@geminixiang/mikan 1.0.0-beta.2 → 1.0.0-beta.21

package/dist/adapters/github/github-ops.d.ts

@@ -0,0 +1,90 @@
+import { GithubClient } from "./client.js";
+import type { GithubBotConfig, GithubCheckSummary, GithubConversationRef, GithubIssueRequest, GithubPrRequest, GithubPrResult, GithubReadRequest, GithubReadResult, PlatformGithubOps } from "./types.js";
+/** Whether the conversation's issue is a PR, for callers where the triggering
+ *  item didn't carry that knowledge. Errs toward plain issue. */
+export declare function fetchIsPr(client: GithubClient, ref: GithubConversationRef): Promise<boolean>;
+/**
+ * The PR's head branch name when it lives in this repo — that is the name
+ * the local checkout should carry, so committing on it and calling
+ * github_pr pushes back to the PR itself instead of opening a new one.
+ * Fork heads (unpushable with the repo-scoped token) and failed lookups
+ * return undefined; callers then fall back to the synthetic pr-<n>.
+ */
+export declare function fetchPrHeadBranch(client: GithubClient, ref: GithubConversationRef): Promise<string | undefined>;
+/**
+ * Host-side backend of the github_* tool pack (`PlatformGithubOps`),
+ * standalone from the messaging bot: it needs the API client, the
+ * conversation working dir, and optional Cloud Build access — not the poll
+ * loop, queues, or trigger gate. Tokens are minted per call, scoped to the
+ * conversation's repo, and never enter the sandbox.
+ */
+export declare class GithubOps implements PlatformGithubOps {
+    private readonly client;
+    private readonly config;
+    /** Cloud Build ids seen in getChecks summaries → their GCP project. */
+    private buildRef;
+    constructor(client: GithubClient, config: {
+        workingDir: string;
+        cloudBuild?: GithubBotConfig["cloudBuild"];
+    });
+    private repoDir;
+    /**
+     * Backs the `github_pr` tool: push a `pi/*` branch the agent prepared in
+     * the conversation's clone, then open a pull request as the App. The write
+     * token is minted per call, scoped to this one repo, and never enters the
+     * sandbox.
+     */
+    pushAndCreatePr(conversationId: string, request: GithubPrRequest): Promise<GithubPrResult>;
+    /**
+     * Backs the `github_checks` tool: CI check runs for a branch the agent
+     * pushed, or for the conversation's PR head when no branch is given.
+     */
+    getChecks(conversationId: string, branch?: string): Promise<GithubCheckSummary[]>;
+    private rememberBuild;
+    /**
+     * Backs the Cloud Build log mode of `github_checks`. GCP credentials stay
+     * host-side (ADC via GOOGLE_APPLICATION_CREDENTIALS — e.g. a Workload
+     * Identity Federation external_account file); the build must have appeared
+     * in a github_checks summary first, which is also where its project is
+     * learned. Unreadable logs degrade to the console url, never a dead end.
+     */
+    getBuildLog(conversationId: string, buildId: string): Promise<string>;
+    /**
+     * Backs the `github_sync` tool: refresh the conversation's ./repo clone
+     * from origin with an ephemeral read token. Fetch-only when moving the
+     * checkout could lose agent work; the formatted report tells the agent
+     * what happened and what to do next.
+     */
+    syncRepo(conversationId: string, branch?: string): Promise<string>;
+    /**
+     * Backs the `github_read` tool: PR/issue metadata the ./repo clone cannot
+     * provide (diff stats, review state, other issues in the repo). Owner/repo
+     * always come from the conversation id, so reads never leave this repo.
+     */
+    readGithub(conversationId: string, request: GithubReadRequest): Promise<GithubReadResult>;
+    /**
+     * Backs the `github_issue` tool: labels, assignees, and open/closed state
+     * on any issue of this conversation's repo (triage). Same-repo by
+     * construction — owner/repo come from the conversation id; the action enum
+     * is closed, so lock/delete/transfer cannot be expressed at all.
+     */
+    manageIssue(conversationId: string, request: GithubIssueRequest): Promise<string>;
+    /**
+     * Backs the `github_review_reply` tool: answer inside one inline review
+     * thread of this conversation's PR. The comment id comes from an
+     * `[PR review comment rc-<id> …]` message; GitHub validates it belongs to
+     * this PR (404 otherwise, translated into agent-actionable guidance).
+     */
+    replyToReviewThread(conversationId: string, commentId: number, body: string): Promise<{
+        url: string;
+    }>;
+    /**
+     * Backs the log mode of `github_checks`: the tail of one CI job's log so
+     * the agent can diagnose a failing check without sandbox credentials. Only
+     * GitHub Actions checks have logs on GitHub — external CI apps (e.g. Cloud
+     * Build) keep theirs on their own service, so a 404 here is translated
+     * into guidance instead of a dead end.
+     */
+    getJobLog(conversationId: string, jobId: number): Promise<string>;
+}
+//# sourceMappingURL=github-ops.d.ts.map

package/dist/adapters/github/github-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-ops.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/github-ops.ts"],"names":[],"mappings":"AAEA,OAAO,EAAkB,YAAY,EAA0C,MAAM,aAAa,CAAC;AAUnG,OAAO,KAAK,EACV,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAWpB;iEACiE;AACjE,wBAAsB,SAAS,CAC7B,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,YAAY,EACpB,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAS7B;AAED;;;;;;GAMG;AACH,qBAAa,SAAU,YAAW,iBAAiB;IAK/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAA0C;IAE1D,YACmB,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC;KAC5C,EACC;IAEJ,OAAO,CAAC,OAAO;IAIf;;;;;OAKG;IACG,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAqD/F;IAED;;;OAGG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiDtF;IAED,OAAO,CAAC,aAAa;IAUrB;;;;;;OAMG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B1E;IAED;;;;;OAKG;IACG,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAyCvE;IAED;;;;OAIG;IACG,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4C9F;IAED;;;;;OAKG;IACG,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoEtF;IAED;;;;;OAKG;IACG,mBAAmB,CACvB,cAAc,EAAE,MAAM,EACtB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CA4B1B;IAED;;;;;;OAMG;IACG,SAAS,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;CACF"}

package/dist/adapters/github/github-ops.js

@@ -0,0 +1,405 @@
+import { existsSync } from "fs";
+import * as log from "../../log.js";
+import { GithubApiError, GITHUB_MAX_COMMENT_LENGTH, githubRetry } from "./client.js";
+import { CLOUD_BUILD_APP_SLUG, CloudBuildLogUnavailableError, fetchCloudBuildLog, isCloudBuildId, projectFromDetailsUrl, } from "./cloudbuild.js";
+import { parseGithubConversationId } from "./ids.js";
+import { conversationRepoDir, GITHUB_PUSH_BRANCH_PATTERN, pushBranch, syncRepo } from "./repo.js";
+/** Both CI log modes tail-truncate to this many characters. */
+const MAX_LOG_CHARS = 20000;
+function truncateLogTail(logText) {
+    return logText.length > MAX_LOG_CHARS
+        ? `…(truncated to the last ${MAX_LOG_CHARS} chars)\n${logText.slice(-MAX_LOG_CHARS)}`
+        : logText;
+}
+/** Whether the conversation's issue is a PR, for callers where the triggering
+ *  item didn't carry that knowledge. Errs toward plain issue. */
+export async function fetchIsPr(client, ref) {
+    try {
+        const issue = await githubRetry(() => client.getIssue(ref.owner, ref.repo, ref.number));
+        return Boolean(issue.pull_request);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The PR's head branch name when it lives in this repo — that is the name
+ * the local checkout should carry, so committing on it and calling
+ * github_pr pushes back to the PR itself instead of opening a new one.
