@cldmv/gh-broker 0.8.0 → 0.9.0

package/src/verbs/report_unlabeled.ts

@@ -1,194 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/verbs/report_unlabeled.ts
- *	@Date: 2026-09-29T02:39:40+00:00 (1790649580)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import type { Octokit } from "@octokit/core";
-import { CallBudget, CallBudgetExhausted, RateLimited, listOwnerRepos, paginate } from "./rest-client.ts";
-
-/**
- * Custom verb: report_unlabeled — issues/PRs with no labels, for one repo or every
- * repo an owner has.
- *
- * Why a custom verb: the hosted GitHub MCP has no "no labels" filter and no
- * cross-repo aggregation — `list_issues`/`list_pull_requests` are single-repo, and
- * finding the unlabeled subset means paging through everything and filtering
- * client-side. This composes plain REST reads (`octokit.request`) over the read PAT,
- * the same allowlist tier as everything it uses.
- *
- * Fan-out safety (see rest-client.ts for the shared rate-limit/budget mechanics):
- * scanning "every repo" can mean dozens of repos x hundreds of issues/PRs each.
- *  - `maxRepos` caps how many repos get enumerated when `repo` is omitted.
- *  - `perRepoLimit` caps items fetched per repo, per resource type (issues, pulls).
- *  - `maxApiCalls` is a hard ceiling on total REST calls made by one invocation.
- * Hitting any cap — or GitHub's own rate limit — stops the scan and returns whatever
- * was found so far with `truncated: true`, rather than throwing partial work away.
- */
-
-export type Target = "issues" | "pulls" | "both";
-export type State = "open" | "closed" | "all";
-
-export interface ReportUnlabeledInput {
-	owner: string;
-	/** Repo name; omit to scan every non-archived repo visible to this owner's read PAT. */
-	repo?: string;
-	target?: Target;
-	state?: State;
-	/** Include draft PRs in the report (default: excluded — a draft isn't triage-ready). */
-	includeDrafts?: boolean;
-	/** Safety cap on repos scanned when `repo` is omitted. Default 50, hard-capped at 200. */
-	maxRepos?: number;
-	/** Safety cap on items fetched per repo, per resource type. Default 200, hard-capped at 1000. */
-	perRepoLimit?: number;
-	/** Hard ceiling on total REST calls for this invocation. Default 250, hard-capped at 1000. */
-	maxApiCalls?: number;
-}
-
-export interface UnlabeledItem {
-	repo: string;
-	type: "issue" | "pull";
-	number: number;
-	title: string;
-	url: string;
-	createdAt: string;
-}
-
-export type TruncatedReason = "max-repos" | "max-api-calls" | "rate-limited";
-
-export interface ReportUnlabeledResult {
-	scanned: { repos: number; issues: number; pulls: number };
-	unlabeled: UnlabeledItem[];
-	truncated?: boolean;
-	truncatedReason?: TruncatedReason;
-	/** Only set when truncatedReason is "rate-limited" and GitHub sent a Retry-After. */
-	retryAfterSeconds?: number;
-}
-
-const DEFAULT_MAX_REPOS = 50;
-const HARD_MAX_REPOS = 200;
-const DEFAULT_PER_REPO_LIMIT = 200;
-const HARD_PER_REPO_LIMIT = 1000;
-const DEFAULT_MAX_API_CALLS = 250;
-const HARD_MAX_API_CALLS = 1000;
-
-interface RawIssueOrPull {
-	number: number;
-	title: string;
-	html_url: string;
-	created_at: string;
-	labels: unknown[];
-	/** Present only on items returned by the /issues endpoint that are actually PRs. */
-	pull_request?: unknown;
-	/** Present only on items returned by the /pulls endpoint. */
