@cldmv/gh-broker 0.9.0 → 0.10.1

package/dist/index.mjs

@@ -7405,6 +7405,7 @@ var require_content_type = __commonJS({
 
 // src/config.ts
 import { readFileSync } from "node:fs";
+import { isAbsolute as isAbsolute3 } from "node:path";
 
 // src/verbs/ghcr/config.ts
 import { isAbsolute, normalize } from "node:path";
@@ -7473,6 +7474,184 @@ function imageAllowed(owner2, image2) {
   return owner2.images.some((g) => imageGlobToRegExp(g).test(image2));
 }
 
+// src/otp/totp.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var STEP_SECONDS = 30;
+function base32Decode(text) {
+  const clean = text.toUpperCase().replace(/=+$/, "");
+  const out = [];
+  let bits = 0;
+  let value = 0;
+  for (const ch of clean) {
+    const idx = BASE32_ALPHABET.indexOf(ch);
+    if (idx < 0) throw new Error("base32: invalid character");
+    value = value << 5 | idx;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+function hotp(key2, counter, digits = 6) {
+  const msg = Buffer.alloc(8);
+  msg.writeBigUInt64BE(BigInt(counter));
+  const mac2 = createHmac("sha1", key2).update(msg).digest();
+  const offset = mac2[mac2.length - 1] & 15;
+  const bin = (mac2[offset] & 127) << 24 | mac2[offset + 1] << 16 | mac2[offset + 2] << 8 | mac2[offset + 3];
+  return String(bin % 10 ** digits).padStart(digits, "0");
+}
+function stepAt(nowMs) {
+  return Math.floor(nowMs / 1e3 / STEP_SECONDS);
+}
+function safeEqual(a, b) {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+function matchStep(key2, code, nowMs, skew = 1, digits = 6) {
+  if (!new RegExp(`^\\d{${digits}}$`).test(code)) return void 0;
+  const now = stepAt(nowMs);
+  let matched;
+  for (let step = now - skew; step <= now + skew; step++) {
+    if (safeEqual(hotp(key2, step, digits), code)) matched = step;
+  }
+  return matched;
+}
+
+// src/otp/policy.ts
+var OTP_STATUS = "otp_status";
+var OTP_ARG = "otp";
+var DEFAULT_GATED = /* @__PURE__ */ new Set([
+  "create_repository",
+  "fork_repository",
+  "merge_pull_request",
+  "pull_request_review_write",
+  "actions_run_trigger",
+  "label_write",
+  "delete_branch",
+  "dismiss_alert",
+  // Disabled by default too (src/availability.ts); gated once enabled.
+  "create_pull_request_with_copilot",
+  "assign_copilot_to_issue",
+  "assign_copilot_to_issue_with_intent"
+]);
+var OTP_DEFAULTS = {
+  windowSeconds: 300,
+  maxFailures: 5,
+  lockoutSeconds: 600,
+  maxLockouts: 3,
+  statePath: "/var/lib/gh-broker/otp-state.json"
+};
+function otpSettings(config2) {
+  const o = config2.otp;
+  return {
+    windowSeconds: o?.windowSeconds ?? OTP_DEFAULTS.windowSeconds,
+    maxFailures: o?.maxFailures ?? OTP_DEFAULTS.maxFailures,
+    lockoutSeconds: o?.lockoutSeconds ?? OTP_DEFAULTS.lockoutSeconds,
+    maxLockouts: o?.maxLockouts ?? OTP_DEFAULTS.maxLockouts,
+    statePath: o?.statePath ?? OTP_DEFAULTS.statePath
+  };
+}
+function isGated(rule) {
+  if (rule.name === OTP_STATUS) return false;
+  return rule.otp ?? DEFAULT_GATED.has(rule.name);
+}
+function readSeed(config2, secrets) {
+  if (!config2.otp) return { problem: "OTP is not set up on this broker (no config.otp); re-run the installer to set it up" };
+  const name = config2.otp.seed.replace(/^cred:/, "");
+  if (!secrets.has(config2.otp.seed)) return { problem: `OTP is not set up on this broker: its seed credential "${name}" is not stored (re-run the installer to generate it)` };
+  let key2;
+  try {
+    key2 = base32Decode(secrets.resolve(config2.otp.seed).trim());
+  } catch {
+    key2 = Buffer.alloc(0);
+  }
+  if (key2.length === 0) return { problem: `OTP is not set up on this broker: the stored seed "${name}" is not valid base32 (re-run the installer to replace it)` };
+  return { key: key2 };
+}
+function otpSetupProblem(config2, secrets) {
+  const seed = readSeed(config2, secrets);
+  return "problem" in seed ? seed.problem : void 0;
+}
+
+// src/agents.ts
+import { isAbsolute as isAbsolute2 } from "node:path";
+var AGENT_USER = /^[a-z_][a-z0-9_-]{0,15}$/;
+var RESERVED_AGENT_USERS = ["__proto__", "root", "gh-broker"];
+function isAgentUser(name) {
+  return AGENT_USER.test(name) && !RESERVED_AGENT_USERS.includes(name);
+}
+var AGENT_GROUP_PREFIX = "gh-broker-agent-";
+var SERVICE_USER = "gh-broker";
+function agentsDir(listen) {
+  if (!listen.startsWith("agents:")) return void 0;
+  const dir = listen.slice("agents:".length);
+  return isAbsolute2(dir) ? dir : void 0;
+}
+function parseAgentGroups(groupFile) {
+  const agents = [];
+  const skipped = [];
+  for (const line of groupFile.split("\n")) {
+    const [group, , gidText, memberText] = line.split(":");
+    if (!group?.startsWith(AGENT_GROUP_PREFIX)) continue;
+    const user = group.slice(AGENT_GROUP_PREFIX.length);
+    const gid = Number(gidText);
+    if (!isAgentUser(user)) {
+      skipped.push(`${group}: "${user}" is not a valid agent user name`);
+      continue;
+    }
+    if (!gidText || !Number.isSafeInteger(gid)) {
+      skipped.push(`${group}: bad gid`);
+      continue;
+    }
+    const members2 = new Set((memberText ?? "").split(",").map((m) => m.trim()).filter(Boolean));
+    if (members2.size !== 2 || !members2.has(SERVICE_USER) || !members2.has(user)) {
+      skipped.push(`${group}: members must be exactly ${SERVICE_USER} and ${user}`);
+      continue;
+    }
+    agents.push({ user, group, gid });
+  }
+  return { agents, skipped };
+}
+
+// src/denylist.ts
+var DENIED_TOOLS = /* @__PURE__ */ new Map([
+  ["create_or_update_file", "file writes go through git"],
+  ["push_files", "file writes go through git"],
+  ["delete_file", "file writes go through git"],
+  ["delete_repository", "deleting a repo stays a manual step in GitHub"],
+  ["create_repository_ruleset", "rulesets are managed by org bootstrap"],
+  ["custom_properties_write", "repo configuration is managed by org bootstrap"]
+]);
+var WRITE_VERBS = "create|update|delete|write|set|add|remove|edit|manage|change";
+var writeTo = (subjects, verbs = WRITE_VERBS) => new RegExp(`(^|_)(${verbs})_(.*_)?(${subjects})$|(^|_)(${subjects})_(${verbs})$`);
+var DENIED_PATTERNS = [
+  [writeTo("files?|contents?|commits?|trees?|blobs?|refs?|git_refs?|changes", "create|update|delete|write|push"), "file writes go through git"],
+  [writeTo("repos?|repositor(y|ies)", "delete"), "deleting a repo stays a manual step in GitHub"],
+  // Not `create`: create_repository is a gated tool, not repo configuration.
