@dxos/plugin-github 0.7.4 → 0.14.0

package/src/operations/materialize-target.ts

@@ -0,0 +1,60 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import * as Operation from '@dxos/compute/Operation';
+import { Database, Filter, Obj, Query, Ref } from '@dxos/echo';
+import { TaskSet } from '@dxos/types';
+
+import { GitHubOperation } from '#types';
+
+import { GITHUB_SOURCE } from '../constants.ts';
+
+const fkFor = (id: string) => ({ source: GITHUB_SOURCE, id });
+
+/**
+ * Find-or-create the empty local root Project for a GitHub repo so a `Cursor`
+ * can reference it as its `spec.target`. Idempotent: keyed by the repo's
+ * GitHub foreign id (`remoteTarget.id`), it returns the existing Project
+ * when one already carries that key. The repo's data is filled in lazily by the
+ * sync operation; here we only stamp the foreign key + a display name.
+ */
+const handler: Operation.WithHandler<typeof GitHubOperation.MaterializeGitHubTarget> =
+  GitHubOperation.MaterializeGitHubTarget.pipe(
+    Operation.withHandler(
+      Effect.fnUntraced(function* ({ connection, remoteTarget }) {
+        if (!remoteTarget) {
+          return yield* Effect.die(new Error('GitHub materializeTarget requires a remoteTarget (repo descriptor).'));
+        }
+        // TODO(wittjosiah): the operation should just depend on `Database.Service` and
+        //   have it provided by the OperationInvoker — composer's invoker is wired
+        //   without a `databaseResolver`, so we derive the db from the connection ref's
+        //   target and provide `Database.layer(db)` ourselves.
+        const db = connection.target ? Obj.getDatabase(connection.target) : undefined;
+        if (!db) {
+          return yield* Effect.die(new Error('No database for connection ref.'));
+        }
+
+        return yield* Effect.gen(function* () {
+          const existing = yield* Database.query(
+            Query.select(Filter.foreignKeys(TaskSet.TaskSet, [fkFor(remoteTarget.id)])),
+          ).run;
+          if (existing.length > 0) {
+            return { target: Ref.make(existing[0]) };
+          }
+
+          const created = yield* Database.add(
+            TaskSet.make({
+              [Obj.Meta]: { keys: [fkFor(remoteTarget.id)] },
+              name: remoteTarget.name,
+            }),
+          );
+          return { target: Ref.make(created) };
+        }).pipe(Effect.provide(Database.layer(db)));
+      }),
+    ),
+  );
+
+export default handler;

