@cldmv/gh-broker 0.10.0 → 0.10.1

package/README.md

@@ -19,19 +19,18 @@ It runs as a dedicated `gh-broker` system user, holds a read-scoped and a write-
 
 ## ✨ What's New
 
-### Latest: v0.10.0 (November 2026)
+### Latest: v0.10.1 (November 2026)
 
-- **OTP gate for risky write tools.** Gated tools need a current code from an authenticator app, so the agent has to ask you. The first good code opens a five-minute window for that agent, and bad codes lock it out, then hard-lock it until `sudo gh-broker otp unlock <user>`.
-- **One socket per agent and the `gh-broker` command.** Each agent user gets its own socket, and `gh-broker agent add|remove|list|sync` writes its MCP config. `gh-broker otp status|list|unlock|rotate` manages the gate, and `gh-broker install` runs the installer.
-- **Eleven new write tools and a deny list.** These include merging, branch updates, repo create and fork, `delete_branch`, `dismiss_alert` and `minimize_comment`, with the risky ones gated by default and the Copilot coding-agent tools disabled. A built-in deny list refuses file writes, repo deletion and repo settings at config load. Breaking: the socket path, the `bin` and `npm_scaffold`'s `npm_otp`; see the upgrade notes.
-- [View full v0.10.0 Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.10.0.md)
+- **The OTP gate says why it refused a code.** A wrong code now reads "not accepted", with the bad-code count and the lockout length, and a reused code says it's spent, so the agent can tell you what happened instead of just asking again.
+- **`report_dependents` lists dev branches on large orgs.** The GraphQL listing pages at 25 repos and backs off when GitHub times out, instead of failing with a raw 502.
+- [View full v0.10.1 Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.10.1.md)
 
 ### Recent Releases
 
+- **v0.10.0** (November 2026) — OTP gate for risky write tools, one socket per agent with the `gh-broker` command, eleven new write tools and a built-in deny list ([Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.10.0.md))
 - **v0.9.0** (November 2026) — `report_alert_status`, `report_release_changes` and `report_dependents` for the release and fleet skills, `ciVerbosity` on `list_pull_requests`, and install from npm ([Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.9.0.md))
 - **v0.8.0** (November 2026) — `npm_scaffold` creates an npm package and its trusted publisher, `ghcr_push` pushes images without an agent-held token, and optional credentials hide their tools ([Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.8.0.md))
 - **v0.7.0** (October 2026) — `issue_labels` adds, removes or swaps single labels without replacing the set, and `issue_write` warns that its `labels` does ([Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.7.0.md))
-- **v0.6.1** (October 2026) — MCP SDK 1.32.0 (same-origin redirects only) and a refreshed vitest toolchain; no broker source changes ([Changelog](https://github.com/CLDMV/gh-broker/blob/master/docs/changelog/v0/v0.6.1.md))
 
 📚 For the complete version history, see the [docs/changelog/](https://github.com/CLDMV/gh-broker/tree/master/docs/changelog/) folder.
 

