@goodandready/dsh-github-ops 0.2.2 → 0.2.4

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 Notable changes to `@goodandready/dsh-github-ops`.
 
+## 0.2.4
+
+### Fixed
+- Fixed GitHub client cache holding onto stale credentials when rotated with a token of the exact same length: cache key now incorporates a non-reversible sha256 token fingerprint (#38).
+
+## 0.2.3
+
+### Added
+- Release assets management: `gh_release_asset_list`, `gh_release_asset_upload`, `gh_release_asset_delete` (#41).
+- Workflow dispatch: `gh_run_dispatch` triggering Actions workflow_dispatch events with inputs and confirm gate (#42).
+- CI log summary: `gh_run_log_summary` extracting compact failure context, stripping ANSI and redacting secrets (#43).
+- Release notes generation: `gh_release_notes_generate` generating changelogs from PRs and commits (#44).
+- PR review discussion threads: `pr_review_threads`, `pr_thread_reply`, `pr_thread_resolve` (#45).
+
 ## 0.2.2
 
 ### Fixed

package/README.md

@@ -87,6 +87,10 @@ Requires a GitHub token in the DSH credential service. Store the token under a n
 | `gh_release_create` | Create a release for a tag, optionally on a specific commit. |
 | `gh_release_edit` | Edit title, notes, draft/prerelease, and **which release is latest**. |
 | `gh_release_delete` | Delete a release (requires `confirm: true`). |
+| `gh_release_asset_list` | List release assets with sizes and download counts (read-only). |
+| `gh_release_asset_upload` | Upload a file asset (.tgz, binary) to a release (requires `confirm: true`). |
+| `gh_release_asset_delete` | Delete a release asset by ID (requires `confirm: true`). |
+| `gh_release_notes_generate` | Generate release notes for a tag from merged PRs and commits (read-only). |
 
 `gh_release_edit` with `makeLatest: true` is the step that keeps the repository badge on
 the current version: creating older releases afterwards otherwise moves “Latest” back.
@@ -119,6 +123,9 @@ a single confirmation cannot make those safe.
 | `review_post` | Publish a review as one summary comment, or as line-anchored inline comments. |
 | `gh_checks` | Check runs, legacy statuses and one rollup verdict for a commit. |
 | `ci_run` | One-shot review of a PR with a rule-based verdict. |
+| `pr_review_threads` | List review discussion threads with comments and resolution status (read-only). |
+| `pr_thread_reply` | Reply to a review discussion thread by threadId or commentId (requires `confirm: true`). |
+| `pr_thread_resolve` | Mark a review discussion thread resolved or unresolved (requires `confirm: true`). |
 
 ### Mirror publication
 
@@ -140,6 +147,8 @@ published because it is part of the package.
 | `gh_run_jobs` | Jobs with their steps, and the steps that failed — usually enough to diagnose a failure. |
 | `gh_run_rerun`, `gh_run_cancel` | Re-run all or only failed jobs; cancel an in-progress run (needs `confirm: true`). |
 | `gh_run_logs` | Returns the logs archive URL: GitHub answers with a redirect to a zip, which is not pulled into the conversation. |
+| `gh_run_dispatch` | Trigger a workflow_dispatch event with inputs (requires `confirm: true`). |
+| `gh_run_log_summary` | Compact failed step log summary with stripped ANSI codes and masked secrets (read-only). |
 
 ### Repository settings
 

package/README.ru.md

@@ -87,6 +87,10 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `gh_release_create` | Создание релиза для тега, при необходимости на конкретном коммите. |
 | `gh_release_edit` | Правка заголовка, заметок, draft/prerelease и **того, какой релиз считается latest**. |
 | `gh_release_delete` | Удаление релиза (нужно `confirm: true`). |
+| `gh_release_asset_list` | Список прикрепленных ассетов релиза с размерами и счетчиками скачиваний (только чтение). |
+| `gh_release_asset_upload` | Загрузка файла (.tgz, бинарника) в релиз (нужно `confirm: true`). |
+| `gh_release_asset_delete` | Удаление ассета по его ID (нужно `confirm: true`). |
+| `gh_release_notes_generate` | Генерация заметок к релизу по PR и коммитам (только чтение). |
 
 `gh_release_edit` с `makeLatest: true` — тот шаг, который держит бейдж репозитория на
 актуальной версии: если после этого создать релиз старой версии, «Latest» уедет назад.
@@ -119,6 +123,9 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `review_post` | Публикация обзора: сводный комментарий или построчные inline-замечания. |
 | `gh_checks` | Check-runs, статусы коммита и единый вердикт. |
 | `ci_run` | Одноразовый обзор PR с вердиктом по правилам. |
+| `pr_review_threads` | Список тредов обсуждений ревью со статусом разрешения (только чтение). |
+| `pr_thread_reply` | Ответ в тред обсуждения по threadId или commentId (нужно `confirm: true`). |
+| `pr_thread_resolve` | Пометка треда ревью разрешенным или повторное открытие (нужно `confirm: true`). |
 