package/src/operations/pull-request.test.ts

@@ -0,0 +1,120 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import { describe, expect, test } from 'vitest';
+
+import { summarizeCheckRuns, summarizeReviews, toCheckRun } from './pull-request.ts';
+
+describe('summarizeCheckRuns', () => {
+  test('no runs is none', () => {
+    expect(summarizeCheckRuns([])).toEqual({ ci: 'none', checks: { total: 0, passed: 0, failed: 0, pending: 0 } });
+  });
+
+  test('all completed without failure is success, skipped and neutral included', () => {
+    const { ci, checks } = summarizeCheckRuns([
+      { name: 'build', status: 'completed', conclusion: 'success' },
+      { name: 'lint', status: 'completed', conclusion: 'skipped' },
+      { name: 'docs', status: 'completed', conclusion: 'neutral' },
+    ]);
+    expect(ci).toEqual('success');
+    expect(checks).toEqual({ total: 3, passed: 3, failed: 0, pending: 0 });
+  });
+
+  test('an unfinished run is pending', () => {
+    const { ci } = summarizeCheckRuns([
+      { name: 'build', status: 'completed', conclusion: 'success' },
+      { name: 'test', status: 'in_progress', conclusion: null },
+    ]);
+    expect(ci).toEqual('pending');
+  });
+
+  test('a stale run does not count as passed', () => {
+    const { ci, checks } = summarizeCheckRuns([
+      { name: 'build', status: 'completed', conclusion: 'success' },
+      { name: 'test', status: 'completed', conclusion: 'stale' },
+    ]);
+    expect(ci).toEqual('failure');
+    expect(checks).toEqual({ total: 2, passed: 1, failed: 1, pending: 0 });
+  });
+
+  test('a failure wins over pending runs', () => {
+    const { ci, checks } = summarizeCheckRuns([
+      { name: 'build', status: 'completed', conclusion: 'timed_out' },
+      { name: 'test', status: 'queued' },
+    ]);
+    expect(ci).toEqual('failure');
+    expect(checks).toEqual({ total: 2, passed: 0, failed: 1, pending: 1 });
+  });
+});
+
+describe('toCheckRun', () => {
+  test('folds a conclusion into the outcome the list shows', () => {
+    expect(toCheckRun({ name: 'test', status: 'completed', conclusion: 'timed_out' }).outcome).toEqual('failure');
+    expect(toCheckRun({ name: 'cli', status: 'completed', conclusion: 'skipped' }).outcome).toEqual('skipped');
+    expect(toCheckRun({ name: 'e2e', status: 'in_progress', conclusion: null }).outcome).toEqual('pending');
+    expect(toCheckRun({ name: 'build', status: 'completed', conclusion: 'success' }).outcome).toEqual('success');
+  });
+
+  test("links the provider's page over GitHub's", () => {
+    const run = toCheckRun({
+      name: 'Check / check',
+      status: 'completed',
+      conclusion: 'success',
+      html_url: 'https://github.com/dxos/dxos/runs/1',
+      details_url: 'https://depot.dev/orgs/acme/workflows/abc?job=1',
+      started_at: '2026-09-23T12:47:05Z',
+      completed_at: '2026-09-23T12:51:13Z',
+    });
+    expect(run).toEqual({
+      name: 'Check / check',
+      outcome: 'success',
+      conclusion: 'success',
+      url: 'https://depot.dev/orgs/acme/workflows/abc?job=1',
+      startedAt: '2026-09-23T12:47:05Z',
+      completedAt: '2026-09-23T12:51:13Z',
+    });
+  });
+});
+
+describe('summarizeReviews', () => {
+  const review = (id: number, login: string, state: string) => ({ id, state, user: { login } });
+
+  test('no reviews is none', () => {
+    expect(summarizeReviews([])).toEqual({ review: 'none', approvals: 0 });
+  });
+
+  test('a comment alone is no verdict', () => {
+    expect(summarizeReviews([review(1, 'alice', 'COMMENTED')])).toEqual({ review: 'none', approvals: 0 });
+  });
+
+  test('approvals are counted per reviewer', () => {
+    expect(
+      summarizeReviews([review(1, 'alice', 'APPROVED'), review(2, 'alice', 'APPROVED'), review(3, 'bob', 'APPROVED')]),
+    ).toEqual({ review: 'approved', approvals: 2 });
+  });
+
+  test('an outstanding request for changes outweighs approvals', () => {
+    expect(summarizeReviews([review(1, 'alice', 'APPROVED'), review(2, 'bob', 'CHANGES_REQUESTED')])).toEqual({
+      review: 'changes_requested',
+      approvals: 1,
+    });
+  });
+
+  test("a reviewer's later approval clears their request, and a later comment does not undo it", () => {
+    expect(
+      summarizeReviews([
+        review(1, 'bob', 'CHANGES_REQUESTED'),
+        review(2, 'bob', 'APPROVED'),
+        review(3, 'bob', 'COMMENTED'),
+      ]),
+    ).toEqual({ review: 'approved', approvals: 1 });
+  });
+
+  test('a dismissed review withdraws the verdict', () => {
+    expect(summarizeReviews([review(1, 'bob', 'APPROVED'), review(2, 'bob', 'DISMISSED')])).toEqual({
+      review: 'none',
+      approvals: 0,
+    });
+  });
+});