+ * Fork heads (unpushable with the repo-scoped token) and failed lookups
+ * return undefined; callers then fall back to the synthetic pr-<n>.
+ */
+export async function fetchPrHeadBranch(client, ref) {
+    try {
+        const pr = await githubRetry(() => client.getPullRequest(ref.owner, ref.repo, ref.number));
+        const sameRepo = pr.head?.repo?.full_name?.toLowerCase() === `${ref.owner}/${ref.repo}`.toLowerCase();
+        return sameRepo ? pr.head?.ref : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Host-side backend of the github_* tool pack (`PlatformGithubOps`),
+ * standalone from the messaging bot: it needs the API client, the
+ * conversation working dir, and optional Cloud Build access — not the poll
+ * loop, queues, or trigger gate. Tokens are minted per call, scoped to the
+ * conversation's repo, and never enter the sandbox.
+ */
+export class GithubOps {
+    constructor(client, config) {
+        this.client = client;
+        this.config = config;
+        /** Cloud Build ids seen in getChecks summaries → their GCP project. */
+        this.buildRef = new Map();
+    }
+    repoDir(conversationId) {
+        return conversationRepoDir(this.config.workingDir, conversationId);
+    }
+    /**
+     * Backs the `github_pr` tool: push a `pi/*` branch the agent prepared in
+     * the conversation's clone, then open a pull request as the App. The write
+     * token is minted per call, scoped to this one repo, and never enters the
+     * sandbox.
+     */
+    async pushAndCreatePr(conversationId, request) {
+        const ref = parseGithubConversationId(conversationId);
+        const dir = this.repoDir(conversationId);
+        if (!existsSync(dir)) {
+            throw new Error("This conversation has no ./repo clone to push from.");
+        }
+        if (!GITHUB_PUSH_BRANCH_PATTERN.test(request.branch)) {
+            throw new Error(`Branch '${request.branch}' is not pushable: name it pi/<something> (e.g. pi/fix-${ref.number}).`);
+        }
+        const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));
+        const base = request.base ?? repository.default_branch;
+        const token = await this.client.createScopedInstallationToken(ref.repo, {
+            contents: "write",
+            pull_requests: "write",
+        });
+        await pushBranch({ dir, branch: request.branch, token });
+        try {
+            const pr = await githubRetry(() => this.client.createPullRequest(ref.owner, ref.repo, {
+                title: request.title,
+                head: request.branch,
+                base,
+                body: request.body,
+                draft: request.draft,
+            }));
+            log.logInfo(`[${conversationId}] Opened PR #${pr.number}: ${pr.html_url}`);
+            return { number: pr.number, url: pr.html_url };
+        }
+        catch (err) {
+            // Idempotency: pushing more commits to a branch that already has an
+            // open PR updates that PR; the create call then 422s. Surface the
+            // existing PR instead of failing the fix-CI-push-again loop.
+            if (err instanceof GithubApiError &&
+                err.status === 422 &&
+                /already exists/i.test(err.message)) {
+                const existing = await this.client.findOpenPullRequestByBranch(ref.owner, ref.repo, request.branch);
+                if (existing) {
+                    log.logInfo(`[${conversationId}] Pushed to existing PR #${existing.number}: ${existing.html_url}`);
+                    return { number: existing.number, url: existing.html_url, updatedExisting: true };
+                }
+            }
+            throw err;
+        }
+    }
+    /**
+     * Backs the `github_checks` tool: CI check runs for a branch the agent
+     * pushed, or for the conversation's PR head when no branch is given.
+     */
+    async getChecks(conversationId, branch) {
+        const ref = parseGithubConversationId(conversationId);
+        let target = branch;
+        if (!target) {
+            let pr;
+            try {
+                pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, ref.number));
+            }
+            catch {
+                pr = null;
+            }
+            if (!pr?.head) {
+                throw new Error("This conversation is not a pull request — pass the branch whose checks you want.");
+            }
+            target = pr.head.sha;
+        }
+        const runs = await githubRetry(() => this.client.listCheckRuns(ref.owner, ref.repo, target));
+        return runs.map((run) => {
+            const externalId = run.external_id?.trim() || null;
+            let buildLogAvailable = false;
+            // Cloud Build runs carry their build UUID in external_id and the GCP
+            // project in details_url. Remember project-by-build so getBuildLog only
+            // serves builds the agent actually saw on this repo's checks.
+            if (this.config.cloudBuild &&
+                run.app?.slug === CLOUD_BUILD_APP_SLUG &&
+                externalId &&
+                isCloudBuildId(externalId)) {
+                const project = projectFromDetailsUrl(run.details_url) ?? this.config.cloudBuild.projectFallback;
+                if (project) {
+                    this.rememberBuild(externalId, project);
+                    buildLogAvailable = true;
+                }
+            }
+            return {
+                id: run.id,
+                name: run.name,
+                status: run.status,
+                conclusion: run.conclusion,
+                url: run.html_url,
+                appSlug: run.app?.slug ?? null,
+                outputSummary: run.output?.summary?.trim() ? run.output.summary.slice(0, 500) : null,
+                externalId,
+                buildLogAvailable,
+            };
+        });
+    }
+    rememberBuild(buildId, project) {
+        // Insertion-ordered Map as a small LRU: re-insert on touch, prune oldest.
