEDBACK_INSTALLATION_ID);
+  if (!repo || !Number.isInteger(installationId) || !githubAppConfigured(feedbackEnv(env))) {
+    throw new PermanentDeliveryError("Feedback issues aren't configured (BUGMOLE_FEEDBACK_REPO, BUGMOLE_FEEDBACK_INSTALLATION_ID, GitHub App)");
+  }
+  return { repo, installationId };
+}
+
+const LABELS = [
+  { name: "feedback", color: "7057ff", description: "Sent from the Bugmole dashboard" },
+  { name: "bug", color: "d73a4a", description: "Something isn't working" },
+];
+const labelsReady = new Set<string>();
+
+async function ensureLabels(env: Env, repo: string, installationId: number): Promise<void> {
+  if (labelsReady.has(repo)) return;
+  for (const label of LABELS) {
+    try {
+      await githubRequest(feedbackEnv(env), installationId, "GET", `/repos/${repo}/labels/${encodeURIComponent(label.name)}`);
+    } catch (error) {
+      if (!(error instanceof GithubAppError) || error.status !== 404) throw error;
+      await githubRequest(feedbackEnv(env), installationId, "POST", `/repos/${repo}/labels`, label).catch((reason) => {
+        // Someone else created it in the meantime.
+        if (!(reason instanceof GithubAppError) || reason.status !== 422) throw reason;
+      });
+    }
+  }
+  labelsReady.add(repo);
+}
+
+async function issueReport(env: Env, reportId: string): Promise<IssueReport | null> {
+  const row = await env.DB.prepare(`
+    SELECT r.*, w.name AS workspace_name FROM feedback_reports r LEFT JOIN workspaces w ON w.id = r.workspace_id WHERE r.id = ?
+  `).bind(reportId).first<Record<string, any>>();
+  if (!row) return null;
+  const data = JSON.parse(row.data_json || "{}");
+  const keys = JSON.parse(row.screenshot_keys_json || "[]") as string[];
+  const dashboard = (env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "");
+  return {
+    id: row.id,
+    kind: row.kind,
+    message: row.message,
+    expectation: data.expectation,
+    rating: row.rating ?? undefined,
+    category: row.category ?? undefined,
+    contact: row.contact ?? undefined,
+    page: row.page,
+    workspace: row.workspace_id ? { id: row.workspace_id, name: row.workspace_name ?? row.workspace_id, plan: row.plan ?? "free" } : null,
+    runUrl: row.run_id ? `${dashboard}/runs?${new URLSearchParams({ project: row.project_id, run: row.run_id })}` : null,
+    environment: data.environment ?? null,
+    screenshotUrls: await Promise.all(keys.map((_, index) => signedScreenshotUrl(env, row.id, index))),
+    console: data.console ?? [],
+    network: data.network ?? [],
+    fingerprint: row.fingerprint,
+    submittedAt: String(row.created_at),
+  };
+}
+
+function permanent(error: unknown): never {
+  if (error instanceof GithubAppError && [401, 403, 404, 410, 422].includes(error.status)) throw new PermanentDeliveryError(error.message);
+  throw error;
+}
+
+registerOutboxHandler("feedback.issue.create", async (env, payload: { reportId: string }) => {
+  const report = await issueReport(env, payload.reportId);
+  const existing = await env.DB.prepare("SELECT github_issue_number AS issue FROM feedback_reports WHERE id = ?").bind(payload.reportId).first<{ issue: number | null }>();
+  if (!report || existing?.issue) return;
+  const { repo, installationId } = target(env);
+  try {
+    await ensureLabels(env, repo, installationId);
+    const issue = formatIssue(report);
+    const created = await githubRequest<{ number: number; html_url: string }>(feedbackEnv(env), installationId, "POST", `/repos/${repo}/issues`, issue);
+    await env.DB.prepare("UPDATE feedback_reports SET github_issue_number = ?, github_issue_url = ?, status = 'open' WHERE id = ?")
+      .bind(created.number, created.html_url, payload.reportId).run();
+  } catch (error) {
+    permanent(error);
+  }
+});
+
+registerOutboxHandler("feedback.issue.comment", async (env, payload: { reportId: string; originalId: string }) => {
+  const original = await env.DB.prepare("SELECT github_issue_number AS issue FROM feedback_reports WHERE id = ?").bind(payload.originalId).first<{ issue: number | null }>();
+  // The original's issue may not exist yet; retry until it does.
