@dev-loops/core 1.0.2-slim.0 → 1.0.3

package/src/github/closing-ref-guard.mjs

@@ -0,0 +1,80 @@
+// Canonical closing-reference primitives shared by the create-pr / edit-pr
+// wrappers so both guard a body's closing reference against the branch's own
+// resolved issue with one implementation. A body swap that re-points the
+// reference at a different issue would otherwise pass silently, and a merge
+// would then close the wrong issue — this is the fail-closed backstop against
+// that data-integrity hole.
+
+import { extractClosingIssueNumbers as extractCanonicalClosingRefs } from "../loop/issue-refinement-artifact.mjs";
+
+// Every issue number the body's closing references name. Delegates to the ONE
+// canonical body-spec parser so the closing-keyword vocabulary (close/closes/
+// closed, fix/fixes/fixed, resolve/resolves/resolved, any case), the cross-repo
+// `owner/repo#N` form, fenced/inline-code stripping (a `Closes #N` inside a
+// ```fenced``` example or `inline code` span does not auto-close on GitHub and
+// must not spoof the guard), and de-duplication stay owned in ONE place — the
+// guard never re-implements them.
+export function extractClosingIssueNumbers(body) {
+  if (!body || typeof body !== "string") return [];
+  return extractCanonicalClosingRefs(body);
+}
+
+// True when the body carries any closing keyword.
+export function detectClosingKeyword(body) {
+  return extractClosingIssueNumbers(body).length > 0;
+}
+
+// The issue number from the body's first closing reference, or null when the
+// body carries none. Back-compat surface (create-pr's `--issue` missing-reference
+// check); the mismatch guard uses extractClosingIssueNumbers to see every one.
+export function extractClosingIssueNumber(body) {
+  const all = extractClosingIssueNumbers(body);
+  return all.length > 0 ? all[0] : null;
+}
+
+// Branch slug `[<prefix>/]issue-<N>[-<slug>]` -> N. Matches the dev-loop
+// worktree default branch name and the prefixed form (e.g. a `dl/`-prefixed
+// slug). Returns null when the branch encodes no issue number.
+const BRANCH_ISSUE_PATTERN = /(?:^|\/)issue-(\d+)(?:-|$)/u;
+export function extractIssueFromBranchSlug(branch) {
+  if (!branch || typeof branch !== "string") return null;
+  const match = BRANCH_ISSUE_PATTERN.exec(branch.trim());
+  return match ? Number(match[1]) : null;
+}
+
+// Resolve the issue a PR is expected to close from its own facts. The branch
+// slug is authoritative (it encodes the issue the loop cut the branch for);
+// the PR's GitHub-derived closingIssuesReferences is the fallback. Returns null
+// when neither yields an issue — a genuinely issue-less PR, which is exempt.
+export function resolveExpectedIssueFromPrContext(ctx) {
+  if (!ctx || typeof ctx !== "object") return null;
+  const fromBranch = extractIssueFromBranchSlug(ctx.headRefName);
+  if (fromBranch !== null) return fromBranch;
+  const refs = Array.isArray(ctx.closingIssuesReferences) ? ctx.closingIssuesReferences : [];
+  for (const ref of refs) {
+    const n = typeof ref === "number" ? ref : Number(ref?.number);
+    if (Number.isInteger(n) && n > 0) return n;
+  }
+  return null;
+}
+
+// Compare the body's closing reference against the branch's resolved issue.
+// Returns a named refusal string when they disagree, else null. A waiver
+// bypasses; an unresolved expected issue (issue-less) is exempt; a body with no
+// closing reference has nothing to mislink and is exempt (only a present-and-
+// disagreeing reference is refused, never a missing one).
+export function resolveClosingRefMismatch({ body, expectedIssue, allowCrossIssue = false }) {
+  if (allowCrossIssue) return null;
+  if (!Number.isInteger(expectedIssue)) return null;
+  const closing = extractClosingIssueNumbers(body);
+  if (closing.length === 0) return null;
+  // Refuse when ANY closing reference disagrees — GitHub closes every one, so a
+  // correct first reference does not excuse a wrong second (a single-issue
+  // dev-loop PR closes only its branch's issue; a deliberate multi/cross-issue
+  // reference uses the waiver).
+  const disagreeing = closing.find((n) => n !== expectedIssue);
+  if (disagreeing !== undefined) {
+    return `CLOSING-REF-BRANCH-MISMATCH: the body closes #${disagreeing} but the branch resolves to issue #${expectedIssue} — refusing a mismatched closing reference (pass --allow-cross-issue to record a deliberate cross-issue reference)`;
+  }
+  return null;
+}