+        this.buildRef.delete(buildId);
+        this.buildRef.set(buildId, { project });
+        if (this.buildRef.size > 200) {
+            const oldest = this.buildRef.keys().next().value;
+            if (oldest !== undefined)
+                this.buildRef.delete(oldest);
+        }
+    }
+    /**
+     * Backs the Cloud Build log mode of `github_checks`. GCP credentials stay
+     * host-side (ADC via GOOGLE_APPLICATION_CREDENTIALS — e.g. a Workload
+     * Identity Federation external_account file); the build must have appeared
+     * in a github_checks summary first, which is also where its project is
+     * learned. Unreadable logs degrade to the console url, never a dead end.
+     */
+    async getBuildLog(conversationId, buildId) {
+        if (!this.config.cloudBuild) {
+            throw new Error("Cloud Build log access is not configured on this host (no GCP credentials).");
+        }
+        const known = this.buildRef.get(buildId);
+        if (!known) {
+            throw new Error(`Unknown build id ${buildId}: run github_checks first and take a [build …] id from ` +
+                `the summary.`);
+        }
+        let logText;
+        try {
+            logText = await fetchCloudBuildLog({
+                tokenProvider: this.config.cloudBuild.tokenProvider,
+                project: known.project,
+                buildId,
+            });
+        }
+        catch (err) {
+            if (err instanceof CloudBuildLogUnavailableError) {
+                throw new Error(`${err.message}${err.consoleUrl ? ` Console: ${err.consoleUrl}` : ""} Use the check's ` +
+                    `summary/url from github_checks, or reproduce the failure locally in ./repo.`, { cause: err });
+            }
+            throw err;
+        }
+        return truncateLogTail(logText);
+    }
+    /**
+     * Backs the `github_sync` tool: refresh the conversation's ./repo clone
+     * from origin with an ephemeral read token. Fetch-only when moving the
+     * checkout could lose agent work; the formatted report tells the agent
+     * what happened and what to do next.
+     */
+    async syncRepo(conversationId, branch) {
+        const ref = parseGithubConversationId(conversationId);
+        const dir = this.repoDir(conversationId);
+        if (!existsSync(dir)) {
+            throw new Error("This conversation has no ./repo clone to sync.");
+        }
+        const token = await this.client.createScopedInstallationToken(ref.repo, {
+            contents: "read",
+        });
+        let prNumber;
+        let prHeadBranch;
+        let defaultBranch;
+        if (!branch) {
+            if (await fetchIsPr(this.client, ref)) {
+                prNumber = ref.number;
+                prHeadBranch = await fetchPrHeadBranch(this.client, ref);
+            }
+            else {
+                const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));
+                defaultBranch = repository.default_branch;
+            }
+        }
+        const result = await syncRepo({ dir, token, branch, prNumber, prHeadBranch, defaultBranch });
+        if (result.updatedCheckout) {
+            return `Updated ./repo: branch ${result.target} is now at ${result.fetchedSha.slice(0, 12)}.`;
+        }
+        const reasons = [];
+        if (result.currentBranch !== result.target) {
+            reasons.push(`the checkout is on '${result.currentBranch}', not '${result.target}'`);
+        }
+        if (result.dirty) {
+            reasons.push("the working tree has uncommitted changes");
+        }
+        if (result.localCommits > 0) {
+            reasons.push(`'${result.target}' has ${result.localCommits} local commit(s) not on origin`);
+        }
+        return (`Fetched ${result.target} to FETCH_HEAD (${result.fetchedSha.slice(0, 12)}) but left the ` +
+            `checkout alone: ${reasons.join("; ")}. Merge or rebase FETCH_HEAD yourself ` +
+            `(e.g. git merge FETCH_HEAD), or commit your work to a pi/* branch first.`);
+    }
+    /**
+     * Backs the `github_read` tool: PR/issue metadata the ./repo clone cannot
+     * provide (diff stats, review state, other issues in the repo). Owner/repo
+     * always come from the conversation id, so reads never leave this repo.
+     */
+    async readGithub(conversationId, request) {
+        const ref = parseGithubConversationId(conversationId);
+        const number = request.number ?? ref.number;
+        switch (request.action) {
+            case "pr": {
+                const pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, number));
+                return { kind: "pr", pr };
+            }
+            case "pr_files": {
+                const files = await githubRetry(() => this.client.listPullRequestFiles(ref.owner, ref.repo, number));
+                return { kind: "pr_files", files };
+            }
+            case "pr_reviews": {
+                const [reviews, threads] = await Promise.all([
+                    githubRetry(() => this.client.listPullRequestReviews(ref.owner, ref.repo, number)),
+                    githubRetry(() => this.client.listPullReviewComments(ref.owner, ref.repo, number)),
+                ]);
+                return { kind: "pr_reviews", reviews, threads };
+            }
+            case "issue": {
+                const issue = await githubRetry(() => this.client.getIssue(ref.owner, ref.repo, number));
+                return { kind: "issue", issue };
+            }
+            case "comments": {
+                const comments = await githubRetry(() => this.client.listIssueComments(ref.owner, ref.repo, number));
+                return { kind: "comments", comments };
+            }
+            case "list": {
+                const issues = await githubRetry(() => this.client.listIssues(ref.owner, ref.repo, {
+                    state: request.state,
+                    labels: request.labels,
+                    creator: request.creator,
+                }));
+                return { kind: "list", issues };
+            }
+            default:
+                throw new Error(`Unknown github_read action: ${String(request.action)}`);
+        }
+    }
+    /**
+     * Backs the `github_issue` tool: labels, assignees, and open/closed state
+     * on any issue of this conversation's repo (triage). Same-repo by
+     * construction — owner/repo come from the conversation id; the action enum
+     * is closed, so lock/delete/transfer cannot be expressed at all.