package/dist/index.mjs

@@ -21468,14 +21468,17 @@ var SEARCH_PAGE_SIZE = 100;
 var SEARCH_MAX_PAGES = 10;
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml"];
 var NAME_PATTERN = /^(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
-var DEV_LIST_MAX_PAGES = 20;
+var DEV_LIST_PAGE_SIZE = 25;
+var DEV_LIST_MIN_PAGE_SIZE = 5;
+var DEV_LIST_MAX_PAGES = 80;
+var TIMEOUT_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
 var DEV_BRANCH = "dev";
 var SEARCH_NOTE = "Candidates come from GitHub code search, which lags recent commits and only indexes default branches; each candidate was verified against its default-branch package.json. A repo that changed very recently can be missing.";
 var DEV_NOTE = " Every `dev` branch that differs from its default branch was also read in full, so dev-trunk repos are included; a `dev` whose root package.json version is below the default branch's is treated as abandoned and skipped (see `abandonedDev`).";
 var NO_DEV_NOTE = " Dev branches were not read, so a dev-trunk repo whose real manifests live on `dev` is missing.";
-var DEV_BRANCHES_QUERY = `query($owner: String!, $after: String) {
+var DEV_BRANCHES_QUERY = `query($owner: String!, $after: String, $first: Int!) {
   repositoryOwner(login: $owner) {
-    repositories(first: 100, after: $after, orderBy: { field: NAME, direction: ASC }) {
+    repositories(first: $first, after: $after, orderBy: { field: NAME, direction: ASC }) {
       pageInfo { hasNextPage endCursor }
       nodes {
         name
@@ -21620,8 +21623,17 @@ async function listDevBranches(octokit, budget, owner2) {
   const repos = [];
   const abandoned = [];
   let after = null;
+  let first = DEV_LIST_PAGE_SIZE;
   for (let page = 1; page <= DEV_LIST_MAX_PAGES; page++) {
-    const res = await reqOne(octokit, budget, "POST /graphql", { query: DEV_BRANCHES_QUERY, variables: { owner: owner2, after } });
+    let res;
+    try {
+      res = await reqOne(octokit, budget, "POST /graphql", { query: DEV_BRANCHES_QUERY, variables: { owner: owner2, after, first } });
+    } catch (err) {
+      if (!TIMEOUT_STATUSES.has(err.status)) throw err;
+      if (first === DEV_LIST_MIN_PAGE_SIZE) return { repos, abandoned, complete: false, timedOut: true };
+      first = Math.max(DEV_LIST_MIN_PAGE_SIZE, Math.ceil(first / 2));
+      continue;
+    }
     const conn = res.data?.repositoryOwner?.repositories;
     if (!conn) throw new Error(`report_dependents: listing dev branches failed: ${res.errors?.map((e) => e.message).join("; ") ?? `no owner "${owner2}"`}`);
     for (const r of conn.nodes) {
@@ -21725,8 +21737,9 @@ async function reportDependents(octokit, input, deps = {}) {
       dependents.push(entry);
     }
     if (devBranches) {
-      const { repos, abandoned, complete } = await listDevBranches(octokit, budget, owner2);
+      const { repos, abandoned, complete, timedOut } = await listDevBranches(octokit, budget, owner2);
       abandonedDev.push(...abandoned);
+      if (timedOut) truncatedReason ??= "github-timeout";
       if (!complete) truncatedReason ??= "max-repos";
       const room = Math.max(0, maxRepos - Math.min(repoNames.length, maxRepos));
       if (repos.length > room) truncatedReason ??= "max-repos";
@@ -25030,11 +25043,30 @@ var OtpGate = class {
       this.windows.push({ user, code, expiresAt, id });
       return { otp: "opened", window: id, until: new Date(expiresAt).toISOString() };
     }
-    if (step !== void 0) throw refusal();
-    this.recordFailure(tool, state, mine, user, now);
-    throw refusal();
+    if (step !== void 0) {
+      throw new OtpRefusal(
+        `OTP code for ${tool} is spent (it, or a newer code, was already used): ask the user for the next code from their authenticator app and pass it as "${OTP_ARG}". Nothing was run.`,
+        { otp: "refused" }
+      );
+    }
+    throw this.rejection(tool, user, this.recordFailure(tool, state, mine, user, now));
+  }
+  /** The refusal for a wrong code, saying how close `user` now is to a lockout. */
+  rejection(tool, user, after) {
+    const lead = `OTP code for ${tool} was not accepted`;
+    if (after.hardLock) {
+      return new OtpRefusal(`${lead}, and that was the last lockout allowed: gh-broker is now locked for ${user}. Ask the user to run "${unlockCommand(user)}" on ${this.host}. Nothing was run.`, {
+        otp: "refused"
+      });
+    }
+    const lockout = windowText(this.settings.lockoutSeconds);
+    if (after.failures === 0) return new OtpRefusal(`${lead}, and that was too many bad codes: OTP is locked for ${lockout}. Nothing was run.`, { otp: "refused" });
+    return new OtpRefusal(
+      `${lead} (${after.failures} of ${this.settings.maxFailures} bad codes before a lockout of ${lockout}): ask the user for a fresh code from their authenticator app and pass it as "${OTP_ARG}". Nothing was run.`,
+      { otp: "refused" }
+    );
   }
-  /** Count one bad code for `user`, starting a short lockout (and maybe the hard lock) at the limit. */
+  /** Count one bad code for `user`, starting a short lockout (and maybe the hard lock) at the limit. Returns the user's new counters. */
   recordFailure(tool, state, mine, user, now) {
     const next = { ...mine, lockouts: mine.lockouts.filter((t) => Date.parse(t) > now - DAY_MS) };
     next.failures += 1;
@@ -25054,6 +25086,7 @@ var OtpGate = class {
       this.unsaved.add(user);
       console.error(`gh-broker: ${err.message}`);
     }
+    return next;
   }
   /**
    * `state` tidied for a write: every user's lockouts pruned to the last 24 h, expired short