package/src/operations/pull-request.ts

@@ -0,0 +1,141 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+import * as Layer from 'effect/Layer';
+
+import { Database, Filter, Obj, type Ref } from '@dxos/echo';
+import { Connection } from '@dxos/link';
+import { type PullRequest } from '@dxos/types';
+
+import { type GitHubOperation } from '#types';
+
+import { GITHUB_PROVIDER_ID } from '../constants.ts';
+import { GitHubPullRequestUnstoredError } from '../errors.ts';
+import { GitHubApi } from '../services/index.ts';
+
+/**
+ * The GitHub connection whose token requests are sent with: the first one holding a token. Shared by
+ * the handlers and by the UI that sends the user to reconnect, so both name the same connection.
+ */
+export const githubConnection = () =>
+  Effect.gen(function* () {
+    const connections = yield* Database.query(Filter.type(Connection.Connection)).run;
+    for (const connection of connections) {
+      if (connection.connectorId !== GITHUB_PROVIDER_ID) {
+        continue;
+      }
+      const accessToken = yield* Database.load(connection.accessToken);
+      if (accessToken.token) {
+        return { connection, token: accessToken.token };
+      }
+    }
+
+    return undefined;
+  });
+
+/**
+ * The token of {@link githubConnection}, or empty for anonymous — which reaches any public pull
+ * request, and is the only option in a space that has not connected GitHub.
+ */
+export const githubToken = () => githubConnection().pipe(Effect.map((selected) => selected?.token ?? ''));
+
+/**
+ * The stored pull request behind an operation's input and credentials for its space.
+ *
+ * The invoker carries no database resolver, so handlers derive one from the pull request itself; a
+ * preview card's in-memory pull request has none and cannot be acted on.
+ */
+export const resolvePullRequest = (ref: Ref.Ref<PullRequest.PullRequest>) =>
+  Effect.gen(function* () {
+    const pullRequest = ref.target;
+    const db = pullRequest ? Obj.getDatabase(pullRequest) : undefined;
+    if (!pullRequest || !db) {
+      return yield* Effect.die(new GitHubPullRequestUnstoredError());
+    }
+    const token = yield* githubToken().pipe(Effect.provide(Database.layer(db)));
+    return { pullRequest, db, credentials: Layer.succeed(GitHubApi.GitHubCredentials, { token }) };
+  });
+
+// `stale` is a completed run GitHub never re-ran, which branch protection does not count as passing.
+const FAILED_CONCLUSIONS = new Set([
+  'failure',
+  'cancelled',
+  'timed_out',
+  'action_required',
+  'startup_failure',
+  'stale',
+]);
+
+/** One check run as the article lists it: its outcome folded the way {@link summarizeCheckRuns} counts it. */
+export const toCheckRun = (run: GitHubApi.GitHubCheckRun): GitHubOperation.CheckRun => {
+  const outcome: GitHubOperation.CheckOutcome =
+    run.status !== 'completed'
+      ? 'pending'
+      : run.conclusion && FAILED_CONCLUSIONS.has(run.conclusion)
+        ? 'failure'
+        : run.conclusion === 'skipped'
+          ? 'skipped'
+          : run.conclusion === 'neutral'
+            ? 'neutral'
+            : 'success';
+  const url = run.details_url ?? run.html_url;
+  return {
+    name: run.name,
+    outcome,
+    ...(run.conclusion ? { conclusion: run.conclusion } : {}),
+    ...(url ? { url } : {}),
+    ...(run.started_at ? { startedAt: run.started_at } : {}),
+    ...(run.completed_at ? { completedAt: run.completed_at } : {}),
+  };
+};
+
+/** Folds a commit's check runs into one outcome: any failure fails, then any unfinished run is pending. */
+export const summarizeCheckRuns = (
+  runs: readonly GitHubApi.GitHubCheckRun[],
+): { ci: GitHubOperation.CiState; checks: GitHubOperation.CheckCounts } => {
+  const checks = { total: runs.length, passed: 0, failed: 0, pending: 0 };
+  for (const run of runs) {
+    if (run.status !== 'completed') {
+      checks.pending++;
+    } else if (run.conclusion && FAILED_CONCLUSIONS.has(run.conclusion)) {
+      checks.failed++;
+    } else {
+      checks.passed++;
+    }
+  }
+
+  const ci: GitHubOperation.CiState =
+    checks.total === 0 ? 'none' : checks.failed > 0 ? 'failure' : checks.pending > 0 ? 'pending' : 'success';
+  return { ci, checks };
+};
+
+/** Review states that set a reviewer's standing verdict; a comment leaves the previous one in place. */
+const VERDICT_STATES = new Set(['APPROVED', 'CHANGES_REQUESTED', 'DISMISSED']);
+
+/**
+ * Folds a pull request's reviews into where they stand, from each reviewer's latest verdict — the
+ * way GitHub reads them: a later approval clears that reviewer's request for changes, and a dismissal
+ * withdraws whichever verdict it replaced.
+ */
+export const summarizeReviews = (
+  reviews: readonly GitHubApi.GitHubSubmittedReview[],
+): { review: GitHubOperation.ReviewState; approvals: number } => {
+  const verdicts = new Map<string, string>();
+  for (const review of reviews) {
+    const login = review.user?.login;
+    if (login && VERDICT_STATES.has(review.state)) {
+      verdicts.set(login, review.state);
+    }
+  }
+
+  const states = [...verdicts.values()];
+  const approvals = states.filter((state) => state === 'APPROVED').length;
+  const review: GitHubOperation.ReviewState = states.includes('CHANGES_REQUESTED')
+    ? 'changes_requested'
+    : approvals > 0
+      ? 'approved'
+      : 'none';
+  return { review, approvals };
+};