+  [writeTo("repos?|repositor(y|ies)|repo_settings|repository_settings|settings|visibility|default_branch|topics", "update|edit|write|set|change|manage|replace|transfer|archive|unarchive|rename"), "repo configuration is managed by org bootstrap"],
+  [writeTo("custom_property|custom_properties|custom_property_values?"), "repo configuration is managed by org bootstrap"],
+  [writeTo("security_and_analysis|vulnerability_alerts|automated_security_fixes", `${WRITE_VERBS}|enable|disable`), "repo configuration is managed by org bootstrap"],
+  [writeTo("workflows?", "enable|disable|write|update|delete"), "turning workflows on or off changes how CI behaves; org bootstrap manages it"],
+  [writeTo("rulesets?"), "rulesets are managed by org bootstrap"],
+  [writeTo("branch_protections?|branch_protection_rules?"), "branch protection is managed by org bootstrap"],
+  [writeTo("variables?|secrets?"), "Actions variables and secrets are managed by org bootstrap"],
+  [writeTo("workflow_permissions|actions_permissions"), "workflow permissions are managed by org bootstrap"],
+  [writeTo("webhooks?|hooks?|deploy_keys?|collaborators?|environments?"), "repo access and configuration are managed by org bootstrap"],
+  [/^(bulk|batch)_(close|lock|unlock|delete|update|write|edit|label|set|add|remove)|^close_((all|bulk)_)?(issues|pull_requests|prs)$|_(issues|pull_requests)_close$/, "bulk writes aren't offered; loop over the single-item tool"],
+  [writeTo("issues?|conversations?|pull_requests?|discussions?", "lock|unlock"), "locking conversations isn't offered"],
+  [/^lock_write$/, "locking conversations isn't offered"]
+];
+function deniedReason(name) {
+  const exact = DENIED_TOOLS.get(name);
+  if (exact) return exact;
+  for (const [pattern, why] of DENIED_PATTERNS) if (pattern.test(name)) return why;
+  return void 0;
+}
+
 // src/config.ts
 var MODES = ["read", "write"];
 function loadConfig(path) {
@@ -7484,8 +7663,11 @@ function loadConfig(path) {
   }
   if (typeof raw !== "object" || raw === null) throw new Error("config: root must be an object");
   const c = raw;
-  if (typeof c.listen !== "string" || !c.listen.startsWith("unix:")) {
-    throw new Error('config.listen: must be a "unix:<path>" string');
+  if (typeof c.listen === "string" && c.listen.startsWith("unix:")) {
+    throw new Error('config.listen: the shared "unix:" socket was replaced by one socket per agent; re-run the installer (sudo gh-broker install) to set listen to "agents:/run/gh-broker/agents"');
+  }
+  if (typeof c.listen !== "string" || !agentsDir(c.listen)) {
+    throw new Error('config.listen: must be "agents:<absolute directory>", e.g. "agents:/run/gh-broker/agents"');
   }
   if (typeof c.upstream !== "string" || !/^https?:\/\//.test(c.upstream)) {
     throw new Error("config.upstream: must be an http(s) URL");
@@ -7499,11 +7681,20 @@ function loadConfig(path) {
     if (typeof o.name !== "string" || !o.name) throw new Error(`config.tools[${i}].name: required`);
     if (!MODES.includes(o.mode)) throw new Error(`config.tools[${i}].mode: must be read|write`);
     if (seen.has(o.name)) throw new Error(`config.tools: duplicate tool "${o.name}"`);
+    const denied = deniedReason(o.name);
+    if (denied) throw new Error(`config.tools[${i}] ("${o.name}"): never allowed in gh-broker (${denied}); remove it from config.tools`);
     seen.add(o.name);
     const custom2 = o.custom === true;
     const augment = o.augment === true;
     if (custom2 && augment) throw new Error(`config.tools[${i}] ("${o.name}"): custom and augment are mutually exclusive`);
-    return { name: o.name, mode: o.mode, custom: custom2, augment };
+    if (o.otp !== void 0 && typeof o.otp !== "boolean") throw new Error(`config.tools[${i}].otp: must be true or false`);
+    if (o.enabled !== void 0 && typeof o.enabled !== "boolean") throw new Error(`config.tools[${i}].enabled: must be true or false`);
+    if (o.name === OTP_STATUS) {
+      if (o.otp === true) throw new Error(`config.tools[${i}] ("${OTP_STATUS}"): can't be gated (otp: true)`);
+      if (o.enabled === false) throw new Error(`config.tools[${i}] ("${OTP_STATUS}"): can't be disabled (enabled: false)`);
+      if (!custom2) throw new Error(`config.tools[${i}] ("${OTP_STATUS}"): must be custom: true`);
+    }
+    return { name: o.name, mode: o.mode, custom: custom2, augment, ...typeof o.otp === "boolean" ? { otp: o.otp } : {}, ...typeof o.enabled === "boolean" ? { enabled: o.enabled } : {} };
   });
   if (typeof c.owners !== "object" || c.owners === null) throw new Error("config.owners: must be an object");
   const owners = {};
@@ -7580,6 +7771,7 @@ function loadConfig(path) {
       ...Array.isArray(n.tokenOrgs) ? { tokenOrgs: n.tokenOrgs } : {}
     };
   }
+  const otp = c.otp !== void 0 ? parseOtpConfig(c.otp) : void 0;
   return {
     listen: c.listen,
     upstream: c.upstream,
@@ -7589,9 +7781,27 @@ function loadConfig(path) {
     ...secrets ? { secrets } : {},
     ...defaultOwner ? { defaultOwner } : {},
     ...npm ? { npm } : {},
-    ...c.ghcr !== void 0 ? { ghcr: parseGhcrConfig(c.ghcr) } : {}
+    ...c.ghcr !== void 0 ? { ghcr: parseGhcrConfig(c.ghcr) } : {},
+    ...otp ? { otp } : {}
   };
 }
+function parseOtpConfig(raw) {
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("config.otp: must be an object");
+  const o = raw;
+  if (typeof o.seed !== "string" || !o.seed.startsWith("cred:")) throw new Error('config.otp.seed: must be a "cred:<name>" ref');
+  const out = { seed: o.seed };
+  for (const key2 of ["windowSeconds", "maxFailures", "lockoutSeconds", "maxLockouts"]) {
+    const v = o[key2];
+    if (v === void 0) continue;
+    if (typeof v !== "number" || !Number.isSafeInteger(v) || v <= 0) throw new Error(`config.otp.${key2}: must be a positive integer`);
+    out[key2] = v;
+  }
+  if (o.statePath !== void 0) {
+    if (typeof o.statePath !== "string" || !isAbsolute3(o.statePath)) throw new Error("config.otp.statePath: must be an absolute path");
+    out.statePath = o.statePath;
+  }
+  return out;
+}
 function indexTools(tools) {
   return new Map(tools.map((t) => [t.name, t]));
 }
@@ -7655,6 +7865,7 @@ function validateRefs(config2, read) {
     assertSafeName(config2.npm.token.slice(CRED_PREFIX.length));
   }
   for (const ref of ghcrCredRefs(config2.ghcr)) credName(ref);
+  if (config2.otp) credName(config2.otp.seed);
 }
 function systemdCredsStore(config2) {
   const dir = process.env.CREDENTIALS_DIRECTORY;
@@ -9590,9 +9801,9 @@ var asciiTabOrNewline = /[\t\n\r]/g;
 function stripTabAndNewline(value) {
   return value.replace(asciiTabOrNewline, "");
 }
-function urlHostnameOk(url2, hostname) {
-  hostname.lastIndex = 0;
-  return hostname.test(url2.hostname);
+function urlHostnameOk(url2, hostname2) {
+  hostname2.lastIndex = 0;
+  return hostname2.test(url2.hostname);
 }
 function urlProtocolOk(url2, protocol) {
   protocol.lastIndex = 0;
@@ -10190,7 +10401,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
     }
     return propValues;
   });
-  const isObject3 = isObject2;
+  const isObject4 = isObject2;
   const catchall = def.catchall;
   let value;
   const memo2 = globalConfig.memoizer;
@@ -10198,7 +10409,7 @@ var $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject3(input)) {
+    if (!isObject4(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -10334,7 +10545,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
     return doc.compile();
   };
   let fastpass;
-  const isObject3 = isObject2;
+  const isObject4 = isObject2;
   const jit = !globalConfig.jitless;
   const allowsEval2 = allowsEval;
   const fastEnabled = jit && allowsEval2.value;
@@ -10343,7 +10554,7 @@ var $ZodObjectJIT = /* @__PURE__ */ $constructor("$ZodObjectJIT", (inst, def) =>
   inst._zod.parse = (payload, ctx) => {
     value ?? (value = _normalized.value);
     const input = payload.value;
-    if (!isObject3(input)) {
+    if (!isObject4(input)) {
       payload.issues.push({
         expected: "object",
         code: "invalid_type",
@@ -17798,8 +18009,8 @@ async function random(size) {
   const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
   let result = "";
   while (result.length < size) {
-    const randomBytes = await getRandomValues(size - result.length);
-    for (const randomByte of randomBytes) {
+    const randomBytes3 = await getRandomValues(size - result.length);
+    for (const randomByte of randomBytes3) {
       if (randomByte < evenDistCutoff) {
         result += mask[randomByte % mask.length];
       }
@@ -19985,8 +20196,8 @@ var stringifyIteratively = (rootValue, replacer, spaceParam) => {
   const isFunctionReplacer = typeof replacer === "function";
   const propertyList = Array.isArray(replacer) ? new Set(replacer.map(String)) : null;
   const prepareVal = (parent, key2, val) => {
-    const isObject3 = val !== null && typeof val === "object";
-    const hasToJSON = isObject3 && typeof val.toJSON === "function";
+    const isObject4 = val !== null && typeof val === "object";
+    const hasToJSON = isObject4 && typeof val.toJSON === "function";
     if (hasToJSON) {
       val = val.toJSON(key2);
     }
@@ -20820,7 +21031,14 @@ function audit(entry) {
 
 // src/availability.ts
 var GHCR_TOOLS = /* @__PURE__ */ new Set(["ghcr_push", "ghcr_push_status", "ghcr_tags"]);
+var DEFAULT_DISABLED = /* @__PURE__ */ new Set(["create_pull_request_with_copilot", "assign_copilot_to_issue", "assign_copilot_to_issue_with_intent"]);