package/src/github/copilot-helpers.mjs

@@ -10,6 +10,22 @@ import { trimmedOrNull } from "../loop/normalize.mjs";
 // acting on the gate's behalf must agree with the gate about what a submitted
 // review is.
 export const SUBMITTED_REVIEW_STATES = new Set(["APPROVED", "CHANGES_REQUESTED", "COMMENTED", "DISMISSED"]);
+
+// Copilot's COMMENTED review summary opens with a disposition header whose
+// emoji is the authoritative signal: "### 🟡 Changes recommended" (findings)
+// vs "### 🟢 Approval recommended" (clean). Keying on the 🟡 marker means a
+// clean body that merely quotes the phrase "changes recommended" — with or
+// without markdown emphasis ("No **changes recommended**", "No _changes
+// recommended_") — is never a false finding. The strong no-emoji signal is
+// already covered by the CHANGES_REQUESTED state.
+const COPILOT_CHANGES_RECOMMENDED_MARKER = "🟡";
+
+export function copilotReviewBodySignalsChanges(state, body) {
+  const normalizedState = typeof state === "string" ? state.toUpperCase() : "";
+  if (normalizedState === "CHANGES_REQUESTED") return true;
+  if (normalizedState !== "COMMENTED") return false;
+  return typeof body === "string" && body.includes(COPILOT_CHANGES_RECOMMENDED_MARKER);
+}
 const GATE_REVIEW_NAMES = new Set(["draft_gate", "pre_approval_gate"]);
 // `review` is a RECOGNIZED gate header that carries no draft/pre-approval
 // evidence by design. Recognizing it lets
@@ -700,6 +716,7 @@ export function summarizeCopilotReviews(reviews, { headSha, draftGateResetAtMs }
   let hasPendingReviewOnCurrentHead = false;
   let hasSubmittedReviewOnCurrentHead = false;
   let latestSubmittedReviewOnCurrentHeadAt = null;
+  let hasBodyFindingOnCurrentHead = false;
   let completedCopilotReviewRounds = 0;
 
   for (const review of effectiveReviews) {
@@ -722,9 +739,18 @@ export function summarizeCopilotReviews(reviews, { headSha, draftGateResetAtMs }
 
     if (SUBMITTED_REVIEW_STATES.has(state)) {
       hasSubmittedReviewOnCurrentHead = true;
-      const submittedAt = typeof review?.submittedAt === "string" ? review.submittedAt : null;
+      const submittedAt = typeof review?.submittedAt === "string"
+        ? review.submittedAt
+        : (typeof review?.submitted_at === "string" ? review.submitted_at : null);
       if (submittedAt !== null && (latestSubmittedReviewOnCurrentHeadAt === null || submittedAt > latestSubmittedReviewOnCurrentHeadAt)) {
         latestSubmittedReviewOnCurrentHeadAt = submittedAt;
+        hasBodyFindingOnCurrentHead = copilotReviewBodySignalsChanges(state, review?.body);
+      } else if (submittedAt !== null && submittedAt === latestSubmittedReviewOnCurrentHeadAt) {
+        // Equal-timestamp tie on the same head: fail toward surfacing so array
+        // order never silently drops a finding when two reviews share a timestamp.
+        hasBodyFindingOnCurrentHead = hasBodyFindingOnCurrentHead || copilotReviewBodySignalsChanges(state, review?.body);
+      } else if (submittedAt === null && latestSubmittedReviewOnCurrentHeadAt === null) {
+        hasBodyFindingOnCurrentHead = hasBodyFindingOnCurrentHead || copilotReviewBodySignalsChanges(state, review?.body);
       }
     }
   }
@@ -740,5 +766,6 @@ export function summarizeCopilotReviews(reviews, { headSha, draftGateResetAtMs }
     hasPendingReviewOnCurrentHead,
     hasSubmittedReviewOnCurrentHead,
     latestSubmittedReviewOnCurrentHeadAt,
+    hasBodyFindingOnCurrentHead,
   };
 }

