@cldmv/gh-broker 0.7.0 → 0.9.0

package/src/config.ts

@@ -1,130 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/config.ts
- *	@Date: 2026-07-07T00:24:51-07:00 (1783409091)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { readFileSync } from "node:fs";
-import type { Config, Mode, ToolRule } from "./types.ts";
-
-const MODES: readonly Mode[] = ["read", "write"];
-
-/** Load and validate the JSON config. Throws with a precise message on any problem. */
-export function loadConfig(path: string): Config {
-	let raw: unknown;
-	try {
-		raw = JSON.parse(readFileSync(path, "utf8"));
-	} catch (err) {
-		throw new Error(`config: cannot read/parse ${path}: ${(err as Error).message}`);
-	}
-	if (typeof raw !== "object" || raw === null) throw new Error("config: root must be an object");
-	const c = raw as Record<string, unknown>;
-
-	if (typeof c.listen !== "string" || !c.listen.startsWith("unix:")) {
-		throw new Error('config.listen: must be a "unix:<path>" string');
-	}
-	if (typeof c.upstream !== "string" || !/^https?:\/\//.test(c.upstream)) {
-		throw new Error("config.upstream: must be an http(s) URL");
-	}
-	if (!Array.isArray(c.tools) || c.tools.length === 0) {
-		throw new Error("config.tools: must be a non-empty array");
-	}
-
-	const seen = new Set<string>();
-	const tools: ToolRule[] = c.tools.map((t, i) => {
-		const o = t as Record<string, unknown>;
-		if (typeof o.name !== "string" || !o.name) throw new Error(`config.tools[${i}].name: required`);
-		if (!MODES.includes(o.mode as Mode)) throw new Error(`config.tools[${i}].mode: must be read|write`);
-		if (seen.has(o.name)) throw new Error(`config.tools: duplicate tool "${o.name}"`);
-		seen.add(o.name);
-		const custom = o.custom === true;
-		const augment = o.augment === true;
-		if (custom && augment) throw new Error(`config.tools[${i}] ("${o.name}"): custom and augment are mutually exclusive`);
-		return { name: o.name, mode: o.mode as Mode, custom, augment };
-	});
-
-	if (typeof c.owners !== "object" || c.owners === null) throw new Error("config.owners: must be an object");
-	const owners: Config["owners"] = {};
-	for (const [owner, v] of Object.entries(c.owners as Record<string, unknown>)) {
-		const o = v as Record<string, unknown>;
-		if (typeof o.read !== "string" || typeof o.write !== "string") {
-			throw new Error(`config.owners.${owner}: needs "read" and "write" credential refs`);
-		}
-		if (o.installationId !== undefined && typeof o.installationId !== "number") {
-			throw new Error(`config.owners.${owner}.installationId: must be a number`);
-		}
-		owners[owner.toLowerCase()] = {
-			read: o.read,
-			write: o.write,
-			...(typeof o.installationId === "number" ? { installationId: o.installationId } : {})
-		};
-	}
-	if (Object.keys(owners).length === 0) throw new Error("config.owners: at least one owner required");
-
-	let defaultOwner: string | undefined;
-	if (c.defaultOwner !== undefined) {
-		if (typeof c.defaultOwner !== "string" || !c.defaultOwner) {
-			throw new Error("config.defaultOwner: must be a non-empty string naming a configured owner");
-		}
-		defaultOwner = c.defaultOwner.toLowerCase();
-		if (!owners[defaultOwner]) {
-			throw new Error(`config.defaultOwner "${c.defaultOwner}" is not a key of config.owners`);
-		}
-	}
-
-	let app: Config["app"];
-	if (c.app !== undefined) {
-		const a = c.app as Record<string, unknown>;
-		if (typeof a.appId !== "number") throw new Error("config.app.appId: must be a number");
-		if (typeof a.privateKey !== "string") throw new Error('config.app.privateKey: must be a "cred:<name>" ref');
-		app = { appId: a.appId, privateKey: a.privateKey };
-	}
-
-	let secrets: Config["secrets"];
-	if (c.secrets !== undefined) {
-		if (typeof c.secrets !== "object" || c.secrets === null || Array.isArray(c.secrets)) throw new Error("config.secrets: must be an object");
-		const s = c.secrets as Record<string, unknown>;
-		if (s.provider !== undefined && s.provider !== "file" && s.provider !== "systemd-creds") {
-			throw new Error('config.secrets.provider: must be "systemd-creds" or "file"');
-		}
-		// Reject an empty path: resolveSecretsPath treats a falsy explicit path as
-		// "not provided" and falls back to env/default, so "" would be silently ignored.
