@cursor/july 0.1.1

package/dist/internal/cli-github.js

@@ -0,0 +1,644 @@
+/**
+ * `agent-serve github …` CLI — forward live GitHub webhooks to a locally
+ * served agent via the `cli/gh-webhook` extension, plus a doctor and an
+ * events lister.
+ *
+ * @see https://docs.github.com/en/webhooks/testing-and-troubleshooting-webhooks/using-the-github-cli-to-forward-webhooks-for-testing
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { execFile, spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { join, resolve as resolvePath } from "node:path";
+import { promisify } from "node:util";
+import { buildGitHubForwardArgs, channelForwardUrl, detectGitHubEnvTokenOverride, findGitHubChannelTargets, GITHUB_WEBHOOK_EXTENSION, GITHUB_WEBHOOK_EXTENSION_PIN, ghWebhookExtensionInstallArgs, ghWebhookExtensionPinSatisfied, githubEnvTokenHint, parseGhWebhookExtensionInstalled, parseGhWebhookExtensionVersion, parseRepoFromRemoteUrl, resolveGitHubForwardTargets, targetLabel, unionForwardEvents, } from "../channels/github/forward.js";
+import { parseGitHubPrRef, selectReplayEvents, signGitHubWebhookBody, synthesizeGitHubEvent, } from "../channels/github/replay.js";
+import { resolveAgentMounts } from "./discovery.js";
+import { startFanoutServer } from "./github-fanout.js";
+const execFileAsync = promisify(execFile);
+const DEFAULT_HOST = "127.0.0.1";
+const DEFAULT_PORT = 3000;
+const GITHUB_HELP = `agent-serve github — forward live GitHub webhooks to a local agent
+
+Usage:
+  agent-serve github forward  [--dir .] [--slug S] [--channel C]
+                              [--repo owner/repo | --org ORG]
+                              [--events a,b,c] [--url URL]
+                              [--host 127.0.0.1] [--port 3000]
+                              [--secret S] [--install]
+  agent-serve github replay   <pr_url|owner/repo#N> [--events a,b,c | *]
+                              [--action A] [--conclusion C] [--comment "…"]
+                              [--context CTX] [--dir .] [--slug S] [--channel C]
+                              [--host H] [--port N] [--url URL] [--secret S]
+                              [--dry-run] [--out DIR] [--json]
+  agent-serve github events   [--dir .] [--host H] [--port N] [--json]
+  agent-serve github doctor   [--install] [--json]
+
+Commands:
+  forward   Run \`gh webhook forward\` for the discovered githubChannel()s.
+            URL + events are derived per channel; the repo is inferred from the
+            git remote when --repo/--org are omitted. When several channels
+            match, one forwarder fans out to all of them (each delivery is
+            re-posted to the channels whose event set matches). Use --slug /
+            --channel to forward to just one.
+  replay    Synthesize webhook payloads from a PR you can *read* (no repo admin,
+            no relay) and POST them to the discovered channel(s). Reads the PR
+            via \`gh api\`, builds GitHub-shaped payloads for --events (default
+            pull_request; \`*\` = the channel's declared events), signs them with
+            --secret / GITHUB_WEBHOOK_SECRET, and fans out like forward.
+            --dry-run prints them; --out writes them as fixtures.
+  events    List discovered GitHub channels and the webhook events each accepts.
+  doctor    Check gh, auth, and the ${GITHUB_WEBHOOK_EXTENSION} extension.
+
+Prerequisites:
+  - gh CLI logged in (\`gh auth login\`).
+  - ${GITHUB_WEBHOOK_EXTENSION} extension (\`agent-serve github doctor --install\`).
+  - The agent already serving (\`agent-serve serve --dir . --dev\`).
+
+Notes:
+  - Set GITHUB_WEBHOOK_SECRET (or pass --secret) so the forwarded deliveries
+    are signed and each channel's signature check passes.
+  - Only one forwarder per repo/org at a time (GitHub limitation) — hence the
+    single-forwarder fan-out rather than one process per channel.