+     */
+    async manageIssue(conversationId, request) {
+        const ref = parseGithubConversationId(conversationId);
+        const number = request.number ?? ref.number;
+        try {
+            switch (request.action) {
+                case "add_labels": {
+                    if (!request.labels?.length) {
+                        throw new Error("add_labels requires a non-empty labels array.");
+                    }
+                    await githubRetry(() => this.client.addIssueLabels(ref.owner, ref.repo, number, request.labels));
+                    return `Added label(s) ${request.labels.join(", ")} to #${number}.`;
+                }
+                case "remove_label": {
+                    if (!request.label) {
+                        throw new Error("remove_label requires a label name.");
+                    }
+                    await githubRetry(() => this.client.removeIssueLabel(ref.owner, ref.repo, number, request.label));
+                    return `Removed label ${request.label} from #${number}.`;
+                }
+                case "add_assignees": {
+                    if (!request.assignees?.length) {
+                        throw new Error("add_assignees requires a non-empty assignees array.");
+                    }
+                    await githubRetry(() => this.client.addIssueAssignees(ref.owner, ref.repo, number, request.assignees));
+                    return `Assigned ${request.assignees.map((login) => `@${login}`).join(", ")} to #${number}.`;
+                }
+                case "remove_assignees": {
+                    if (!request.assignees?.length) {
+                        throw new Error("remove_assignees requires a non-empty assignees array.");
+                    }
+                    await githubRetry(() => this.client.removeIssueAssignees(ref.owner, ref.repo, number, request.assignees));
+                    return `Unassigned ${request.assignees.map((login) => `@${login}`).join(", ")} from #${number}.`;
+                }
+                case "close": {
+                    await githubRetry(() => this.client.updateIssueState(ref.owner, ref.repo, number, "closed", request.state_reason));
+                    return `Closed #${number}${request.state_reason ? ` as ${request.state_reason}` : ""}.`;
+                }
+                case "reopen": {
+                    await githubRetry(() => this.client.updateIssueState(ref.owner, ref.repo, number, "open"));
+                    return `Reopened #${number}.`;
+                }
+                default:
+                    throw new Error(`Unknown github_issue action: ${String(request.action)}`);
+            }
+        }
+        catch (err) {
+            if (err instanceof GithubApiError && err.status === 404) {
+                throw new Error(`Issue #${number} not found in ${ref.owner}/${ref.repo}.`, { cause: err });
+            }
+            throw err;
+        }
+    }
+    /**
+     * Backs the `github_review_reply` tool: answer inside one inline review
+     * thread of this conversation's PR. The comment id comes from an
+     * `[PR review comment rc-<id> …]` message; GitHub validates it belongs to
+     * this PR (404 otherwise, translated into agent-actionable guidance).
+     */
+    async replyToReviewThread(conversationId, commentId, body) {
+        if (!Number.isInteger(commentId) || commentId <= 0) {
+            throw new Error("comment_id must be the numeric id from an [PR review comment rc-<id> …] message.");
+        }
+        const ref = parseGithubConversationId(conversationId);
+        const text = body.length > GITHUB_MAX_COMMENT_LENGTH
+            ? `${body.slice(0, GITHUB_MAX_COMMENT_LENGTH)}\n…(truncated)`
+            : body;
+        try {
+            const reply = await githubRetry(() => this.client.replyToReviewComment(ref.owner, ref.repo, ref.number, commentId, text));
+            return {
+                url: `https://github.com/${ref.owner}/${ref.repo}/pull/${ref.number}#discussion_r${reply.id}`,
+            };
+        }
+        catch (err) {
+            if (err instanceof GithubApiError && err.status === 404) {
+                throw new Error(`Comment ${commentId} is not a review comment on this PR. Take the id from an ` +
+                    `[PR review comment rc-<id> …] message in this conversation; do not guess ids.`, { cause: err });
+            }
+            throw err;
+        }
+    }
+    /**
+     * Backs the log mode of `github_checks`: the tail of one CI job's log so
+     * the agent can diagnose a failing check without sandbox credentials. Only
+     * GitHub Actions checks have logs on GitHub — external CI apps (e.g. Cloud
+     * Build) keep theirs on their own service, so a 404 here is translated
+     * into guidance instead of a dead end.
+     */
+    async getJobLog(conversationId, jobId) {
+        if (!Number.isInteger(jobId) || jobId <= 0) {
+            throw new Error("job_id must be a positive Actions job id taken from a [job …] entry in the github_checks summary.");
+        }
+        const ref = parseGithubConversationId(conversationId);
+        let logText;
+        try {
+            logText = await githubRetry(() => this.client.getJobLog(ref.owner, ref.repo, jobId));
+        }
+        catch (err) {
+            if (err instanceof GithubApiError && err.status === 404) {
+                throw new Error(`No GitHub Actions log for job ${jobId}. Logs are only available for checks reported ` +
+                    `by github-actions; external CI (e.g. Cloud Build) keeps logs on its own service — ` +
+                    `use that check's summary/url from github_checks, or reproduce the failure locally ` +
+                    `in ./repo instead. Do not retry with other ids.`, { cause: err });
+            }
+            throw err;
+        }
+        return truncateLogTail(logText);
+    }
+}
+//# sourceMappingURL=github-ops.js.map

package/dist/adapters/github/github-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-ops.js","sourceRoot":"","sources":["../../../src/adapters/github/github-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AACpC,OAAO,EAAE,cAAc,EAAgB,yBAAyB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACnG,OAAO,EACL,oBAAoB,EACpB,6BAA6B,EAC7B,kBAAkB,EAClB,cAAc,EACd,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAalG,+DAA+D;AAC/D,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,aAAa;QACnC,CAAC,CAAC,2BAA2B,aAAa,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,EAAE;QACrF,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAoB,EACpB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAoB,EACpB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GACZ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACvF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,SAAS;IAIpB,YACmB,MAAoB,EACpB,MAGhB;QAJgB,WAAM,GAAN,MAAM,CAAc;QACpB,WAAM,GAAN,MAAM,CAGtB;QARH,uEAAuE;QAC/D,aAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAQvD,CAAC;IAEI,OAAO,CAAC,cAAsB;QACpC,OAAO,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACrE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,cAAsB,EAAE,OAAwB;QACpE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,WAAW,OAAO,CAAC,MAAM,0DAA0D,GAAG,CAAC,MAAM