-		if (s.path !== undefined && (typeof s.path !== "string" || s.path.length === 0)) {
-			throw new Error("config.secrets.path: must be a non-empty string");
-		}
-		// path only means anything to the file provider; the systemd-creds provider
-		// (the default) reads $CREDENTIALS_DIRECTORY and would silently ignore it.
-		// Reject the combination so an operator can't think a file path is in effect.
-		if (s.path !== undefined && (s.provider ?? "systemd-creds") !== "file") {
-			throw new Error('config.secrets.path is only used by the "file" provider — set provider to "file" or remove path');
-		}
-		secrets = {
-			...(s.provider === "file" || s.provider === "systemd-creds" ? { provider: s.provider } : {}),
-			...(typeof s.path === "string" ? { path: s.path } : {})
-		};
-	}
-
-	return {
-		listen: c.listen,
-		upstream: c.upstream,
-		tools,
-		owners,
-		...(app ? { app } : {}),
-		...(secrets ? { secrets } : {}),
-		...(defaultOwner ? { defaultOwner } : {})
-	};
-}
-
-/** Build a name→rule index for O(1) allowlist checks. */
-export function indexTools(tools: ToolRule[]): Map<string, ToolRule> {
-	return new Map(tools.map((t) => [t.name, t]));
-}

package/src/index.ts

@@ -1,107 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/index.ts
- *	@Date: 2026-07-07T00:24:51-07:00 (1783409091)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { loadConfig } from "./config.ts";
-import { loadSecretStore } from "./secrets.ts";
-import { UpstreamPool } from "./upstream.ts";
-import { Router } from "./router.ts";
-import { AppAuth } from "./appauth.ts";
-import { buildCatalog } from "./catalog.ts";
-import { startServer } from "./server.ts";
-import { resolveConfigPath } from "./paths.ts";
-
-function argConfig(): string {
-	const i = process.argv.indexOf("--config");
-	if (i >= 0) {
-		// Fail fast on `--config` with no value (or a flag as the "value") rather than
-		// silently falling back to env/default and hiding the operator's mistake.
-		const explicit = process.argv[i + 1];
-		if (!explicit || explicit.startsWith("-")) throw new Error("--config requires a path argument");
-		return resolveConfigPath(explicit);
-	}
-	return resolveConfigPath(undefined);
-}
-
-async function main(): Promise<void> {
-	const configPath = argConfig();
-
-	// --print-paths: emit the resolved config + secrets paths and exit. The
-	// installer uses this so there is one path resolver (src/paths.ts), no drift.
-	// Honor a deployed config's secrets.path override when the config already exists
-	// (upgrades); fall back to the default when it doesn't (first install) or is
-	// unparseable — this must not require a valid config to run.
-	if (process.argv.includes("--print-paths")) {
-		const { resolveSecretsPath } = await import("./paths.ts");
-		let secretsOverride: string | undefined;
-		try {
-			secretsOverride = loadConfig(configPath).secrets?.path;
-		} catch {
-			secretsOverride = undefined;
-		}
-		console.log(JSON.stringify({ config: configPath, secrets: resolveSecretsPath(secretsOverride) }));
-		return;
-	}
-
-	const config = loadConfig(configPath);
-
-	// --check: validate the config parses (and, where possible, that credentials
-	// resolve), then exit WITHOUT starting the server. The installer runs this to
-	// fail an install/upgrade early. The file provider validates here; the
-	// systemd-creds provider can only resolve under systemd (needs
-	// $CREDENTIALS_DIRECTORY), so it's checked at service start / by the smoke test.