+  if (!original?.issue) throw new Error("The original report's issue isn't filed yet");
+  const report = await issueReport(env, payload.reportId);
+  if (!report) return;
+  const { repo, installationId } = target(env);
+  const { body } = formatIssue(report);
+  try {
+    await githubRequest(feedbackEnv(env), installationId, "POST", `/repos/${repo}/issues/${original.issue}/comments`, {
+      body: `**Reported again** (same problem, report \`${report.id}\`)\n\n${body}`,
+    });
+    await env.DB.prepare("UPDATE feedback_reports SET github_issue_number = ?, status = 'open' WHERE id = ?").bind(original.issue, payload.reportId).run();
+  } catch (error) {
+    permanent(error);
+  }
+});
+

package/src/registry-worker/flags.ts

@@ -0,0 +1,39 @@
+// Feature flags for the gap-closing rollout. A global var turns a feature on
+// for everyone ("on"), or leaves it to per-workspace opt-in ("beta", the
+// default); "off" disables it even for opted-in workspaces.
+
+export const FEATURES = [
+  "entitlements",
+  "cloud_runners",
+  "billing",
+  "pr_checks",
+  "slack",
+  "teams",
+  "device_clouds",
+  "sso",
+  "feedback",
+  "mcp",
+] as const;
+export type Feature = (typeof FEATURES)[number];
+
+export type FlagEnv = {
+  DB: D1Database;
+  [key: `FEATURE_${string}`]: string | undefined;
+};
+
+export type FlagMode = "on" | "beta" | "off" | "shadow";
+
+export function flagMode(env: FlagEnv, feature: Feature): FlagMode {
+  const raw = (env[`FEATURE_${feature.toUpperCase()}`] ?? "beta").trim().toLowerCase();
+  return raw === "on" || raw === "off" || raw === "shadow" ? raw : "beta";
+}
+
+export async function flagOn(env: FlagEnv, workspaceId: string | null | undefined, feature: Feature): Promise<boolean> {
+  const mode = flagMode(env, feature);
+  if (mode === "on") return true;
+  if (mode === "off" || mode === "shadow" || !workspaceId) return false;
+  const row = await env.DB.prepare(
+    "SELECT enabled FROM workspace_flags WHERE workspace_id = ? AND flag = ?",
+  ).bind(workspaceId, feature).first<{ enabled: number }>();
+  return row?.enabled === 1;
+}

package/src/registry-worker/github/checks.test.ts

@@ -0,0 +1,177 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { generateKeyPairSync } from "node:crypto";
+import type { Env } from "../core.js";
+import { call, createTestEnv, seedPlan, seedProject } from "../testing/harness.js";
+import { drainOutbox } from "../notifications/outbox.js";
+import { parseGithubEvent, previewUrl } from "./checks.js";
+
+const SHA = "a".repeat(40);
+const privateKey = generateKeyPairSync("rsa", { modulusLength: 2048 }).privateKey.export({ type: "pkcs1", format: "pem" }).toString();
+
+function fakeGithub() {
+  const state = { checks: new Map<number, any>(), calls: [] as Array<{ method: string; path: string; body: any }>, next: 100, failWith: 0 };
+  const doFetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+    const url = new URL(String(input));
+    const body = init?.body ? JSON.parse(String(init.body)) : null;
+    state.calls.push({ method: init?.method ?? "GET", path: url.pathname, body });
+    if (url.pathname.endsWith("/access_tokens")) return Response.json({ token: "ghs_x", expires_at: new Date(Date.now() + 3_600_000).toISOString() }, { status: 201 });
+    if (state.failWith) return new Response("nope", { status: state.failWith });
+    if (init?.method === "POST" && url.pathname.endsWith("/check-runs")) {
+      const id = state.next++;
+      state.checks.set(id, { ...body });
+      return Response.json({ id, html_url: `https://github.com/check/${id}` }, { status: 201 });
+    }
+    const match = url.pathname.match(/\/check-runs\/(\d+)$/);
+    if (init?.method === "PATCH" && match) {
+      Object.assign(state.checks.get(Number(match[1])), body);
+      return Response.json({ id: Number(match[1]) });
+    }
+    return new Response("not found", { status: 404 });
+  }) as unknown as typeof fetch;
+  return { state, doFetch };
+}
+
+async function setup(gh: ReturnType<typeof fakeGithub>, plan = "team") {
+  const created = createTestEnv({
+    FEATURE_PR_CHECKS: "on",
+    GITHUB_APP_ID: "1",
+    GITHUB_APP_PRIVATE_KEY: privateKey,
+    GITHUB_FETCH: gh.doFetch,
+    DASHBOARD_URL: "https://dash.test",
+  } as Partial<Env>);
+  const project = await seedProject(created.env);
+  created.db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, ?)").run(project.workspaceId, plan);
+  await seedPlan(created.env, project.projectId, project.owner, "checkout");
+  await seedPlan(created.env, project.projectId, project.owner, "signup");
+  await call(created.env, "POST", `/api/projects/${project.projectId}/github-installations`, {
+    as: project.owner,