-	draft?: boolean;
-}
-
-async function listUnlabeledIssues(
-	octokit: Octokit,
-	budget: CallBudget,
-	owner: string,
-	repo: string,
-	state: State,
-	limit: number
-): Promise<{ scanned: number; unlabeled: UnlabeledItem[] }> {
-	const raw = await paginate<RawIssueOrPull>(octokit, budget, "GET /repos/{owner}/{repo}/issues", { owner, repo, state }, limit);
-	const issuesOnly = raw.filter((it) => !("pull_request" in it));
-	const unlabeled = issuesOnly
-		.filter((it) => it.labels.length === 0)
-		.map((it) => toUnlabeledItem(owner, repo, "issue", it));
-	return { scanned: issuesOnly.length, unlabeled };
-}
-
-async function listUnlabeledPulls(
-	octokit: Octokit,
-	budget: CallBudget,
-	owner: string,
-	repo: string,
-	state: State,
-	limit: number,
-	includeDrafts: boolean
-): Promise<{ scanned: number; unlabeled: UnlabeledItem[] }> {
-	const raw = await paginate<RawIssueOrPull>(octokit, budget, "GET /repos/{owner}/{repo}/pulls", { owner, repo, state }, limit);
-	const unlabeled = raw
-		.filter((it) => includeDrafts || !it.draft)
-		.filter((it) => it.labels.length === 0)
-		.map((it) => toUnlabeledItem(owner, repo, "pull", it));
-	return { scanned: raw.length, unlabeled };
-}
-
-function toUnlabeledItem(owner: string, repo: string, type: "issue" | "pull", it: RawIssueOrPull): UnlabeledItem {
-	return { repo: `${owner}/${repo}`, type, number: it.number, title: it.title, url: it.html_url, createdAt: it.created_at };
-}
-
-export async function reportUnlabeled(octokit: Octokit, input: ReportUnlabeledInput): Promise<ReportUnlabeledResult> {
-	const target = input.target ?? "both";
-	const state = input.state ?? "open";
-	const includeDrafts = input.includeDrafts ?? false;
-	const maxRepos = Math.min(input.maxRepos ?? DEFAULT_MAX_REPOS, HARD_MAX_REPOS);
-	const perRepoLimit = Math.min(input.perRepoLimit ?? DEFAULT_PER_REPO_LIMIT, HARD_PER_REPO_LIMIT);
-	const maxApiCalls = Math.min(input.maxApiCalls ?? DEFAULT_MAX_API_CALLS, HARD_MAX_API_CALLS);
-	const budget = new CallBudget(maxApiCalls);
-
-	const unlabeled: UnlabeledItem[] = [];
-	const scanned = { repos: 0, issues: 0, pulls: 0 };
-
-	try {
-		let repos: string[];
-		if (input.repo) {
-			repos = [input.repo];
-		} else {
-			repos = await listOwnerRepos(octokit, budget, input.owner, maxRepos);
-		}
-		scanned.repos = repos.length;
-
-		for (const repo of repos) {
-			if (target === "issues" || target === "both") {
-				const out = await listUnlabeledIssues(octokit, budget, input.owner, repo, state, perRepoLimit);
-				scanned.issues += out.scanned;
-				unlabeled.push(...out.unlabeled);
-			}
-			if (target === "pulls" || target === "both") {
-				const out = await listUnlabeledPulls(octokit, budget, input.owner, repo, state, perRepoLimit, includeDrafts);
-				scanned.pulls += out.scanned;
-				unlabeled.push(...out.unlabeled);
-			}
-		}
-	} catch (err) {
-		if (err instanceof RateLimited) {
-			return { scanned, unlabeled, truncated: true, truncatedReason: "rate-limited", ...(err.retryAfterSeconds !== undefined ? { retryAfterSeconds: err.retryAfterSeconds } : {}) };
-		}
-		if (err instanceof CallBudgetExhausted) {
-			return { scanned, unlabeled, truncated: true, truncatedReason: "max-api-calls" };
-		}
-		throw err;
-	}
-
-	return { scanned, unlabeled };
-}
-
-/** JSON Schema advertised to the agent for report_unlabeled. */