,IAAI,CAClG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,cAAc,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE;YACtE,QAAQ,EAAE,OAAO;YACjB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAChC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;gBACjD,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,MAAM;gBACpB,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB,CAAC,CACH,CAAC;YACF,GAAG,CAAC,OAAO,CAAC,IAAI,cAAc,gBAAgB,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,oEAAoE;YACpE,kEAAkE;YAClE,6DAA6D;YAC7D,IACE,GAAG,YAAY,cAAc;gBAC7B,GAAG,CAAC,MAAM,KAAK,GAAG;gBAClB,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EACnC,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAC5D,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,IAAI,EACR,OAAO,CAAC,MAAM,CACf,CAAC;gBACF,IAAI,QAAQ,EAAE,CAAC;oBACb,GAAG,CAAC,OAAO,CACT,IAAI,cAAc,4BAA4B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,EAAE,CACtF,CAAC;oBACF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,MAAe;QACrD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,MAAM,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5F,CAAC;YAAC,MAAM,CAAC;gBACP,EAAE,GAAG,IAAI,CAAC;YACZ,CAAC;YACD,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACtB,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;YACnD,IAAI,iBAAiB,GAAG,KAAK,CAAC;YAC9B,qEAAqE;YACrE,wEAAwE;YACxE,8DAA8D;YAC9D,IACE,IAAI,CAAC,MAAM,CAAC,UAAU;gBACtB,GAAG,CAAC,GAAG,EAAE,IAAI,KAAK,oBAAoB;gBACtC,UAAU;gBACV,cAAc,CAAC,UAAU,CAAC,EAC1B,CAAC;gBACD,MAAM,OAAO,GACX,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;gBACnF,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;oBACxC,iBAAiB,GAAG,IAAI,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,GAAG,EAAE,GAAG,CAAC,QAAQ;gBACjB,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,IAAI;gBAC9B,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;gBACpF,UAAU;gBACV,iBAAiB;aAClB,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,OAAe,EAAE,OAAe;QACpD,0EAA0E;QAC1E,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,OAAe;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,yDAAyD;gBAClF,cAAc,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,kBAAkB,CAAC;gBACjC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa;gBACnD,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB;oBACrF,6EAA6E,EAC/E,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,cAAsB,EAAE,MAAe;QACpD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,EAAE;YACtE,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,IAAI,QAA4B,CAAC;QACjC,IAAI,YAAgC,CAAC;QACrC,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;gBACtB,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3F,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,CAAC;QAE7F,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,OAAO,0BAA0B,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAChG,CAAC;QACD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,aAAa,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,SAAS,MAAM,CAAC,YAAY,gCAAgC,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,CACL,WAAW,MAAM,CAAC,MAAM,mBAAmB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB;YAC1F,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC;YAC7E,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,UAAU,CAAC,cAAsB,EAAE,OAA0B;QACjE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC5C,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC5F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;YAC5B,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAC9D,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;YACrC,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBAC3C,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;oBAClF,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;iBACnF,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAClD,CAAC;YACD,KAAK,OAAO,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClC,CAAC;YACD,KAAK,UAAU,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACtC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAC3D,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;YACxC,CAAC;YACD,KAAK,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE;oBAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB,CAAC,CACH,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YAClC,CAAC;YACD;gBACE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,cAAsB,EAAE,OAA2B;QACnE,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC;QAC5C,IAAI,CAAC;YACH,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;gBACvB,KAAK,YAAY,EAAE,CAAC;oBAClB,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;wBAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;oBACnE,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAO,CAAC,CACzE,CAAC;oBACF,OAAO,kBAAkB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,CAAC;gBACtE,CAAC;gBACD,KAAK,cAAc,EAAE,CAAC;oBACpB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;oBACzD,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAM,CAAC,CAC1E,CAAC;oBACF,OAAO,iBAAiB,OAAO,CAAC,KAAK,UAAU,MAAM,GAAG,CAAC;gBAC3D,CAAC;gBACD,KAAK,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;oBACzE,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAU,CAAC,CAC/E,CAAC;oBACF,OAAO,YAAY,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,GAAG,CAAC;gBAC/F,CAAC;gBACD,KAAK,kBAAkB,EAAE,CAAC;oBACxB,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;oBAC5E,CAAC;oBACD,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,SAAU,CAAC,CAClF,CAAC;oBACF,OAAO,cAAc,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,GAAG,CAAC;gBACnG,CAAC;gBACD,KAAK,OAAO,EAAE,CAAC;oBACb,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC1B,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,IAAI,EACR,MAAM,EACN,QAAQ,EACR,OAAO,CAAC,YAAY,CACrB,CACF,CAAC;oBACF,OAAO,WAAW,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;gBAC1F,CAAC;gBACD,KAAK,QAAQ,EAAE,CAAC;oBACd,MAAM,WAAW,CAAC,GAAG,EAAE,CACrB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAClE,CAAC;oBACF,OAAO,aAAa,MAAM,GAAG,CAAC;gBAChC,CAAC;gBACD;oBACE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,UAAU,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,mBAAmB,CACvB,cAAsB,EACtB,SAAiB,EACjB,IAAY;QAEZ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,IAAI,GACR,IAAI,CAAC,MAAM,GAAG,yBAAyB;YACrC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,CAAC,gBAAgB;YAC7D,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CACnC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CACnF,CAAC;YACF,OAAO;gBACL,GAAG,EAAE,sBAAsB,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,MAAM,gBAAgB,KAAK,CAAC,EAAE,EAAE;aAC9F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,2DAA2D;oBAC7E,+EAA+E,EACjF,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,cAAsB,EAAE,KAAa;QACnD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,yBAAyB,CAAC,cAAc,CAAC,CAAC;QACtD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CACb,iCAAiC,KAAK,gDAAgD;oBACpF,oFAAoF;oBACpF,oFAAoF;oBACpF,iDAAiD,EACnD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport * as log from \"../../log.js\";\nimport { GithubApiError, GithubClient, GITHUB_MAX_COMMENT_LENGTH, githubRetry } from \"./client.js\";\nimport {\n  CLOUD_BUILD_APP_SLUG,\n  CloudBuildLogUnavailableError,\n  