package/src/github/issue-ops.mjs

@@ -4,6 +4,7 @@ import { runChild as defaultRunChild } from "../cli/primitives.mjs";
 import { parseJsonText } from "./review-threads.mjs";
 import { parseRepoSlug } from "./repo-slug.mjs";
 import { guardCommentBodyNoIssuePrIds } from "./comment-id-guard.mjs";
+import { assertGithubWriteStubbedInTestMode } from "./test-mode-write-guard.mjs";
 
 /**
  * Core `gh issue` operations, extracted from the thin CLI wrappers under
@@ -88,6 +89,7 @@ export async function resolveCreateBody(options) {
 }
 
 export async function createIssue(options, { env = process.env, ghCommand = "gh", run = defaultRunChild } = {}) {
+  assertGithubWriteStubbedInTestMode(run, "issue create", { env });
   const body = await resolveCreateBody(options);
   if (typeof body !== "string" || body.trim().length === 0) {
     const source = options.bodyFile !== undefined ? `--body-file ${options.bodyFile}` : "--body";
@@ -182,6 +184,7 @@ export function buildStateChangeArgs(options) {
 }
 
 export async function editIssue(options, { env = process.env, ghCommand = "gh", run = defaultRunChild } = {}) {
+  assertGithubWriteStubbedInTestMode(run, "issue edit/close", { env });
   const { args, edited } = await buildEditArgs(options);
   // Skip the edit call entirely when --state is the only change requested —
   // `gh issue edit` with no field flags errors ("no changed fields").
@@ -227,6 +230,7 @@ export async function resolveCommentBody(options) {
 }
 
 export async function commentIssue(options, { env = process.env, ghCommand = "gh", run = defaultRunChild } = {}) {
+  assertGithubWriteStubbedInTestMode(run, "issue comment", { env });
   const body = await resolveCommentBody(options);
   // ISSUE/PR-ID GUARD (#1731): a generated comment body must never emit a raw
   // issue/PR id (fail-closed unless explicitly allowlisted). `allowedRefs` is

package/src/github/repo-slug.mjs

@@ -83,10 +83,33 @@ export function dedupeRepoSlugOptions(options) {
   }
   return uniqueOptions;
 }
+// Parses a git remote URL into an <owner/name> slug, but only for github.com
+// remotes. The URI form (scheme://[user@]host[:port]/path) is checked before
+// the scp form (host:path), because the scp regex also matches URIs like
+// https://... — checking scp first would misparse the host out of the scheme.
+function parseGitHubRemoteSlug(url) {
+  let host, path;
+  const uri = url.match(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\/(.+)$/);
+  const scp = url.match(/^(?:[^@/]+@)?([^/:]+):(.+)$/);
+  if (uri) {
+    host = uri[1];
+    path = uri[2];
+  } else if (scp) {
+    host = scp[1];
+    path = scp[2];
+  } else {
+    return null;
+  }
+  if (host.toLowerCase() !== "github.com") return null;
+  const seg = path.match(/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (!seg) return null;
+  return `${seg[1]}/${seg[2]}`;
+}
+
 /**
  * Auto-detect <owner/name> from `git remote get-url origin`.
  * Returns the slug string on success, or null when detection fails
- * (no origin remote, not a git repo, or unparseable URL).
+ * (no origin remote, not a git repo, non-github.com host, or unparseable URL).
  * Does NOT throw — callers should add their own context-specific error messages.
  */
 export function detectRepoSlug(cwd) {
@@ -96,9 +119,7 @@ export function detectRepoSlug(cwd) {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
     }).trim();
-    const match = url.match(/[:/]([^/]+)\/([^/]+?)(?:\.git)?$/);
-    if (!match) return null;
-    return `${match[1]}/${match[2]}`;
+    return parseGitHubRemoteSlug(url);
   } catch {
     return null;
   }