-export const REPORT_UNLABELED_SCHEMA = {
-	type: "object" as const,
-	required: ["owner"],
-	additionalProperties: false,
-	properties: {
-		owner: { type: "string", description: "repository owner (org/user login) — selects the read credential" },
-		repo: { type: "string", description: "repository name; omit to scan every non-archived repo visible to this owner's read PAT" },
-		target: { type: "string", enum: ["issues", "pulls", "both"], description: "what to scan for missing labels", default: "both" },
-		state: { type: "string", enum: ["open", "closed", "all"], description: "issue/PR state to scan", default: "open" },
-		includeDrafts: { type: "boolean", description: "include draft PRs in the report (default: excluded)", default: false },
-		maxRepos: { type: "number", description: `safety cap on repos scanned when repo is omitted (default ${DEFAULT_MAX_REPOS}, hard cap ${HARD_MAX_REPOS})` },
-		perRepoLimit: { type: "number", description: `safety cap on items scanned per repo, per resource type (default ${DEFAULT_PER_REPO_LIMIT}, hard cap ${HARD_PER_REPO_LIMIT})` },
-		maxApiCalls: { type: "number", description: `hard ceiling on total REST calls this invocation makes (default ${DEFAULT_MAX_API_CALLS}, hard cap ${HARD_MAX_API_CALLS})` }
-	}
-};

package/src/verbs/rest-client.ts

@@ -1,181 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/verbs/rest-client.ts
- *	@Date: 2026-09-29T02:39:40+00:00 (1790649580)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import type { Octokit } from "@octokit/core";
-
-/**
- * Shared REST-call machinery for custom verbs that compose plain `octokit.request()`
- * calls instead of proxying a hosted-MCP tool (currently `report_unlabeled` and
- * `report_ci_status`). Factored out once a second verb needed the identical
- * rate-limit/call-budget handling — see report_unlabeled.ts's original version for
- * the rationale (kept here, not duplicated).
- *
- * Rate-limit floor: proactively stops once remaining requests drop to 2% of the
- * token's OWN limit (read from `x-ratelimit-limit` on every response — never
- * hardcode GitHub's number, it can differ by token type/tier), floored at an
- * absolute minimum for low-limit tokens. Leaves headroom for other broker traffic
- * sharing the same PAT, rather than waiting to actually get a 403.
- */
-
-const PAGE_SIZE = 100;
-const RATE_LIMIT_FLOOR_RATIO = 0.02;
-const RATE_LIMIT_FLOOR_MIN = 20;
-
-export class RateLimited extends Error {
-	readonly retryAfterSeconds?: number;
-	constructor(retryAfterSeconds?: number) {
-		super("rate limited");
-		this.retryAfterSeconds = retryAfterSeconds;
-	}
-}
-
-export class CallBudgetExhausted extends Error {
-	constructor() {
-		super("call budget exhausted");
-	}
-}
-
-export class CallBudget {
-	private remaining: number;
-	constructor(max: number) {
-		this.remaining = max;
-	}
-	/** Throws CallBudgetExhausted once the budget is spent. */
-	spend(): void {
-		if (this.remaining <= 0) throw new CallBudgetExhausted();
-		this.remaining--;
-	}
-}
-
-/**
- * A 403 is only a rate limit when GitHub says so — a Retry-After header, an exhausted
- * `x-ratelimit-remaining`, or a rate-limit/abuse message. Any other 403 is a permission
- * or feature-disabled answer (e.g. code scanning off for a repo) and must surface to the
- * caller with its status intact instead of being mistaken for throttling.