+
+See also: docs/guides/github.md, skills/github/SKILL.md
+`;
+export function cmdGithub(subcommand, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        switch (subcommand) {
+            case undefined:
+            case "help":
+            case "--help":
+            case "-h":
+                process.stdout.write(GITHUB_HELP);
+                return subcommand === undefined ? 1 : 0;
+            case "forward":
+                return cmdGithubForward(options);
+            case "replay":
+                return cmdGithubReplay(options);
+            case "events":
+                return cmdGithubEvents(options);
+            case "doctor":
+                return cmdGithubDoctor(options);
+            default:
+                process.stderr.write(`Unknown github subcommand: ${subcommand}\n`);
+                process.stdout.write(GITHUB_HELP);
+                return 1;
+        }
+    });
+}
+function cmdGithubForward(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const dir = resolvePath(options.dir);
+        const channels = findGitHubChannelTargets(yield resolveAgentMounts(dir));
+        const resolveInput = {
+            targets: channels,
+            slug: options.slug,
+            channel: options.channel,
+            host: (_a = options.host) !== null && _a !== void 0 ? _a : DEFAULT_HOST,
+            port: (_b = options.port) !== null && _b !== void 0 ? _b : DEFAULT_PORT,
+            url: options.url,
+            events: parseEventList(options.events),
+        };
+        const resolved = resolveGitHubForwardTargets(resolveInput);
+        if (!resolved.ok) {
+            process.stderr.write(`${resolved.error}\n`);
+            return 1;
+        }
+        const targets = resolved.targets;
+        const extension = yield ensureWebhookExtension(options.install === true);
+        if (!extension.ok) {
+            process.stderr.write(`${extension.message}\n`);
+            return 1;
+        }
+        let repo = options.repo;
+        const org = options.org;
+        if (repo === undefined && org === undefined) {
+            repo = yield inferRepo(dir);
+            if (repo === undefined) {
+                process.stderr.write("could not infer the repository — pass --repo owner/repo (or --org <org>)\n");
+                return 1;
+            }
+            process.stderr.write(`[agent-serve] inferred --repo ${repo}\n`);
+        }
+        const secret = (_c = options.secret) !== null && _c !== void 0 ? _c : process.env.GITHUB_WEBHOOK_SECRET;
+        // `gh webhook forward` targets a single URL, and GitHub allows only one
+        // forwarder per repo/org. To feed several channels at once, run one
+        // forwarder into a local proxy that re-delivers each raw (still-signed)
+        // delivery to every matching channel. A single channel needs no proxy.
+        const fanout = targets.length > 1;
+        const proxy = fanout ? yield startFanoutServer(targets) : undefined;
+        const forwardUrl = (_d = proxy === null || proxy === void 0 ? void 0 : proxy.url) !== null && _d !== void 0 ? _d : targets[0].url;
+        const events = fanout ? unionForwardEvents(targets) : targets[0].events;
+        const args = buildGitHubForwardArgs({
+            url: forwardUrl,
+            events,
+            repo,
+            org,
+            secret,
+        });
+        process.stderr.write(`[agent-serve] forwarding ${org !== undefined ? `org ${org}` : `repo ${repo}`} to ${targets.length} channel${targets.length === 1 ? "" : "s"}:\n`);
+        for (const target of targets) {
+            process.stderr.write(`[agent-serve]   → ${targetLabel(target)}  ${target.url}  (${target.events.join(", ")})\n`);
+        }
+        if (fanout) {
+            process.stderr.write(`[agent-serve] fan-out proxy on ${forwardUrl} (union events: ${events.join(", ")})\n`);
+        }
+        if (secret === undefined || secret === "") {
+            process.stderr.write("[agent-serve] no signing secret — deliveries are unsigned. A `serve --dev` github channel accepts them; set GITHUB_WEBHOOK_SECRET on both sides to verify signatures (required for a non-dev target).\n");
+        }
+        const envToken = detectGitHubEnvTokenOverride();
+        if (envToken !== undefined) {
+            process.stderr.write(`[agent-serve] warning: ${githubEnvTokenHint(envToken)}\n`);
+        }
+        process.stderr.write(`[agent-serve] running: gh ${redact(args)}\n`);
+        try {
+            return yield spawnGh(args);
+        }
+        finally {
+            proxy === null || proxy === void 0 ? void 0 : proxy.close();
+        }
+    });
+}
+function cmdGithubReplay(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
+        var _d, _e, _f, _g, _h, _j;
+        const prUrl = options.prUrl;
+        if (prUrl === undefined || prUrl === "") {
+            process.stderr.write("github replay needs a PR URL or owner/repo#N\n");
+            return 1;
+        }
+        const ref = parseGitHubPrRef(prUrl);
+        if (ref === undefined) {
+            process.stderr.write(`could not parse PR ref: ${prUrl}\n`);
+            return 1;
+        }
+        // Which channel(s) to deliver to — reuse forward's discovery + URL builder,
+        // but keep each channel's *declared* events so `--events=*` can expand them.
