@goodandready/dsh-github-ops 0.2.12 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.3.0
+
+### Features
+- **Token Capability Diagnostics & Scopes Audit** (#72): Introduced `gh_token_audit` tool (`auditTokenScopes`) providing automated token permission checks (classic vs fine-grained) and early capability warnings for missing repository, workflow, packages, or org administration scopes. Added `scopeWarnings` in `/status` payload.
+- **Selective CI Failure Log Inspector** (#67): Added `gh_run_failure_inspector` tool with regex-based failure step isolation, automatic ANSI sequence stripping, secret token masking, and highlighted failure summaries without needing to download full workflow artifact archives.
+- **Interactive Stash Management & Diff Preview** (#70): Added stash diff preview endpoint (`GET /scm?stash=stash@{N}`) and full lifecycle actions (`stashShow`, `stashApply`, `stashPop`, `stashDrop` with confirmation safety). Updated Source Control UI with quick diff viewer and stash operation buttons.
+
 ## 0.2.12
 
 ### Security

package/lib/client.js

@@ -101,6 +101,7 @@ window.__ModuleLoader__.load({
       scmDelete: 'Delete',
       scmSwitch: 'Switch',
       scmStashSave: 'Save stash',
+      scmStashView: 'Diff',
       scmStashApply: 'Apply',
       scmStashPop: 'Pop',
       scmStashDrop: 'Drop',
@@ -203,6 +204,7 @@ window.__ModuleLoader__.load({
       scmDelete: '删除',
       scmSwitch: '切换',
       scmStashSave: '保存 stash',
+      scmStashView: '差异',
       scmStashApply: '应用',
       scmStashPop: '弹出',
       scmStashDrop: '删除',
@@ -328,7 +330,17 @@ window.__ModuleLoader__.load({
       const openDiff = (file, staged) => {
         setSelected({ path: file.path, staged })
         setDiff({ phase: 'loading', text: '' })
-        const query = `?file=${encodeURIComponent(file.path)}${staged ? '&staged=1' : ''}`
+        const query = `?file=${encodeURIComponent(file.path)}${staged ? '&staged=1' : ''}${cwdQuery ? `&${cwdQuery}` : ''}`
+        fetchWithTimeout(SCM_PATH + query, { headers: { accept: 'application/json' } })
+          .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
+          .then((payload) => setDiff({ phase: 'ready', text: payload.diff || '' }))
+          .catch((err) => setDiff({ phase: 'error', text: String((err && err.message) || err) }))
+      }
+
+      const openStashDiff = (stashRef) => {
+        setSelected({ path: stashRef, isStash: true })
+        setDiff({ phase: 'loading', text: '' })
+        const query = `?stash=${encodeURIComponent(stashRef)}${cwdQuery ? `&${cwdQuery}` : ''}`
         fetchWithTimeout(SCM_PATH + query, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setDiff({ phase: 'ready', text: payload.diff || '' }))
@@ -460,6 +472,7 @@ window.__ModuleLoader__.load({
           onChange: (event) => setStashMessage(event.target.value),
         }),
         button(t('scmStashSave'), () => runAction('stashPush', { message: stashMessage }), { disabled: Boolean(busy) }),
+        (payload.stashes || []).slice(0, 4).map((entry) => button(`${t('scmStashView')} ${entry.ref}`, () => openStashDiff(entry.ref))),
         (payload.stashes || []).slice(0, 4).map((entry) => button(`${t('scmStashApply')} ${entry.ref}`, () => runAction('stashApply', { ref: entry.ref }))),
         (payload.stashes || []).slice(0, 4).map((entry) => button(`${t('scmStashPop')} ${entry.ref}`, () => runAction('stashPop', { ref: entry.ref }))),
         (payload.stashes || []).slice(0, 4).map((entry) => button(
@@ -1128,7 +1141,7 @@ window.__ModuleLoader__.load({
     exports.SCM_ACTIONS = [
       'stage', 'unstage', 'discard', 'commit', 'push', 'sync',
       'branchCreate', 'branchCheckout', 'branchDelete',
-      'stashPush', 'stashApply', 'stashPop', 'stashDrop', 'continue', 'abort',
+      'stashPush', 'stashApply', 'stashPop', 'stashDrop', 'stashShow', 'continue', 'abort',
     ]
     exports.PullRequestBar = PullRequestBar
     exports.GitHubPanel = GitHubPanel

