@cldmv/gh-broker 0.8.0 → 0.10.0

package/tests/rest-client.test.vitest.mts

@@ -1,115 +0,0 @@
-import { describe, it, expect, vi } from "vitest";
-import { CallBudget, CallBudgetExhausted, RateLimited, listOwnerRepos, paginateAfter, req } from "../src/verbs/rest-client.ts";
-
-function octokitWith(handler: (route: string, params: any) => Promise<{ data: unknown; headers?: Record<string, string> }>): any {
-	return { request: vi.fn(handler) };
-}
-
-describe("403 classification", () => {
-	const call = (err: unknown) => req(octokitWith(async () => { throw err; }), new CallBudget(5), "GET /x", {});
-
-	it("treats a 403 with Retry-After as a rate limit and carries the delay", async () => {
-		const err = Object.assign(new Error("Forbidden"), { status: 403, response: { headers: { "retry-after": "42" } } });
-		await expect(call(err)).rejects.toMatchObject({ retryAfterSeconds: 42 });
-		await expect(call(err)).rejects.toBeInstanceOf(RateLimited);
-	});
-
-	it("treats a 403 with an exhausted x-ratelimit-remaining as a rate limit", async () => {
-		const err = Object.assign(new Error("Forbidden"), { status: 403, response: { headers: { "x-ratelimit-remaining": "0" } } });
-		await expect(call(err)).rejects.toBeInstanceOf(RateLimited);
-	});
-
-	it("treats a 403 whose message mentions a rate limit or abuse detection as a rate limit", async () => {
-		await expect(call(Object.assign(new Error("API rate limit exceeded"), { status: 403 }))).rejects.toBeInstanceOf(RateLimited);
-		await expect(call(Object.assign(new Error("You have exceeded a secondary rate limit"), { status: 403 }))).rejects.toBeInstanceOf(RateLimited);
-		await expect(call(Object.assign(new Error("abuse detection mechanism"), { status: 403 }))).rejects.toBeInstanceOf(RateLimited);
-	});
-
-	it("always treats a 429 as a rate limit", async () => {
-		await expect(call(Object.assign(new Error("Too Many Requests"), { status: 429 }))).rejects.toBeInstanceOf(RateLimited);
-	});
-
-	it("rethrows a plain permission 403 with its status intact instead of calling it a rate limit", async () => {
-		const err = Object.assign(new Error("Code Security must be enabled for this repository to use code scanning."), { status: 403 });
-		const rejected = await call(err).catch((e) => e);
-		expect(rejected).not.toBeInstanceOf(RateLimited);
-		expect(rejected).toBe(err);
-		expect(rejected.status).toBe(403);
-	});
-
-	it("still rethrows other statuses untouched", async () => {
-		const err = Object.assign(new Error("Not Found"), { status: 404 });
-		await expect(call(err)).rejects.toBe(err);
-	});
-});
-
-describe("paginateAfter (Link-header cursor pagination)", () => {
-	const link = (cursor: string) => `<https://api.github.com/x?per_page=100&after=${cursor}>; rel="next", <https://api.github.com/x?per_page=100>; rel="first"`;
-
-	it("follows the rel=next cursor across pages and stops when there is no next link", async () => {
-		const octokit = octokitWith(async (_route, params) => {
-			if (!params.after) return { data: [{ n: 1 }, { n: 2 }], headers: { link: link("CUR1") } };
-			if (params.after === "CUR1") return { data: [{ n: 3 }], headers: {} };
-			throw new Error(`unexpected cursor ${params.after}`);
-		});
-		const out = await paginateAfter<{ n: number }>(octokit, new CallBudget(10), "GET /x", { a: 1 }, 100);
-		expect(out.map((o) => o.n)).toEqual([1, 2, 3]);
-		expect(octokit.request).toHaveBeenCalledTimes(2);
-		expect(octokit.request.mock.calls[0]![1]).toMatchObject({ a: 1, per_page: 100 });
-		expect(octokit.request.mock.calls[0]![1]).not.toHaveProperty("after");
-	});
-