+        const dir = resolvePath(options.dir);
+        const channels = findGitHubChannelTargets(yield resolveAgentMounts(dir));
+        const host = (_d = options.host) !== null && _d !== void 0 ? _d : DEFAULT_HOST;
+        const port = (_e = options.port) !== null && _e !== void 0 ? _e : DEFAULT_PORT;
+        let candidates = channels;
+        if (options.slug !== undefined) {
+            candidates = candidates.filter((c) => c.slug === options.slug);
+        }
+        if (options.channel !== undefined) {
+            candidates = candidates.filter((c) => c.channelId === options.channel);
+        }
+        if (options.url !== undefined && candidates.length > 1) {
+            process.stderr.write("--url targets a single channel; narrow with --slug/--channel\n");
+            return 1;
+        }
+        if (candidates.length === 0 && options.url === undefined) {
+            process.stderr.write("no GitHub channel found. Author agent/channels/github.ts with githubChannel(), or pass --url.\n");
+            return 1;
+        }
+        const targets = options.url === undefined
+            ? candidates.map((c) => ({
+                slug: c.slug,
+                channelId: c.channelId,
+                url: channelForwardUrl({
+                    host,
+                    port,
+                    slug: c.slug,
+                    channelId: c.channelId,
+                    routePath: c.routePath,
+                }),
+                events: c.events,
+            }))
+            : [
+                {
+                    slug: (_f = (_a = candidates[0]) === null || _a === void 0 ? void 0 : _a.slug) !== null && _f !== void 0 ? _f : "",
+                    channelId: (_g = (_b = candidates[0]) === null || _b === void 0 ? void 0 : _b.channelId) !== null && _g !== void 0 ? _g : "",
+                    url: options.url,
+                    events: (_h = (_c = candidates[0]) === null || _c === void 0 ? void 0 : _c.events) !== null && _h !== void 0 ? _h : [],
+                },
+            ];
+        const requested = parseEventList(options.events);
+        const { events: eventsToReplay, unsupported } = selectReplayEvents(requested, unionForwardEvents(targets));
+        if (unsupported.length > 0) {
+            process.stderr.write(`[agent-serve] cannot synthesize (skipped): ${unsupported.join(", ")}\n`);
+        }
+        if (eventsToReplay.length === 0) {
+            process.stderr.write("no synthesizable events selected\n");
+            return 1;
+        }
+        // Read the PR — pull access is enough (no admin, no relay).
+        let repo;
+        let pull;
+        try {
+            repo = yield ghApiJson(`repos/${ref.owner}/${ref.repo}`);
+            pull = yield ghApiJson(`repos/${ref.owner}/${ref.repo}/pulls/${ref.number}`);
+        }
+        catch (error) {
+            process.stderr.write(`failed to read ${ref.label} via gh api: ${error instanceof Error ? error.message : String(error)}\n`);
+            return 1;
+        }
+        // Best-effort: mirror a real CI check (app slug / conclusion) for CI events.