-	if (process.argv.includes("--check")) {
-		const provider = config.secrets?.provider ?? "systemd-creds";
-		// Truthy, not just "defined": the systemd-creds store treats an empty
-		// $CREDENTIALS_DIRECTORY as unset (if (!dir)), so --check must too — otherwise
-		// it would attempt secret resolution and fail where it should report unchecked.
-		const secretsChecked = provider === "file" || Boolean(process.env.CREDENTIALS_DIRECTORY);
-		if (secretsChecked) loadSecretStore(config);
-		console.log(JSON.stringify({ event: "config-ok", config: configPath, provider, secretsChecked, owners: Object.keys(config.owners), tools: config.tools.length }));
-		return;
-	}
-
-	const secrets = loadSecretStore(config); // eagerly validates every referenced credential
-	const upstream = new UpstreamPool(config);
-
-	// Optional GitHub App (for link_issue). Non-fatal: a misconfigured App disables
-	// link_issue but never takes down the read/write path.
-	let appAuth: AppAuth | undefined;
-	if (config.app) {
-		try {
-			appAuth = new AppAuth(config, secrets);
-		} catch (err) {
-			console.error(`gh-broker: app-auth disabled (link_issue unavailable): ${(err as Error).message}`);
-		}
-	}
-
-	const router = new Router(config, secrets, upstream, appAuth);
-	const catalog = await buildCatalog(config, secrets, upstream);
-	await startServer(config, router, catalog);
-	console.log(
-		JSON.stringify({
-			ts: new Date().toISOString(),
-			event: "listening",
-			listen: config.listen,
-			owners: Object.keys(config.owners),
-			app: appAuth ? "enabled" : "none",
-			tools: catalog.map((t) => t.name)
-		})
-	);
-}
-
-main().catch((err: unknown) => {
-	console.error(`gh-broker: fatal: ${(err as Error).message}`);
-	process.exit(1);
-});

package/src/paths.ts

@@ -1,60 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/paths.ts
- *	@Date: 2026-09-06T10:05:35-07:00 (1788714335)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import { platform, env } from "node:process";
-import { join } from "node:path";
-
-/**
- * Platform-neutral path resolution for the config and secrets files.
- *
- * Nothing is hardcoded to /etc. Both files resolve through the same order:
- *   1. an explicit path (a `--config` flag, or GH_BROKER_CONFIG / GH_BROKER_SECRETS),
- *   2. the platform's system config dir (below),
- *   3. the packaged default under that dir.
- *
- * Only the Linux defaults are exercised today; the macOS/Windows entries are
- * wired so a later port is a table entry, not surgery. See docs/deploy-architecture.md.
- */
-
-/** The system-wide config directory for the current platform (env-overridable). */
-export function configDir(): string {
-	const override = env.GH_BROKER_CONFIG_DIR;
-	if (override) return override;
-	switch (platform) {
-		case "darwin":
-			return "/Library/Application Support/gh-broker";
-		case "win32":
-			return join(env.ProgramData ?? "C:\\ProgramData", "gh-broker");
-		default: // linux and other unixes
-			return "/etc/gh-broker";
-	}
-}
-
-/**
- * Resolve the config file path: an explicit argument (from `--config`) wins,
- * then GH_BROKER_CONFIG, then `<configDir>/config.json`.
- */
-export function resolveConfigPath(explicit?: string): string {
-	if (explicit) return explicit;
-	if (env.GH_BROKER_CONFIG) return env.GH_BROKER_CONFIG;
-	return join(configDir(), "config.json");
-}
-
-/** Resolve the secrets file path: an explicit argument wins, then GH_BROKER_SECRETS, then `<configDir>/secrets.json`. */
-export function resolveSecretsPath(explicit?: string): string {
-	if (explicit) return explicit;
-	if (env.GH_BROKER_SECRETS) return env.GH_BROKER_SECRETS;
-	return join(configDir(), "secrets.json");
-}

package/src/router.ts

@@ -1,258 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/router.ts
- *	@Date: 2026-07-07T00:24:51-07:00 (1783409091)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-16T17:17:03-07:00 (1792196223)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import type { CallToolResult } from "@modelcontextprotocol/sdk/types.js";
-import type { Config, SecretStore, ToolRule } from "./types.ts";
-import type { AppAuth } from "./appauth.ts";
-import { Octokit } from "@octokit/core";
-import { indexTools } from "./config.ts";
-import { audit } from "./audit.ts";
-// DEFERRED: link_issue is App-token-only and not wired in — see docs.