+function isEnabled(rule) {
+  return rule.enabled ?? !DEFAULT_DISABLED.has(rule.name);
+}
 function unavailableReason(rule, config2, secrets) {
+  if (!isEnabled(rule)) {
+    return DEFAULT_DISABLED.has(rule.name) && rule.enabled === void 0 ? `it is disabled by default; set "enabled": true on its entry in config.tools to turn it on` : `it is disabled in config.tools ("enabled": false)`;
+  }
   if (rule.name === "npm_scaffold") {
     if (!config2.npm) return "the npm integration is not configured (enable it with the installer's --npm)";
     if (!secrets.has(config2.npm.token)) return `its credential "${config2.npm.token.replace(/^cred:/, "")}" is not stored (re-run the installer with --npm)`;
@@ -20832,6 +21050,7 @@ function unavailableReason(rule, config2, secrets) {
       return `no GHCR credential is stored (${refs.map((r) => `"${r.replace(/^cred:/, "")}"`).join(", ")}; re-run the installer to add one)`;
     }
   }
+  if (isGated(rule)) return otpSetupProblem(config2, secrets);
   return void 0;
 }
 
@@ -21249,14 +21468,17 @@ var SEARCH_PAGE_SIZE = 100;
 var SEARCH_MAX_PAGES = 10;
 var LOCKFILES = ["package-lock.json", "pnpm-lock.yaml"];
 var NAME_PATTERN = /^(@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
-var DEV_LIST_MAX_PAGES = 20;
+var DEV_LIST_PAGE_SIZE = 25;
+var DEV_LIST_MIN_PAGE_SIZE = 5;
+var DEV_LIST_MAX_PAGES = 80;
+var TIMEOUT_STATUSES = /* @__PURE__ */ new Set([502, 503, 504]);
 var DEV_BRANCH = "dev";
 var SEARCH_NOTE = "Candidates come from GitHub code search, which lags recent commits and only indexes default branches; each candidate was verified against its default-branch package.json. A repo that changed very recently can be missing.";
 var DEV_NOTE = " Every `dev` branch that differs from its default branch was also read in full, so dev-trunk repos are included; a `dev` whose root package.json version is below the default branch's is treated as abandoned and skipped (see `abandonedDev`).";
 var NO_DEV_NOTE = " Dev branches were not read, so a dev-trunk repo whose real manifests live on `dev` is missing.";
-var DEV_BRANCHES_QUERY = `query($owner: String!, $after: String) {
+var DEV_BRANCHES_QUERY = `query($owner: String!, $after: String, $first: Int!) {
   repositoryOwner(login: $owner) {
-    repositories(first: 100, after: $after, orderBy: { field: NAME, direction: ASC }) {
+    repositories(first: $first, after: $after, orderBy: { field: NAME, direction: ASC }) {
       pageInfo { hasNextPage endCursor }
       nodes {
         name
@@ -21401,8 +21623,17 @@ async function listDevBranches(octokit, budget, owner2) {
   const repos = [];
   const abandoned = [];
   let after = null;
+  let first = DEV_LIST_PAGE_SIZE;
   for (let page = 1; page <= DEV_LIST_MAX_PAGES; page++) {
-    const res = await reqOne(octokit, budget, "POST /graphql", { query: DEV_BRANCHES_QUERY, variables: { owner: owner2, after } });
+    let res;
+    try {
+      res = await reqOne(octokit, budget, "POST /graphql", { query: DEV_BRANCHES_QUERY, variables: { owner: owner2, after, first } });
+    } catch (err) {
+      if (!TIMEOUT_STATUSES.has(err.status)) throw err;
+      if (first === DEV_LIST_MIN_PAGE_SIZE) return { repos, abandoned, complete: false, timedOut: true };
+      first = Math.max(DEV_LIST_MIN_PAGE_SIZE, Math.ceil(first / 2));
+      continue;
+    }
     const conn = res.data?.repositoryOwner?.repositories;
     if (!conn) throw new Error(`report_dependents: listing dev branches failed: ${res.errors?.map((e) => e.message).join("; ") ?? `no owner "${owner2}"`}`);
     for (const r of conn.nodes) {
@@ -21506,8 +21737,9 @@ async function reportDependents(octokit, input, deps = {}) {
       dependents.push(entry);
     }
     if (devBranches) {
-      const { repos, abandoned, complete } = await listDevBranches(octokit, budget, owner2);
+      const { repos, abandoned, complete, timedOut } = await listDevBranches(octokit, budget, owner2);
       abandonedDev.push(...abandoned);
+      if (timedOut) truncatedReason ??= "github-timeout";
       if (!complete) truncatedReason ??= "max-repos";
       const room = Math.max(0, maxRepos - Math.min(repoNames.length, maxRepos));
       if (repos.length > room) truncatedReason ??= "max-repos";
@@ -23295,7 +23527,7 @@ function tarballDigests(tarball) {
 var PLACEHOLDER_VERSION = "0.0.0-stage";
 var SCAFFOLD_MARKER = "gh-broker";
 var DEFAULT_WORKFLOW = "publish.yml";
-var INPUT_KEYS2 = /* @__PURE__ */ new Set(["owner", "repo", "package", "otp", "workflow"]);
+var INPUT_KEYS2 = /* @__PURE__ */ new Set(["owner", "repo", "package", "npm_otp", "workflow"]);
 var PACKAGE_NAME = /^@[a-z0-9][a-z0-9._~-]*\/[a-z0-9][a-z0-9._~-]*$/;
 var NPM_SCAFFOLD_SCHEMA = {
   type: "object",
@@ -23303,10 +23535,10 @@ var NPM_SCAFFOLD_SCHEMA = {
     owner: { type: "string", description: "Repository owner (a configured owner)." },
     repo: { type: "string", description: "Repository whose package.json names the package." },
     package: { type: "string", description: 'Scoped package name, e.g. "@cldmv/new-thing". Must be under a scope in config.npm.scopes.' },
-    otp: { type: "string", description: "One-time password the user read from their authenticator. Ask the user for it right before calling; codes expire in about 30 seconds." },
+    npm_otp: { type: "string", description: "npm one-time password the user read from their authenticator. Ask the user for it right before calling; codes expire in about 30 seconds." },
     workflow: { type: "string", description: `The repo's publish workflow file in .github/workflows. Default "publish.yml".` }
   },
-  required: ["owner", "repo", "package", "otp"],
+  required: ["owner", "repo", "package", "npm_otp"],
   additionalProperties: false
 };
 var fail3 = (msg) => {
@@ -23320,7 +23552,7 @@ function validate3(input) {
   if (typeof a.owner !== "string" || !/^[A-Za-z0-9-]+$/.test(a.owner)) fail3('"owner" must be a GitHub owner name');
   if (typeof a.repo !== "string" || !/^[A-Za-z0-9._-]+$/.test(a.repo)) fail3('"repo" must be a repository name');
   if (typeof a.package !== "string" || a.package.length > 214 || !PACKAGE_NAME.test(a.package)) fail3('"package" must be a lowercase scoped npm package name, e.g. "@cldmv/new-thing"');
-  if (typeof a.otp !== "string" || !/^[0-9]{6,8}$/.test(a.otp)) fail3('"otp" must be the 6-8 digit code from the authenticator');
+  if (typeof a.npm_otp !== "string" || !/^[0-9]{6,8}$/.test(a.npm_otp)) fail3('"npm_otp" must be the 6-8 digit npm code from the authenticator');
   if (a.workflow !== void 0 && (typeof a.workflow !== "string" || !/^[A-Za-z0-9._-]+\.ya?ml$/.test(a.workflow))) {
     fail3('"workflow" must be a workflow file name in .github/workflows, e.g. "publish.yml"');
   }
@@ -23328,7 +23560,7 @@ function validate3(input) {
     owner: a.owner,
     repo: a.repo,
     package: a.package,
-    otp: a.otp,
+    npm_otp: a.npm_otp,
     workflow: a.workflow ?? DEFAULT_WORKFLOW
   };
 }
@@ -23439,7 +23671,7 @@ async function npmScaffold(input, deps) {
   const existing = await deps.registry.packument(args.package);
   if (!existing) {
     try {
-      await deps.registry.publish(placeholderDocument(args.package, facts, access, deps.registry.registry), args.package, args.otp);
+      await deps.registry.publish(placeholderDocument(args.package, facts, access, deps.registry.registry), args.package, args.npm_otp);
     } catch (err) {
       if (err instanceof NpmOtpRequired) {
         return { ...base, status: "needs_otp", done: [], remaining: ["publish", "trust"], message: "npm refused the one-time password before publishing; nothing was written. Call again with a fresh code." };
@@ -23464,7 +23696,7 @@ async function npmScaffold(input, deps) {
   }
   let out;
   try {
-    out = await deps.registry.addGithubTrust(args.package, { repository: facts.repository, file: args.workflow }, args.otp);
+    out = await deps.registry.addGithubTrust(args.package, { repository: facts.repository, file: args.workflow }, args.npm_otp);
   } catch (err) {
     if (err instanceof NpmOtpRequired) {
       return {
@@ -23511,10 +23743,187 @@ async function npmScaffold(input, deps) {
   };
 }
 
+// src/verbs/minimize_comment.ts
+var MINIMIZE_CLASSIFIERS = ["RESOLVED", "OUTDATED", "DUPLICATE", "OFF_TOPIC", "SPAM", "ABUSE"];
+var MINIMIZE = `
+	mutation($id: ID!, $classifier: ReportedContentClassifiers!) {
+		minimizeComment(input: { subjectId: $id, classifier: $classifier }) {
+			minimizedComment { isMinimized minimizedReason }
+		}
+	}`;
+var UNMINIMIZE = `
+	mutation($id: ID!) {
+		unminimizeComment(input: { subjectId: $id }) {
+			unminimizedComment { isMinimized minimizedReason }
+		}
+	}`;
+async function nodeIdOf(octokit, input) {
+  if (input.commentId !== void 0) {
+    if (typeof input.commentId !== "string" || !input.commentId.trim()) throw new Error("minimize_comment: commentId must be a comment node id");
+    if (input.commentNumber !== void 0) throw new Error("minimize_comment: pass commentId or commentNumber, not both");
+    return input.commentId;
+  }
+  if (!Number.isSafeInteger(input.commentNumber) || input.commentNumber <= 0) {
+    throw new Error("minimize_comment: pass commentId (node id), or commentNumber (REST id) with type and repo");
+  }