+        const wantsCi = eventsToReplay.some((event) => ["check_run", "check_suite", "workflow_run", "status"].includes(event));
+        const check = wantsCi
+            ? yield fetchReplayCheck(ref, pull.head.sha)
+            : undefined;
+        const synthesized = [];
+        for (const event of eventsToReplay) {
+            const result = synthesizeGitHubEvent({
+                event,
+                repo,
+                pull,
+                action: options.action,
+                conclusion: options.conclusion,
+                context: options.context,
+                comment: options.comment,
+                check,
+            });
+            if ("error" in result) {
+                process.stderr.write(`[agent-serve] skipping ${event}: ${result.error}\n`);
+                continue;
+            }
+            synthesized.push(result);
+        }
+        if (synthesized.length === 0) {
+            process.stderr.write("nothing to replay after synthesis\n");
+            return 1;
+        }
+        const secret = (_j = options.secret) !== null && _j !== void 0 ? _j : process.env.GITHUB_WEBHOOK_SECRET;
+        process.stderr.write(`[agent-serve] replaying ${ref.label} (${synthesized
+            .map((s) => s.eventName)
+            .join(", ")}) → ${targets.length} channel${targets.length === 1 ? "" : "s"}\n`);
+        const report = [];
+        let anyRejected = false;
+        for (const event of synthesized) {
+            const body = Buffer.from(JSON.stringify(event.payload));
+            const headers = {
+                "content-type": "application/json",
+                "x-github-event": event.eventName,
+                "x-github-delivery": randomUUID(),
+            };
+            if (secret !== undefined && secret !== "") {
+                headers["x-hub-signature-256"] =
+                    `sha256=${signGitHubWebhookBody({ secret, body })}`;
+            }
+            if (options.out !== undefined) {
+                const file = yield writeReplayFixture(options.out, event);
+                process.stderr.write(`[agent-serve] wrote ${file}\n`);
+            }
+            const label = eventLabel(event);
+            if (options.dryRun === true) {
+                report.push(Object.assign(Object.assign({}, eventReport(event)), { payload: event.payload }));
+                if (options.json !== true) {
+                    process.stdout.write(`--- ${label} ---\n${JSON.stringify(event.payload, null, 2)}\n`);
+                }
+                continue;
+            }
+            const deliveries = yield deliverReplayEvent(body, headers, event.eventName, targets);
+            if (deliveries.length === 0 ||
+                deliveries.some((delivery) => !delivery.ok)) {
+                anyRejected = true;
+            }
+            report.push(Object.assign(Object.assign({}, eventReport(event)), { deliveries }));
+            if (options.json !== true) {
+                const summary = deliveries
+                    .map((delivery) => `${delivery.label} ${delivery.status || "ERR"}${delivery.ok ? "" : " (rejected)"}`)
+                    .join(", ") || "(no matching channel)";
+                process.stderr.write(`[agent-serve]   ${label} → ${summary}\n`);
+            }
+        }
+        if (options.json === true) {
+            process.stdout.write(`${JSON.stringify({ pr: ref.label, dryRun: options.dryRun === true, events: report }, null, 2)}\n`);
+        }
+        return anyRejected ? 1 : 0;
+    });
+}
+/** POST one synthesized event to every channel whose event set matches. */
+function deliverReplayEvent(body, headers, eventName, targets) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const recipients = targets.filter((target) => target.events.length === 0 || target.events.includes(eventName));
+        const payload = new Uint8Array(body);
+        // Bounded by the channel count (a handful) — see fanoutDelivery.