package/src/github/test-mode-write-guard.mjs

@@ -0,0 +1,81 @@
+/**
+ * Fail-closed test-mode guard for GitHub WRITE helpers.
+ *
+ * A GitHub write helper (issue/PR create/edit/close/comment/merge) must never
+ * reach a live GitHub write path from a test. The real incident: an unstubbed
+ * `bun run verify` drove a dedup test's followUpDraft through
+ * applyFollowUpIssues -> ensureFollowUpIssue -> createIssue and FILED A REAL
+ * ISSUE against the repo. The DI stub seam existed; the test simply did not
+ * thread it, and nothing failed closed to stop the live write.
+ *
+ * This guard is TEST-MODE ONLY. In production (`NODE_ENV !== "test"`) it is a
+ * no-op — it never changes production write behavior (non-goal: no production
+ * behavior change; no general network sandbox). It only asserts, when a test is
+ * running, that the write is stubbed by one of the two sanctioned seams:
+ *
+ * Test mode is derived from the EXECUTING PROCESS's own env (`process.env`),
+ * never from the write-target `env` a caller passes in. A caller can build a
+ * sparse `env` (e.g. `{ GH_TOKEN }` with no `NODE_ENV`) to shape the `gh`
+ * child's environment; if that sparse env decided test mode, it could turn
+ * the guard off from under a test simply by omitting `NODE_ENV`. Reading the
+ * real process env instead makes that impossible: a caller-supplied env can
+ * never disable the guard.
+ *
+ *   (a) In-process DI seam: the helper's `run`/`runChild` was replaced with a
+ *       stub (e.g. `makeGhMock`), so it is no longer the live child-exec seam.
+ *   (b) Process-boundary seam: a subprocess test installed a fake `gh` on PATH
+ *       (`writeGhStub`) and attests it via `DEV_LOOPS_GH_STUB` in the child env.
+ *
+ * Anything else in test mode fails closed at the call site, before any network
+ * call, with an actionable error naming both seams.
+ */
+
+import { runChild as liveRunChild } from "../cli/primitives.mjs";
+
+/**
+ * Env var a process-boundary gh stub sets to attest that `gh` itself is a stub
+ * (set automatically by the `writeGhStub` test helper). Only consulted in test
+ * mode, so it is not a production escape hatch.
+ */
+export const GH_STUB_ATTESTATION_ENV = "DEV_LOOPS_GH_STUB";
+
+/**
+ * True when `run` is the live child-exec seam — i.e. NO in-process DI stub was
+ * injected. `null`/`undefined` (a helper with no run seam, e.g. the spawn-based
+ * create-pr path) is treated as live too, so it fails closed rather than open.
+ * @param {unknown} run
+ */
+export function isLiveExecutor(run) {
+  return run == null || run === liveRunChild;
+}
+
+/**
+ * Assert a GitHub write is stubbed when running under a test. No-op unless the
+ * EXECUTING PROCESS is in test mode (`processEnv.NODE_ENV === "test"`) — never
+ * decided by the caller-supplied write-target `env`, so a sparse `env` (e.g.
+ * missing `NODE_ENV`) cannot bypass the guard. Throws (code
+ * `GH_WRITE_UNSTUBBED_IN_TEST`) when the write would reach the live path with
+ * neither sanctioned stub seam present.
+ *
+ * @param {unknown} run - the helper's `run`/`runChild` seam (omit for spawn-only
+ *   helpers with no in-process seam).
+ * @param {string} op - human-readable op name, e.g. `"issue create"`.
+ * @param {{ env?: NodeJS.ProcessEnv, processEnv?: NodeJS.ProcessEnv }} [opts]
+ *   `env` is the write-target env (consulted only for the stub attestation);
+ *   `processEnv` (defaults to `process.env`, injectable for tests) is the
+ *   real executing process's env and is the sole source of test-mode.
+ */
+export function assertGithubWriteStubbedInTestMode(run, op, { env = process.env, processEnv = process.env } = {}) {
+  if (processEnv?.NODE_ENV !== "test") return; // production / non-test: never guards
+  if (!isLiveExecutor(run)) return; // (a) in-process DI stub injected
+  if (processEnv?.[GH_STUB_ATTESTATION_ENV] || env?.[GH_STUB_ATTESTATION_ENV]) return; // (b) process-boundary gh stub
+  throw Object.assign(
+    new Error(
+      `GitHub write helper "${op}" was called in test mode without an injected stub — ` +
+        `refusing to reach a live GitHub write path (a test must never mutate the real repo). ` +
+        `Inject the in-process DI seam (pass { run } / { runChild }, e.g. makeGhMock) or stub gh ` +
+        `at the process boundary (writeGhStub, which sets ${GH_STUB_ATTESTATION_ENV}). See issue 2216.`,
+    ),
+    { code: "GH_WRITE_UNSTUBBED_IN_TEST" },
+  );
+}