-	it("URL-decodes the cursor before sending it back", async () => {
-		const octokit = octokitWith(async (_route, params) => {
-			if (!params.after) return { data: [{ n: 1 }], headers: { link: link("a%3Db%2Fc") } };
-			expect(params.after).toBe("a=b/c");
-			return { data: [], headers: {} };
-		});
-		await paginateAfter(octokit, new CallBudget(10), "GET /x", {}, 100);
-		expect(octokit.request).toHaveBeenCalledTimes(2);
-	});
-
-	it("stops at the limit even when more pages exist, trimming to the limit", async () => {
-		const octokit = octokitWith(async () => ({ data: [{ n: 1 }, { n: 2 }, { n: 3 }], headers: { link: link("MORE") } }));
-		const out = await paginateAfter(octokit, new CallBudget(10), "GET /x", {}, 2);
-		expect(out).toHaveLength(2);
-		expect(octokit.request).toHaveBeenCalledTimes(1);
-	});
-
-	it("stops on an empty page and on a non-array body", async () => {
-		expect(await paginateAfter(octokitWith(async () => ({ data: [], headers: { link: link("X") } })), new CallBudget(5), "GET /x", {}, 10)).toEqual([]);
-		expect(await paginateAfter(octokitWith(async () => ({ data: { message: "nope" }, headers: {} })), new CallBudget(5), "GET /x", {}, 10)).toEqual([]);
-	});
-
-	it("charges the call budget per page and throws once it is spent", async () => {
-		const octokit = octokitWith(async () => ({ data: [{ n: 1 }], headers: { link: link("MORE") } }));
-		await expect(paginateAfter(octokit, new CallBudget(2), "GET /x", {}, 100)).rejects.toBeInstanceOf(CallBudgetExhausted);
-	});
-});
-
-describe("listOwnerRepos", () => {
-	it("returns non-archived repo names from the org endpoint", async () => {
-		const octokit = octokitWith(async () => ({ data: [{ name: "a" }, { name: "b", archived: true }, { name: "c" }], headers: {} }));
-		expect(await listOwnerRepos(octokit, new CallBudget(5), "cldmv", 50)).toEqual(["a", "c"]);
-	});
-
-	it("falls back to the user endpoint when the org endpoint 404s", async () => {
-		const octokit = octokitWith(async (route) => {
-			if (route === "GET /orgs/{owner}/repos") throw Object.assign(new Error("Not Found"), { status: 404 });
-			return { data: [{ name: "solo" }], headers: {} };
-		});
-		expect(await listOwnerRepos(octokit, new CallBudget(5), "someone", 50)).toEqual(["solo"]);
-	});
-
-	it("does not fall back on a rate limit or budget exhaustion", async () => {
-		const limited = octokitWith(async () => { throw Object.assign(new Error("x"), { status: 429 }); });
-		await expect(listOwnerRepos(limited, new CallBudget(5), "cldmv", 50)).rejects.toBeInstanceOf(RateLimited);
-		expect(limited.request).toHaveBeenCalledTimes(1);
-		await expect(listOwnerRepos(octokitWith(async () => ({ data: [], headers: {} })), new CallBudget(0), "cldmv", 50)).rejects.toBeInstanceOf(CallBudgetExhausted);
-	});
-
-	it("propagates a non-404 error", async () => {
-		const octokit = octokitWith(async () => { throw Object.assign(new Error("boom"), { status: 500 }); });
-		await expect(listOwnerRepos(octokit, new CallBudget(5), "cldmv", 50)).rejects.toThrow("boom");
-	});
-});

package/tests/router.test.vitest.mts

@@ -1,505 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-
-// Octokit is `new`-ed inside dispatchCustom for the review-thread verbs, so mock it
-// to hand back a controllable graphql fn. link_issue instead uses the injected
-// appAuth's octokit (also wired to graphqlMock below).
-const { graphqlMock, requestMock } = vi.hoisted(() => ({ graphqlMock: vi.fn(), requestMock: vi.fn() }));
-vi.mock("@octokit/core", () => ({
-	// Constructable mock (arrow fns can't be `new`-ed) — every instance shares graphqlMock/requestMock.