 ### Публикация зеркала
 
@@ -140,6 +147,8 @@ Allowlist — состав `package.json → files` плюс `.gitignore`, `LICE
 | `gh_run_jobs` | Джобы с шагами и отдельно — упавшие шаги; обычно этого достаточно для диагноза. |
 | `gh_run_rerun`, `gh_run_cancel` | Перезапуск всех или только упавших джоб; отмена идущего запуска (нужно `confirm: true`). |
 | `gh_run_logs` | Возвращает адрес архива логов: GitHub отвечает редиректом на zip, который не тянется в разговор. |
+| `gh_run_dispatch` | Запуск workflow_dispatch с пользовательскими параметрами inputs (нужно `confirm: true`). |
+| `gh_run_log_summary` | Компактная выжимка логов упавшего шага с очисткой ANSI и маскированием токенов (только чтение). |
 
 ### Настройки репозитория
 

package/README.zh.md

@@ -84,6 +84,10 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `gh_release_create` | 为 tag 创建 release，可指定 commit。 |
 | `gh_release_edit` | 修改标题、说明、draft/prerelease，以及**哪个 release 是 latest**。 |
 | `gh_release_delete` | 删除 release（需要 `confirm: true`）。 |
+| `gh_release_asset_list` | 列出 release 关联的资源附件（大小与下载量）（只读）。 |
+| `gh_release_asset_upload` | 上传文件附件（.tgz、二进制等）至已有 release（需要 `confirm: true`）。 |
+| `gh_release_asset_delete` | 按资源 ID 删除 release 附件（需要 `confirm: true`）。 |
+| `gh_release_notes_generate` | 根据 PR 与提交自动生成 release notes（只读）。 |
 
 `gh_release_edit` 配合 `makeLatest: true` 是保持仓库徽章指向当前版本的关键一步：之后再创建
 旧版本的 release 会把 “Latest” 移回旧版本。
@@ -115,6 +119,9 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `review_post` | 发布评审：一条汇总评论，或按行内联评论。 |
 | `gh_checks` | 某个提交的 check runs、旧式状态与统一结论。 |
 | `ci_run` | 对 PR 做一次性评审并给出基于规则的结论。 |
+| `pr_review_threads` | 列出代码审查讨论主题及其评论与解决状态（只读）。 |
+| `pr_thread_reply` | 按 threadId 或 commentId 回复审查主题评论（需要 `confirm: true`）。 |
+| `pr_thread_resolve` | 标记代码审查主题为已解决或重新打开（需要 `confirm: true`）。 |
 
 ### 镜像发布
 
@@ -135,6 +142,8 @@ dsh plugin --profile web add @goodandready/dsh-github-ops
 | `gh_run_jobs` | 作业及其步骤，并单独列出失败的步骤——通常足以定位失败原因。 |
 | `gh_run_rerun`、`gh_run_cancel` | 重跑全部或仅失败作业；取消进行中的运行（需要 `confirm: true`）。 |
 | `gh_run_logs` | 返回日志压缩包地址：GitHub 以 302 指向 zip，不会把二进制拉进对话。 |
+| `gh_run_dispatch` | 触发附带输入参数的 workflow_dispatch 工作流（需要 `confirm: true`）。 |
+| `gh_run_log_summary` | 提取失败步骤的精简日志摘要（去除 ANSI 代码并脱敏令牌）（只读）。 |
 