package/lib/routes.js

@@ -9,7 +9,7 @@ import { existsSync, statSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
 import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from './status.js'
-import { buildAction, validateCwd } from './scm-write.js'
+import { buildAction, validateCwd, validateStashRef } from './scm-write.js'
 import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom } from './scm.js'
 import { listIssues } from './tools/issues.js'
 import { listRuns } from './tools/actions.js'
@@ -168,6 +168,19 @@ export function registerRoutes(ctx, deps = {}) {
             return sendJson(res, 200, { file, staged, diff: String(text || '').slice(0, 200000) })
           }
 
+          const stash = url.searchParams.get('stash') || ''
+          if (stash) {
+            let stashRef
+            try {
+              stashRef = validateStashRef(stash)
+            } catch (err) {
+              return sendJson(res, 400, { error: String((err && err.message) || err) })
+            }
+            const diff = await git(['stash', 'show', '-p', stashRef], { cwd })
+            const text = diff.code === 0 ? diff.stdout : diff.stderr
+            return sendJson(res, 200, { stash: stashRef, diff: String(text || '').slice(0, 200000) })
+          }
+
           const branchAnswer = await git(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd })
           if (branchAnswer.code !== 0) {
             return sendJson(res, 200, scmPayload({ cwd, error: 'not a git repository (or no commits yet)' }))

package/lib/scm-write.js

@@ -36,9 +36,10 @@ export function validateMessage(message) {
   return trimmed
 }
 
-/** Stash references are `stash@{N}`; nothing else is accepted. */
+/** Stash references are `stash@{N}` or integer indices; nothing else is accepted. */
 export function validateStashRef(ref) {
-  const value = String(ref == null ? '' : ref).trim()
+  let value = String(ref == null ? '' : ref).trim()
+  if (/^\d{1,3}$/.test(value)) value = `stash@{${value}}`
   if (!/^stash@\{\d{1,3}\}$/.test(value)) throw new Error(`refusing an unsafe stash reference: "${value.slice(0, 40)}"`)
   return value
 }
@@ -92,11 +93,17 @@ export function buildAction(action, args = {}) {
       return result(name, steps, destructive, 'save the working copy to a stash')
     }
     case 'stashApply':
+    case 'stash_apply':
       return result(name, [['stash', 'apply', validateStashRef(args.ref)]], destructive, `apply ${args.ref}`)
     case 'stashPop':
+    case 'stash_pop':
       return result(name, [['stash', 'pop', validateStashRef(args.ref)]], destructive, `apply and drop ${args.ref}`)
     case 'stashDrop':
+    case 'stash_drop':
       return result(name, [['stash', 'drop', validateStashRef(args.ref)]], destructive, `drop ${args.ref}`)
+    case 'stashShow':
+    case 'stash_show':
+      return result(name, [['stash', 'show', '-p', validateStashRef(args.ref)]], destructive, `show diff of ${args.ref}`)
     case 'continue': {
       const verb = String(args.verb || '').trim()
       if (!CONTINUE_VERBS.includes(verb)) throw new Error(`refusing to continue an unknown operation: "${verb.slice(0, 20)}"`)
@@ -136,7 +143,7 @@ export function buildAction(action, args = {}) {
   }
 }
 