-// import { linkIssue, type LinkIssueInput } from "./verbs/link_issue.ts";
-import {
-	resolveReviewThread,
-	replyReviewThread,
-	type ResolveReviewThreadInput,
-	type ReplyReviewThreadInput
-} from "./verbs/review_thread.ts";
-import { reportUnlabeled, type ReportUnlabeledInput } from "./verbs/report_unlabeled.ts";
-import { reportSecurityAlerts, type ReportSecurityAlertsInput } from "./verbs/report_security_alerts.ts";
-import { reportReleasePrs, type ReportReleasePrsInput } from "./verbs/report_release_prs.ts";
-import { issueLabels, type IssueLabelsInput } from "./verbs/issue_labels.ts";
-import { reportCiStatus, ciStatusForHeadSha, type ReportCiStatusInput, type FailedJobLogsFetcher } from "./verbs/report_ci_status.ts";
-
-/** What the router needs from the upstream (hosted-MCP) client pool. */
-export interface Upstream {
-	forward(tool: string, args: Record<string, unknown>, token: string): Promise<CallToolResult>;
-}
-
-/**
- * Enforces the default-deny allowlist, resolves the (owner, mode) → PAT, and either
- * forwards to the hosted MCP or dispatches a custom verb. The token never leaves here.
- */
-export class Router {
-	private readonly config: Config;
-	private readonly secrets: SecretStore;
-	private readonly upstream: Upstream;
-	private readonly appAuth?: AppAuth;
-	private readonly rules: Map<string, ToolRule>;
-
-	constructor(config: Config, secrets: SecretStore, upstream: Upstream, appAuth?: AppAuth) {
-		this.config = config;
-		this.secrets = secrets;
-		this.upstream = upstream;
-		this.appAuth = appAuth;
-		this.rules = indexTools(config.tools);
-	}
-
-	/** Tools advertised to the agent (used to build tools/list). */
-	advertisedTools(): ToolRule[] {
-		return this.config.tools;
-	}
-
-	async call(tool: string, args: Record<string, unknown>): Promise<CallToolResult> {
-		const rule = this.rules.get(tool);
-		if (!rule) {
-			audit({ tool, decision: "deny", detail: "not in allowlist" });
-			throw new Error(`tool "${tool}" is not allowed`);
-		}
-		// Owner-less reads (global advisory DB, get_me, notifications) fall back to
-		// the configured defaultOwner's READ PAT. Writes never fall back — a write
-		// must always name the owner it targets.
-		let owner = extractOwner(args);
-		if (!owner && rule.mode === "read" && this.config.defaultOwner && this.config.owners[this.config.defaultOwner]) {
-			owner = this.config.defaultOwner.toLowerCase();
-		}
-		if (!owner) {
-			audit({ tool, decision: "error", detail: "no owner in args" });
-			throw new Error(`tool "${tool}": could not determine repo owner from arguments`);
-		}
-		const creds = this.config.owners[owner];
-		if (!creds) {
-			audit({ tool, owner, decision: "error", detail: "no creds for owner" });
-			throw new Error(`no credentials configured for owner "${owner}" — add it to config.owners + creds`);
-		}
-		const token = this.secrets.resolve(rule.mode === "write" ? creds.write : creds.read);
-		const repo = typeof args.repo === "string" ? `${owner}/${args.repo}` : owner;
-
-		const decision = rule.custom ? "custom" : rule.augment ? "augment" : "forward";
-		try {
-			const out = rule.custom
-				? await this.dispatchCustom(tool, args, owner, token)
-				: rule.augment
-					? await this.dispatchAugmented(tool, args, owner, token)
-					: await this.upstream.forward(tool, args, token);
-			audit({ tool, owner, mode: rule.mode, repo, decision, ok: true });
-			return out;
-		} catch (err) {
-			audit({ tool, owner, mode: rule.mode, repo, decision, ok: false, detail: (err as Error).message });
-			throw err;
-		}
-	}
-
-	private async dispatchCustom(
-		tool: string,
-		args: Record<string, unknown>,
-		owner: string,
-		token: string
-	): Promise<CallToolResult> {
-		switch (tool) {
-			// DEFERRED: link_issue (App-token-only addClosingIssueReference) is not wired in — see docs.