 ### 仓库设置
 

package/lib/auth.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 // Access resolution across the sources a GitHub user actually has.
 //
 // Order (tokenSource: "auto"): the DSH credentials service, then the environment variable of
@@ -69,3 +70,66 @@ export async function resolveAccess({ credentials, tokenEnv, tokenSource = 'auto
   }
   return { value: '', source: '', guidance: NO_ACCESS_GUIDANCE }
 }
+/**
+ * Deterministic non-reversible token fingerprint for client cache keys:
+ * differentiates tokens of identical length without leaking token content into logs or keys.
+ */
+export function tokenFingerprint(value) {
+  if (!value || typeof value !== 'string') return ''
+  return createHash('sha256').update(value).digest('hex').slice(0, 16)
+}
+
+/**
+ * Cache key for shared GitHub client instances.
+ * Incorporates the token fingerprint (not length) so rotation between equal-length tokens
+ * creates a new client and uses the new Bearer immediately.
+ */
+export function clientCacheKey(access, cfg = {}) {
+  return [
+    access?.source || '',
+    tokenFingerprint(access?.value),
+    cfg?.baseUrl || '',
+    cfg?.timeoutMs || '',
+    cfg?.cacheTtlMs || '',
+    cfg?.maxRetries ?? '',
+  ].join('|')
+}
+
+/**
+ * Manages the shared GitHub client instance:
+ * caches the client while the key matches; recreates it when the token or config changes.
+ */
+export function createClientHolder({ createClient, signalProvider } = {}) {
+  let sharedClient = null
+  let sharedKey = ''
+
+  return {
+    get(access, cfg = {}) {
+      if (!access || !access.value) {
+        throw new Error(`GitHub access is not configured: ${access?.guidance || NO_ACCESS_GUIDANCE}`)
+      }
+      const key = clientCacheKey(access, cfg)
+      if (!sharedClient || sharedKey !== key) {
+        if (typeof createClient !== 'function') {
+          throw new Error('createClient factory must be a function')
+        }
+        sharedClient = createClient({
+          token: access.value,
+          baseUrl: cfg.baseUrl || 'https://api.github.com',
+          timeoutMs: Number(cfg.timeoutMs) || 30000,
+          cacheTtlMs: Number.isFinite(Number(cfg.cacheTtlMs)) ? Number(cfg.cacheTtlMs) : 60000,
+          maxRetries: Number.isFinite(Number(cfg.maxRetries)) ? Number(cfg.maxRetries) : 2,
+          signalProvider,
+        })
+        sharedKey = key
+      }
+      return sharedClient
+    },
+    currentKey: () => sharedKey,
+    currentClient: () => sharedClient,
+    reset: () => {
+      sharedClient = null
+      sharedKey = ''
+    },
+  }
+}

package/lib/github.js

@@ -134,15 +134,16 @@ export function createGitHubClient({
     cache.set(key, { value, expiresAt: Date.now() + cacheTtlMs })
   }
 
-  async function attemptOnce({ method, path, query, body, url, accept, redirect, signal }) {
+  async function attemptOnce({ method, path, query, body, url, accept, redirect, signal, headers: extraHeaders, rawText }) {
     const target = url || buildUrl(baseUrl, path, query)
     const headers = {
       accept,
       'x-github-api-version': apiVersion,
       'user-agent': userAgent,
+      ...(extraHeaders || {}),
     }
     if (token) headers.authorization = `Bearer ${token}`
-    if (body !== undefined) headers['content-type'] = 'application/json'
+    if (body !== undefined && !headers['content-type']) headers['content-type'] = 'application/json'
 
     const controller = typeof AbortController === 'function' ? new AbortController() : null
     const timer = controller && timeoutMs > 0
@@ -161,10 +162,17 @@ export function createGitHubClient({
 
     let response
     try {
+      const requestBody = (() => {
+        if (body === undefined || body === null) return undefined
+        if (typeof body === 'string' || (typeof Buffer !== 'undefined' && Buffer.isBuffer(body)) || body instanceof Uint8Array) {
+          return body
+        }
+        return JSON.stringify(body)
+      })()
       response = await fetchImpl(target, {
         method,
         headers,
-        body: body === undefined ? undefined : JSON.stringify(body),
+        body: requestBody,
         signal: combined || undefined,
         ...(redirect ? { redirect } : {}),
       })
@@ -191,16 +199,20 @@ export function createGitHubClient({
     const text = typeof response.text === 'function' ? await response.text() : ''
     let payload = null
     if (text) {
-      try {
-        payload = JSON.parse(text)
-      } catch {
-        payload = { raw: text.slice(0, 2000) }
+      if (rawText) {
+        payload = text
+      } else {
+        try {
+          payload = JSON.parse(text)
+        } catch {
+          payload = { raw: text.slice(0, 2000) }
+        }
       }
     }
     return { response, payload, rateLimit }
   }
 