-	Octokit: vi.fn(function (this: any) {
-		this.graphql = graphqlMock;
-		this.request = requestMock;
-	})
-}));
-
-import { Octokit } from "@octokit/core";
-import { Router, extractOwner } from "../src/router.ts";
-
-function makeConfig(overrides: Record<string, unknown> = {}): any {
-	return {
-		listen: "unix:/x.sock",
-		upstream: "https://api.githubcopilot.com/mcp/",
-		tools: [
-			{ name: "get_me", mode: "read" },
-			{ name: "create_pull_request", mode: "write" },
-			{ name: "link_issue", mode: "write", custom: true },
-			{ name: "resolve_review_thread", mode: "write", custom: true },
-			{ name: "reply_review_thread", mode: "write", custom: true },
-			{ name: "issue_labels", mode: "write", custom: true },
-			{ name: "report_unlabeled", mode: "read", custom: true },
-			{ name: "report_security_alerts", mode: "read", custom: true },
-			{ name: "report_release_prs", mode: "read", custom: true },
-			{ name: "report_ci_status", mode: "read", custom: true },
-			{ name: "pull_request_read", mode: "read", augment: true }
-		],
-		owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
-		...overrides
-	};
-}
-
-describe("extractOwner", () => {
-	it("reads args.owner (lowercased)", () => {
-		expect(extractOwner({ owner: "CLDMV" })).toBe("cldmv");
-	});
-	it("falls back to args.org for org-scoped tools", () => {
-		expect(extractOwner({ org: "SomeOrg" })).toBe("someorg");
-	});
-	it("extracts repo:owner/name out of a search query", () => {
-		expect(extractOwner({ query: "is:pr repo:CLDMV/gh-broker author:x" })).toBe("cldmv");
-	});
-	it("extracts org: out of a search query", () => {
-		expect(extractOwner({ query: "org:Acme is:issue" })).toBe("acme");
-	});
-	it("extracts user: out of a search query", () => {
-		expect(extractOwner({ query: "user:Someone foo" })).toBe("someone");
-	});
-	it("reads the owner from a repository owner/name string", () => {
-		expect(extractOwner({ repository: "CLDMV/thing" })).toBe("cldmv");
-	});
-	it("returns undefined when no owner is derivable", () => {
-		expect(extractOwner({ foo: "bar" })).toBeUndefined();
-		expect(extractOwner({ repository: "no-slash" })).toBeUndefined();
-		expect(extractOwner({ query: "just some words" })).toBeUndefined();
-	});
-});
-
-describe("Router.call", () => {
-	let secrets: { resolve: ReturnType<typeof vi.fn> };
-	let upstream: { forward: ReturnType<typeof vi.fn> };
-
-	beforeEach(() => {
-		vi.clearAllMocks();
-		vi.spyOn(console, "log").mockImplementation(() => {}); // silence audit output
-		secrets = { resolve: vi.fn((ref: string) => `token:${ref}`), has: vi.fn(() => true) };
-		upstream = { forward: vi.fn().mockResolvedValue({ content: [{ type: "text", text: "ok" }] }) };
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("denies a tool that is not in the allowlist", async () => {
-		const r = new Router(makeConfig(), secrets as any, upstream as any);
-		await expect(r.call("rm_rf", {})).rejects.toThrow(/tool "rm_rf" is not allowed/);
-		expect(upstream.forward).not.toHaveBeenCalled();
-	});
-
-	it("advertisedTools returns the config tools", () => {
-		const cfg = makeConfig();
-		const r = new Router(cfg, secrets as any, upstream as any);
-		expect(r.advertisedTools()).toEqual(cfg.tools);
-	});
-
-	it("advertisedTools leaves out a tool whose optional integration is not set up", () => {
-		const cfg = makeConfig({ tools: [{ name: "get_me", mode: "read" }, { name: "npm_scaffold", mode: "write", custom: true }] });
-		expect(new Router(cfg, secrets as any, upstream as any).advertisedTools().map((t) => t.name)).toEqual(["get_me"]);
-	});
-
-	it("forwards a read call with the resolved read PAT", async () => {
-		const r = new Router(makeConfig(), secrets as any, upstream as any);
-		const out = await r.call("get_me", { owner: "CLDMV" });
-		expect(secrets.resolve).toHaveBeenCalledWith("cred:cldmv-read");
-		expect(upstream.forward).toHaveBeenCalledWith("get_me", { owner: "CLDMV" }, "token:cred:cldmv-read");
-		expect(out).toEqual({ content: [{ type: "text", text: "ok" }] });
-	});
-
-	it("uses the write PAT for a write-mode tool", async () => {
-		const r = new Router(makeConfig(), secrets as any, upstream as any);
-		await r.call("create_pull_request", { owner: "cldmv", repo: "gh-broker" });
-		expect(secrets.resolve).toHaveBeenCalledWith("cred:cldmv-write");
-	});
-
-	it("falls back an owner-less READ to defaultOwner's read PAT", async () => {
-		const r = new Router(makeConfig({ defaultOwner: "cldmv" }), secrets as any, upstream as any);
-		await r.call("get_me", {});
-		expect(secrets.resolve).toHaveBeenCalledWith("cred:cldmv-read");
-		expect(upstream.forward).toHaveBeenCalledWith("get_me", {}, "token:cred:cldmv-read");
-	});
-
-	it("does NOT fall back an owner-less WRITE, even with defaultOwner set", async () => {