package/src/loop/bash-command-classify.mjs

@@ -8,9 +8,65 @@
  * Pure and side-effect free.
  */
 
-/** The repository these gate guards apply to. */
+/**
+ * The dev-loops repo itself. Retained ONLY for the Pi extension's
+ * (`extension/post-merge-update.ts`) dev-loops-repo SELF-UPDATE scoping (`markPendingUpdate` /
+ * `queueIfEligible`), which is legitimately anchored to this one repo, not to whatever repo the
+ * harness happens to run in. Both harness guard suites — the Claude PreToolUse Bash gate
+ * (`decideBashGate` in `hook-decisions.mjs`) and the Pi extension's `gh pr ready`/`gh pr merge`
+ * guards (`post-merge-update.ts`) — now resolve the managed repo dynamically via
+ * `deriveInManagedRepo` below instead of comparing against this hardcoded slug, so every guard
+ * also applies in a dev-loops-managed consumer repo.
+ */
 export const TARGET_REPO_SLUG = "mfittko/dev-loops";
 
+/** `.devloops` config file extensions checked (in order) to decide whether a repo root is
+ * dev-loops-managed. Shared by every harness that resolves `inManagedContext` from the
+ * filesystem (`fs.existsSync(path.join(repoRoot, \`.devloops${ext}\`))`). */
+export const DEVLOOPS_CONFIG_VARIANTS = ["", ".yaml", ".yml", ".json"];
+
+/**
+ * Whether the current repo counts as "managed" for guard-gating purposes: inside a
+ * dev-loops-managed context (a `.devloops` config exists at its root) AND, when the managed
+ * repo's identity resolves, the cwd repo IS that managed repo. FAIL CLOSED: inside a managed
+ * context whose identity can't be resolved (`managedRepoSlug` null), the guard suite still
+ * applies rather than silently allowing everything.
+ * @param {Object} [params]
+ * @param {boolean} [params.inManagedContext] - Whether a `.devloops` config exists at the repo root.
+ * @param {string|null} [params.managedRepoSlug] - Resolved owner/name of the managed repo, or null.
+ * @param {string|null} [params.repoSlug] - Resolved owner/name of the cwd repo, or null.
+ * @returns {boolean}
+ */
+export function deriveInManagedRepo({ inManagedContext = false, managedRepoSlug = null, repoSlug = null } = {}) {
+  const managedSlug = (managedRepoSlug ?? "").trim().toLowerCase() || null;
+  const cwdSlug = (repoSlug ?? "").trim().toLowerCase() || null;
+  return Boolean(inManagedContext) && (managedSlug === null || cwdSlug === managedSlug);
+}
+
+/**
+ * Whether an explicit `--repo`/`-R` (or `GH_REPO=`) target is PROVABLY a different repo than the
+ * managed one — both slugs must resolve and differ. An unresolvable managed slug never proves
+ * foreign-ness (fail closed: the guard stays active rather than waving an explicit flag through).
+ * @param {string|null} explicitRepo
+ * @param {string|null} managedRepoSlug
+ * @returns {boolean}
+ */
+export function explicitRepoProvenForeign(explicitRepo, managedRepoSlug) {
+  const managedSlug = (managedRepoSlug ?? "").trim().toLowerCase() || null;
+  const explicit = (explicitRepo ?? "").trim().toLowerCase() || null;
+  if (managedSlug === null || explicit === null) {
+    return false;
+  }
+  // Both sides must be clean owner/name identities before we can prove foreign: a
+  // managed slug that bypassed the normalizer (e.g. a hostile `acme/widgets;id` test
+  // double) can't be trusted to prove anything about the explicit `--repo` — fail
+  // closed (the managed-repo guard still applies) rather than wave it through.
+  if (!isCleanRepoSlug(managedSlug) || !isCleanRepoSlug(explicit)) {
+    return false;
+  }
+  return explicit !== managedSlug;
+}
+
 /** Flags known to take a value argument for `gh pr ready` (not boolean flags). */
 export const FLAGS_THAT_TAKE_VALUE = new Set(["-r", "--repo"]);
 