-  async function call({ method = 'GET', path, query, body, url, accept = 'application/vnd.github+json', redirect, signal }) {
+  async function call({ method = 'GET', path, query, body, url, accept = 'application/vnd.github+json', redirect, signal, headers, rawText }) {
     // The signal may come from the caller's turn: the shared client asks the provider, so a
     // cancelled turn aborts the request in flight instead of waiting for the timeout.
     const turnSignal = signal || (typeof signalProvider === 'function' ? signalProvider() : undefined)
@@ -218,7 +230,7 @@ export function createGitHubClient({
     for (let attempt = 1; attempt <= attemptsAllowed; attempt += 1) {
       let result
       try {
-        result = await attemptOnce({ method: upper, path, query, body, url, accept, redirect, signal: turnSignal })
+        result = await attemptOnce({ method: upper, path, query, body, url, accept, redirect, signal: turnSignal, headers, rawText })
       } catch (err) {
         lastError = err
         if (!retryable || attempt >= attemptsAllowed) {
@@ -302,6 +314,9 @@ export function createGitHubClient({
      * Resolve an endpoint that answers with a redirect instead of JSON (the workflow
      * logs archive is a 302 to a zip). Nothing is downloaded: the caller gets the URL.
      */
+    baseUrl,
+    call,
+    getRaw: (path, opts = {}) => call({ ...opts, method: 'GET', path, rawText: true }).then((r) => r.data),
     async getRedirect(path, { query } = {}) {
       const target = buildUrl(baseUrl, path, query)
       const headers = {

package/lib/index.js

@@ -15,7 +15,7 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import { credentialRef } from '@deepseek-ai/dsh-credentials'
 
 import { createGitHubClient, parseRepoSpec, describeError, GitHubError } from './github.js'
-import { resolveAccess, NO_ACCESS_GUIDANCE } from './auth.js'
+import { resolveAccess, NO_ACCESS_GUIDANCE, createClientHolder } from './auth.js'
 import { resolveRepoContext } from './repo-context.js'
 import { presentationFor } from './present.js'
 import { createRecords, startReviewJob } from './jobs.js'
@@ -233,39 +233,20 @@ export function apply(ctx, rawConfig) {
   }
 
   // One client per configuration: the read cache lives in it, and the signal for the
-  // current tool call arrives through the async context.
-  let sharedClient = null
-  let sharedKey = ''
+  // current tool call arrives through the async context. Token rotation immediately recreates
+  // the client even when the new token has the exact same length.
+  const clientHolder = createClientHolder({
+    createClient: createGitHubClient,
+    signalProvider: () => {
+      const store = callContext.getStore()
+      return store && store.signal ? store.signal : undefined
+    },
+  })
 
   async function client() {
     const cfg = liveConfig()
     const access = await resolveToken()
-    if (!access.value) {
-      throw new Error(`GitHub access is not configured: ${access.guidance || NO_ACCESS_GUIDANCE}`)
-    }
-    const key = [
-      access.source,
-      access.value.length,
-      cfg.baseUrl || '',
-      cfg.timeoutMs || '',
-      cfg.cacheTtlMs || '',
-      cfg.maxRetries ?? '',
-    ].join('|')
-    if (!sharedClient || sharedKey !== key) {
-      sharedClient = createGitHubClient({
-        token: access.value,
-        baseUrl: cfg.baseUrl || 'https://api.github.com',
-        timeoutMs: Number(cfg.timeoutMs) || 30000,
-        cacheTtlMs: Number.isFinite(Number(cfg.cacheTtlMs)) ? Number(cfg.cacheTtlMs) : 60000,
-        maxRetries: Number.isFinite(Number(cfg.maxRetries)) ? Number(cfg.maxRetries) : 2,
-        signalProvider: () => {
-          const store = callContext.getStore()
-          return store && store.signal ? store.signal : undefined
-        },
-      })
-      sharedKey = key
-    }
-    return sharedClient
+    return clientHolder.get(access, cfg)
   }
 
   /**
@@ -304,7 +285,7 @@ export function apply(ctx, rawConfig) {
   const skippedTools = []
   /** Every registered tool, so gh_help never drifts from reality. */
   const catalog = []
-  const WRITE_PREFIXES = ['pr_', 'issue_', 'review_post', 'gh_api', 'gh_run_rerun', 'gh_run_cancel', 'gh_mirror_publish', 'gh_release_', 'gh_tag_', 'gh_repo_create', 'gh_repo_edit', 'gh_secret_', 'gh_variable_', 'gh_ruleset_', 'gh_branch_protection_set', 'gh_branch_protection_delete', 'gh_push_']
+  const WRITE_PREFIXES = ['pr_', 'issue_', 'review_post', 'gh_api', 'gh_run_rerun', 'gh_run_cancel', 'gh_run_dispatch', 'gh_mirror_publish', 'gh_release_', 'gh_tag_', 'gh_repo_create', 'gh_repo_edit', 'gh_secret_', 'gh_variable_', 'gh_ruleset_', 'gh_branch_protection_set', 'gh_branch_protection_delete', 'gh_push_']
 
   function tool(toolName, description, parameters, run) {
     const definition = defineTool({