-		const r = new Router(makeConfig({ defaultOwner: "cldmv" }), secrets as any, upstream as any);
-		await expect(r.call("create_pull_request", {})).rejects.toThrow(/could not determine repo owner/);
-	});
-
-	it("errors on an owner-less read when there is no defaultOwner", async () => {
-		const r = new Router(makeConfig(), secrets as any, upstream as any);
-		await expect(r.call("get_me", {})).rejects.toThrow(/could not determine repo owner/);
-	});
-
-	it("errors when the owner has no configured credentials", async () => {
-		const r = new Router(makeConfig(), secrets as any, upstream as any);
-		await expect(r.call("get_me", { owner: "stranger" })).rejects.toThrow(/no credentials configured for owner "stranger"/);
-	});
-
-	it("re-throws (and audits) when the upstream forward fails", async () => {
-		upstream.forward.mockRejectedValue(new Error("upstream boom"));
-		const r = new Router(makeConfig(), secrets as any, upstream as any);
-		await expect(r.call("get_me", { owner: "cldmv" })).rejects.toThrow(/upstream boom/);
-	});
-
-	describe("custom verbs", () => {
-		it("link_issue is DEFERRED — dispatching it (even if allowlisted) is not implemented", async () => {
-			// The catalog + router hooks for link_issue are commented out (App-token-only,
-			// not wired in). So even with an allowlist entry it never dispatches — it falls
-			// through to the not-implemented default, and never reaches the upstream.
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			await expect(r.call("link_issue", { owner: "cldmv", repo: "x", pull: 1, issue: 2 })).rejects.toThrow(
-				/custom verb "link_issue" not implemented/
-			);
-			expect(upstream.forward).not.toHaveBeenCalled();
-		});
-
-		it("resolve_review_thread runs on a write-PAT Octokit", async () => {
-			graphqlMock.mockResolvedValue({ resolveReviewThread: { thread: { id: "PRRT_1", isResolved: true } } });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("resolve_review_thread", { owner: "cldmv", threadId: "PRRT_1" });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-write" });
-			expect(out).toEqual({ content: [{ type: "text", text: "thread PRRT_1: isResolved=true" }] });
-		});
-
-		it("npm_scaffold is unavailable without an npm block, before any credential is read", async () => {
-			const r = new Router(makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }] }), secrets as any, upstream as any);
-			await expect(r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" })).rejects.toThrow(
-				/tool "npm_scaffold" is not available on this broker: the npm integration is not configured/
-			);
-			expect(secrets.resolve).not.toHaveBeenCalled();
-		});
-
-		it("npm_scaffold is unavailable when its token is not stored", async () => {
-			secrets.has.mockImplementation((ref: string) => ref !== "cred:npm-token");
-			const cfg = makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }], npm: { token: "cred:npm-token", scopes: ["@cldmv"] } });
-			const r = new Router(cfg, secrets as any, upstream as any);
-			await expect(r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" })).rejects.toThrow(/its credential "npm-token" is not stored/);
-			expect(secrets.resolve).not.toHaveBeenCalled();
-		});
-
-		it("npm_scaffold reads GitHub on the READ PAT and resolves the npm token", async () => {
-			requestMock.mockRejectedValue(Object.assign(new Error("Not Found"), { status: 404 }));
-			const cfg = makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }], npm: { token: "cred:npm-token", scopes: ["@cldmv"] } });
-			const r = new Router(cfg, secrets as any, upstream as any);
-			await expect(r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" })).rejects.toThrow(/repository cldmv\/x not found/);
-			expect(Octokit).toHaveBeenLastCalledWith({ auth: "token:cred:cldmv-read" });
-			expect(secrets.resolve).toHaveBeenCalledWith("cred:npm-token");
-		});
-
-		it("npm_scaffold publishes through the configured registry and returns the verb's result", async () => {
-			const b64 = (x: string) => Buffer.from(x).toString("base64");
-			requestMock.mockImplementation(async (route: string, p: any) => {
-				if (route === "GET /repos/{owner}/{repo}") return { data: { full_name: "CLDMV/x", private: false, default_branch: "master" } };
-				if (p.path === "package.json") return { data: { type: "file", encoding: "base64", content: b64('{"name":"@cldmv/x"}') } };
-				return { data: { type: "file", encoding: "base64", content: b64("name: publish") } };
-			});
-			const urls: string[] = [];
-			const fetchMock = vi.fn(async (url: string, init: any) => {
-				urls.push(`${init.method} ${url}`);
-				return { status: init.method === "GET" ? 404 : 200, headers: { get: () => null }, text: async () => "{}" };
-			});
-			vi.stubGlobal("fetch", fetchMock);
-			try {