fetchCloudBuildLog,\n  isCloudBuildId,\n  projectFromDetailsUrl,\n} from \"./cloudbuild.js\";\nimport { parseGithubConversationId } from \"./ids.js\";\nimport { conversationRepoDir, GITHUB_PUSH_BRANCH_PATTERN, pushBranch, syncRepo } from \"./repo.js\";\nimport type {\n  GithubBotConfig,\n  GithubCheckSummary,\n  GithubConversationRef,\n  GithubIssueRequest,\n  GithubPrRequest,\n  GithubPrResult,\n  GithubReadRequest,\n  GithubReadResult,\n  PlatformGithubOps,\n} from \"./types.js\";\n\n/** Both CI log modes tail-truncate to this many characters. */\nconst MAX_LOG_CHARS = 20000;\n\nfunction truncateLogTail(logText: string): string {\n  return logText.length > MAX_LOG_CHARS\n    ? `…(truncated to the last ${MAX_LOG_CHARS} chars)\\n${logText.slice(-MAX_LOG_CHARS)}`\n    : logText;\n}\n\n/** Whether the conversation's issue is a PR, for callers where the triggering\n *  item didn't carry that knowledge. Errs toward plain issue. */\nexport async function fetchIsPr(\n  client: GithubClient,\n  ref: GithubConversationRef,\n): Promise<boolean> {\n  try {\n    const issue = await githubRetry(() => client.getIssue(ref.owner, ref.repo, ref.number));\n    return Boolean(issue.pull_request);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The PR's head branch name when it lives in this repo — that is the name\n * the local checkout should carry, so committing on it and calling\n * github_pr pushes back to the PR itself instead of opening a new one.\n * Fork heads (unpushable with the repo-scoped token) and failed lookups\n * return undefined; callers then fall back to the synthetic pr-<n>.\n */\nexport async function fetchPrHeadBranch(\n  client: GithubClient,\n  ref: GithubConversationRef,\n): Promise<string | undefined> {\n  try {\n    const pr = await githubRetry(() => client.getPullRequest(ref.owner, ref.repo, ref.number));\n    const sameRepo =\n      pr.head?.repo?.full_name?.toLowerCase() === `${ref.owner}/${ref.repo}`.toLowerCase();\n    return sameRepo ? pr.head?.ref : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Host-side backend of the github_* tool pack (`PlatformGithubOps`),\n * standalone from the messaging bot: it needs the API client, the\n * conversation working dir, and optional Cloud Build access — not the poll\n * loop, queues, or trigger gate. Tokens are minted per call, scoped to the\n * conversation's repo, and never enter the sandbox.\n */\nexport class GithubOps implements PlatformGithubOps {\n  /** Cloud Build ids seen in getChecks summaries → their GCP project. */\n  private buildRef = new Map<string, { project: string }>();\n\n  constructor(\n    private readonly client: GithubClient,\n    private readonly config: {\n      workingDir: string;\n      cloudBuild?: GithubBotConfig[\"cloudBuild\"];\n    },\n  ) {}\n\n  private repoDir(conversationId: string): string {\n    return conversationRepoDir(this.config.workingDir, conversationId);\n  }\n\n  /**\n   * Backs the `github_pr` tool: push a `pi/*` branch the agent prepared in\n   * the conversation's clone, then open a pull request as the App. The write\n   * token is minted per call, scoped to this one repo, and never enters the\n   * sandbox.\n   */\n  async pushAndCreatePr(conversationId: string, request: GithubPrRequest): Promise<GithubPrResult> {\n    const ref = parseGithubConversationId(conversationId);\n    const dir = this.repoDir(conversationId);\n    if (!existsSync(dir)) {\n      throw new Error(\"This conversation has no ./repo clone to push from.\");\n    }\n    if (!GITHUB_PUSH_BRANCH_PATTERN.test(request.branch)) {\n      throw new Error(\n        `Branch '${request.branch}' is not pushable: name it pi/<something> (e.g. pi/fix-${ref.number}).`,\n      );\n    }\n    const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));\n    const base = request.base ?? repository.default_branch;\n    const token = await this.client.createScopedInstallationToken(ref.repo, {\n      contents: \"write\",\n      pull_requests: \"write\",\n    });\n    await pushBranch({ dir, branch: request.branch, token });\n    try {\n      const pr = await githubRetry(() =>\n        this.client.createPullRequest(ref.owner, ref.repo, {\n          title: request.title,\n          head: request.branch,\n          base,\n          body: request.body,\n          draft: request.draft,\n        }),\n      );\n      log.logInfo(`[${conversationId}] Opened PR #${pr.number}: ${pr.html_url}`);\n      return { number: pr.number, url: pr.html_url };\n    } catch (err) {\n      // Idempotency: pushing more commits to a branch that already has an\n      // open PR updates that PR; the create call then 422s. Surface the\n      // existing PR instead of failing the fix-CI-push-again loop.\n      if (\n        err instanceof GithubApiError &&\n        err.status === 422 &&\n        /already exists/i.test(err.message)\n      ) {\n        const existing = await this.client.findOpenPullRequestByBranch(\n          ref.owner,\n          ref.repo,\n          request.branch,\n        );\n        if (existing) {\n          log.logInfo(\n            `[${conversationId}] Pushed to existing PR #${existing.number}: ${existing.html_url}`,\n          );\n          return { number: existing.number, url: existing.html_url, updatedExisting: true };\n        }\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the `github_checks` tool: CI check runs for a branch the agent\n   * pushed, or for the conversation's PR head when no branch is given.\n   */\n  async getChecks(conversationId: string, branch?: string): Promise<GithubCheckSummary[]> {\n    const ref = parseGithubConversationId(conversationId);\n    let target = branch;\n    if (!target) {\n      let pr;\n      try {\n        pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, ref.number));\n      } catch {\n        pr = null;\n      }\n      if (!pr?.head) {\n        throw new Error(\n          \"This conversation is not a pull request — pass the branch whose checks you want.\",\n        );\n      }\n      target = pr.head.sha;\n    }\n    const runs = await githubRetry(() => this.client.listCheckRuns(ref.owner, ref.repo, target));\n    return runs.map((run) => {\n      const externalId = run.external_id?.trim() || null;\n      let buildLogAvailable = false;\n      // Cloud Build runs carry their build UUID in external_id and the GCP\n      // project in details_url. Remember project-by-build so getBuildLog only\n      // serves builds the agent actually saw on this repo's checks.\n      if (\n        this.config.cloudBuild &&\n        run.app?.slug === CLOUD_BUILD_APP_SLUG &&\n        externalId &&\n        isCloudBuildId(externalId)\n      ) {\n        const project =\n          projectFromDetailsUrl(run.details_url) ?? this.config.cloudBuild.projectFallback;\n        if (project) {\n          this.rememberBuild(externalId, project);\n          buildLogAvailable = true;\n        }\n      }\n      return {\n        id: run.id,\n        name: run.name,\n        status: run.status,\n        conclusion: run.conclusion,\n        url: run.html_url,\n        appSlug: run.app?.slug ?? null,\n        outputSummary: run.output?.summary?.trim() ? run.output.summary.slice(0, 500) : null,\n        externalId,\n        buildLogAvailable,\n      };\n    });\n  }\n\n  private rememberBuild(buildId: string, project: string): void {\n    // Insertion-ordered Map as a small LRU: re-insert on touch, prune oldest.