package/lib/tools/actions.js

@@ -105,3 +105,81 @@ export async function getRunLogsUrl(client, { owner, repo, runId }) {
       : `GitHub answered HTTP ${status} without a download location — the logs may have expired.`,
   }
 }
+
+export async function dispatchWorkflow(client, { owner, repo, workflow, ref, inputs }) {
+  ensureRepo({ owner, repo })
+  if (!workflow) throw new Error('workflow is required (file name like "release.yml" or numeric id)')
+  if (!ref) throw new Error('ref is required (branch or tag name like "main")')
+  const payload = { ref: String(ref) }
+  if (inputs && typeof inputs === 'object') {
+    const formatted = {}
+    for (const [k, v] of Object.entries(inputs)) {
+      if (v !== undefined && v !== null) {
+        formatted[k] = typeof v === 'string' ? v : String(v)
+      }
+    }
+    payload.inputs = formatted
+  }
+  const route = `/repos/${owner}/${repo}/actions/workflows/${encodeURIComponent(workflow)}/dispatches`
+  await client.post(route, payload)
+  return {
+    dispatched: true,
+    workflow: String(workflow),
+    ref: String(ref),
+    inputs: payload.inputs || {},
+  }
+}
+
+export function cleanLogContent(rawText, maxLines = 100) {
+  if (!rawText || typeof rawText !== 'string') return []
+  const stripped = rawText.replace(/\u001b\[[0-9;]*[a-zA-Z]/g, '').replace(/\r/g, '')
+  const lines = stripped.split('\n')
+  const masked = lines.map((line) => {
+    return line
+      .replace(/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}/g, '[REDACTED_TOKEN]')
+      .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED_TOKEN]')
+  })
+  const cap = Math.max(1, Math.min(Number(maxLines) || 100, 250))
+  return masked.slice(-cap)
+}
+
+export async function getJobLogSummary(client, { owner, repo, runId, jobId, maxLines = 100 }) {
+  ensureRepo({ owner, repo })
+  let targetJobId = jobId
+  let targetJobName = ''
+  let failedStep = null
+
+  if (!targetJobId) {
+    if (!runId) throw new Error('either runId or jobId is required')
+    const { jobs } = await listRunJobs(client, { owner, repo, runId })
+    const failedJob = jobs.find((j) => j.conclusion === 'failure') || jobs[0]
+    if (!failedJob) {
+      return { note: `No jobs found for run ${runId}`, lines: [] }
+    }
+    targetJobId = failedJob.id
+    targetJobName = failedJob.name
+    failedStep = (failedJob.failedSteps && failedJob.failedSteps[0]) || null
+  }
+
+  let logText = ''
+  try {
+    const res = await client.getRaw(`/repos/${owner}/${repo}/actions/jobs/${targetJobId}/logs`)
+    logText = typeof res === 'string' ? res : (res && res.data ? res.data : String(res || ''))
+  } catch (err) {
+    return {
+      jobId: targetJobId,
+      jobName: targetJobName,
+      error: `Could not retrieve logs: ${err && err.message}`,
+      lines: [],
+    }
+  }
+
+  const lines = cleanLogContent(logText, maxLines)
+  return {
+    jobId: targetJobId,
+    jobName: targetJobName,
+    failedStep,
+    lineCount: lines.length,
+    lines,
+  }
+}