-				const cfg = makeConfig({ tools: [{ name: "npm_scaffold", mode: "write", custom: true }], npm: { token: "cred:npm-token", scopes: ["@cldmv"], registry: "https://npm.example.test" } });
-				const r = new Router(cfg, secrets as any, upstream as any);
-				const out = await r.call("npm_scaffold", { owner: "cldmv", repo: "x", package: "@cldmv/x", otp: "123456" });
-				expect(JSON.parse((out.content[0] as any).text)).toMatchObject({ status: "needs_otp", done: ["publish"], remaining: ["trust"] });
-				expect(urls).toEqual(["GET https://npm.example.test/@cldmv%2fx?write=true", "PUT https://npm.example.test/@cldmv%2fx"]);
-				expect(fetchMock.mock.calls[1]![1].headers.authorization).toBe("Bearer token:cred:npm-token");
-			} finally {
-				vi.unstubAllGlobals();
-			}
-		});
-
-		it("throws for an allowlisted custom verb that has no implementation", async () => {
-			const cfg = makeConfig({ tools: [{ name: "weird_verb", mode: "read", custom: true }] });
-			const r = new Router(cfg, secrets as any, upstream as any);
-			await expect(r.call("weird_verb", { owner: "cldmv" })).rejects.toThrow(/custom verb "weird_verb" not implemented/);
-		});
-
-		it("reply_review_thread runs on a write-PAT Octokit", async () => {
-			graphqlMock.mockResolvedValue({ addPullRequestReviewThreadReply: { comment: { id: "C_1", url: "https://gh/c/1" } } });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("reply_review_thread", { owner: "cldmv", threadId: "PRRT_1", body: "thanks" });
-			expect(out).toEqual({ content: [{ type: "text", text: "replied: https://gh/c/1" }] });
-		});
-
-		it("issue_labels runs on a write-PAT Octokit and returns the resulting label set as JSON text", async () => {
-			requestMock.mockImplementation(async (route: string) => {
-				if (route === "GET /repos/{owner}/{repo}/issues/{issue_number}/labels") return { data: [{ name: "type: bug" }] };
-				if (route === "GET /repos/{owner}/{repo}/labels/{name}") return { data: { name: "area: auth" } };
-				return { data: [{ name: "type: bug" }, { name: "area: auth" }] };
-			});
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("issue_labels", { owner: "CLDMV", repo: "gh-broker", issue_number: 117, add: "area: auth" });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-write" });
-			expect(JSON.parse((out.content[0] as { text: string }).text)).toEqual({
-				issue: "CLDMV/gh-broker#117",
-				labels: ["type: bug", "area: auth"],
-				added: ["area: auth"],
-				removed: [],
-				created: []
-			});
-			expect(upstream.forward).not.toHaveBeenCalled();
-		});
-
-		it("report_unlabeled runs on a read-PAT Octokit and returns the JSON report as text", async () => {
-			requestMock.mockResolvedValue({ data: [], headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("report_unlabeled", { owner: "cldmv", repo: "gh-broker" });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-read" });
-			expect(out).toEqual({
-				content: [{ type: "text", text: JSON.stringify({ scanned: { repos: 1, issues: 0, pulls: 0 }, unlabeled: [] }) }]
-			});
-		});
-
-		it("report_security_alerts runs on a read-PAT Octokit and returns the JSON report as text", async () => {
-			requestMock.mockResolvedValue({ data: [], headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("report_security_alerts", { owner: "cldmv" });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-read" });
-			expect(out).toEqual({
-				content: [
-					{
-						type: "text",
-						text: JSON.stringify({
-							scanned: {},
-							scope: { dependabot: "org", codeql: "org", secrets: "org" },
-							counts: { dependabot: {}, codeql: {}, secrets: {} },
-							byRepo: [],
-							alerts: []
-						})
-					}
-				]
-			});
-		});
-
-		it("report_release_prs runs on a read-PAT Octokit and returns the JSON report as text", async () => {
-			requestMock.mockResolvedValue({ data: { total_count: 0, incomplete_results: false, items: [] }, headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("report_release_prs", { owner: "cldmv" });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-read" });
-			expect(out).toEqual({
-				content: [
-					{
-						type: "text",
-						text: JSON.stringify({ scanned: { releasePrs: 0 }, summary: { ready: 0, needsChangelog: 0, unknownVersion: 0 }, releasePrs: [] })
-					}
-				]
-			});
-		});
-
-		it("report_ci_status runs on a read-PAT Octokit and returns the JSON report as text", async () => {
-			requestMock.mockResolvedValueOnce({ data: { head: { sha: "abc" } }, headers: {} }).mockResolvedValueOnce({ data: { workflow_runs: [] }, headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5 });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-read" });
-			expect(out).toEqual({
-				content: [{ type: "text", text: JSON.stringify({ pull: 5, summary: { passed: 0, failed: 0, pending: 0 } }) }]
-			});
-		});
-