\n    this.buildRef.delete(buildId);\n    this.buildRef.set(buildId, { project });\n    if (this.buildRef.size > 200) {\n      const oldest = this.buildRef.keys().next().value;\n      if (oldest !== undefined) this.buildRef.delete(oldest);\n    }\n  }\n\n  /**\n   * Backs the Cloud Build log mode of `github_checks`. GCP credentials stay\n   * host-side (ADC via GOOGLE_APPLICATION_CREDENTIALS — e.g. a Workload\n   * Identity Federation external_account file); the build must have appeared\n   * in a github_checks summary first, which is also where its project is\n   * learned. Unreadable logs degrade to the console url, never a dead end.\n   */\n  async getBuildLog(conversationId: string, buildId: string): Promise<string> {\n    if (!this.config.cloudBuild) {\n      throw new Error(\n        \"Cloud Build log access is not configured on this host (no GCP credentials).\",\n      );\n    }\n    const known = this.buildRef.get(buildId);\n    if (!known) {\n      throw new Error(\n        `Unknown build id ${buildId}: run github_checks first and take a [build …] id from ` +\n          `the summary.`,\n      );\n    }\n    let logText: string;\n    try {\n      logText = await fetchCloudBuildLog({\n        tokenProvider: this.config.cloudBuild.tokenProvider,\n        project: known.project,\n        buildId,\n      });\n    } catch (err) {\n      if (err instanceof CloudBuildLogUnavailableError) {\n        throw new Error(\n          `${err.message}${err.consoleUrl ? ` Console: ${err.consoleUrl}` : \"\"} Use the check's ` +\n            `summary/url from github_checks, or reproduce the failure locally in ./repo.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n    return truncateLogTail(logText);\n  }\n\n  /**\n   * Backs the `github_sync` tool: refresh the conversation's ./repo clone\n   * from origin with an ephemeral read token. Fetch-only when moving the\n   * checkout could lose agent work; the formatted report tells the agent\n   * what happened and what to do next.\n   */\n  async syncRepo(conversationId: string, branch?: string): Promise<string> {\n    const ref = parseGithubConversationId(conversationId);\n    const dir = this.repoDir(conversationId);\n    if (!existsSync(dir)) {\n      throw new Error(\"This conversation has no ./repo clone to sync.\");\n    }\n    const token = await this.client.createScopedInstallationToken(ref.repo, {\n      contents: \"read\",\n    });\n    let prNumber: number | undefined;\n    let prHeadBranch: string | undefined;\n    let defaultBranch: string | undefined;\n    if (!branch) {\n      if (await fetchIsPr(this.client, ref)) {\n        prNumber = ref.number;\n        prHeadBranch = await fetchPrHeadBranch(this.client, ref);\n      } else {\n        const repository = await githubRetry(() => this.client.getRepository(ref.owner, ref.repo));\n        defaultBranch = repository.default_branch;\n      }\n    }\n    const result = await syncRepo({ dir, token, branch, prNumber, prHeadBranch, defaultBranch });\n\n    if (result.updatedCheckout) {\n      return `Updated ./repo: branch ${result.target} is now at ${result.fetchedSha.slice(0, 12)}.`;\n    }\n    const reasons: string[] = [];\n    if (result.currentBranch !== result.target) {\n      reasons.push(`the checkout is on '${result.currentBranch}', not '${result.target}'`);\n    }\n    if (result.dirty) {\n      reasons.push(\"the working tree has uncommitted changes\");\n    }\n    if (result.localCommits > 0) {\n      reasons.push(`'${result.target}' has ${result.localCommits} local commit(s) not on origin`);\n    }\n    return (\n      `Fetched ${result.target} to FETCH_HEAD (${result.fetchedSha.slice(0, 12)}) but left the ` +\n      `checkout alone: ${reasons.join(\"; \")}. Merge or rebase FETCH_HEAD yourself ` +\n      `(e.g. git merge FETCH_HEAD), or commit your work to a pi/* branch first.`\n    );\n  }\n\n  /**\n   * Backs the `github_read` tool: PR/issue metadata the ./repo clone cannot\n   * provide (diff stats, review state, other issues in the repo). Owner/repo\n   * always come from the conversation id, so reads never leave this repo.\n   */\n  async readGithub(conversationId: string, request: GithubReadRequest): Promise<GithubReadResult> {\n    const ref = parseGithubConversationId(conversationId);\n    const number = request.number ?? ref.number;\n    switch (request.action) {\n      case \"pr\": {\n        const pr = await githubRetry(() => this.client.getPullRequest(ref.owner, ref.repo, number));\n        return { kind: \"pr\", pr };\n      }\n      case \"pr_files\": {\n        const files = await githubRetry(() =>\n          this.client.listPullRequestFiles(ref.owner, ref.repo, number),\n        );\n        return { kind: \"pr_files\", files };\n      }\n      case \"pr_reviews\": {\n        const [reviews, threads] = await Promise.all([\n          githubRetry(() => this.client.listPullRequestReviews(ref.owner, ref.repo, number)),\n          githubRetry(() => this.client.listPullReviewComments(ref.owner, ref.repo, number)),\n        ]);\n        return { kind: \"pr_reviews\", reviews, threads };\n      }\n      case \"issue\": {\n        const issue = await githubRetry(() => this.client.getIssue(ref.owner, ref.repo, number));\n        return { kind: \"issue\", issue };\n      }\n      case \"comments\": {\n        const comments = await githubRetry(() =>\n          this.client.listIssueComments(ref.owner, ref.repo, number),\n        );\n        return { kind: \"comments\", comments };\n      }\n      case \"list\": {\n        const issues = await githubRetry(() =>\n          this.client.listIssues(ref.owner, ref.repo, {\n            state: request.state,\n            labels: request.labels,\n            creator: request.creator,\n          }),\n        );\n        return { kind: \"list\", issues };\n      }\n      default:\n        throw new Error(`Unknown github_read action: ${String(request.action)}`);\n    }\n  }\n\n  /**\n   * Backs the `github_issue` tool: labels, assignees, and open/closed state\n   * on any issue of this conversation's repo (triage). Same-repo by\n   * construction — owner/repo come from the conversation id; the action enum\n   * is closed, so lock/delete/transfer cannot be expressed at all.\n   */\n  async manageIssue(conversationId: string, request: GithubIssueRequest): Promise<string> {\n    const ref = parseGithubConversationId(conversationId);\n    const number = request.number ?? ref.number;\n    try {\n      switch (request.action) {\n        case \"add_labels\": {\n          if (!request.labels?.length) {\n            throw new Error(\"add_labels requires a non-empty labels array.\");\n          }\n          await githubRetry(() =>\n            this.client.addIssueLabels(ref.owner, ref.repo, number, request.labels!),\n          );\n          return `Added label(s) ${request.labels.join(\", \")} to #${number}.`;\n        }\n        case \"remove_label\": {\n          if (!request.label) {\n            throw new Error(\"remove_label requires a label name.