package/lib/tools/pulls.js

@@ -205,3 +205,132 @@ export async function ciRun(client, { owner, repo, number, maxDiffChars, rules }
     ].filter(Boolean).join('\n'),
   }
 }
+
+export async function listReviewThreads(client, { owner, repo, number, unresolvedOnly = false }) {
+  ensureRepo({ owner, repo })
+  if (!number) throw new Error('number is required')
+  const query = `query($owner: String!, $repo: String!, $number: Int!) {
+    repository(owner: $owner, name: $repo) {
+      pullRequest(number: $number) {
+        reviewThreads(first: 50) {
+          nodes {
+            id
+            isResolved
+            isOutdated
+            path
+            line
+            diffSide
+            resolvedBy { login }
+            comments(first: 20) {
+              nodes {
+                id
+                databaseId
+                body
+                author { login }
+                createdAt
+                url
+              }
+            }
+          }
+        }
+      }
+    }
+  }`
+  const data = await client.graphql(query, { owner, repo, number: Number(number) })
+  const pull = data && data.repository && data.repository.pullRequest
+  if (!pull) throw new Error(`pull request #${number} not found in ${owner}/${repo}`)
+  const rawNodes = (pull.reviewThreads && pull.reviewThreads.nodes) || []
+  let threads = rawNodes.map((t) => ({
+    id: t.id,
+    isResolved: Boolean(t.isResolved),
+    isOutdated: Boolean(t.isOutdated),
+    path: t.path || '',
+    line: t.line || null,
+    diffSide: t.diffSide || 'RIGHT',
+    resolvedBy: t.resolvedBy && t.resolvedBy.login ? t.resolvedBy.login : null,
+    comments: ((t.comments && t.comments.nodes) || []).map((c) => ({
+      id: c.id,
+      databaseId: c.databaseId,
+      author: (c.author && c.author.login) || 'unknown',
+      body: c.body || '',
+      createdAt: c.createdAt,
+      url: c.url || '',
+    })),
+  }))
+  if (unresolvedOnly) {
+    threads = threads.filter((t) => !t.isResolved)
+  }
+  return { threads, count: threads.length, number: Number(number) }
+}
+
+export async function replyReviewThread(client, { owner, repo, number, threadId, commentId, body }) {
+  ensureRepo({ owner, repo })
+  if (!body || typeof body !== 'string' || !body.trim()) {
+    throw new Error('body is required')
+  }
+  if (!threadId && !commentId) {
+    throw new Error('either threadId or commentId is required to reply to a review thread')
+  }
+
+  if (threadId) {
+    const mutation = `mutation($threadId: ID!, $body: String!) {
+      addPullRequestReviewThreadReply(input: { pullRequestReviewThreadId: $threadId, body: $body }) {
+        comment {
+          id
+          databaseId
+          body
+          createdAt
+        }
+      }
+    }`
+    const data = await client.graphql(mutation, { threadId, body })
+    const comment = data?.addPullRequestReviewThreadReply?.comment
+    return {
+      replied: true,
+      threadId,
+      commentId: comment?.databaseId || null,
+      body,
+      createdAt: comment?.createdAt || null,
+    }
+  }
+
+  if (!number) throw new Error('pull number is required when replying via commentId')
+  const { data } = await client.post(`/repos/${owner}/${repo}/pulls/${number}/comments`, {
+    body,
+    in_reply_to: Number(commentId),
+  })
+  return {
+    replied: true,
+    number: Number(number),
+    commentId: data?.id || Number(commentId),
+    body,
+    createdAt: data?.created_at || null,
+  }
+}
+
+export async function resolveReviewThread(client, { owner, repo, threadId, resolve = true }) {
+  ensureRepo({ owner, repo })
+  if (!threadId) throw new Error('threadId is required (GraphQL ID of the review thread)')
+  const shouldResolve = resolve !== false
+  const mutation = shouldResolve
+    ? `mutation($threadId: ID!) {
+        resolveReviewThread(input: { threadId: $threadId }) {
+          thread { id isResolved }
+        }
+      }`
+    : `mutation($threadId: ID!) {
+        unresolveReviewThread(input: { threadId: $threadId }) {
+          thread { id isResolved }
+        }
+      }`
+
+  const data = await client.graphql(mutation, { threadId })
+  const thread = shouldResolve
+    ? data?.resolveReviewThread?.thread
+    : data?.unresolveReviewThread?.thread
+
+  return {
+    threadId,
+    isResolved: thread ? Boolean(thread.isResolved) : shouldResolve,
+  }
+}

package/lib/tools/register-collab.js

@@ -19,6 +19,9 @@ import {
   postReview,
   getChecks,
   ciRun,
+  listReviewThreads,
+  replyReviewThread,
+  resolveReviewThread,
 } from './pulls.js'
 