-			// Re-enable by restoring this case + the import above + the catalog block, adding a
-			// link_issue allowlist entry to config, and configuring config.app + owner installationId.
-			// case "link_issue": {
-			// 	const octokit = this.appAuth?.octokitFor(owner);
-			// 	if (!octokit) {
-			// 		throw new Error(`link_issue needs a GitHub App for "${owner}": set config.app + owners.${owner}.installationId + the app key cred (addClosingIssueReference is App-token-only — not available to fine-grained PATs)`);
-			// 	}
-			// 	const out = await linkIssue(octokit, args as unknown as LinkIssueInput);
-			// 	return { content: [{ type: "text", text: `linked: PR ${out.pullRequestId} → issue ${out.issueId}` }] };
-			// }
-			case "resolve_review_thread": {
-				// PAT-usable (Pull requests: write) — run on the resolved write PAT, not the App token.
-				const octokit = new Octokit({ auth: token });
-				const out = await resolveReviewThread(octokit, args as unknown as ResolveReviewThreadInput);
-				return { content: [{ type: "text", text: `thread ${out.threadId}: isResolved=${out.isResolved}` }] };
-			}
-			case "reply_review_thread": {
-				const octokit = new Octokit({ auth: token });
-				const out = await replyReviewThread(octokit, args as unknown as ReplyReviewThreadInput);
-				return { content: [{ type: "text", text: `replied: ${out.url}` }] };
-			}
-			case "issue_labels": {
-				// Per-label REST endpoints (Issues: write) on the resolved write PAT.
-				const octokit = new Octokit({ auth: token });
-				const out = await issueLabels(octokit, args as unknown as IssueLabelsInput);
-				return { content: [{ type: "text", text: JSON.stringify(out) }] };
-			}
-			case "report_unlabeled": {
-				const octokit = new Octokit({ auth: token });
-				const out = await reportUnlabeled(octokit, args as unknown as ReportUnlabeledInput);
-				return { content: [{ type: "text", text: JSON.stringify(out) }] };
-			}
-			case "report_security_alerts": {
-				const octokit = new Octokit({ auth: token });
-				const out = await reportSecurityAlerts(octokit, args as unknown as ReportSecurityAlertsInput);
-				return { content: [{ type: "text", text: JSON.stringify(out) }] };
-			}
-			case "report_release_prs": {
-				const octokit = new Octokit({ auth: token });
-				const out = await reportReleasePrs(octokit, args as unknown as ReportReleasePrsInput);
-				return { content: [{ type: "text", text: JSON.stringify(out) }] };
-			}
-			case "report_ci_status": {
-				const octokit = new Octokit({ auth: token });
-				const reportArgs = args as unknown as ReportCiStatusInput;
-				const out = await reportCiStatus(octokit, reportArgs, this.makeJobLogsFetcher(owner, reportArgs.repo, token));
-				return { content: [{ type: "text", text: JSON.stringify(out) }] };
-			}
-			default:
-				throw new Error(`custom verb "${tool}" not implemented`);
-		}
-	}
-
-	/**
-	 * A failing-run's job logs, via the hosted MCP's own `get_job_logs` tool
-	 * (`failed_only: true` fetches every failing job in the run in one call) rather
-	 * than a hand-rolled REST call — see report_ci_status.ts's FailedJobLogsFetcher
-	 * doc comment for why. Best-effort: any failure here (bad shape, upstream error)
-	 * just yields an empty map — report_ci_status treats a lookup miss as "no
-	 * logTail for this job", never a hard failure of the whole report.