\");\n          }\n          await githubRetry(() =>\n            this.client.removeIssueLabel(ref.owner, ref.repo, number, request.label!),\n          );\n          return `Removed label ${request.label} from #${number}.`;\n        }\n        case \"add_assignees\": {\n          if (!request.assignees?.length) {\n            throw new Error(\"add_assignees requires a non-empty assignees array.\");\n          }\n          await githubRetry(() =>\n            this.client.addIssueAssignees(ref.owner, ref.repo, number, request.assignees!),\n          );\n          return `Assigned ${request.assignees.map((login) => `@${login}`).join(\", \")} to #${number}.`;\n        }\n        case \"remove_assignees\": {\n          if (!request.assignees?.length) {\n            throw new Error(\"remove_assignees requires a non-empty assignees array.\");\n          }\n          await githubRetry(() =>\n            this.client.removeIssueAssignees(ref.owner, ref.repo, number, request.assignees!),\n          );\n          return `Unassigned ${request.assignees.map((login) => `@${login}`).join(\", \")} from #${number}.`;\n        }\n        case \"close\": {\n          await githubRetry(() =>\n            this.client.updateIssueState(\n              ref.owner,\n              ref.repo,\n              number,\n              \"closed\",\n              request.state_reason,\n            ),\n          );\n          return `Closed #${number}${request.state_reason ? ` as ${request.state_reason}` : \"\"}.`;\n        }\n        case \"reopen\": {\n          await githubRetry(() =>\n            this.client.updateIssueState(ref.owner, ref.repo, number, \"open\"),\n          );\n          return `Reopened #${number}.`;\n        }\n        default:\n          throw new Error(`Unknown github_issue action: ${String(request.action)}`);\n      }\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(`Issue #${number} not found in ${ref.owner}/${ref.repo}.`, { cause: err });\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the `github_review_reply` tool: answer inside one inline review\n   * thread of this conversation's PR. The comment id comes from an\n   * `[PR review comment rc-<id> …]` message; GitHub validates it belongs to\n   * this PR (404 otherwise, translated into agent-actionable guidance).\n   */\n  async replyToReviewThread(\n    conversationId: string,\n    commentId: number,\n    body: string,\n  ): Promise<{ url: string }> {\n    if (!Number.isInteger(commentId) || commentId <= 0) {\n      throw new Error(\n        \"comment_id must be the numeric id from an [PR review comment rc-<id> …] message.\",\n      );\n    }\n    const ref = parseGithubConversationId(conversationId);\n    const text =\n      body.length > GITHUB_MAX_COMMENT_LENGTH\n        ? `${body.slice(0, GITHUB_MAX_COMMENT_LENGTH)}\\n…(truncated)`\n        : body;\n    try {\n      const reply = await githubRetry(() =>\n        this.client.replyToReviewComment(ref.owner, ref.repo, ref.number, commentId, text),\n      );\n      return {\n        url: `https://github.com/${ref.owner}/${ref.repo}/pull/${ref.number}#discussion_r${reply.id}`,\n      };\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(\n          `Comment ${commentId} is not a review comment on this PR. Take the id from an ` +\n            `[PR review comment rc-<id> …] message in this conversation; do not guess ids.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n  }\n\n  /**\n   * Backs the log mode of `github_checks`: the tail of one CI job's log so\n   * the agent can diagnose a failing check without sandbox credentials. Only\n   * GitHub Actions checks have logs on GitHub — external CI apps (e.g. Cloud\n   * Build) keep theirs on their own service, so a 404 here is translated\n   * into guidance instead of a dead end.\n   */\n  async getJobLog(conversationId: string, jobId: number): Promise<string> {\n    if (!Number.isInteger(jobId) || jobId <= 0) {\n      throw new Error(\n        \"job_id must be a positive Actions job id taken from a [job …] entry in the github_checks summary.\",\n      );\n    }\n    const ref = parseGithubConversationId(conversationId);\n    let logText: string;\n    try {\n      logText = await githubRetry(() => this.client.getJobLog(ref.owner, ref.repo, jobId));\n    } catch (err) {\n      if (err instanceof GithubApiError && err.status === 404) {\n        throw new Error(\n          `No GitHub Actions log for job ${jobId}. Logs are only available for checks reported ` +\n            `by github-actions; external CI (e.g. Cloud Build) keeps logs on its own service — ` +\n            `use that check's summary/url from github_checks, or reproduce the failure locally ` +\n            `in ./repo instead. Do not retry with other ids.`,\n          { cause: err },\n        );\n      }\n      throw err;\n    }\n    return truncateLogTail(logText);\n  }\n}\n"]}

package/dist/adapters/github/ids.d.ts

@@ -0,0 +1,34 @@
+import type { GithubConversationRef } from "./types.js";
+/**
+ * Conversation id for one issue/PR: `GH_<owner>_<repo>_<number>`.
+ *
+ * DESIGN.md originally proposed `gh:<owner>/<repo>#<number>`, but conversation
+ * ids are used verbatim as a single path segment (LAYOUT.md § Casing) and the
+ * conversation dir is bind-mounted with docker's `-v source:target` syntax in
+ * image mode — so the id can contain neither `/` nor `:`. `_` is the
+ * separator because it is the only inert character that also parses back
+ * unambiguously under GitHub's name grammar: owners allow `-` (so `-` would
+ * make the owner/repo boundary ambiguous) but never `_`, repos may contain
+ * `_` but the trailing number is pure digits — so the first `_` and the last
+ * `_` before the digits are always the real boundaries.
+ *
+ * Owner and repo are lowercased: GitHub names are case-insensitive (and this
+ * id has two spelling sources — the GITHUB_REPOS env var and API payloads),
+ * so per LAYOUT.md § Casing this is a mikan-derived slug, not a verbatim
+ * platform id, and derived slugs are lowercased to keep one issue from
+ * mapping to two conversation dirs on case-sensitive filesystems.
+ */
+export declare function buildGithubConversationId(ref: GithubConversationRef): string;
+export declare function parseGithubConversationId(conversationId: string): GithubConversationRef;
+/** Message ts used for the issue/PR body itself (comments use their comment id). */
+export declare const GITHUB_ISSUE_BODY_TS = "issue";
+/**
+ * Message ts for an inline PR review comment: `rc-<id>`. Review-comment ids
+ * live in a different id space than issue-comment ids, and several endpoints
+ * (reactions, edits) differ by family — the prefix makes routing a review id
+ * to an issue-comment endpoint structurally impossible.
+ */
+export declare function githubReviewCommentTs(commentId: number): string;
+/** The review-comment id inside an `rc-<id>` ts, or null for other ts kinds. */
+export declare function parseReviewCommentTs(ts: string): number | null;
+//# sourceMappingURL=ids.d.ts.map

package/dist/adapters/github/ids.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/ids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,qBAAqB,GAAG,MAAM,CAE5E;AAID,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,qBAAqB,CAYvF;AAED,oFAAoF;AACpF,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG9D"}