- */
-function looksRateLimited(err: Error, headers: Record<string, string> | undefined): boolean {
-	if (headers?.["retry-after"] !== undefined) return true;
-	if (headers?.["x-ratelimit-remaining"] === "0") return true;
-	return /rate limit|abuse|secondary/i.test(err.message);
-}
-
-/** Runs one octokit.request call, charging the budget and enforcing the rate-limit floor. */
-async function doRequest(octokit: Octokit, budget: CallBudget, route: string, params: Record<string, unknown>): Promise<{ data: unknown }> {
-	budget.spend();
-	try {
-		const res = await octokit.request(route, params);
-		const headers = res.headers as Record<string, string> | undefined;
-		const remainingHeader = headers?.["x-ratelimit-remaining"];
-		if (remainingHeader !== undefined) {
-			const remaining = Number(remainingHeader);
-			const limit = Number(headers?.["x-ratelimit-limit"]);
-			const floor = Number.isFinite(limit) ? Math.max(RATE_LIMIT_FLOOR_MIN, Math.ceil(limit * RATE_LIMIT_FLOOR_RATIO)) : RATE_LIMIT_FLOOR_MIN;
-			if (remaining <= floor) throw new RateLimited();
-		}
-		return res;
-	} catch (err) {
-		if (err instanceof RateLimited) throw err;
-		const status = (err as { status?: number }).status;
-		const headers = (err as { response?: { headers?: Record<string, string> } }).response?.headers;
-		if (status === 429 || (status === 403 && looksRateLimited(err as Error, headers))) {
-			const retryAfter = headers?.["retry-after"];
-			throw new RateLimited(retryAfter ? Number(retryAfter) : undefined);
-		}
-		throw err;
-	}
-}
-
-/**
- * Runs one octokit.request call expected to return a listing. `extract` pulls the
- * item array out of the response body — plain for bare-array endpoints
- * (issues/pulls/repos), overridden for endpoints that wrap the array in a named
- * field (e.g. Actions: `{ workflow_runs: [...] }`).
- */
-export async function req<T>(
-	octokit: Octokit,
-	budget: CallBudget,
-	route: string,
-	params: Record<string, unknown>,
-	extract: (data: unknown) => T[] = (d) => d as T[]
-): Promise<T[]> {
-	const res = await doRequest(octokit, budget, route, params);
-	return extract(res.data);
-}
-
-/** Runs one octokit.request call expected to return a single resource (not a listing). */
-export async function reqOne<T>(octokit: Octokit, budget: CallBudget, route: string, params: Record<string, unknown>): Promise<T> {
-	const res = await doRequest(octokit, budget, route, params);
-	return res.data as T;
-}
-
-/** Paginates a listing endpoint up to `limit` items, stopping at a short last page. */
-export async function paginate<T>(
-	octokit: Octokit,
-	budget: CallBudget,
-	route: string,
-	params: Record<string, unknown>,
-	limit: number,
-	extract?: (data: unknown) => T[]
-): Promise<T[]> {
-	const out: T[] = [];
-	let page = 1;
-	while (out.length < limit) {
-		const batch = await req<T>(octokit, budget, route, { ...params, per_page: PAGE_SIZE, page }, extract);
-		if (batch.length === 0) break;
-		out.push(...batch);
-		if (batch.length < PAGE_SIZE) break;
-		page++;
-	}
-	return out.length > limit ? out.slice(0, limit) : out;
-}
-
-/**
- * Paginates a listing endpoint that uses cursor pagination (`after`) instead of `page` —
- * Dependabot's alert endpoints. Follows the `rel="next"` cursor in the Link header and
- * stops at the last page or once `limit` items are collected.
- */
-export async function paginateAfter<T>(octokit: Octokit, budget: CallBudget, route: string, params: Record<string, unknown>, limit: number): Promise<T[]> {
-	const out: T[] = [];
-	let after: string | undefined;
-	while (out.length < limit) {
-		const res = await doRequest(octokit, budget, route, { ...params, per_page: PAGE_SIZE, ...(after ? { after } : {}) });
-		const batch = res.data;
-		if (!Array.isArray(batch) || batch.length === 0) break;
-		out.push(...(batch as T[]));
-		const link = (res as { headers?: Record<string, string> }).headers?.link;
-		const next = link ? /<[^>]*[?&]after=([^&>]+)[^>]*>;\s*rel="next"/.exec(link) : null;
-		if (!next) break;
-		after = decodeURIComponent(next[1]!);
-	}
-	return out.length > limit ? out.slice(0, limit) : out;
-}
-
-interface RawRepo {
-	name: string;
-	archived?: boolean;
-}
-
-/** Lists non-archived repo names for an owner — tries the org endpoint, falls back to user. */
-export async function listOwnerRepos(octokit: Octokit, budget: CallBudget, owner: string, maxRepos: number): Promise<string[]> {
-	let raw: RawRepo[];
-	try {
-		raw = await paginate<RawRepo>(octokit, budget, "GET /orgs/{owner}/repos", { owner, type: "all" }, maxRepos);
-	} catch (err) {
-		if (err instanceof RateLimited || err instanceof CallBudgetExhausted) throw err;
-		if ((err as { status?: number }).status !== 404) throw err;
-		raw = await paginate<RawRepo>(octokit, budget, "GET /users/{username}/repos", { username: owner, type: "all" }, maxRepos);
-	}
-	return raw.filter((r) => !r.archived).map((r) => r.name);
-}

package/src/verbs/review_thread.ts

@@ -1,138 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /src/verbs/review_thread.ts
- *	@Date: 2026-07-11T10:24:46-07:00 (1783790686)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-import type { Octokit } from "@octokit/core";
-
-/**
- * Custom verbs: reply_review_thread + resolve_review_thread — respond to and resolve
- * pull-request review threads (e.g. Copilot's review comments).