+  if (input.type !== "issue" && input.type !== "review") throw new Error('minimize_comment: commentNumber needs type "issue" (issue or PR conversation comment) or "review" (PR review comment)');
+  if (typeof input.repo !== "string" || !input.repo) throw new Error("minimize_comment: commentNumber needs repo");
+  const route = input.type === "issue" ? "GET /repos/{owner}/{repo}/issues/comments/{comment_id}" : "GET /repos/{owner}/{repo}/pulls/comments/{comment_id}";
+  const res = await octokit.request(route, { owner: input.owner, repo: input.repo, comment_id: input.commentNumber });
+  const nodeId = res.data.node_id;
+  if (typeof nodeId !== "string" || !nodeId) throw new Error(`minimize_comment: GitHub returned no node id for ${input.type} comment ${input.commentNumber}`);
+  return nodeId;
+}
+async function minimizeComment(octokit, input) {
+  const classifier = input.classifier ?? "RESOLVED";
+  if (input.unhide === true && input.classifier !== void 0) throw new Error("minimize_comment: unhide takes no classifier");
+  if (!MINIMIZE_CLASSIFIERS.includes(classifier)) throw new Error(`minimize_comment: classifier must be one of ${MINIMIZE_CLASSIFIERS.join(", ")}`);
+  const id = await nodeIdOf(octokit, input);
+  if (input.unhide === true) {
+    const data2 = await octokit.graphql(UNMINIMIZE, { id });
+    const c2 = data2.unminimizeComment?.unminimizedComment;
+    if (!c2) throw new Error(`minimize_comment: GitHub returned no comment for "${id}"`);
+    return { commentId: id, isMinimized: c2.isMinimized, minimizedReason: c2.minimizedReason ?? null };
+  }
+  const data = await octokit.graphql(MINIMIZE, { id, classifier });
+  const c = data.minimizeComment?.minimizedComment;
+  if (!c) throw new Error(`minimize_comment: GitHub returned no comment for "${id}"`);
+  return { commentId: id, isMinimized: c.isMinimized, minimizedReason: c.minimizedReason ?? null };
+}
+var MINIMIZE_COMMENT_DESCRIPTION = `Hide a comment on an issue or PR (collapsed, like "Hide \u2192 Resolved" in GitHub), or show it again with unhide: true. Meant for folding away bot review comments once they're addressed. Name the comment by node id (commentId, e.g. from pull_request_read get_review_comments), or by REST id (commentNumber) with type "issue" (issue or PR conversation comment) or "review" (PR review comment) and repo. Runs on the write PAT.`;
+var MINIMIZE_COMMENT_SCHEMA = {
+  type: "object",
+  required: ["owner"],
+  additionalProperties: false,
+  properties: {
+    owner: { type: "string", description: "repository owner (org/user login); selects the write credential" },
+    repo: { type: "string", description: "repository name (needed with commentNumber)" },
+    commentId: { type: "string", description: 'comment node id, e.g. "IC_\u2026" or "PRRC_\u2026"' },
+    commentNumber: { type: "number", description: "REST comment id, used with type and repo when the node id isn't at hand" },
+    type: { type: "string", enum: ["issue", "review"], description: "with commentNumber: issue (issue or PR conversation comment) or review (PR review comment)" },
+    classifier: { type: "string", enum: [...MINIMIZE_CLASSIFIERS], description: "why it's hidden (default RESOLVED)" },
+    unhide: { type: "boolean", description: "true shows a hidden comment again" }
+  }
+};
+
+// src/verbs/delete_branch.ts
+var KEPT_BRANCHES = /* @__PURE__ */ new Set(["master", "main", "next", "hotfixes", "dev", "badges", "gh-pages"]);
+async function deleteBranch(octokit, input) {
+  const { owner: owner2, repo } = input;
+  if (typeof repo !== "string" || !repo) throw new Error("delete_branch: repo is required");
+  const branch = typeof input.branch === "string" ? input.branch.replace(/^refs\/heads\//, "") : "";
+  if (!branch) throw new Error("delete_branch: branch is required");
+  if (KEPT_BRANCHES.has(branch)) throw new Error(`delete_branch: refusing to delete "${branch}": the release flow depends on it`);
+  const meta2 = await octokit.request("GET /repos/{owner}/{repo}", { owner: owner2, repo });
+  const repoData = meta2.data;
+  const defaultBranch = repoData.default_branch;
+  if (branch === defaultBranch) throw new Error(`delete_branch: refusing to delete "${branch}": it is ${owner2}/${repo}'s default branch`);
+  const lookups = [
+    { side: "head", where: { owner: owner2, repo }, filter: { head: `${owner2}:${branch}` } },
+    { side: "base", where: { owner: owner2, repo }, filter: { base: branch } }
+  ];
+  const upstreams = repoData.fork ? [repoData.parent, repoData.source] : [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const up of upstreams) {
+    if (!up?.owner?.login || !up.name || seen.has(`${up.owner.login}/${up.name}`)) continue;
+    seen.add(`${up.owner.login}/${up.name}`);
+    lookups.push({ side: "head", where: { owner: up.owner.login, repo: up.name }, filter: { head: `${owner2}:${branch}` } });
+  }
+  for (const { side, where, filter } of lookups) {
+    const open2 = await octokit.request("GET /repos/{owner}/{repo}/pulls", { ...where, state: "open", ...filter, per_page: 10 });
+    const prs = open2.data;
+    if (prs.length > 0) {
+      const ref2 = where.owner === owner2 && where.repo === repo ? "" : `${where.owner}/${where.repo}`;
+      throw new Error(`delete_branch: refusing to delete "${branch}": it is the ${side} of open PR ${prs.map((p) => `${ref2}#${p.number}`).join(", ")}, which deleting it would close`);
+    }
+  }
+  const missing = new Error(`delete_branch: no branch "${branch}" in ${owner2}/${repo}`);
+  let ref;
+  try {
+    ref = await octokit.request("GET /repos/{owner}/{repo}/git/ref/{ref}", { owner: owner2, repo, ref: `heads/${branch}` });
+  } catch (err) {
+    throw err.status === 404 ? missing : err;
+  }
+  const sha = ref.data.object?.sha;
+  if (typeof sha !== "string") throw missing;
+  await octokit.request("DELETE /repos/{owner}/{repo}/git/refs/{ref}", { owner: owner2, repo, ref: `heads/${branch}` });
+  return { deleted: branch, sha, restore: `git push origin ${sha}:refs/heads/${branch}` };
+}
+var DELETE_BRANCH_DESCRIPTION = "Delete one branch on GitHub. Refuses the repo's default branch, the release-flow branches (master, main, next, hotfixes, dev, badges, gh-pages), and any branch that is the head or base of an open PR, including a PR from a fork into its parent or the root of its fork network (deleting it would close the PR). Rulesets still apply. Returns the deleted tip's sha and the git command that restores it. Runs on the write PAT (Contents: write).";
+var DELETE_BRANCH_SCHEMA = {
+  type: "object",
+  required: ["owner", "repo", "branch"],
+  additionalProperties: false,
+  properties: {
+    owner: { type: "string", description: "repository owner (org/user login); selects the write credential" },
+    repo: { type: "string", description: "repository name" },
+    branch: { type: "string", description: 'branch name, e.g. "feat/otp-gate" (a leading refs/heads/ is accepted)' }
+  }
+};
+
+// src/verbs/dismiss_alert.ts
+var ALERT_KINDS = ["code_scanning", "dependabot", "secret_scanning"];
+var DISMISS_REASONS = {
+  code_scanning: ["false positive", "won't fix", "used in tests"],
+  dependabot: ["fix_started", "inaccurate", "no_bandwidth", "not_used", "tolerable_risk"],
+  secret_scanning: ["false_positive", "wont_fix", "revoked", "used_in_tests"]
+};
+var ROUTES = {
+  code_scanning: "PATCH /repos/{owner}/{repo}/code-scanning/alerts/{alert_number}",
+  dependabot: "PATCH /repos/{owner}/{repo}/dependabot/alerts/{alert_number}",
+  secret_scanning: "PATCH /repos/{owner}/{repo}/secret-scanning/alerts/{alert_number}"
+};
+function bodyFor(kind, reopen, reason, comment) {
+  if (kind === "secret_scanning") {
+    if (reopen) return { state: "open", ...comment ? { resolution_comment: comment } : {} };
+    return { state: "resolved", resolution: reason, ...comment ? { resolution_comment: comment } : {} };
+  }
+  if (reopen) return { state: "open" };
+  return { state: "dismissed", dismissed_reason: reason, ...comment ? { dismissed_comment: comment } : {} };
+}
+async function dismissAlert(octokit, input) {
+  const { owner: owner2, repo, kind } = input;
+  if (typeof repo !== "string" || !repo) throw new Error("dismiss_alert: repo is required");
+  if (!ALERT_KINDS.includes(kind)) throw new Error(`dismiss_alert: kind must be one of ${ALERT_KINDS.join(", ")}`);
+  if (!Number.isSafeInteger(input.alertNumber) || input.alertNumber <= 0) throw new Error("dismiss_alert: alertNumber must be a positive integer");
+  if (input.comment !== void 0 && typeof input.comment !== "string") throw new Error("dismiss_alert: comment must be a string");
+  const reopen = input.reopen === true;
+  if (reopen && input.reason !== void 0) throw new Error("dismiss_alert: a reopen takes no reason");
+  if (reopen && input.comment !== void 0 && kind !== "secret_scanning") throw new Error(`dismiss_alert: GitHub stores no comment when a ${kind} alert is reopened; leave comment out`);
+  if (!reopen && !DISMISS_REASONS[kind].includes(input.reason)) {
+    throw new Error(`dismiss_alert: reason is required for a ${kind} alert, one of: ${DISMISS_REASONS[kind].map((r) => `"${r}"`).join(", ")}`);
+  }
+  const res = await octokit.request(ROUTES[kind], { owner: owner2, repo, alert_number: input.alertNumber, ...bodyFor(kind, reopen, input.reason, input.comment) });
+  const d = res.data;
+  const reason = kind === "secret_scanning" ? d.resolution : d.dismissed_reason;
+  return {
+    kind,