-		describe("report_ci_status tier-3 log fetch (via get_job_logs, not raw REST)", () => {
-			const queuePrRunJob = () =>
-				requestMock
-					.mockResolvedValueOnce({ data: { head: { sha: "abc" } }, headers: {} })
-					.mockResolvedValueOnce({ data: { workflow_runs: [{ id: 9, name: "CI", status: "completed", conclusion: "failure", html_url: "https://gh/run/9" }] }, headers: {} })
-					.mockResolvedValueOnce({ data: { jobs: [{ id: 555, name: "test", status: "completed", conclusion: "failure", html_url: "https://gh/job/555", steps: [] }] }, headers: {} });
-
-			it("calls get_job_logs with failed_only+run_id and attaches the matched job's log", async () => {
-				queuePrRunJob();
-				upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ logs: [{ job_id: 555, logs_content: "boom" }] }) }] });
-				const r = new Router(makeConfig(), secrets as any, upstream as any);
-				const out: any = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5, verbosity: 3 });
-				expect(upstream.forward).toHaveBeenCalledWith(
-					"get_job_logs",
-					{ owner: "cldmv", repo: "gh-broker", run_id: 9, failed_only: true, return_content: true, tail_lines: 200 },
-					"token:cred:cldmv-read"
-				);
-				expect(JSON.parse(out.content[0].text).failures[0].logTail).toBe("boom");
-			});
-
-			it("yields no logTail when get_job_logs' content isn't the expected JSON-text shape", async () => {
-				queuePrRunJob();
-				upstream.forward.mockResolvedValue({ content: [{ type: "text", text: "not json" }] });
-				const r = new Router(makeConfig(), secrets as any, upstream as any);
-				const out: any = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5, verbosity: 3 });
-				expect(JSON.parse(out.content[0].text).failures[0].logTail).toBeUndefined();
-			});
-
-			it("yields no logTail when get_job_logs has no text content block at all", async () => {
-				queuePrRunJob();
-				upstream.forward.mockResolvedValue({ content: [] });
-				const r = new Router(makeConfig(), secrets as any, upstream as any);
-				const out: any = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5, verbosity: 3 });
-				expect(JSON.parse(out.content[0].text).failures[0].logTail).toBeUndefined();
-			});
-
-			it("yields no logTail when get_job_logs itself throws (best-effort, not a hard failure)", async () => {
-				queuePrRunJob();
-				upstream.forward.mockRejectedValue(new Error("upstream boom"));
-				const r = new Router(makeConfig(), secrets as any, upstream as any);
-				const out: any = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5, verbosity: 3 });
-				expect(JSON.parse(out.content[0].text).failures[0].logTail).toBeUndefined();
-			});
-
-			it("yields no logTail when the parsed response has no logs array at all", async () => {
-				queuePrRunJob();
-				upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ message: "no failed jobs" }) }] });
-				const r = new Router(makeConfig(), secrets as any, upstream as any);
-				const out: any = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5, verbosity: 3 });
-				expect(JSON.parse(out.content[0].text).failures[0].logTail).toBeUndefined();
-			});
-
-			it("ignores a logs entry with a malformed job_id/logs_content", async () => {
-				queuePrRunJob();
-				upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ logs: [{ job_id: "not-a-number", logs_content: "x" }] }) }] });
-				const r = new Router(makeConfig(), secrets as any, upstream as any);
-				const out: any = await r.call("report_ci_status", { owner: "cldmv", repo: "gh-broker", pull: 5, verbosity: 3 });
-				expect(JSON.parse(out.content[0].text).failures[0].logTail).toBeUndefined();
-			});
-		});
-	});
-
-	describe("augmented tools", () => {
-		it("forwards untouched when ciVerbosity is absent (opt-in only)", async () => {
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get" });
-			expect(out).toEqual({ content: [{ type: "text", text: "ok" }] });
-			expect(Octokit).not.toHaveBeenCalled();
-		});
-
-		it("forwards untouched when method isn't get, even with ciVerbosity present", async () => {
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get_diff", ciVerbosity: 1 });
-			expect(out).toEqual({ content: [{ type: "text", text: "ok" }] });
-			expect(upstream.forward).toHaveBeenCalledWith("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get_diff" }, "token:cred:cldmv-read");
-		});
-
-		it("injects a ci field computed from the PR's head sha when ciVerbosity is given", async () => {
-			upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ number: 5, head: { sha: "abc123" } }) }] });
-			requestMock.mockResolvedValueOnce({ data: { workflow_runs: [] }, headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get", ciVerbosity: 0 });
-			expect(Octokit).toHaveBeenCalledWith({ auth: "token:cred:cldmv-read" });
-			// Strips gh-broker's own params before forwarding upstream.