- *
- * Why custom verbs:
- *  - The hosted GitHub MCP can READ review threads (`pull_request_read` →
- *    `get_review_comments`, which returns each thread's node id + `isResolved`), but
- *    exposes NO tool to reply inside a thread or to resolve/unresolve one. Those are
- *    GraphQL mutations (`addPullRequestReviewThreadReply`, `resolveReviewThread`,
- *    `unresolveReviewThread`) with no hosted-MCP wrapper, so they can't be proxied.
- *  - Unlike `link_issue`'s App-token-only mutation, these ARE available to a
- *    fine-grained PAT with **Pull requests: write** — the same permission the broker's
- *    write cred already uses for `create_pull_request` / `update_pull_request` /
- *    `add_issue_comment`. So they run on the resolved write PAT (least privilege), not
- *    the App token.
- *
- * Uses Octokit (`octokit.graphql`) — GitHub's official SDK.
- *
- * The `threadId` is the review-thread NODE id (e.g. "PRRT_kwDO…"), taken verbatim from
- * `pull_request_read` (`get_review_comments`) — each returned thread carries it as `id`.
- */
-
-export interface ResolveReviewThreadInput {
-	owner: string;
-	repo?: string;
-	/** Review-thread node id (e.g. "PRRT_…") from pull_request_read get_review_comments. */
-	threadId: string;
-	/** true → resolve (default); false → unresolve. */
-	resolve?: boolean;
-}
-
-export interface ReplyReviewThreadInput {
-	owner: string;
-	repo?: string;
-	/** Review-thread node id (e.g. "PRRT_…") to reply into. */
-	threadId: string;
-	/** Reply body (Markdown). */
-	body: string;
-}
-
-const RESOLVE_THREAD = `
-	mutation($threadId: ID!) {
-		resolveReviewThread(input: { threadId: $threadId }) {
-			thread { id isResolved }
-		}
-	}`;
-
-const UNRESOLVE_THREAD = `
-	mutation($threadId: ID!) {
-		unresolveReviewThread(input: { threadId: $threadId }) {
-			thread { id isResolved }
-		}
-	}`;
-
-const REPLY_THREAD = `
-	mutation($threadId: ID!, $body: String!) {
-		addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $threadId, body: $body }) {
-			comment { id url }
-		}
-	}`;
-
-/** Resolve (or unresolve) a review thread. Returns the thread id and its new resolved state. */
-export async function resolveReviewThread(
-	octokit: Octokit,
-	input: ResolveReviewThreadInput
-): Promise<{ threadId: string; isResolved: boolean }> {
-	const unresolve = input.resolve === false;
-	const data = await octokit.graphql<{
-		resolveReviewThread?: { thread: { id: string; isResolved: boolean } };
-		unresolveReviewThread?: { thread: { id: string; isResolved: boolean } };
-	}>(unresolve ? UNRESOLVE_THREAD : RESOLVE_THREAD, { threadId: input.threadId });
-	const thread = (data.resolveReviewThread ?? data.unresolveReviewThread)?.thread;
-	if (!thread) throw new Error(`resolve_review_thread: no thread returned for "${input.threadId}"`);
-	return { threadId: thread.id, isResolved: thread.isResolved };
-}
-
-/** Post a reply inside a review thread. Returns the new comment's node id + html url. */
-export async function replyReviewThread(
-	octokit: Octokit,
-	input: ReplyReviewThreadInput
-): Promise<{ commentId: string; url: string }> {
-	if (!input.body || !input.body.trim()) throw new Error("reply_review_thread: body is required");
-	const data = await octokit.graphql<{