+    number: typeof d.number === "number" ? d.number : input.alertNumber,
+    state: typeof d.state === "string" ? d.state : "unknown",
+    reason: typeof reason === "string" ? reason : null,
+    url: typeof d.html_url === "string" ? d.html_url : null
+  };
+}
+var DISMISS_ALERT_DESCRIPTION = `Dismiss one code scanning, Dependabot or secret scanning alert, or reopen it with reopen: true. A dismissal needs a reason, which depends on kind: code_scanning ${DISMISS_REASONS.code_scanning.map((r) => `"${r}"`).join(" / ")}; dependabot ${DISMISS_REASONS.dependabot.join(" / ")}; secret_scanning ${DISMISS_REASONS.secret_scanning.join(" / ")}. Returns the alert's number, state, reason and URL only; a secret's value is never returned. Runs on the write PAT.`;
+var DISMISS_ALERT_SCHEMA = {
+  type: "object",
+  required: ["owner", "repo", "kind", "alertNumber"],
+  additionalProperties: false,
+  properties: {
+    owner: { type: "string", description: "repository owner (org/user login); selects the write credential" },
+    repo: { type: "string", description: "repository name" },
+    kind: { type: "string", enum: [...ALERT_KINDS], description: "which alert type" },
+    alertNumber: { type: "number", description: "the alert number" },
+    reason: { type: "string", description: "why it's dismissed; the accepted values depend on kind (see the description)" },
+    comment: { type: "string", description: "optional note stored with the dismissal" },
+    reopen: { type: "boolean", description: "true reopens the alert instead of dismissing it (no reason)" }
+  }
+};
+
 // src/verbs/ghcr/archive.ts
 import { closeSync, constants, fstatSync, openSync, readlinkSync, realpathSync } from "node:fs";
 import { createHash as createHash2 } from "node:crypto";
-import { dirname, isAbsolute as isAbsolute2, join as join3, normalize as normalize2 } from "node:path";
+import { dirname, isAbsolute as isAbsolute4, join as join3, normalize as normalize2 } from "node:path";
 
 // src/verbs/ghcr/tar.ts
 import { readSync } from "node:fs";
@@ -23685,7 +24094,7 @@ var fail5 = (msg) => {
 };
 function openArchive(input, dropDir, maxBytes) {
   if (typeof input !== "string" || !input || input.length > 4096 || input.includes("\0")) fail5('"archive" must be a file path inside the drop directory');
-  const candidate = normalize2(isAbsolute2(input) ? input : join3(dropDir, input));
+  const candidate = normalize2(isAbsolute4(input) ? input : join3(dropDir, input));
   const outside = `"archive" must be an existing file inside the drop directory ${dropDir}`;
   if (!candidate.startsWith(`${dropDir}/`)) fail5(outside);
   let realDrop;
@@ -24400,6 +24809,349 @@ var GHCR_CATALOG = {
   }
 };
 
+// src/otp/gate.ts
+import { createHmac as createHmac2, randomBytes as randomBytes2 } from "node:crypto";
+import { hostname } from "node:os";
+
+// src/otp/state.ts
+import { closeSync as closeSync2, fstatSync as fstatSync2, fsyncSync, openSync as openSync2, readFileSync as readFileSync3, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname as dirname2 } from "node:path";
+function emptyState() {
+  return { version: 1, lastAcceptedStep: 0, users: {} };
+}
+function emptyUser() {
+  return { failures: 0, lockedUntil: null, lockouts: [], hardLock: null };
+}
+function userState(state, user) {
+  const u = Object.hasOwn(state.users, user) ? state.users[user] : emptyUser();
+  return { ...u, lockouts: [...u.lockouts] };
+}
+var isIso = (v) => typeof v === "string" && !Number.isNaN(Date.parse(v));
+var isCount = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
+var isObject3 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function parseUser(raw) {
+  if (!isObject3(raw) || !isCount(raw.failures)) return void 0;
+  if (raw.lockedUntil !== null && !isIso(raw.lockedUntil)) return void 0;
+  if (!Array.isArray(raw.lockouts) || !raw.lockouts.every(isIso)) return void 0;
+  let hardLock = null;
+  if (raw.hardLock !== null) {
+    const h = raw.hardLock;
+    if (!isObject3(h) || !isIso(h.since) || !isCount(h.lockouts)) return void 0;
+    hardLock = { since: h.since, lockouts: h.lockouts };
+  }
+  return { failures: raw.failures, lockedUntil: raw.lockedUntil, lockouts: [...raw.lockouts], hardLock };
+}
+function parseState(raw) {
+  if (!isObject3(raw) || raw.version !== 1 || !isCount(raw.lastAcceptedStep) || !isObject3(raw.users)) return void 0;
+  const users = {};
+  for (const [name, entry] of Object.entries(raw.users)) {
+    const u = parseUser(entry);
+    if (!u || !isAgentUser(name)) return void 0;
+    users[name] = u;
+  }
+  return { version: 1, lastAcceptedStep: raw.lastAcceptedStep, users };
+}
+function signature(path) {
+  try {
+    const st = statSync(path);
+    return `${st.ino}:${st.mtimeMs}:${st.size}`;
+  } catch (err) {
+    if (err.code === "ENOENT") return "missing";
+    return `error:${err.code}`;
+  }
+}
+var OtpStateFile = class {
+  path;
+  now;
+  sig;
+  cached;
+  constructor(path, now = Date.now) {
+    this.path = path;
+    this.now = now;
+  }
+  /** The current state, re-read from disk only when the file changed. */
+  read() {
+    const sig = signature(this.path);
+    if (this.cached && sig === this.sig) return this.cached;
+    this.sig = sig;
+    this.cached = this.load(sig);
+    return this.cached;
+  }
+  load(sig) {
+    if (sig === "missing") return { ok: true, state: emptyState() };
+    let state;
+    let why = "unexpected shape";
+    try {
+      state = parseState(JSON.parse(readFileSync3(this.path, "utf8")));
+    } catch (err) {
+      why = err.message;
+    }
+    if (state) return { ok: true, state };
+    const since = new Date(this.now()).toISOString();
+    console.error(`gh-broker: OTP state file ${this.path} is unreadable or corrupt (${why}); failing closed: every tool except otp_status is locked for every user until "gh-broker otp unlock" rewrites it`);
+    return { ok: false, since };
+  }
+  /**
+   * Persist `state` atomically. On success the cache holds the new state; on failure the
+   * cache still holds it (so in-process counters keep counting) and the error is thrown,
+   * so the caller can refuse anything that depends on the write having landed.
+   */
+  write(state) {
+    this.cached = { ok: true, state };
+    const tmp = `${this.path}.tmp-${process.pid}-${randomBytes(6).toString("hex")}`;
+    let written;
+    try {
+      const fd = openSync2(tmp, "wx", 384);
+      try {
+        writeSync(fd, `${JSON.stringify(state, null, "	")}
+`);
+        fsyncSync(fd);
+        const st = fstatSync2(fd);
+        written = `${st.ino}:${st.mtimeMs}:${st.size}`;
+      } finally {
+        closeSync2(fd);
+      }
+      renameSync(tmp, this.path);
+    } catch (err) {
+      try {
+        unlinkSync(tmp);
+      } catch {
+      }
+      this.sig = signature(this.path);
+      throw new Error(`OTP state could not be saved to ${this.path}: ${err.message}`);
+    }
+    this.sig = written;
+    syncDir(dirname2(this.path));
+  }
+};
+function syncDir(dir) {
+  try {
+    const fd = openSync2(dir, "r");
+    try {
+      fsyncSync(fd);
+    } finally {
+      closeSync2(fd);
+    }
+  } catch {
+  }
+}
+
+// src/otp/gate.ts
+var OtpRefusal = class extends Error {
+  audit;
+  constructor(message, audit2) {
+    super(message);
+    this.name = "OtpRefusal";
+    this.audit = audit2;
+  }
+};
+var UNLOCK_COMMAND = "sudo gh-broker otp unlock";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNLOCK_ALL_COMMAND = "sudo gh-broker otp unlock --all";
+function unlockCommand(user) {
+  return `${UNLOCK_COMMAND} ${user}`;
+}
+var OtpGate = class {
+  config;
+  secrets;
+  settings;
+  now;
+  host;
+  state;
+  /** Per-process key for window ids. */
+  idKey = randomBytes2(32);
+  windows = [];
+  /** Users whose latest bad-code count is only in memory because the state file couldn't be written. */
+  unsaved = /* @__PURE__ */ new Set();
+  constructor(config2, secrets, options = {}) {
+    this.config = config2;
+    this.secrets = secrets;
+    this.settings = otpSettings(config2);
+    this.now = options.now ?? Date.now;
+    this.host = options.host ?? hostname();
+    this.state = new OtpStateFile(this.settings.statePath, this.now);
+  }
+  /** Whether the gate runs at all. Without config.otp no state file is ever touched. */
+  get enabled() {
+    return this.config.otp !== void 0;
+  }
+  /**
+   * The hard-lock refusal for `user`, if that user is hard-locked (or the state file is
+   * unusable, which locks everyone). The router checks this on every call except otp_status.
+   */
+  hardLockRefusal(user) {
+    if (!this.enabled) return void 0;
+    const read = this.state.read();
+    if (!read.ok) {
+      return new OtpRefusal(
+        `gh-broker is locked for every agent: its OTP state file is unreadable or corrupt (since ${read.since}). Ask the user to run "${UNLOCK_ALL_COMMAND}" on ${this.host}. Nothing was run.`,
+        { otp: "hard-locked" }
+      );
+    }
+    const since = userState(read.state, user).hardLock?.since;
+    if (since === void 0) return void 0;
+    return new OtpRefusal(
+      `gh-broker is locked for ${user} after repeated bad OTP codes (since ${since}). Ask the user to run "${unlockCommand(user)}" on ${this.host}. Nothing was run.`,
+      { otp: "hard-locked" }
+    );
+  }
+  /**
+   * Decide `user`'s call to the gated tool `tool` carrying `code` (the raw `otp` argument).