package/src/operations/refresh-pull-requests.ts

@@ -0,0 +1,69 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Clock from 'effect/Clock';
+import * as Effect from 'effect/Effect';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+
+import * as Operation from '@dxos/compute/Operation';
+import { log } from '@dxos/log';
+
+import { GitHubOperation } from '#types';
+
+import { githubToken } from './pull-request.ts';
+import { ensureRefreshTrigger, queryInFlightPullRequests, refreshPullRequest, selectRefreshBatch } from './refresh.ts';
+
+/** Bounded so a space with many open pull requests does not burst GitHub's secondary rate limit. */
+const REFRESH_CONCURRENCY = 2;
+
+/** The hourly `REFRESH_CRON` period, so each scheduled run lands in its own batch window. */
+const REFRESH_INTERVAL_MS = 60 * 60 * 1000;
+
+const handler: Operation.WithHandler<typeof GitHubOperation.RefreshPullRequests> =
+  GitHubOperation.RefreshPullRequests.pipe(
+    Operation.withHandler(
+      Effect.fn(function* () {
+        // Collapses any duplicate a racing peer created, so the space keeps one schedule.
+        yield* ensureRefreshTrigger();
+        const inFlight = yield* queryInFlightPullRequests();
+        if (inFlight.length === 0) {
+          return { checked: 0, updated: 0, failed: 0 };
+        }
+
+        const window = Math.floor((yield* Clock.currentTimeMillis) / REFRESH_INTERVAL_MS);
+        const pullRequests = selectRefreshBatch(inFlight, window);
+
+        const token = yield* githubToken();
+        const results = yield* Effect.forEach(
+          pullRequests,
+          (pullRequest) =>
+            // One deleted or unreachable pull request must not fail the run: EDGE disables a trigger
+            // after repeated failures, which would stop refreshing every other one.
+            refreshPullRequest(pullRequest, token).pipe(
+              Effect.map((updated) => (updated.length > 0 ? 'updated' : 'unchanged')),
+              Effect.catchDefect((cause) =>
+                Effect.sync(() => {
+                  log.warn('pull request refresh failed', {
+                    owner: pullRequest.owner,
+                    repo: pullRequest.repo,
+                    number: pullRequest.number,
+                    cause,
+                  });
+                  return 'failed' as const;
+                }),
+              ),
+            ),
+          { concurrency: REFRESH_CONCURRENCY },
+        );
+
+        return {
+          checked: pullRequests.length,
+          updated: results.filter((result) => result === 'updated').length,
+          failed: results.filter((result) => result === 'failed').length,
+        };
+      }, Effect.provide(FetchHttpClient.layer)),
+    ),
+  );
+
+export default handler;