-		addPullRequestReviewThreadReply: { comment: { id: string; url: string } };
-	}>(REPLY_THREAD, { threadId: input.threadId, body: input.body });
-	const comment = data.addPullRequestReviewThreadReply?.comment;
-	if (!comment) throw new Error(`reply_review_thread: reply failed for "${input.threadId}"`);
-	return { commentId: comment.id, url: comment.url };
-}
-
-/** JSON Schema advertised to the agent for resolve_review_thread. */
-export const RESOLVE_REVIEW_THREAD_SCHEMA = {
-	type: "object" as const,
-	required: ["owner", "threadId"],
-	additionalProperties: false,
-	properties: {
-		owner: { type: "string", description: "repository owner (org/user login) — selects the write credential" },
-		repo: { type: "string", description: "repository name (optional; for the audit log only)" },
-		threadId: {
-			type: "string",
-			description: 'review-thread node id (e.g. "PRRT_…"), taken verbatim from pull_request_read get_review_comments'
-		},
-		resolve: { type: "boolean", description: "true to resolve (default), false to unresolve", default: true }
-	}
-};
-
-/** JSON Schema advertised to the agent for reply_review_thread. */
-export const REPLY_REVIEW_THREAD_SCHEMA = {
-	type: "object" as const,
-	required: ["owner", "threadId", "body"],
-	additionalProperties: false,
-	properties: {
-		owner: { type: "string", description: "repository owner (org/user login) — selects the write credential" },
-		repo: { type: "string", description: "repository name (optional; for the audit log only)" },
-		threadId: {
-			type: "string",
-			description: 'review-thread node id (e.g. "PRRT_…") to reply into, from pull_request_read get_review_comments'
-		},
-		body: { type: "string", description: "reply body (Markdown)" }
-	}
-};

package/tests/appauth.test.vitest.mts

@@ -1,76 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-const { createAppAuthMock, octokitCtor } = vi.hoisted(() => ({
-	createAppAuthMock: vi.fn(),
-	// Constructable mock (arrow fns can't be `new`-ed).
-	octokitCtor: vi.fn(function (this: any, opts: unknown) {
-		this.__opts = opts;
-	})
-}));
-
-vi.mock("@octokit/core", () => ({ Octokit: octokitCtor }));
-vi.mock("@octokit/auth-app", () => ({ createAppAuth: createAppAuthMock }));
-
-import { Octokit } from "@octokit/core";
-import { createAppAuth } from "@octokit/auth-app";
-import { AppAuth } from "../src/appauth.ts";
-
-function config(overrides: Record<string, unknown> = {}): any {
-	return {
-		listen: "unix:/x",
-		upstream: "https://x",
-		tools: [],
-		app: { appId: 555, privateKey: "cred:app-key" },
-		owners: {
-			cldmv: { read: "cred:r", write: "cred:w", installationId: 42 },
-			noapp: { read: "cred:r2", write: "cred:w2" }
-		},
-		...overrides
-	};
-}
-
-describe("AppAuth", () => {
-	let secrets: { resolve: ReturnType<typeof vi.fn> };
-
-	beforeEach(() => {
-		vi.clearAllMocks();
-		secrets = { resolve: vi.fn((ref: string) => (ref === "cred:app-key" ? "PEM-PRIVATE-KEY" : "other")) };
-	});
-
-	it("throws when the config has no app section", () => {
-		expect(() => new AppAuth(config({ app: undefined }), secrets as any)).toThrow(/no app config/);
-	});
-
-	it("resolves the App private key at construction", () => {
-		new AppAuth(config(), secrets as any);