 const REPOSITORY = {
@@ -230,4 +233,63 @@ export function registerCollabTools({ tool, asRepo, client, liveConfig, reviewRu
       return ciRun(await client(), { owner, repo, number: args.number, maxDiffChars: args.maxDiffChars, rules: rules() })
     },
   )
+
+  tool(
+    'pr_review_threads',
+    'List review discussion threads of a pull request with their comments and resolved status. Read-only.',
+    repoParams({
+      number: { type: 'number', description: 'Pull request number.' },
+      unresolvedOnly: { type: 'boolean', description: 'If true, returns only unresolved threads (default false).' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return listReviewThreads(await client(), {
+        owner, repo,
+        number: args.number || args.pullNumber,
+        unresolvedOnly: Boolean(args.unresolvedOnly),
+      })
+    },
+  )
+
+  tool(
+    'pr_thread_reply',
+    'Reply to a review discussion thread in a pull request (by threadId or commentId). Requires confirm: true.',
+    repoParams({
+      number: { type: 'number', description: 'Pull request number (required when replying by commentId).' },
+      threadId: { type: 'string', description: 'GraphQL ID of the review thread (from pr_review_threads).' },
+      commentId: { type: 'number', description: 'Database ID of the comment being replied to.' },
+      body: { type: 'string', description: 'Reply comment body.' },
+      confirm: { type: 'boolean', description: 'Must be true to post reply.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('replying to a review thread requires confirm: true')
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return replyReviewThread(await client(), {
+        owner, repo,
+        number: args.number || args.pullNumber,
+        threadId: args.threadId,
+        commentId: args.commentId,
+        body: args.body,
+      })
+    },
+  )
+
+  tool(
+    'pr_thread_resolve',
+    'Resolve or unresolve a review discussion thread in a pull request. Requires confirm: true.',
+    repoParams({
+      threadId: { type: 'string', description: 'GraphQL ID of the review thread (from pr_review_threads).' },
+      resolve: { type: 'boolean', description: 'true to resolve (default), false to unresolve.' },
+      confirm: { type: 'boolean', description: 'Must be true to resolve thread.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('resolving a review thread requires confirm: true')
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return resolveReviewThread(await client(), {
+        owner, repo,
+        threadId: args.threadId,
+        resolve: args.resolve !== false,
+      })
+    },
+  )
 }

package/lib/tools/register-core.js

@@ -4,7 +4,7 @@
 // Everything here takes its dependencies as arguments, so the host half stays thin
 // and the definitions are reusable in tests.
 
-import { listReleases, getRelease, createRelease, editRelease, deleteRelease } from './releases.js'
+import { listReleases, getRelease, createRelease, editRelease, deleteRelease, listReleaseAssets, uploadReleaseAsset, deleteReleaseAsset, generateReleaseNotes } from './releases.js'
 import { listTags, createTag, deleteTag } from './tags.js'
 import { callApi } from './api.js'
 import { getRepo, getFile, searchRepos, createRepo, editRepo } from './repos.js'
@@ -185,6 +185,82 @@ export function registerCoreTools({ tool, asRepo, client, liveConfig }) {
     },
   )
 
+  tool(
+    'gh_release_asset_list',
+    'List uploaded assets of a GitHub release (by tag or releaseId). Read-only.',
+    repoParams({
+      tag: { type: 'string', description: 'Release tag.' },
+      releaseId: { type: 'number', description: 'Release ID.' },
+      limit: { type: 'number', description: 'Max assets to return (default 50).' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return listReleaseAssets(await client(), { owner, repo, tag: args.tag, releaseId: args.releaseId, limit: args.limit })
+    },
+  )
+
+  tool(
+    'gh_release_asset_upload',
+    'Upload a file asset to an existing GitHub release (by tag or releaseId). Requires confirm: true.',
+    repoParams({
+      tag: { type: 'string', description: 'Release tag.' },
+      releaseId: { type: 'number', description: 'Release ID.' },
+      filePath: { type: 'string', description: 'Local path to the file to upload.' },
+      name: { type: 'string', description: 'File name as it will appear in the release (defaults to file basename).' },
+      label: { type: 'string', description: 'Optional user-facing label description for the asset.' },
+      contentType: { type: 'string', description: 'MIME type of the asset (defaults to application/octet-stream).' },
+      confirm: { type: 'boolean', description: 'Must be true to upload.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('uploading a release asset requires confirm: true')
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return uploadReleaseAsset(await client(), {
+        owner, repo,
+        tag: args.tag,
+        releaseId: args.releaseId,
+        filePath: args.filePath,
+        name: args.name,
+        label: args.label,
+        contentType: args.contentType,
+      })
+    },
+  )
+
+  tool(
+    'gh_release_asset_delete',
+    'Delete an asset from a release by assetId. Requires confirm: true.',
+    repoParams({
+      assetId: { type: 'number', description: 'ID of the asset to delete.' },
+      confirm: { type: 'boolean', description: 'Must be true to actually delete.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('deleting a release asset requires confirm: true')
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return deleteReleaseAsset(await client(), { owner, repo, assetId: args.assetId })
+    },
+  )
+
+  tool(
+    'gh_release_notes_generate',
+    'Generate release notes for a release tag from merged pull requests and commits. Read-only.',
+    repoParams({
+      tag: { type: 'string', description: 'Tag name for the release (e.g. "v1.2.0").' },
+      target: { type: 'string', description: 'Target branch or commit if tag does not exist yet.' },
+      previousTag: { type: 'string', description: 'Previous tag to compare against.' },
+      configFile: { type: 'string', description: 'Path to configuration file in repo (e.g. ".github/release.yml").' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return generateReleaseNotes(await client(), {
+        owner, repo,
+        tag: args.tag || args.tagName,
+        target: args.target || args.targetCommitish,
+        previousTag: args.previousTag || args.previousTagName,
+        configFile: args.configFile || args.configurationFilePath,
+      })
+    },
+  )
+
   // ------------------------------------------------------------------------ tags
 