package/src/operations/refresh.test.ts

@@ -0,0 +1,112 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+import { afterEach, beforeEach, describe, test } from 'vitest';
+
+import * as Trigger from '@dxos/compute/Trigger';
+import { Database, Filter, Obj, Ref } from '@dxos/echo';
+import { EchoTestBuilder } from '@dxos/echo-client/testing';
+import * as EffectEx from '@dxos/effect/EffectEx';
+import { PullRequest } from '@dxos/types';
+
+import { GitHubOperation } from '#types';
+
+import { REFRESH_CRON, ensureRefreshTrigger, queryInFlightPullRequests, selectRefreshBatch } from './refresh.ts';
+
+describe('pull request refresh', () => {
+  let builder: EchoTestBuilder;
+
+  beforeEach(async () => {
+    builder = await new EchoTestBuilder().open();
+  });
+
+  afterEach(async () => {
+    await builder.close();
+  });
+
+  const setup = async () => {
+    const { db, graph } = await builder.createDatabase();
+    graph.registry.add([Trigger.Trigger, PullRequest.PullRequest]);
+    return db;
+  };
+
+  const run = <T>(db: Database.Database, effect: Effect.Effect<T, never, Database.Service>) =>
+    effect.pipe(Effect.provide(Database.layer(db)), EffectEx.runAndForwardErrors);
+
+  test('a space gets one remote timer trigger, however often it is ensured', async ({ expect }) => {
+    const db = await setup();
+    const first = await run(db, ensureRefreshTrigger());
+    const second = await run(db, ensureRefreshTrigger());
+
+    expect(second.id).toBe(first.id);
+    const triggers = await db.query(Filter.type(Trigger.Trigger)).run();
+    expect(triggers).toHaveLength(1);
+    expect(first.remote).toBe(true);
+    expect(first.enabled).toBe(true);
+    expect(first.spec).toEqual({ kind: 'timer', cron: REFRESH_CRON });
+    expect(first.runnable?.uri).toBe(GitHubOperation.RefreshPullRequests.meta.key.toString());
+  });
+
+  test('a disabled refresh trigger is left disabled', async ({ expect }) => {
+    const db = await setup();
+    const trigger = await run(db, ensureRefreshTrigger());
+    Obj.update(trigger, (trigger) => {
+      trigger.enabled = false;
+    });
+
+    const ensured = await run(db, ensureRefreshTrigger());
+    expect(ensured.id).toBe(trigger.id);
+    expect(ensured.enabled).toBe(false);
+  });
+
+  test('only pull requests GitHub can still change are refreshed', async ({ expect }) => {
+    const db = await setup();
+    const make = (number: number, state: PullRequest.State) =>
+      db.add(PullRequest.make({ owner: 'dxos', repo: 'dxos', number, title: `#${number}`, state }));
+    make(1, 'open');
+    make(2, 'draft');
+    make(3, 'closed');
+    make(4, 'merged');
+
+    const inFlight = await run(db, queryInFlightPullRequests());
+    expect(inFlight.map((pullRequest) => pullRequest.number).sort()).toEqual([1, 2]);
+  });
+
+  test('duplicates a racing peer created collapse to the lowest-id trigger', async ({ expect }) => {
+    const db = await setup();
+    const make = () =>
+      db.add(
+        Trigger.make({
+          enabled: true,
+          remote: true,
+          spec: Trigger.specTimer(REFRESH_CRON),
+          runnable: Ref.fromURI(GitHubOperation.RefreshPullRequests.meta.key),
+          input: {},
+        }),
+      );
+    const ids = [make().id, make().id].sort();
+
+    const kept = await run(db, ensureRefreshTrigger());
+    expect(kept.id).toBe(ids[0]);
+    const triggers = await db.query(Filter.type(Trigger.Trigger)).run();
+    expect(triggers.map((trigger) => trigger.id)).toEqual([ids[0]]);
+  });
+
+  test('successive runs walk every open pull request in bounded batches', async ({ expect }) => {
+    const db = await setup();
+    const pullRequests = Array.from({ length: 5 }, (_, index) =>
+      db.add(PullRequest.make({ owner: 'dxos', repo: 'dxos', number: index, title: `#${index}`, state: 'open' })),
+    );
+
+    expect(selectRefreshBatch(pullRequests, 0, 10)).toHaveLength(5);
+    const seen = new Set<string>();
+    for (let window = 0; window < 3; window++) {
+      const batch = selectRefreshBatch(pullRequests, window, 2);
+      expect(batch).toHaveLength(2);
+      batch.forEach((pullRequest) => seen.add(pullRequest.id));
+    }
+    expect(seen.size).toBe(5);
+  });
+});