-			expect(upstream.forward).toHaveBeenCalledWith("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get" }, "token:cred:cldmv-read");
-			expect(out).toEqual({
-				content: [{ type: "text", text: JSON.stringify({ number: 5, head: { sha: "abc123" }, ci: { pull: 5, summary: { passed: 0, failed: 0, pending: 0 } } }) }]
-			});
-		});
-
-		it("tier 3 on the augmented pull_request_read also fetches logs via get_job_logs", async () => {
-			upstream.forward.mockImplementation(async (tool: string) => {
-				if (tool === "pull_request_read") return { content: [{ type: "text", text: JSON.stringify({ number: 5, head: { sha: "abc123" } }) }] };
-				if (tool === "get_job_logs") return { content: [{ type: "text", text: JSON.stringify({ logs: [{ job_id: 555, logs_content: "boom" }] }) }] };
-				throw new Error(`unexpected upstream tool ${tool}`);
-			});
-			requestMock
-				.mockResolvedValueOnce({ data: { workflow_runs: [{ id: 9, name: "CI", status: "completed", conclusion: "failure", html_url: "https://gh/run/9" }] }, headers: {} })
-				.mockResolvedValueOnce({ data: { jobs: [{ id: 555, name: "test", status: "completed", conclusion: "failure", html_url: "https://gh/job/555", steps: [] }] }, headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out: any = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get", ciVerbosity: 3 });
-			expect(upstream.forward).toHaveBeenCalledWith(
-				"get_job_logs",
-				{ owner: "cldmv", repo: "gh-broker", run_id: 9, failed_only: true, return_content: true, tail_lines: 200 },
-				"token:cred:cldmv-read"
-			);
-			expect(JSON.parse(out.content[0].text).ci.failures[0].logTail).toBe("boom");
-		});
-
-		it("defaults to method 'get' (augments) when method is omitted entirely, and forwards a given logLines", async () => {
-			upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ number: 5, head: { sha: "abc123" } }) }] });
-			requestMock.mockResolvedValueOnce({ data: { workflow_runs: [] }, headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out: any = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, ciVerbosity: 0, logLines: 50 });
-			expect(JSON.parse(out.content[0].text).ci).toEqual({ pull: 5, summary: { passed: 0, failed: 0, pending: 0 } });
-		});
-
-		it("returns the upstream result untouched when there is no text content block at all", async () => {
-			upstream.forward.mockResolvedValue({ content: [] });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get", ciVerbosity: 0 });
-			expect(out).toEqual({ content: [] });
-			expect(Octokit).not.toHaveBeenCalled();
-		});
-
-		it("resolves a missing repo arg to an empty string rather than throwing", async () => {
-			upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ number: 5, head: { sha: "abc123" } }) }] });
-			requestMock.mockResolvedValueOnce({ data: { workflow_runs: [] }, headers: {} });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out: any = await r.call("pull_request_read", { owner: "cldmv", pullNumber: 5, method: "get", ciVerbosity: 0 });
-			expect(JSON.parse(out.content[0].text).ci).toEqual({ pull: 5, summary: { passed: 0, failed: 0, pending: 0 } });
-		});
-
-		it("returns the upstream result untouched when its content isn't the expected JSON-text shape", async () => {
-			upstream.forward.mockResolvedValue({ content: [{ type: "text", text: "not json" }] });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get", ciVerbosity: 0 });
-			expect(out).toEqual({ content: [{ type: "text", text: "not json" }] });
-			expect(Octokit).not.toHaveBeenCalled();
-		});
-
-		it("just forwards an augment-flagged tool with no dispatchAugmented case for it", async () => {
-			const cfg = makeConfig({ tools: [{ name: "weird_augment", mode: "read", augment: true }] });
-			const r = new Router(cfg, secrets as any, upstream as any);