+        return Promise.all(recipients.map((target) => __awaiter(this, void 0, void 0, function* () {
+            try {
+                const response = yield fetch(target.url, {
+                    method: "POST",
+                    headers,
+                    body: payload,
+                });
+                return {
+                    label: targetLabel(target),
+                    status: response.status,
+                    ok: response.ok,
+                };
+            }
+            catch (error) {
+                return {
+                    label: targetLabel(target),
+                    status: 0,
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        })));
+    });
+}
+function eventLabel(event) {
+    return event.action === undefined
+        ? event.eventName
+        : `${event.eventName}.${event.action}`;
+}
+function eventReport(event) {
+    return { event: event.eventName, action: event.action };
+}
+/** GET `gh api <path>` and parse JSON (throws on non-zero exit). */
+function ghApiJson(path) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const { stdout } = yield execFileAsync("gh", [
+            "api",
+            path,
+            "-H",
+            "Accept: application/vnd.github+json",
+        ]);
+        return JSON.parse(stdout);
+    });
+}
+function fetchReplayCheck(ref, sha) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        try {
+            const data = yield ghApiJson(`repos/${ref.owner}/${ref.repo}/commits/${sha}/check-runs?per_page=100`);
+            const runs = (_a = data.check_runs) !== null && _a !== void 0 ? _a : [];
+            const chosen = (_b = runs.find((run) => run.conclusion === "failure")) !== null && _b !== void 0 ? _b : runs[0];
+            if (chosen === undefined) {
+                return undefined;
+            }
+            return {
+                id: chosen.id,
+                name: chosen.name,
+                conclusion: chosen.conclusion,
+                app: chosen.app,
+            };
+        }
+        catch (_c) {
+            return undefined;
+        }
+    });
+}
+function writeReplayFixture(outDir, event) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const dir = resolvePath(outDir);
+        yield mkdir(dir, { recursive: true });
+        const file = join(dir, `${eventLabel(event)}.json`);
+        yield writeFile(file, `${JSON.stringify(event.payload, null, 2)}\n`);
+        return file;
+    });
+}
+function cmdGithubEvents(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b;
+        const dir = resolvePath(options.dir);
+        const targets = findGitHubChannelTargets(yield resolveAgentMounts(dir));
+        const host = (_a = options.host) !== null && _a !== void 0 ? _a : DEFAULT_HOST;
+        const port = (_b = options.port) !== null && _b !== void 0 ? _b : DEFAULT_PORT;
+        const urlFor = (t) => channelForwardUrl({
+            host,
+            port,
+            slug: t.slug,
+            channelId: t.channelId,
+            routePath: t.routePath,
+        });
+        if (options.json) {
+            process.stdout.write(`${JSON.stringify({
+                channels: targets.map((t) => ({
+                    slug: t.slug,
+                    channelId: t.channelId,
+                    url: urlFor(t),
+                    events: t.events,
+                })),
+            }, null, 2)}\n`);
+            return 0;
+        }
+        if (targets.length === 0) {
+            process.stdout.write("no GitHub channels found (author agent/channels/github.ts with githubChannel())\n");
+            return 0;
+        }
+        for (const t of targets) {
+            const label = t.slug === "" ? t.channelId : `${t.slug}/${t.channelId}`;
+            process.stdout.write(`${label}\n  url:    ${urlFor(t)}\n  events: ${t.events.join(", ") || "none"}\n`);
+        }
+        return 0;
+    });
+}
+function cmdGithubDoctor(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        var _b, _c, _d, _e;
+        const checks = [];
+        const version = yield tryExec({ command: "gh", args: ["--version"] });
+        if (version === undefined) {
+            checks.push({
+                id: "gh",
+                ok: false,
+                message: "gh CLI not found — install from https://cli.github.com",
+            });
+            return reportDoctor(checks, options.json);
+        }
+        checks.push({
+            id: "gh",
+            ok: true,
+            message: (_b = (_a = version.split("\n")[0]) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : "gh present",
+        });