package/src/operations/refresh.ts

@@ -0,0 +1,111 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import * as Trigger from '@dxos/compute/Trigger';
+import { Database, Filter, Obj, Ref } from '@dxos/echo';
+import { PullRequest } from '@dxos/types';
+
+import { GitHubOperation } from '#types';
+
+import { pullRequestChanges } from '../pull-request.ts';
+import { fetchPullRequestWithFallback } from './import-pull-request.ts';
+
+/**
+ * How often the space's refresh trigger polls its open pull requests: hourly, at an off-the-hour minute
+ * so the fleet of spaces does not land on EDGE's busiest tick, and because every open pull request
+ * costs a GitHub request against the connection's rate limit.
+ */
+export const REFRESH_CRON = '17 * * * *';
+
+/** States GitHub can still move a pull request out of; a closed or merged one is settled. */
+const IN_FLIGHT_STATES: readonly PullRequest.State[] = ['open', 'draft'];
+
+/**
+ * Re-read one stored pull request from GitHub and write back the fields that changed.
+ *
+ * Uses the anonymous fallback, so a public pull request still refreshes behind a revoked token.
+ * Returns the names of the changed fields.
+ */
+export const refreshPullRequest = Effect.fn('refreshPullRequest')(function* (
+  pullRequest: PullRequest.PullRequest,
+  token: string,
+) {
+  const pull = yield* fetchPullRequestWithFallback(pullRequest, token);
+  const changes = pullRequestChanges(pullRequest, pull);
+  const updated = Object.keys(changes);
+  if (updated.length > 0) {
+    Obj.update(pullRequest, (pullRequest) => {
+      Object.assign(pullRequest, changes);
+    });
+  }
+
+  return updated;
+});
+
+/** Code-unit order, so every peer and EDGE agree on it regardless of locale. */
+const byId = (left: { id: string }, right: { id: string }): number =>
+  left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+
+/** Most pull requests one run refreshes, so a run stays within GitHub's rate limit and EDGE's subrequest budget. */
+export const REFRESH_BATCH_SIZE = 20;
+
+/**
+ * The slice of `pullRequests` the run in window `window` refreshes: consecutive windows walk the list in
+ * id order and wrap, so every pull request is refreshed once every `ceil(count / size)` runs without
+ * storing a cursor.
+ */
+export const selectRefreshBatch = (
+  pullRequests: readonly PullRequest.PullRequest[],
+  window: number,
+  size = REFRESH_BATCH_SIZE,
+): PullRequest.PullRequest[] => {
+  if (pullRequests.length <= size) {
+    return [...pullRequests];
+  }
+  const ordered = [...pullRequests].sort(byId);
+  const start = (window * size) % ordered.length;
+  return Array.from({ length: size }, (_, index) => ordered[(start + index) % ordered.length]);
+};
+
+/** The space's pull requests GitHub may still change. */
+export const queryInFlightPullRequests = () =>
+  Database.query(Filter.type(PullRequest.PullRequest)).run.pipe(
+    Effect.map((pullRequests) => pullRequests.filter((pullRequest) => IN_FLIGHT_STATES.includes(pullRequest.state))),
+    Effect.orDie,
+  );
+
+const isRefreshTrigger = (trigger: Trigger.Trigger): boolean =>
+  trigger.runnable?.uri === GitHubOperation.RefreshPullRequests.meta.key.toString();
+
+/**
+ * Give the space its one pull-request refresh trigger, unless it has one already — including one the
+ * user disabled, which stays disabled.
+ *
+ * Peers that race to create it each add their own, so every caller converges on the same keeper (the
+ * lowest id) and removes the rest. The trigger runs on EDGE, so pull requests keep refreshing while no
+ * client has the space open.
+ */
+export const ensureRefreshTrigger = Effect.fn('ensureRefreshTrigger')(function* () {
+  const triggers = yield* Database.query(Filter.type(Trigger.Trigger)).run.pipe(Effect.orDie);
+  const [keeper, ...duplicates] = triggers.filter(isRefreshTrigger).sort(byId);
+  for (const duplicate of duplicates) {
+    yield* Database.remove(duplicate);
+  }
+  if (keeper) {
+    return keeper;
+  }
+
+  return yield* Database.add(
+    Trigger.make({
+      enabled: true,
+      remote: true,
+      spec: Trigger.specTimer(REFRESH_CRON),
+      // Statically defined in the registry, so referred to by key rather than copied into the space.
+      runnable: Ref.fromURI(GitHubOperation.RefreshPullRequests.meta.key),
+      input: {},
+    }),
+  );
+});