-const DESTRUCTIVE = new Set(['discard', 'branchDelete', 'stashDrop', 'abort', 'worktreeRemove'])
+const DESTRUCTIVE = new Set(['discard', 'branchDelete', 'stashDrop', 'stash_drop', 'abort', 'worktreeRemove'])
 
 function result(action, steps, destructive, summary) {
   return { action, steps, mutating: true, destructive, needsConfirm: destructive, summary }
@@ -146,7 +153,7 @@ function result(action, steps, destructive, summary) {
 export const ACTIONS = Object.freeze([
   'stage', 'unstage', 'discard', 'commit', 'push', 'sync',
   'branchCreate', 'branchCheckout', 'branchDelete',
-  'stashPush', 'stashApply', 'stashPop', 'stashDrop',
+  'stashPush', 'stashApply', 'stashPop', 'stashDrop', 'stashShow',
   'worktreeAdd', 'worktreeRemove',
   'continue', 'abort',
 ])

package/lib/status.js

@@ -1,3 +1,4 @@
+import { auditTokenScopes } from './token-audit.js'
 // What the settings card is allowed to know.
 //
 // The status of the access — where it comes from, which account, what the rate limit looks
@@ -126,12 +127,14 @@ function header(req, name) {
  */
 export function statusPayload({ access, identity, rateLimit, scopes, cache, error } = {}) {
   const configured = Boolean(access && access.value)
+  const audit = auditTokenScopes(scopes)
   return {
     configured,
     source: configured ? access.source || '' : '',
     login: (identity && identity.login) || '',
     name: (identity && identity.name) || '',
     scopes: scopes || '',
+    scopeWarnings: audit.warnings,
     rateLimit: rateLimit
       ? { limit: rateLimit.limit, remaining: rateLimit.remaining, resetAt: rateLimit.resetAt }
       : null,

package/lib/token-audit.js

@@ -0,0 +1,84 @@
+// Token scopes audit and capability diagnostics.
+// Compares GitHub x-oauth-scopes against features of dsh-github-ops.
+
+export const CAPABILITY_REQUIREMENTS = [
+  {
+    capability: 'Repositories & Code (Private)',
+    requiredAny: ['repo'],
+    impact: 'Access to private repositories, code pushes, branches, releases, issues and PRs',
+  },
+  {
+    capability: 'Repositories & Code (Public)',
+    requiredAny: ['repo', 'public_repo'],
+    impact: 'Access to public repository code, issues, releases and PRs',
+  },
+  {
+    capability: 'Workflows & CI Runs',
+    requiredAny: ['workflow'],
+    impact: 'Triggering workflow runs, cancelling runs and updating .github/workflows',
+  },
+  {
+    capability: 'GitHub Packages',
+    requiredAny: ['write:packages', 'read:packages'],
+    impact: 'Publishing and downloading package bundles from ghcr.io / npm.pkg.github.com',
+  },
+  {
+    capability: 'Organization & Teams',
+    requiredAny: ['read:org', 'admin:org'],
+    impact: 'Listing organization repositories, teams and membership',
+  },
+]
+
+export function auditTokenScopes(rawScopes) {
+  const scopesStr = typeof rawScopes === 'string' ? rawScopes.trim() : ''
+  if (!scopesStr) {
+    return {
+      scopes: [],
+      raw: '',
+      isFineGrained: true,
+      capabilities: [],
+      missing: [],
+      warnings: ['Token does not report OAuth scopes (typical for fine-grained Personal Access Tokens or GitHub Apps). Permissions are scoped per-repository.'],
+      hasFullRepoAccess: false,
+      hasWorkflowAccess: false,
+    }
+  }
+
+  const scopeList = scopesStr.split(',').map((s) => s.trim().toLowerCase()).filter(Boolean)
+  const scopeSet = new Set(scopeList)
+
+  const capabilities = []
+  const missing = []
+  const warnings = []
+
+  for (const item of CAPABILITY_REQUIREMENTS) {
+    const granted = item.requiredAny.some((s) => scopeSet.has(s))
+    capabilities.push({
+      capability: item.capability,
+      granted,
+      requiredAny: item.requiredAny,
+    })
+    if (!granted) {
+      missing.push({
+        capability: item.capability,
+        requiredAny: item.requiredAny,
+        impact: item.impact,
+      })
+      warnings.push(`Missing scope [${item.requiredAny.join(' or ')}] for ${item.capability}: ${item.impact}`)
+    }
+  }
+
+  const hasFullRepoAccess = scopeSet.has('repo')
+  const hasWorkflowAccess = scopeSet.has('workflow')
+
+  return {
+    scopes: scopeList,
+    raw: scopesStr,
+    isFineGrained: false,
+    capabilities,
+    missing,
+    warnings,
+    hasFullRepoAccess,
+    hasWorkflowAccess,
+  }
+}