+        const auth = yield tryExec({ command: "gh", args: ["auth", "status"] });
+        checks.push({
+            id: "auth",
+            ok: auth !== undefined,
+            message: auth !== undefined
+                ? "gh auth status ok"
+                : "not logged in — run `gh auth login`",
+        });
+        let extensionList = (_c = (yield tryExec({ command: "gh", args: ["extension", "list"] }))) !== null && _c !== void 0 ? _c : "";
+        let installed = parseGhWebhookExtensionInstalled(extensionList);
+        let pinOk = installed && ghWebhookExtensionPinSatisfied(extensionList);
+        if ((!installed || !pinOk) && options.install === true) {
+            const install = yield tryExec({
+                command: "gh",
+                args: ghWebhookExtensionInstallArgs({ force: installed && !pinOk }),
+            });
+            if (install !== undefined) {
+                extensionList = (_d = (yield tryExec({ command: "gh", args: ["extension", "list"] }))) !== null && _d !== void 0 ? _d : "";
+                installed = parseGhWebhookExtensionInstalled(extensionList);
+                pinOk = installed && ghWebhookExtensionPinSatisfied(extensionList);
+            }
+            else {
+                installed = false;
+                pinOk = false;
+            }
+            checks.push({
+                id: "install",
+                ok: installed && pinOk,
+                message: installed && pinOk
+                    ? `installed ${GITHUB_WEBHOOK_EXTENSION}@${GITHUB_WEBHOOK_EXTENSION_PIN}`
+                    : `failed to install ${GITHUB_WEBHOOK_EXTENSION}@${GITHUB_WEBHOOK_EXTENSION_PIN}`,
+            });
+        }
+        checks.push({
+            id: "extension",
+            ok: installed && pinOk,
+            message: installed && pinOk
+                ? `${GITHUB_WEBHOOK_EXTENSION}@${GITHUB_WEBHOOK_EXTENSION_PIN} installed`
+                : !installed
+                    ? `${GITHUB_WEBHOOK_EXTENSION} missing — run \`agent-serve github doctor --install\``
+                    : `${GITHUB_WEBHOOK_EXTENSION} is ${(_e = parseGhWebhookExtensionVersion(extensionList)) !== null && _e !== void 0 ? _e : "unknown"} (need ${GITHUB_WEBHOOK_EXTENSION_PIN}) — run \`agent-serve github doctor --install\``,
+        });
+        const envToken = detectGitHubEnvTokenOverride();
+        checks.push(envToken === undefined
+            ? {
+                id: "env_token",
+                ok: true,
+                message: "no GITHUB_TOKEN/GH_TOKEN override (gh uses its own login)",
+            }
+            : {
+                id: "env_token",
+                ok: false,
+                warn: true,
+                message: githubEnvTokenHint(envToken),
+            });
+        return reportDoctor(checks, options.json);
+    });
+}
+function reportDoctor(checks, json) {
+    // Warnings (e.g. an env-token override) are advisory and do not fail doctor.
+    const ok = checks.every((check) => check.ok || check.warn === true);
+    if (json === true) {
+        process.stdout.write(`${JSON.stringify({ ok, checks }, null, 2)}\n`);
+    }
+    else {
+        for (const check of checks) {
+            const marker = check.ok ? "ok" : check.warn === true ? "!!warn" : "!!";
+            process.stdout.write(`${marker}  ${check.id}: ${check.message}\n`);
+        }
+        process.stdout.write(ok ? "doctor: pass\n" : "doctor: fail\n");
+    }
+    return ok ? 0 : 1;
+}
+function ensureWebhookExtension(install) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        if ((yield tryExec({ command: "gh", args: ["--version"] })) === undefined) {
+            return {
+                ok: false,
+                message: "gh CLI not found — install from https://cli.github.com, then `gh auth login`",
+            };
+        }
+        const list = (_a = (yield tryExec({ command: "gh", args: ["extension", "list"] }))) !== null && _a !== void 0 ? _a : "";
+        const installed = parseGhWebhookExtensionInstalled(list);
+        const pinOk = installed && ghWebhookExtensionPinSatisfied(list);
+        if (installed && pinOk) {
+            return { ok: true, message: "" };
+        }
+        if (!install) {
+            return {
+                ok: false,
+                message: !installed
+                    ? `${GITHUB_WEBHOOK_EXTENSION} not installed — run \`gh extension install ${GITHUB_WEBHOOK_EXTENSION} --pin ${GITHUB_WEBHOOK_EXTENSION_PIN}\` or re-run with --install`
+                    : `${GITHUB_WEBHOOK_EXTENSION} is ${(_b = parseGhWebhookExtensionVersion(list)) !== null && _b !== void 0 ? _b : "unknown"} (need ${GITHUB_WEBHOOK_EXTENSION_PIN}) — re-run with --install`,