+    body: { installationId: 42, accountLogin: "acme", accountType: "Organization", repositorySelection: "selected", repositories: [{ owner: "acme", repo: "shop" }] },
+  });
+  const event = (body: Record<string, unknown>) => call(created.env, "POST", "/api/github/events", {
+    headers: { "x-aegis-id": "bugmole-dashboard-service", "x-aegis-secret": "test-service-secret" },
+    body,
+  });
+  return { ...created, ...project, event };
+}
+
+test("preview URLs and forwarded events are checked before use", () => {
+  assert.equal(previewUrl("https://pr-{number}.preview.acme.test", { number: 12, sha: SHA }), "https://pr-12.preview.acme.test/");
+  assert.equal(previewUrl("https://{branch}--shop.pages.dev/", { sha: SHA, branch: "Feature/Checkout Flow" }), "https://feature-checkout-flow--shop.pages.dev/");
+  assert.equal(previewUrl("https://x.test/{short_sha}", { sha: SHA }), "https://x.test/aaaaaaa");
+  assert.equal(previewUrl("https://pr-{number}.test", { sha: SHA }), null);
+  assert.equal(previewUrl("javascript:{sha}", { sha: SHA }), null);
+
+  assert.deepEqual(parseGithubEvent({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA.toUpperCase(), prNumber: 7, branch: "main" }),
+    { type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 7, branch: "main" });
+  assert.equal(parseGithubEvent({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: "short", prNumber: 7 }), null);
+  assert.equal(parseGithubEvent({ type: "pull_request", installationId: 42, repo: "../etc", sha: SHA, prNumber: 7 }), null);
+  assert.equal(parseGithubEvent({ type: "deployment", installationId: 42, repo: "acme/shop", sha: SHA, url: "file:///etc/passwd" }), null);
+  assert.equal(parseGithubEvent({ type: "push", installationId: 42, repo: "acme/shop", sha: SHA }), null);
+});
+
+test("only the dashboard's service identity can forward GitHub events", async () => {
+  const gh = fakeGithub();
+  const { env, owner } = await setup(gh);
+  const body = { type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 7 };
+  assert.equal((await call(env, "POST", "/api/github/events", { as: owner, body })).status, 403);
+});
+
+test("a pull request runs the chosen plans against its preview and reports each as a check", async () => {
+  const gh = fakeGithub();
+  const { env, db, projectId, owner, event } = await setup(gh);
+  const bind = await call(env, "POST", `/api/projects/${projectId}/repo-bindings`, {
+    as: owner,
+    body: { repo: "acme/shop", installationId: 42, planIds: ["checkout"], baseUrlTemplate: "https://pr-{number}.preview.acme.test", executionMode: "self" },
+  });
+  assert.equal(bind.status, 201, JSON.stringify(bind.json));
+
+  const started = await event({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 7, branch: "feature" });
+  assert.equal(started.json.started.length, 1, "only the chosen plan");
+  const again = await event({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 7 });
+  assert.deepEqual(again.json.started, started.json.started, "a redelivered webhook doesn't start a second run");
+  const runId = started.json.started[0];
+  const run = db.db.prepare("SELECT environment_base_url AS url, commit_sha AS sha, pr_number AS pr, execution_mode AS mode FROM runs WHERE id = ?").get(runId) as any;
+  assert.deepEqual({ ...run }, { url: "https://pr-7.preview.acme.test/", sha: SHA, pr: 7, mode: "self" });
+
+  await drainOutbox(env);
+  const [checkId] = [...gh.state.checks.keys()];
+  assert.equal(gh.state.checks.size, 1);
+  assert.deepEqual({ name: gh.state.checks.get(checkId).name, sha: gh.state.checks.get(checkId).head_sha, status: gh.state.checks.get(checkId).status },
+    { name: "Bugmole: checkout", sha: SHA, status: "queued" });
+  assert.match(gh.state.checks.get(checkId).details_url, /dash\.test\/runs\?project=shop&run=/);
+  const create = gh.state.calls.find((c) => c.path.endsWith("/check-runs"))!;
+  assert.equal(create.path, "/repos/acme/shop/check-runs");
+
+  await call(env, "POST", `/api/runs/${runId}/claim`, { as: owner, body: { workerId: "w1" } });
+  await drainOutbox(env);
+  assert.equal(gh.state.checks.get(checkId).status, "in_progress");
+  await call(env, "POST", `/api/runs/${runId}`, { as: owner, body: { workerId: "w1", status: "error", stepsPassed: 2, stepsFailed: 1, errorMessage: "Payment never appeared" } });
+  await drainOutbox(env);
+  const done = gh.state.checks.get(checkId);
+  assert.equal(done.status, "completed");
+  assert.equal(done.conclusion, "failure");
+  assert.match(done.output.summary, /2 steps passed, 1 failed on https:\/\/pr-7\.preview\.acme\.test\//);
+  assert.match(done.output.summary, /> Payment never appeared/);
+
+  // "Re-run" on GitHub starts a fresh run against the same commit and preview.