@@ -21,7 +77,7 @@ export const FLAGS_THAT_TAKE_VALUE = new Set(["-r", "--repo"]);
  * strings — so a segment must break on them too, else `echo hi\ngh pr create` evades
  * the gate. Used by all segment-splitting sites (DRY).
  */
-const SHELL_SEGMENT_SEPARATOR = /\s*(?:&&|\|\||;|\||\n|\r)\s*/;
+const SHELL_SEGMENT_SEPARATOR = /\s*(?:&&|\|\||;|\||&|\n|\r)\s*/;
 
 /**
  * Strip a single balanced surrounding quote pair (`'…'` or `"…"`) from a shell arg value.
@@ -67,8 +123,32 @@ export function trimToNull(value) {
   return trimmed ? trimmed : null;
 }
 
+/**
+ * Strict GitHub owner/name identity shape: each of the two path segments is
+ * `[A-Za-z0-9._-]+` — the character set GitHub itself allows in an owner or repo name. A slug
+ * outside this shape (a shell metacharacter, whitespace, path traversal, or an extra `/` segment)
+ * can never be a real GitHub identity.
+ */
+const CLEAN_REPO_SLUG_RE = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+
+/**
+ * Whether `slug` is a clean `owner/name` GitHub identity (see `CLEAN_REPO_SLUG_RE`). Exported so a
+ * sink that interpolates a repo slug into a shell command string (e.g. the Pi extension's
+ * `gateCommand` in `extension/post-merge-update.ts`) can defense-in-depth guard the interpolation,
+ * on top of `normalizeGitHubRepoSlug` already enforcing this shape at the source.
+ * @param {string|null|undefined} slug @returns {boolean}
+ */
+export function isCleanRepoSlug(slug) {
+  return typeof slug === "string" && CLEAN_REPO_SLUG_RE.test(slug);
+}
+
 /**
  * Normalize a git remote URL into an `owner/name` slug (lowercased), or null.
+ * A hostile remote (e.g. `git@github.com:acme/widgets;id`) never yields a slug carrying the
+ * injected metacharacters — the extracted candidate must match `CLEAN_REPO_SLUG_RE` or this
+ * returns null instead, so every caller (both harnesses' managed-repo scope checks, and any sink
+ * that interpolates the slug into a shell command) sees either a real GitHub identity or null,
+ * never shell-metacharacter-bearing text.
  * @param {string} remoteUrl
  * @returns {string|null}
  */
@@ -91,7 +171,8 @@ export function normalizeGitHubRepoSlug(remoteUrl) {
     if (!match) {
       continue;
     }
-    return trimToNull(match[1])?.toLowerCase() ?? null;
+    const slug = trimToNull(match[1])?.toLowerCase() ?? null;
+    return isCleanRepoSlug(slug) ? slug : null;
   }
 
   return null;
@@ -486,6 +567,25 @@ export function extractRepoFlagsFromGhPrCreateSegments(command) {
   return extractRepoFlagsFromGhSubcmdVerbSegments(command, "pr", "create");
 }
 