package/lib/tools/actions.js

@@ -175,11 +175,13 @@ export async function getJobLogSummary(client, { owner, repo, runId, jobId, maxL
   }
 
   const lines = cleanLogContent(logText, maxLines)
+  const errorHighlights = lines.filter((l) => /\b(error|failed|failure|fatal)\b|##\[error\]|npm err!/i.test(l)).slice(-10)
   return {
     jobId: targetJobId,
     jobName: targetJobName,
     failedStep,
     lineCount: lines.length,
     lines,
+    errorHighlights,
   }
 }

package/lib/tools/register-ops.js

@@ -102,6 +102,19 @@ export function registerOpsTools({ tool, asRepo, client, liveConfig }) {
     async (args) => withRepo(args, async ({ owner, repo }) => getRunLogsUrl(await client(), { owner, repo, runId: args.runId })),
   )
 
+  tool(
+    'gh_run_failure_inspector',
+    'Inspect failed jobs and steps in a GitHub Actions workflow run, downloading only the relevant job log text, stripping ANSI escapes, redacting tokens, and returning the diagnostic error lines without downloading full zip archives. Read-only.',
+    repoParams({
+      runId: { type: 'number', description: 'Workflow run id (e.g. from gh_run_list).' },
+      jobId: { type: 'number', description: 'Specific job id to inspect (optional, defaults to first failed job).' },
+      maxLines: { type: 'number', description: 'Maximum log lines to return (default 100, max 250).' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => getJobLogSummary(await client(), {
+      owner, repo, runId: args.runId, jobId: args.jobId, maxLines: args.maxLines,
+    })),
+  )
+
   tool(
     'gh_run_dispatch',
     'Trigger a workflow_dispatch event for a GitHub Actions workflow with inputs. Requires confirm: true.',

package/lib/tools/register-write.js

@@ -1,3 +1,4 @@
+import { auditTokenScopes } from '../token-audit.js'
 // Content and account tools: writing files without a checkout, and signing in without a
 // terminal.
 //
@@ -226,6 +227,28 @@ export function registerWriteTools({ tool, asRepo, client, liveConfig, auth }) {
     },
   )
 
+  tool(
+    'gh_token_audit',
+    'Audit OAuth token scopes and report granted vs missing capabilities (repo, workflow, packages, org) with diagnostic warnings. Read-only.',
+    {},
+    async () => {
+      const access = await auth.resolve()
+      if (!access.value) return { configured: false, guidance: access.guidance }
+      const github = await client()
+      const { data, rateLimit } = await github.get('/user')
+      const rawScopes = github.lastScopes ? github.lastScopes() : ''
+      const audit = auditTokenScopes(rawScopes)
+      return {
+        configured: true,
+        source: access.source,
+        login: data && data.login,
+        name: data && data.name,
+        rateLimit: rateLimit || undefined,
+        ...audit,
+      }
+    },
+  )
+
   tool(
     'gh_auth_logout',
     'Forget the sign-in stored by this plugin (gh_auth_login). Other sources (a DSH credential, the environment, the gh CLI) are untouched. Requires confirm: true.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.12",
+  "version": "0.3.0",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",