-			const out = await r.call("weird_augment", { owner: "cldmv" });
-			expect(out).toEqual({ content: [{ type: "text", text: "ok" }] });
-		});
-
-		it("returns the upstream result untouched when the parsed PR is missing number/head.sha", async () => {
-			upstream.forward.mockResolvedValue({ content: [{ type: "text", text: JSON.stringify({ title: "no head here" }) }] });
-			const r = new Router(makeConfig(), secrets as any, upstream as any);
-			const out = await r.call("pull_request_read", { owner: "cldmv", repo: "gh-broker", pullNumber: 5, method: "get", ciVerbosity: 0 });
-			expect(out).toEqual({ content: [{ type: "text", text: JSON.stringify({ title: "no head here" }) }] });
-			expect(Octokit).not.toHaveBeenCalled();
-		});
-	});
-});
-
-describe("Router.call — GHCR verbs", () => {
-	const ghcr = { dropDir: "/srv/gh-broker/ghcr-drop", protectReleaseTags: true, maxArchiveBytes: 1024, owners: { cldmv: { username: "u", credential: "cred:cldmv-packages", images: ["hoot"] } } };
-	const tools = [
-		{ name: "ghcr_push", mode: "write", custom: true },
-		{ name: "ghcr_push_status", mode: "read", custom: true },
-		{ name: "ghcr_tags", mode: "read", custom: true }
-	];
-	let secrets: { resolve: ReturnType<typeof vi.fn> };
-	beforeEach(() => {
-		vi.spyOn(console, "log").mockImplementation(() => {});
-		secrets = { resolve: vi.fn((ref: string) => `token:${ref}`), has: vi.fn(() => true) };
-	});
-	afterEach(() => vi.restoreAllMocks());
-
-	it("dispatches ghcr_push_status to the GHCR service and returns JSON", async () => {
-		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
-		expect(await r.call("ghcr_push_status", { owner: "cldmv" })).toEqual({ content: [{ type: "text", text: JSON.stringify({ jobs: [] }) }] });
-	});
-
-	it("passes GHCR refusals through (allowlist checked before any network call or GHCR credential read)", async () => {
-		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
-		await expect(r.call("ghcr_tags", { owner: "cldmv", image: "private" })).rejects.toThrow(/not on the allowlist/);
-		await expect(r.call("ghcr_push", { owner: "cldmv", image: "private", tag: "t", archive: "a.tar" })).rejects.toThrow(/not on the allowlist/);
-		expect(secrets.resolve).not.toHaveBeenCalledWith("cred:cldmv-packages");
-	});
-
-	it("audits and rethrows a GHCR call that names no owner", async () => {
-		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
-		await expect(r.call("ghcr_push_status", {})).rejects.toThrow();
-	});
-
-	it("refuses GHCR verbs when config.ghcr is absent", async () => {
-		const r = new Router(makeConfig({ tools }), secrets as any, { forward: vi.fn() } as any);
-		await expect(r.call("ghcr_push", { owner: "cldmv", image: "hoot", tag: "t", archive: "a" })).rejects.toThrow(/tool "ghcr_push" is not available on this broker: GHCR pushes are not configured/);
-	});
-
-	it("refuses an owner whose GHCR credential is not stored, while another owner's is", async () => {
-		const ghcr = {
-			dropDir: "/srv/x/drop",
-			protectReleaseTags: true,
-			maxArchiveBytes: 1,
-			owners: { cldmv: { username: "u", credential: "cred:cldmv-packages", images: ["hoot"] }, other: { username: "o", credential: "cred:other-packages", images: ["x"] } }
-		};
-		secrets.has.mockImplementation((ref: string) => ref === "cred:other-packages");
-		const r = new Router(makeConfig({ tools, ghcr }), secrets as any, { forward: vi.fn() } as any);
-		await expect(r.call("ghcr_push_status", { owner: "cldmv" })).rejects.toThrow(/owner "cldmv"'s GHCR credential "cldmv-packages" is not stored/);
-		await expect(r.call("ghcr_push_status", { owner: "other" })).resolves.toMatchObject({ content: [{ type: "text" }] });
-		expect(secrets.resolve).not.toHaveBeenCalledWith("cred:cldmv-packages");
-	});
-});