+   * Returns the audit fields when the call may run; throws OtpRefusal when it may not.
+   * Only call this after hardLockRefusal() and the availability check passed (OTP is set up).
+   */
+  authorize(tool, code, user) {
+    const now = this.now();
+    const read = this.state.read();
+    if (!read.ok || userState(read.state, user).hardLock) throw this.hardLockRefusal(user);
+    const state = read.state;
+    const mine = userState(state, user);
+    const lockedUntil = mine.lockedUntil ? Date.parse(mine.lockedUntil) : 0;
+    if (lockedUntil > now) {
+      const minutes = Math.max(1, Math.ceil((lockedUntil - now) / 6e4));
+      throw new OtpRefusal(`OTP is locked for ${minutes} more minute(s) after too many bad codes. Nothing was run.`, { otp: "locked" });
+    }
+    const unsavedRefusal = () => new OtpRefusal(`OTP could not be checked: the broker could not save its OTP state. Nothing was run.`, { otp: "refused" });
+    if (this.unsaved.has(user)) {
+      try {
+        this.state.write(this.compact(state, now));
+        this.unsaved.delete(user);
+      } catch (err) {
+        console.error(`gh-broker: ${err.message}`);
+        throw unsavedRefusal();
+      }
+    }
+    const refusal = () => new OtpRefusal(`OTP required for ${tool}: ask the user for a current code from their authenticator app and pass it as "${OTP_ARG}". Nothing was run.`, { otp: "refused" });
+    if (code === void 0 || code === null || code === "") throw refusal();
+    if (typeof code === "number" && Number.isInteger(code) && code >= 0 && code <= 999999) code = String(code).padStart(6, "0");
+    if (typeof code !== "string") throw refusal();
+    this.windows = this.windows.filter((w) => w.expiresAt > now);
+    let hit;
+    for (const w of this.windows) if (w.user === user && safeEqual(w.code, code)) hit = w;
+    if (hit) return { otp: "window", window: hit.id };
+    const step = matchStep(readSeed(this.config, this.secrets).key, code, now);
+    if (step !== void 0 && step > state.lastAcceptedStep) {
+      try {
+        this.state.write(this.compact({ ...state, lastAcceptedStep: step, users: { ...state.users, [user]: { ...mine, failures: 0 } } }, now));
+      } catch (err) {
+        console.error(`gh-broker: ${err.message}`);
+        throw unsavedRefusal();
+      }
+      const id = createHmac2("sha256", this.idKey).update(`${user}\0${code}`).digest("hex").slice(0, 16);
+      const expiresAt = now + this.settings.windowSeconds * 1e3;
+      this.windows.push({ user, code, expiresAt, id });
+      return { otp: "opened", window: id, until: new Date(expiresAt).toISOString() };
+    }
+    if (step !== void 0) {
+      throw new OtpRefusal(
+        `OTP code for ${tool} is spent (it, or a newer code, was already used): ask the user for the next code from their authenticator app and pass it as "${OTP_ARG}". Nothing was run.`,
+        { otp: "refused" }
+      );
+    }
+    throw this.rejection(tool, user, this.recordFailure(tool, state, mine, user, now));
+  }
+  /** The refusal for a wrong code, saying how close `user` now is to a lockout. */
+  rejection(tool, user, after) {
+    const lead = `OTP code for ${tool} was not accepted`;
+    if (after.hardLock) {
+      return new OtpRefusal(`${lead}, and that was the last lockout allowed: gh-broker is now locked for ${user}. Ask the user to run "${unlockCommand(user)}" on ${this.host}. Nothing was run.`, {
+        otp: "refused"
+      });
+    }
+    const lockout = windowText(this.settings.lockoutSeconds);
+    if (after.failures === 0) return new OtpRefusal(`${lead}, and that was too many bad codes: OTP is locked for ${lockout}. Nothing was run.`, { otp: "refused" });
+    return new OtpRefusal(
+      `${lead} (${after.failures} of ${this.settings.maxFailures} bad codes before a lockout of ${lockout}): ask the user for a fresh code from their authenticator app and pass it as "${OTP_ARG}". Nothing was run.`,
+      { otp: "refused" }
+    );
+  }
+  /** Count one bad code for `user`, starting a short lockout (and maybe the hard lock) at the limit. Returns the user's new counters. */
+  recordFailure(tool, state, mine, user, now) {
+    const next = { ...mine, lockouts: mine.lockouts.filter((t) => Date.parse(t) > now - DAY_MS) };
+    next.failures += 1;
+    if (next.failures >= this.settings.maxFailures) {
+      const at = new Date(now).toISOString();
+      next.failures = 0;
+      next.lockedUntil = new Date(now + this.settings.lockoutSeconds * 1e3).toISOString();
+      next.lockouts.push(at);
+      if (next.lockouts.length >= this.settings.maxLockouts) next.hardLock = { since: at, lockouts: next.lockouts.length };
+      audit(
+        next.hardLock ? { tool, user, decision: "deny", otp: "hard-lock", detail: `${next.lockouts.length} lockouts in 24 h; every tool except otp_status is refused until "${unlockCommand(user)}"` } : { tool, user, decision: "deny", otp: "lockout", until: next.lockedUntil, detail: `${this.settings.maxFailures} bad codes` }
+      );
+    }
+    try {
+      this.state.write(this.compact({ ...state, users: { ...state.users, [user]: next } }, now));
+    } catch (err) {
+      this.unsaved.add(user);
+      console.error(`gh-broker: ${err.message}`);
+    }
+    return next;
+  }
+  /**
+   * `state` tidied for a write: every user's lockouts pruned to the last 24 h, expired short
+   * lockouts cleared, and users left with nothing to record dropped.
+   */
+  compact(state, now) {
+    const users = {};
+    for (const [name, u] of Object.entries(state.users)) {
+      const lockouts = u.lockouts.filter((t) => Date.parse(t) > now - DAY_MS);
+      const lockedUntil = u.lockedUntil && Date.parse(u.lockedUntil) > now ? u.lockedUntil : null;
+      if (u.failures === 0 && lockedUntil === null && lockouts.length === 0 && u.hardLock === null) continue;
+      users[name] = { failures: u.failures, lockedUntil, lockouts, hardLock: u.hardLock };
+    }
+    return { ...state, users };
+  }
+  /**
+   * The otp_status report for `user`: their own windows and counters, plus every hard-locked
+   * user. Never a code, the seed, or anything derived from them.
+   */
+  status(user) {
+    const now = this.now();
+    const gatedTools = this.config.tools.filter((t) => isGated(t) && isEnabled(t)).map((t) => t.name);
+    let mine = emptyUser();
+    let hardLock = null;
+    let lockedUsers = [];
+    let corrupt = false;
+    if (this.enabled) {
+      const read = this.state.read();
+      if (read.ok) {
+        mine = userState(read.state, user);
+        hardLock = mine.hardLock;
+        lockedUsers = Object.entries(read.state.users).filter(([, u]) => u.hardLock).map(([name, u]) => ({ user: name, since: u.hardLock.since, lockouts: u.hardLock.lockouts, unlockCommand: unlockCommand(name) }));
+      } else {
+        hardLock = { since: read.since, lockouts: 0 };
+        corrupt = true;
+        lockedUsers = [{ user, since: read.since, lockouts: 0, unlockCommand: UNLOCK_ALL_COMMAND }];
+      }
+    }
+    const open2 = this.windows.filter((w) => w.user === user && w.expiresAt > now);
+    const next = open2.length ? Math.min(...open2.map((w) => w.expiresAt)) : void 0;
+    const lockedUntil = mine.lockedUntil && Date.parse(mine.lockedUntil) > now ? mine.lockedUntil : null;
+    return {
+      configured: !("problem" in readSeed(this.config, this.secrets)),
+      user,
+      gatedTools,
+      windowSeconds: this.settings.windowSeconds,
+      openWindows: open2.length,
+      nextWindowExpiresAt: next === void 0 ? null : new Date(next).toISOString(),
+      failures: mine.failures,
+      maxFailures: this.settings.maxFailures,
+      lockedUntil,
+      lockoutsLast24h: mine.lockouts.filter((t) => Date.parse(t) > now - DAY_MS).length,
+      maxLockouts: this.settings.maxLockouts,
+      hardLock,
+      unlockCommand: corrupt ? UNLOCK_ALL_COMMAND : unlockCommand(user),
+      lockedUsers,
+      host: this.host
+    };
+  }
+};
+function windowText(seconds) {
+  if (seconds % 60 === 0) return `${seconds / 60} minute${seconds === 60 ? "" : "s"}`;
+  return `${seconds} seconds`;
+}
+
 // src/router.ts
 var GHCR_TOOLS2 = /* @__PURE__ */ new Set(["ghcr_push", "ghcr_push_status", "ghcr_tags"]);
 var Router = class {
@@ -24410,65 +25162,110 @@ var Router = class {
   rules;
   /** GHCR verbs run on config.ghcr's own credential, not the owner's GitHub PAT (created on first use). */
   ghcr;
-  constructor(config2, secrets, upstream, appAuth) {
+  /** The OTP gate (#143). Inert without config.otp. */
+  otp;
+  constructor(config2, secrets, upstream, appAuth, otp) {
     this.config = config2;
     this.secrets = secrets;
     this.upstream = upstream;
     this.appAuth = appAuth;
     this.rules = indexTools(config2.tools);
+    this.otp = otp ?? new OtpGate(config2, secrets);
   }
   /** Tools advertised to the agent (used to build tools/list). */
   advertisedTools() {
     return this.config.tools.filter((rule) => !unavailableReason(rule, this.config, this.secrets));
   }
-  async call(tool, args) {
+  /** Run `tool` for `caller`, the agent user whose socket the call came in on. */
+  async call(tool, rawArgs, caller) {
+    const user = caller.user;
     const rule = this.rules.get(tool);
     if (!rule) {
-      audit({ tool, decision: "deny", detail: "not in allowlist" });
+      audit({ tool, user, decision: "deny", detail: "not in allowlist" });