+/**
+ * Return `{ segment, explicitRepo }` for every `gh pr merge` segment (ignoring --help/-h) —
+ * PreToolUse gate scope check use only, so a proven-foreign leading segment can't shield a later
+ * managed one. Mirrors `extractRepoFlagsFromGhPrCreateSegments`.
+ * @param {string} command @returns {{ segment: string, explicitRepo: string|null }[]}
+ */
+export function extractRepoFlagsFromGhPrMergeSegments(command) {
+  return extractRepoFlagsFromGhSubcmdVerbSegments(command, "pr", "merge");
+}
+
+/**
+ * Return `{ segment, explicitRepo }` for every `gh pr ready` segment (ignoring --help/-h) —
+ * PreToolUse gate scope check use only. Mirrors `extractRepoFlagsFromGhPrCreateSegments`.
+ * @param {string} command @returns {{ segment: string, explicitRepo: string|null }[]}
+ */
+export function extractRepoFlagsFromGhPrReadySegments(command) {
+  return extractRepoFlagsFromGhSubcmdVerbSegments(command, "pr", "ready");
+}
+
 /** @param {string} command @returns {number|null} */
 export function extractPrNumberFromGhPrMerge(command) {
   return extractPrNumberFromGhPrVerb(command, "merge");
@@ -574,13 +674,22 @@ export function extractGhApiEndpointSegments(command) {
   return out;
 }
 
-/** The `gh api` segments whose endpoint is the target repo's URL path. Matches the absolute
- * slug-embedded form (`repos/mfittko/dev-loops/...`) and the bare relative form (`issues/...`),
- * which gh api resolves against the cwd repo — the decideBashGate call site gates the relative form
- * on `inTargetRepo`. */
-function targetGhApiPathRegex(suffix) {
-  const slug = TARGET_REPO_SLUG.replace("/", "\\/");
-  return new RegExp(`(?:repos/${slug}/|^)${suffix}`);
+/** The `gh api` segments whose endpoint is the dev-loops-managed repo's URL path. Matches the
+ * absolute slug-embedded form (`repos/<managedSlug>/...`) when `managedSlug` resolves, plus the
+ * bare relative form (`issues/...`), which gh api resolves against the cwd repo — the
+ * decideBashGate call site gates the relative form on `inManagedRepo`. When `managedSlug` is null
+ * (the managed repo's identity could not be resolved in a managed context — AC4's fail-closed
+ * case), the absolute arm matches ANY owner/repo rather than a specific slug: identity is unknown,
+ * so an absolute write must be denied regardless of which repo it targets, not waved through for
+ * lack of a slug to compare against. The absolute arm fully regex-escapes a resolved slug (a `.`
+ * in a legitimate repo name must match literally, not as a wildcard) and matches
+ * case-insensitively (GitHub repo identity is case-insensitive). */
+function managedGhApiPathRegex(suffix, managedSlug) {
+  if (!managedSlug) {
+    return new RegExp(`(?:repos/[^/]+/[^/]+/|^)${suffix}`, "i");
+  }
+  const slug = managedSlug.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+  return new RegExp(`(?:repos/${slug}/|^)${suffix}`, "i");
 }
 
 /** Strip a `scheme://host` prefix from an absolute gh api URL endpoint (`https://api.github.com/...`),
@@ -617,15 +726,18 @@ function ghApiSegmentHasWriteMethod(segment) {
 }
 
 /**
- * SUBISSUE-NO-ADHOC-BYPASS: raw `gh api` WRITE to `.../issues/<n>/sub_issues[/priority]` on the target
- * repo — the ad-hoc sub-issue mutation that must flow through the sanctioned `manage-sub-issues`
- * wrapper instead. Actor-independent (the issue's decided policy): the main agent gets no reserved
- * direct path to sub-issue writes. Anchored on the target repo's URL path segment AND an explicit write
- * method, so a `gh api` read or another repo's `sub_issues` write passes through (no false deny).
- * @param {string} command @returns {boolean}
+ * SUBISSUE-NO-ADHOC-BYPASS: raw `gh api` WRITE to `.../issues/<n>/sub_issues[/priority]` on the
+ * dev-loops-managed repo — the ad-hoc sub-issue mutation that must flow through the sanctioned
+ * `manage-sub-issues` wrapper instead. Actor-independent (the issue's decided policy): the main
+ * agent gets no reserved direct path to sub-issue writes. Anchored on the managed repo's URL path
+ * segment AND an explicit write method, so a `gh api` read or another repo's `sub_issues` write
+ * passes through (no false deny).
+ * @param {string} command @param {string|null} [managedSlug] - Resolved managed-repo slug, or
+ *   null when unresolvable (both the relative and any absolute repos/<owner>/<repo>/ form match then, fail closed).
+ * @returns {boolean}
  */
-export function commandContainsSubIssueAdHocBypass(command) {
-  const re = targetGhApiPathRegex(`issues/\\d+/sub_issues(?:/priority)?(?:\\s|$)`);
+export function commandContainsSubIssueAdHocBypass(command, managedSlug = null) {
+  const re = managedGhApiPathRegex(`issues/\\d+/sub_issues(?:/priority)?(?:\\s|$)`, managedSlug);
   return extractGhApiEndpointSegments(command).some(
     ({ segment, endpoint }) => Boolean(endpoint) && re.test(normalizeGhApiEndpoint(endpoint)) && ghApiSegmentHasWriteMethod(segment),
   );
@@ -633,12 +745,15 @@ export function commandContainsSubIssueAdHocBypass(command) {
 