+            };
+        }
+        process.stderr.write(`[agent-serve] installing ${GITHUB_WEBHOOK_EXTENSION}@${GITHUB_WEBHOOK_EXTENSION_PIN}…\n`);
+        if ((yield tryExec({
+            command: "gh",
+            args: ghWebhookExtensionInstallArgs({ force: installed && !pinOk }),
+        })) === undefined) {
+            return {
+                ok: false,
+                message: `failed to install ${GITHUB_WEBHOOK_EXTENSION}@${GITHUB_WEBHOOK_EXTENSION_PIN}`,
+            };
+        }
+        const listAfter = (_c = (yield tryExec({ command: "gh", args: ["extension", "list"] }))) !== null && _c !== void 0 ? _c : "";
+        const installedAfter = parseGhWebhookExtensionInstalled(listAfter);
+        const pinOkAfter = installedAfter && ghWebhookExtensionPinSatisfied(listAfter);
+        if (!installedAfter || !pinOkAfter) {
+            return {
+                ok: false,
+                message: !installedAfter
+                    ? `${GITHUB_WEBHOOK_EXTENSION} missing after install`
+                    : `${GITHUB_WEBHOOK_EXTENSION} is ${(_d = parseGhWebhookExtensionVersion(listAfter)) !== null && _d !== void 0 ? _d : "unknown"} after install (need ${GITHUB_WEBHOOK_EXTENSION_PIN})`,
+            };
+        }
+        return { ok: true, message: "" };
+    });
+}
+function inferRepo(dir) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const viaGh = yield tryExec({
+            command: "gh",
+            args: ["repo", "view", "--json", "nameWithOwner", "-q", ".nameWithOwner"],
+            cwd: dir,
+        });
+        const trimmed = viaGh === null || viaGh === void 0 ? void 0 : viaGh.trim();
+        if (trimmed !== undefined && trimmed !== "") {
+            return trimmed;
+        }
+        const remote = yield tryExec({
+            command: "git",
+            args: ["-C", dir, "remote", "get-url", "origin"],
+        });
+        return remote === undefined ? undefined : parseRepoFromRemoteUrl(remote);
+    });
+}
+/** Run a command, returning stdout on success or undefined on any failure. */
+function tryExec(options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const { stdout } = yield execFileAsync(options.command, options.args, Object.assign({}, (options.cwd === undefined ? {} : { cwd: options.cwd })));
+            return stdout;
+        }
+        catch (_a) {
+            return undefined;
+        }
+    });
+}
+function spawnGh(args) {
+    return new Promise((resolve) => {
+        const child = spawn("gh", args, { stdio: "inherit" });
+        const forward = (signal) => {
+            if (!child.killed) {
+                child.kill(signal);
+            }
+        };
+        process.on("SIGINT", forward);
+        process.on("SIGTERM", forward);
+        child.on("error", (error) => {
+            process.stderr.write(`failed to run gh: ${error.message}\n`);
+            resolve(1);
+        });
+        child.on("exit", (code, signal) => {
+            resolve(code !== null && code !== void 0 ? code : (signal === null ? 0 : 130));
+        });
+    });
+}
+/** Split a comma/whitespace-separated list; undefined when empty/unset. */
+function parseEventList(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    const events = value
+        .split(/[\s,]+/)
+        .map((event) => event.trim())
+        .filter(Boolean);
+    return events.length === 0 ? undefined : events;
+}
+/** Render the gh argv for logging with the signing secret masked. */
+function redact(args) {
+    return args
+        .map((arg) => (arg.startsWith("--secret=") ? "--secret=***" : arg))
+        .join(" ");
+}

package/dist/internal/cli-slack.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `agent-serve slack …` CLI — manifests, setup, doctor (Socket Mode).
+ */
+export interface SlackCliOptions {
+    dir: string;
+    name?: string;
+    env?: "dev" | "prod" | "both";
+    json?: boolean;
+    print?: boolean;
+    /** Per-agent env prefix for tokens (`MY_AGENT`). */
+    prefix?: string;
+    /** Use shared `SLACK_*` env vars (no per-agent prefix). */
+    noPrefix?: boolean;
+    /** Subscribe manifests to channel-post events (opt-in channel watch). */
+    channelPosts?: boolean;
+}
+export declare function cmdSlack(subcommand: string | undefined, options: SlackCliOptions): Promise<number>;
+//# sourceMappingURL=cli-slack.d.ts.map

package/dist/internal/cli-slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-slack.d.ts","sourceRoot":"","sources":["../../src/internal/cli-slack.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAoBD,wBAAsB,QAAQ,CAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,MAAM,CAAC,CAsBjB"}