       throw new Error(`tool "${tool}" is not allowed`);
     }
+    if (tool !== OTP_STATUS) {
+      const locked = this.otp.hardLockRefusal(user);
+      if (locked) {
+        audit({ tool, user, decision: "deny", detail: "otp hard lock", ...locked.audit });
+        throw locked;
+      }
+    }
+    let args = rawArgs;
+    let code;
+    if (Object.hasOwn(rawArgs, OTP_ARG)) {
+      const { [OTP_ARG]: given, ...rest } = rawArgs;
+      code = given;
+      args = rest;
+    }
     const unavailable = unavailableReason(rule, this.config, this.secrets);
     if (unavailable) {
-      audit({ tool, decision: "deny", detail: `unavailable: ${unavailable}` });
+      audit({ tool, user, decision: "deny", detail: `unavailable: ${unavailable}` });
       throw new Error(`tool "${tool}" is not available on this broker: ${unavailable}`);
     }
-    if (GHCR_TOOLS2.has(tool)) return this.callGhcr(tool, args, rule);
-    let owner2 = extractOwner(args);
+    if (tool === OTP_STATUS) {
+      audit({ tool, user, mode: rule.mode, decision: "custom", ok: true });
+      return { content: [{ type: "text", text: JSON.stringify(this.otp.status(user)) }] };
+    }
+    let createdIn;
+    if (REPO_CREATING.has(tool) || tool === "actions_run_trigger") {
+      try {
+        if (tool === "actions_run_trigger") refuseLogDeletion(args);
+        else createdIn = creationOwner(tool, args, this.config.owners);
+      } catch (err) {
+        const requested = typeof args.organization === "string" ? args.organization : extractOwner(args);
+        audit({ tool, user, mode: rule.mode, ...requested ? { owner: requested.toLowerCase() } : {}, decision: "error", detail: err.message });
+        throw err;
+      }
+    }
+    let otp;
+    if (isGated(rule)) {
+      try {
+        otp = this.otp.authorize(tool, code, user);
+      } catch (err) {
+        audit({ tool, user, decision: "deny", detail: "otp", ...err.audit });
+        throw err;
+      }
+    }
+    if (GHCR_TOOLS2.has(tool)) return this.callGhcr(tool, args, rule, user, otp);
+    let owner2 = createdIn ?? extractOwner(args);
     if (!owner2 && rule.mode === "read" && this.config.defaultOwner && this.config.owners[this.config.defaultOwner]) {
       owner2 = this.config.defaultOwner.toLowerCase();
     }
     if (!owner2) {
-      audit({ tool, decision: "error", detail: "no owner in args" });
+      audit({ tool, user, decision: "error", detail: "no owner in args" });
       throw new Error(`tool "${tool}": could not determine repo owner from arguments`);
     }
     const creds = this.config.owners[owner2];
     if (!creds) {
-      audit({ tool, owner: owner2, decision: "error", detail: "no creds for owner" });
+      audit({ tool, user, owner: owner2, decision: "error", detail: "no creds for owner" });
       throw new Error(`no credentials configured for owner "${owner2}" \u2014 add it to config.owners + creds`);
     }
     const token = this.secrets.resolve(rule.mode === "write" ? creds.write : creds.read);
-    const repo = typeof args.repo === "string" ? `${owner2}/${args.repo}` : owner2;
+    const repoName = tool === "create_repository" ? args.name : args.repo;
+    const repo = typeof repoName === "string" ? `${owner2}/${repoName}` : owner2;
+    const forked = tool === "fork_repository" ? { source: `${String(args.owner)}/${String(args.repo)}` } : {};
     const decision = rule.custom ? "custom" : rule.augment ? "augment" : "forward";
     try {
       const out = rule.custom ? await this.dispatchCustom(tool, args, owner2, token) : rule.augment ? await this.dispatchAugmented(tool, args, owner2, token) : await this.upstream.forward(tool, args, token);
-      audit({ tool, owner: owner2, mode: rule.mode, repo, decision, ok: true });
+      audit({ tool, user, owner: owner2, mode: rule.mode, repo, ...forked, decision, ok: true, ...otp });
       return out;
     } catch (err) {
-      audit({ tool, owner: owner2, mode: rule.mode, repo, decision, ok: false, detail: err.message });
+      audit({ tool, user, owner: owner2, mode: rule.mode, repo, ...forked, decision, ok: false, detail: err.message, ...otp });
       throw err;
     }
   }
   /** GHCR verbs: config.ghcr checks the owner and image itself; no GitHub PAT is resolved. */
-  async callGhcr(tool, args, rule) {
+  async callGhcr(tool, args, rule, user, otp) {
     const owner2 = extractOwner(args) ?? "";
     const repo = typeof args.image === "string" ? `${owner2}/${args.image}` : owner2;
     try {
       this.ghcr ??= new GhcrService(this.config.ghcr, this.secrets);
       const out = tool === "ghcr_push" ? await this.ghcr.push(args) : tool === "ghcr_tags" ? await this.ghcr.tags(args) : this.ghcr.status(args);
-      audit({ tool, owner: owner2, mode: rule.mode, repo, decision: "custom", ok: true });
+      audit({ tool, user, owner: owner2, mode: rule.mode, repo, decision: "custom", ok: true, ...otp });
       return { content: [{ type: "text", text: JSON.stringify(out) }] };
     } catch (err) {
-      audit({ tool, owner: owner2, mode: rule.mode, repo, decision: "custom", ok: false, detail: err.message });
+      audit({ tool, user, owner: owner2, mode: rule.mode, repo, decision: "custom", ok: false, detail: err.message, ...otp });
       throw err;
     }
   }
@@ -24543,6 +25340,18 @@ var Router = class {
         const out = await npmScaffold(args, { octokit, registry: registry2, scopes: npm.scopes });
         return { content: [{ type: "text", text: JSON.stringify(out) }] };
       }
+      case "minimize_comment": {
+        const out = await minimizeComment(new Octokit({ auth: token }), args);
+        return { content: [{ type: "text", text: JSON.stringify(out) }] };
+      }
+      case "delete_branch": {
+        const out = await deleteBranch(new Octokit({ auth: token }), args);
+        return { content: [{ type: "text", text: JSON.stringify(out) }] };
+      }
+      case "dismiss_alert": {
+        const out = await dismissAlert(new Octokit({ auth: token }), args);
+        return { content: [{ type: "text", text: JSON.stringify(out) }] };
+      }
       default:
         throw new Error(`custom verb "${tool}" not implemented`);
     }
@@ -24649,6 +25458,21 @@ var Router = class {
     }
   }
 };
+var REPO_CREATING = /* @__PURE__ */ new Set(["create_repository", "fork_repository"]);
+function creationOwner(tool, args, owners) {
+  if (typeof args.organization !== "string" || !args.organization) {
+    throw new Error(`tool "${tool}": "organization" is required (the org the repo is created in); gh-broker doesn't create repos in a personal account`);
+  }
+  const org = args.organization.toLowerCase();
+  if (!owners[org]) throw new Error(`no credentials configured for owner "${org}" \u2014 add it to config.owners + creds`);
+  if (tool === "create_repository" && typeof args.private !== "boolean") {
+    throw new Error(`tool "create_repository": "private" is required, true or false; a repo's visibility is never left to a default`);
+  }
+  return org;
+}
+function refuseLogDeletion(args) {
+  if (args.method === "delete_workflow_run_logs") throw new Error(`tool "actions_run_trigger": method "delete_workflow_run_logs" is not allowed in gh-broker; a run's logs are kept`);
+}
 function extractOwner(args) {
   if (typeof args.owner === "string" && args.owner) return args.owner.toLowerCase();
   if (typeof args.org === "string" && args.org) return args.org.toLowerCase();
@@ -26016,6 +26840,14 @@ var AppAuth = class {
   }
 };
 
+// src/verbs/otp_status.ts
+var OTP_STATUS_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {}
+};
+var OTP_STATUS_DESCRIPTION = `Report the broker's OTP gate: whether OTP is set up, which tools need an "otp" code, how many windows are open and when the next one closes, bad codes so far, any short lockout, short lockouts in the last 24 h, and the hard lock (which blocks every other tool) with the command that clears it. Never shows a code or the seed. Works even while the broker is locked. Needs no owner.`;
+
 // src/catalog.ts
 async function buildCatalog(config2, secrets, upstream) {
   const upstreamByName = /* @__PURE__ */ new Map();
@@ -26064,7 +26896,7 @@ async function buildCatalog(config2, secrets, upstream) {
       } else if (rule.name === "npm_scaffold") {
         tools.push({
           name: "npm_scaffold",
-          description: "Create a new npm package and register its GitHub Actions trusted publisher, so the repo's publish workflow can release it through OIDC from then on. Publishes a broker-built placeholder (0.0.0-stage, no code) and never publishes a version of an existing package. Every npm write needs its own one-time password from the user, so it takes two calls: the first publishes the placeholder and returns status needs_otp; ask the user for the next code and call again to add the trusted publisher. Ask for each code right before the call. A refused or expired code also returns needs_otp with the remaining steps. Checks first that the repo's package.json names the package and that the workflow file exists. Uses the broker's npm token (no 2FA bypass) and the read PAT.",