 /**
  * COPILOT-FOLLOWUP-REPLY-RESOLVE-HELPER (REST half): raw `gh api` POST to
- * `.../pulls/<n>/comments/<m>/replies` on the target repo — the ad-hoc thread reply that must flow
- * through `reply-resolve-review-thread(s).mjs`. Actor-independent: no reserved direct reply path.
- * @param {string} command @returns {boolean}
+ * `.../pulls/<n>/comments/<m>/replies` on the dev-loops-managed repo — the ad-hoc thread reply
+ * that must flow through `reply-resolve-review-thread(s).mjs`. Actor-independent: no reserved
+ * direct reply path.
+ * @param {string} command @param {string|null} [managedSlug] - Resolved managed-repo slug, or
+ *   null when unresolvable (both the relative and any absolute repos/<owner>/<repo>/ form match then, fail closed).
+ * @returns {boolean}
  */
-export function commandContainsReplyResolveBypass(command) {
-  const re = targetGhApiPathRegex(`pulls/\\d+/comments/\\d+/replies(?:\\s|$)`);
+export function commandContainsReplyResolveBypass(command, managedSlug = null) {
+  const re = managedGhApiPathRegex(`pulls/\\d+/comments/\\d+/replies(?:\\s|$)`, managedSlug);
   return extractGhApiEndpointSegments(command).some(
     ({ segment, endpoint }) => Boolean(endpoint) && re.test(normalizeGhApiEndpoint(endpoint)) && ghApiSegmentHasWriteMethod(segment),
   );
@@ -657,12 +772,14 @@ export function commandContainsGraphqlResolveReviewThread(command) {
 
 /**
  * COPILOT-FOLLOWUP-REQUEST-HELPER-ONLY (REST half): raw `gh api` write to
- * `.../pulls/<n>/requested_reviewers` on the target repo — the ad-hoc Copilot review request that must
- * flow through `scripts/github/request-copilot-review.mjs`. Actor-independent.
- * @param {string} command @returns {boolean}
+ * `.../pulls/<n>/requested_reviewers` on the dev-loops-managed repo — the ad-hoc Copilot review
+ * request that must flow through `scripts/github/request-copilot-review.mjs`. Actor-independent.
+ * @param {string} command @param {string|null} [managedSlug] - Resolved managed-repo slug, or
+ *   null when unresolvable (both the relative and any absolute repos/<owner>/<repo>/ form match then, fail closed).
+ * @returns {boolean}
  */
-export function commandContainsCopilotRequestBypass(command) {
-  const re = targetGhApiPathRegex(`pulls/\\d+/requested_reviewers(?:\\s|$)`);
+export function commandContainsCopilotRequestBypass(command, managedSlug = null) {
+  const re = managedGhApiPathRegex(`pulls/\\d+/requested_reviewers(?:\\s|$)`, managedSlug);
   return extractGhApiEndpointSegments(command).some(
     ({ segment, endpoint }) => Boolean(endpoint) && re.test(normalizeGhApiEndpoint(endpoint)) && ghApiSegmentHasWriteMethod(segment),
   );