-		expect(secrets.resolve).toHaveBeenCalledWith("cred:app-key");
-	});
-
-	it("returns null for an owner without an installationId", () => {
-		const auth = new AppAuth(config(), secrets as any);
-		expect(auth.octokitFor("noapp")).toBeNull();
-	});
-
-	it("returns null for an unknown owner", () => {
-		const auth = new AppAuth(config(), secrets as any);
-		expect(auth.octokitFor("nobody")).toBeNull();
-	});
-
-	it("builds an App-authed Octokit for an owner with an installationId", () => {
-		const auth = new AppAuth(config(), secrets as any);
-		const ok = auth.octokitFor("cldmv");
-		expect(ok).not.toBeNull();
-		expect(Octokit).toHaveBeenCalledWith({
-			authStrategy: createAppAuth,
-			auth: { appId: 555, privateKey: "PEM-PRIVATE-KEY", installationId: 42 }
-		});
-	});
-
-	it("caches the Octokit per installation id", () => {
-		const auth = new AppAuth(config(), secrets as any);
-		const first = auth.octokitFor("cldmv");
-		const second = auth.octokitFor("cldmv");
-		expect(first).toBe(second);
-		expect(Octokit).toHaveBeenCalledTimes(1);
-	});
-});

package/tests/audit.test.vitest.mts

@@ -1,48 +0,0 @@
-import { describe, it, expect, vi, afterEach } from "vitest";
-import { audit } from "../src/audit.ts";
-
-describe("audit", () => {
-	afterEach(() => {
-		vi.restoreAllMocks();
-	});
-
-	it("emits a single JSON line with a timestamp and the entry fields", () => {
-		const spy = vi.spyOn(console, "log").mockImplementation(() => {});
-		audit({ tool: "get_me", owner: "cldmv", mode: "read", repo: "cldmv/gh-broker", decision: "forward", ok: true });
-		expect(spy).toHaveBeenCalledTimes(1);
-		const line = spy.mock.calls[0]![0] as string;
-		const parsed = JSON.parse(line);
-		expect(parsed).toMatchObject({
-			tool: "get_me",
-			owner: "cldmv",
-			mode: "read",
-			repo: "cldmv/gh-broker",
-			decision: "forward",
-			ok: true
-		});
-		expect(typeof parsed.ts).toBe("string");
-		expect(new Date(parsed.ts).toISOString()).toBe(parsed.ts); // valid ISO timestamp
-	});
-
-	it("never emits a token — no cred value or Authorization content in the line", () => {
-		const spy = vi.spyOn(console, "log").mockImplementation(() => {});
-		// The audit API has no token field; even if a caller mistakenly passed extra
-		// fields, only the AuditEntry keys are what the router hands it. Assert the
-		// emitted line carries no token-shaped content for the fields it does take.
-		audit({ tool: "create_pull_request", owner: "cldmv", mode: "write", repo: "cldmv/x", decision: "custom", ok: true, detail: "done" });
-		const line = spy.mock.calls[0]![0] as string;
-		expect(line).not.toMatch(/token/i);
-		expect(line).not.toMatch(/bearer/i);
-		expect(line).not.toMatch(/cred:/);
-		const parsed = JSON.parse(line);
-		expect(Object.keys(parsed).sort()).toEqual(["decision", "detail", "mode", "ok", "owner", "repo", "tool", "ts"].sort());
-	});
-
-	it("emits a minimal deny entry", () => {
-		const spy = vi.spyOn(console, "log").mockImplementation(() => {});
-		audit({ tool: "rm_rf", decision: "deny", detail: "not in allowlist" });
-		const parsed = JSON.parse(spy.mock.calls[0]![0] as string);
-		expect(parsed).toMatchObject({ tool: "rm_rf", decision: "deny", detail: "not in allowlist" });
-		expect(parsed.owner).toBeUndefined();
-	});
-});