+          description: "Create a new npm package and register its GitHub Actions trusted publisher, so the repo's publish workflow can release it through OIDC from then on. Publishes a broker-built placeholder (0.0.0-stage, no code) and never publishes a version of an existing package. Every npm write needs its own one-time password from the user, passed as npm_otp, so it takes two calls: the first publishes the placeholder and returns status needs_otp; ask the user for the next npm code and call again with it in npm_otp to add the trusted publisher. Ask for each code right before the call. A refused or expired code also returns needs_otp with the remaining steps. Checks first that the repo's package.json names the package and that the workflow file exists. Uses the broker's npm token (no 2FA bypass) and the read PAT.",
           inputSchema: NPM_SCAFFOLD_SCHEMA
         });
       } else if (rule.name === "report_unlabeled") {
@@ -26109,6 +26941,14 @@ async function buildCatalog(config2, secrets, upstream) {
           description: "Report CI health for a PR, or every open PR in a repo, at a chosen verbosity: 0 counts only, 1 adds which run/job failed, 2 adds which step failed, 3 adds a tail of the failing job's log. Detail beyond tier 0 is only fetched for runs that are actually failing. Runs on the read PAT.",
           inputSchema: REPORT_CI_STATUS_SCHEMA
         });
+      } else if (rule.name === "minimize_comment") {
+        tools.push({ name: "minimize_comment", description: MINIMIZE_COMMENT_DESCRIPTION, inputSchema: MINIMIZE_COMMENT_SCHEMA });
+      } else if (rule.name === "delete_branch") {
+        tools.push({ name: "delete_branch", description: DELETE_BRANCH_DESCRIPTION, inputSchema: DELETE_BRANCH_SCHEMA });
+      } else if (rule.name === "dismiss_alert") {
+        tools.push({ name: "dismiss_alert", description: DISMISS_ALERT_DESCRIPTION, inputSchema: DISMISS_ALERT_SCHEMA });
+      } else if (rule.name === OTP_STATUS) {
+        tools.push({ name: OTP_STATUS, description: OTP_STATUS_DESCRIPTION, inputSchema: OTP_STATUS_SCHEMA });
       } else if (GHCR_CATALOG[rule.name]) {
         tools.push({ name: rule.name, ...GHCR_CATALOG[rule.name] });
       }
@@ -26154,6 +26994,21 @@ async function buildCatalog(config2, secrets, upstream) {
       });
       continue;
     }
+    if (rule.name === "create_repository" || rule.name === "fork_repository") {
+      const schema = base.inputSchema;
+      const needed = rule.name === "create_repository" ? ["organization", "private"] : ["organization"];
+      const note = rule.name === "create_repository" ? ' gh-broker: "organization" and "private" are required; the repo is never created in a personal account or left public by default.' : ' gh-broker: "organization" (where the fork goes) is required; forks are never created in a personal account.';
+      tools.push({
+        ...base,
+        description: `${base.description ?? ""}${note}`.trim(),
+        inputSchema: { ...schema, type: "object", required: [.../* @__PURE__ */ new Set([...schema.required ?? [], ...needed])] }
+      });
+      continue;
+    }
+    if (rule.name === "actions_run_trigger") {
+      tools.push({ ...base, description: `${base.description ?? ""} gh-broker: method "delete_workflow_run_logs" is refused; a run's logs are kept.`.trim() });
+      continue;
+    }
     if (rule.name === "issue_write") {
       const pointer = config2.tools.some((t) => t.name === "issue_labels" && t.custom) ? " To add, remove or swap individual labels, use issue_labels instead." : " Read the current labels first and pass the full set you want to keep.";
       tools.push({
@@ -26164,12 +27019,34 @@ async function buildCatalog(config2, secrets, upstream) {
     }
     tools.push(base);
   }
-  return tools;
+  return withOtp(tools, config2);
+}
+function withOtp(tools, config2) {
+  const gated = new Set(config2.tools.filter(isGated).map((t) => t.name));
+  const window = windowText(otpSettings(config2).windowSeconds);
+  return tools.map((tool) => {
+    if (!gated.has(tool.name)) return tool;
+    const schema = tool.inputSchema;
+    return {
+      ...tool,
+      description: `${tool.description ?? ""} Needs a broker OTP (gh-broker): ask the user for a current code from their authenticator app and pass it as "${OTP_ARG}". One code works for every gated tool for ${window} after the first call that uses it.`.trim(),
+      inputSchema: {
+        ...schema,
+        type: "object",
+        properties: {
+          ...schema.properties ?? {},
+          [OTP_ARG]: { type: "string", description: "gh-broker: a current 6-digit code from the user's authenticator app, or the code that opened the current window" }
+        },
+        required: [...(schema.required ?? []).filter((r) => r !== OTP_ARG), OTP_ARG]
+      }
+    };
+  });
 }
 
 // src/server.ts
 import { createServer } from "node:net";
-import { chmodSync, chownSync, existsSync, readFileSync as readFileSync3, unlinkSync } from "node:fs";
+import { chmodSync, chownSync, existsSync, mkdirSync, readdirSync, readFileSync as readFileSync4, rmSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { join as join4 } from "node:path";
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 var ExperimentalServerTasks = class {
@@ -26864,26 +27741,12 @@ var StdioServerTransport = class {
 
 // src/server.ts
 var SERVER_INFO = { name: "gh-broker", version: "0.1.0" };
-function socketPath(listen) {
-  if (!listen.startsWith("unix:")) throw new Error(`server: unsupported listen "${listen}"`);
-  return listen.slice("unix:".length);
-}
-function groupGid(name) {
-  try {
-    for (const line of readFileSync3("/etc/group", "utf8").split("\n")) {
-      const parts = line.split(":");
-      if (parts[0] === name && parts[2]) return Number(parts[2]);
-    }
-  } catch {
-  }
-  return void 0;
-}
-function handleConnection(socket, router, catalog) {
+function handleConnection(socket, router, catalog, user) {
   const server = new Server(SERVER_INFO, { capabilities: { tools: {} } });
   server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: catalog }));
   server.setRequestHandler(CallToolRequestSchema, async (req2) => {
     const args = req2.params.arguments ?? {};
-    return router.call(req2.params.name, args);
+    return router.call(req2.params.name, args, { user });
   });
   const transport = new StdioServerTransport(socket, socket);
   server.connect(transport).catch((err) => {
@@ -26895,24 +27758,59 @@ function handleConnection(socket, router, catalog) {
   socket.on("error", () => {
   });
 }
-function startServer(config2, router, catalog) {
-  const path = socketPath(config2.listen);
-  if (existsSync(path)) unlinkSync(path);
+function readAgents(groupFile) {
+  let text;
+  try {
+    text = readFileSync4(groupFile, "utf8");
+  } catch (err) {
+    console.error(`gh-broker: cannot read ${groupFile} (${err.message}); serving no agents`);
+    return [];
+  }
+  const { agents, skipped } = parseAgentGroups(text);
+  for (const why of skipped) console.error(`gh-broker: ignoring agent group ${why}`);
+  return agents;
+}
+function listenFor(path, agent, router, catalog) {
+  if (existsSync(path)) unlinkSync2(path);
   return new Promise((resolve, reject) => {
-    const server = createServer((sock) => handleConnection(sock, router, catalog));
+    const server = createServer((sock) => handleConnection(sock, router, catalog, agent.user));
     server.on("error", reject);
     server.listen(path, () => {
-      const group = process.env.GH_BROKER_SOCKET_GROUP ?? "gh-broker-clients";
-      const gid = groupGid(group);
       try {
-        if (gid !== void 0) chownSync(path, process.getuid?.() ?? -1, gid);
+        chownSync(path, process.getuid?.() ?? -1, agent.gid);
+      } catch (err) {
+        console.error(`gh-broker: cannot give ${path} to group ${agent.group} (${err.message}); ${agent.user} can't connect`);
+      }
+      try {
         chmodSync(path, 432);
-      } catch {
+      } catch (err) {
+        server.close();
+        reject(err);
+        return;
       }
       resolve();
     });
   });
 }
+async function startServer(config2, router, catalog, options = {}) {
+  const dir = agentsDir(config2.listen);
+  if (!dir) throw new Error(`server: unsupported listen "${config2.listen}" (expected "agents:<absolute dir>")`);
+  const agents = readAgents(options.groupFile ?? "/etc/group");
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+    chmodSync(dir, 493);
+  }
+  const wanted = new Set(agents.map((a) => `${a.user}.sock`));
+  for (const name of readdirSync(dir)) {
+    if (name.endsWith(".sock") && !wanted.has(name)) rmSync(join4(dir, name), { force: true });
+  }
+  if (agents.length === 0) {
+    console.error("gh-broker: no agents registered (no gh-broker-agent-<user> group with members gh-broker and <user>); serving nothing. Add one with: sudo gh-broker agent add <user>");
+    return [];
+  }
+  for (const agent of agents) await listenFor(join4(dir, `${agent.user}.sock`), agent, router, catalog);
+  return agents.map((a) => a.user);
+}
 
 // src/index.ts
 init_paths();
@@ -26958,12 +27856,13 @@ async function main() {
   }
   const router = new Router(config2, secrets, upstream, appAuth);
   const catalog = await buildCatalog(config2, secrets, upstream);
-  await startServer(config2, router, catalog);
+  const agents = await startServer(config2, router, catalog);
   console.log(
     JSON.stringify({
       ts: (/* @__PURE__ */ new Date()).toISOString(),
       event: "listening",
       listen: config2.listen,
+      agents,
       owners: Object.keys(config2.owners),
       app: appAuth ? "enabled" : "none",
       tools: catalog.map((t) => t.name)