-	 */
-	private makeJobLogsFetcher(owner: string, repo: string, token: string): FailedJobLogsFetcher {
-		return async (runId, tailLines) => {
-			const map = new Map<number, string>();
-			try {
-				const result = await this.upstream.forward("get_job_logs", { owner, repo, run_id: runId, failed_only: true, return_content: true, tail_lines: tailLines }, token);
-				const textBlock = result.content?.find((c) => (c as { type?: string }).type === "text") as { text?: string } | undefined;
-				if (!textBlock?.text) return map;
-				const parsed = JSON.parse(textBlock.text) as { logs?: Array<{ job_id?: unknown; logs_content?: unknown }> };
-				for (const entry of parsed.logs ?? []) {
-					if (typeof entry.job_id === "number" && typeof entry.logs_content === "string") map.set(entry.job_id, entry.logs_content);
-				}
-			} catch {
-				/* best-effort — see doc comment */
-			}
-			return map;
-		};
-	}
-
-	/**
-	 * Forwards to the hosted MCP like a plain proxy, then post-processes the result.
-	 * gh-broker presents its own MCP contract — a proxied tool's response is not
-	 * required to match the hosted MCP's shape verbatim (see [[broker-owns-its-mcp-contract]]
-	 * in project memory). `ciVerbosity`/`logLines` are gh-broker's own extension
-	 * params, stripped before forwarding since the upstream schema doesn't know them.
-	 *
-	 * Opt-in only: with no `ciVerbosity`, this is byte-identical to a plain forward —
-	 * augmenting every `pull_request_read` call by default would add an unrequested
-	 * API call (and cost) to every ordinary PR read.
-	 *
-	 * Best-effort: if the upstream response isn't the JSON-text shape expected (a
-	 * format this broker doesn't control), the original result is returned unmodified
-	 * rather than thrown — a shape mismatch should degrade to "no CI data added," not
-	 * break an otherwise-successful PR read.
-	 */
-	private async dispatchAugmented(tool: string, args: Record<string, unknown>, owner: string, token: string): Promise<CallToolResult> {
-		switch (tool) {
-			case "pull_request_read": {
-				const { ciVerbosity, logLines, ...upstreamArgs } = args as Record<string, unknown> & { ciVerbosity?: number; logLines?: number };
-				const result = await this.upstream.forward(tool, upstreamArgs, token);
-				if (ciVerbosity === undefined) return result;
-				if ((upstreamArgs.method ?? "get") !== "get") return result; // only the single-PR "get" shape is augmentable
-
-				const textBlock = result.content?.find((c) => (c as { type?: string }).type === "text") as { text?: string } | undefined;
-				if (!textBlock?.text) return result;
-				let pr: unknown;
-				try {
-					pr = JSON.parse(textBlock.text);
-				} catch {
-					return result;
-				}
-				const p = pr as { number?: unknown; head?: { sha?: unknown } };
-				if (typeof p.number !== "number" || typeof p.head?.sha !== "string") return result;
-
-				const repo = String(upstreamArgs.repo ?? "");
-				const octokit = new Octokit({ auth: token });
-				const ci = await ciStatusForHeadSha(octokit, owner, repo, p.number, p.head.sha, {
-					verbosity: Number(ciVerbosity),
-					logLines: logLines !== undefined ? Number(logLines) : undefined,
-					fetchFailedJobLogs: this.makeJobLogsFetcher(owner, repo, token)
-				});
-				textBlock.text = JSON.stringify({ ...(pr as object), ci });
-				return result;
-			}
-			default:
-				return this.upstream.forward(tool, args, token);
-		}
-	}
-}
-
-/** Derive the repo owner from a tool call's arguments, so we pick the right PAT. */
-export function extractOwner(args: Record<string, unknown>): string | undefined {
-	if (typeof args.owner === "string" && args.owner) return args.owner.toLowerCase();
-	// Many org-scoped tools (list_org_repository_security_advisories, get_team_members, …)
-	// name the org as `org` rather than `owner`; for routing, org === owner.
-	if (typeof args.org === "string" && args.org) return args.org.toLowerCase();
-	if (typeof args.query === "string") {
-		const m = args.query.match(/\brepo:([^/\s]+)\/[^\s]+|\b(?:org|user):([^\s]+)/i);
-		const hit = m?.[1] ?? m?.[2];
-		if (hit) return hit.toLowerCase();
-	}
-	if (typeof args.repository === "string" && args.repository.includes("/")) {
-		return args.repository.split("/")[0]?.toLowerCase();
-	}
-	return undefined;
-}