+  const rerun = await event({ type: "check_rerun", installationId: 42, repo: "acme/shop", checkRunId: checkId });
+  assert.equal(rerun.json.started.length, 1);
+  assert.notEqual(rerun.json.started[0], runId);
+  const second = db.db.prepare("SELECT environment_base_url AS url, commit_sha AS sha FROM runs WHERE id = ?").get(rerun.json.started[0]) as any;
+  assert.deepEqual({ ...second }, { url: "https://pr-7.preview.acme.test/", sha: SHA });
+  await drainOutbox(env);
+  assert.equal(gh.state.checks.size, 2);
+});
+
+test("a successful deployment runs every plan against the deployed URL", async () => {
+  const gh = fakeGithub();
+  const { env, db, projectId, owner, event } = await setup(gh);
+  await call(env, "POST", `/api/projects/${projectId}/repo-bindings`, { as: owner, body: { repo: "acme/shop", installationId: 42, trigger: "deployment", executionMode: "self" } });
+  assert.equal((await event({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 3 })).json.started.length, 0, "not bound to pull requests");
+  const started = await event({ type: "deployment", installationId: 42, repo: "acme/shop", sha: SHA, url: "https://shop-git-abc.vercel.app" });
+  assert.equal(started.json.started.length, 2);
+  const urls = db.db.prepare("SELECT DISTINCT environment_base_url AS url FROM runs").all() as any[];
+  assert.deepEqual(urls.map((row) => row.url), ["https://shop-git-abc.vercel.app"]);
+});
+
+test("checks need a paid plan, a connected repository, and managers to set them up", async () => {
+  const gh = fakeGithub();
+  const free = await setup(gh, "free");
+  const refused = await call(free.env, "POST", `/api/projects/${free.projectId}/repo-bindings`, { as: free.owner, body: { repo: "acme/shop", installationId: 42 } });
+  assert.equal(refused.status, 402);
+
+  const { env, projectId, owner, event, db } = await setup(gh);
+  const add = (body: Record<string, unknown>, as = owner) => call(env, "POST", `/api/projects/${projectId}/repo-bindings`, { as, body });
+  assert.equal((await add({ repo: "acme/other", installationId: 42 })).status, 422, "repository not connected");
+  assert.equal((await add({ repo: "acme/shop", installationId: 99 })).status, 422, "someone else's installation");
+  assert.equal((await add({ repo: "acme/shop", installationId: 42, baseUrlTemplate: "ftp://{number}" })).status, 422);
+  assert.equal((await add({ repo: "acme/shop", installationId: 42 }, "user_stranger")).status, 403);
+  const ok = await add({ repo: "acme/shop", installationId: 42, executionMode: "self" });
+  assert.equal(ok.status, 201);
+  assert.equal((await add({ repo: "acme/shop", installationId: 42 })).status, 409);
+
+  // Downgraded to Free: events are ignored rather than starting runs nobody paid for.
+  db.db.prepare("UPDATE workspace_plans SET plan = 'free'").run();
+  assert.equal((await event({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 1 })).json.started.length, 0);
+  db.db.prepare("UPDATE workspace_plans SET plan = 'team'").run();
+  // The installation is removed from GitHub: nothing starts.
+  db.db.prepare("UPDATE github_installations SET revoked_at = CURRENT_TIMESTAMP").run();
+  assert.equal((await event({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 1 })).json.started.length, 0);
+
+  const list = await call(env, "GET", `/api/projects/${projectId}/repo-bindings`, { as: owner });
+  assert.equal(list.json.bindings.length, 1);
+  assert.equal(list.json.configured, true);
+  assert.equal((await call(env, "DELETE", `/api/projects/${projectId}/repo-bindings/${ok.json.binding.id}`, { as: owner })).status, 200);
+});
+
+test("a check GitHub won't accept is dropped, not retried forever", async () => {
+  const gh = fakeGithub();
+  const { env, db, projectId, owner, event } = await setup(gh);
+  await call(env, "POST", `/api/projects/${projectId}/repo-bindings`, { as: owner, body: { repo: "acme/shop", installationId: 42, executionMode: "self" } });
+  gh.state.failWith = 404;
+  await event({ type: "pull_request", installationId: 42, repo: "acme/shop", sha: SHA, prNumber: 9 });
+  await drainOutbox(env);
+  const dead = db.db.prepare("SELECT COUNT(*) AS c FROM outbox WHERE kind = 'github.check.create' AND status = 'dead'").get() as any;
+  assert.equal(dead.c, 2);
+});