package/src/operations/submit-pull-request-approval.ts

@@ -0,0 +1,41 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
+import * as Option from 'effect/Option';
+
+import * as Operation from '@dxos/compute/Operation';
+
+import { GitHubOperation } from '#types';
+
+import { approvalCommentBody, isApprovalRefused } from '../approval.ts';
+import { GitHubApi } from '../services/index.ts';
+import { resolvePullRequest } from './pull-request.ts';
+
+const handler: Operation.WithHandler<typeof GitHubOperation.SubmitPullRequestApproval> =
+  GitHubOperation.SubmitPullRequestApproval.pipe(
+    Operation.withHandler(
+      Effect.fn(function* ({ pullRequest: ref, body }) {
+        const { pullRequest, credentials } = yield* resolvePullRequest(ref);
+        const { owner, repo, number } = pullRequest;
+        const review = yield* GitHubApi.approvePullRequest(owner, repo, number, body).pipe(
+          Effect.provide(credentials),
+          Effect.asSome,
+          // Only a refusal to review becomes a comment; every other failure stays a failure.
+          Effect.catchIf(isApprovalRefused, () => Effect.succeedNone),
+        );
+        if (Option.isSome(review)) {
+          return { reviewId: review.value.id, commented: false };
+        }
+
+        const comment = yield* GitHubApi.createIssueComment(owner, repo, number, approvalCommentBody(body)).pipe(
+          Effect.provide(credentials),
+        );
+        return { commentId: comment.id, url: comment.html_url ?? undefined, commented: true };
+      }, Effect.provide(FetchHttpClient.layer)),
+    ),
+  );
+
+export default handler;