   tool(

package/lib/tools/register-ops.js

@@ -10,6 +10,8 @@ import {
   rerunRun,
   cancelRun,
   getRunLogsUrl,
+  dispatchWorkflow,
+  getJobLogSummary,
 } from './actions.js'
 import {
   listVariables,
@@ -100,6 +102,36 @@ export function registerOpsTools({ tool, asRepo, client, liveConfig }) {
     async (args) => withRepo(args, async ({ owner, repo }) => getRunLogsUrl(await client(), { owner, repo, runId: args.runId })),
   )
 
+  tool(
+    'gh_run_dispatch',
+    'Trigger a workflow_dispatch event for a GitHub Actions workflow with inputs. Requires confirm: true.',
+    repoParams({
+      workflow: { type: 'string', description: 'Workflow file name (e.g. "ci.yml") or numeric ID.' },
+      ref: { type: 'string', description: 'Branch or tag ref (e.g. "main").' },
+      inputs: { type: 'object', additionalProperties: true, description: 'Input values configured in the workflow.' },
+      confirm: { type: 'boolean', description: 'Must be true to dispatch.' },
+    }),
+    async (args) => {
+      if (args.confirm !== true) throw new Error('dispatching a workflow run requires confirm: true')
+      return withRepo(args, async ({ owner, repo }) => dispatchWorkflow(await client(), {
+        owner, repo, workflow: args.workflow, ref: args.ref, inputs: args.inputs,
+      }))
+    },
+  )
+
+  tool(
+    'gh_run_log_summary',
+    'Get a compact summary of failed step logs for a run or job (cleans ANSI codes, strips tokens, returns last lines). Read-only.',
+    repoParams({
+      runId: { type: 'number', description: 'Run ID (if jobId omitted, inspects failed jobs in the run).' },
+      jobId: { type: 'number', description: 'Direct Job ID.' },
+      maxLines: { type: 'number', description: 'Maximum log lines to return (default 100, max 250).' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => getJobLogSummary(await client(), {
+      owner, repo, runId: args.runId, jobId: args.jobId, maxLines: args.maxLines,
+    })),
+  )
+
   // ---------------------------------------------------------------- variables
 
   tool(

package/lib/tools/releases.js

@@ -111,3 +111,90 @@ export async function deleteRelease(client, { owner, repo, tag, releaseId }) {
   await client.del(`/repos/${owner}/${repo}/releases/${id}`)
   return { deleted: true, id, tag: tag || '' }
 }
+
+export function normalizeAsset(data) {
+  if (!data || typeof data !== 'object') return data
+  return {
+    id: data.id,
+    name: data.name,
+    label: data.label || '',
+    state: data.state || 'uploaded',
+    size: Number(data.size) || 0,
+    downloads: Number(data.download_count) || 0,
+    createdAt: data.created_at,
+    updatedAt: data.updated_at,
+    browserDownloadUrl: data.browser_download_url || data.url || '',
+    contentType: data.content_type || 'application/octet-stream',
+  }
+}
+
+export async function listReleaseAssets(client, { owner, repo, tag, releaseId, limit = 50 } = {}) {
+  ensureRepo({ owner, repo })
+  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+  const capped = Math.max(1, Math.min(Number(limit) || 50, 100))
+  const { data, rateLimit } = await client.get(`/repos/${owner}/${repo}/releases/${id}/assets`, {
+    query: { per_page: capped },
+  })
+  const assets = (Array.isArray(data) ? data.map(normalizeAsset) : []).slice(0, capped)
+  return { assets, count: assets.length, releaseId: id, rateLimit }
+}
+
+export async function uploadReleaseAsset(client, { owner, repo, tag, releaseId, filePath, name, label, contentType }) {
+  ensureRepo({ owner, repo })
+  if (!filePath) throw new Error('filePath is required')
+  const id = await resolveReleaseId(client, { owner, repo, tag, releaseId })
+
+  const fs = await import('node:fs/promises')
+  const path = await import('node:path')
+
+  let stats
+  try {
+    stats = await fs.stat(filePath)
+  } catch (err) {
+    throw new Error(`cannot access file "${filePath}": ${err && err.message}`)
+  }
+  if (!stats.isFile()) throw new Error(`"${filePath}" is not a file`)
+
+  const fileBuffer = await fs.readFile(filePath)
+  const assetName = name || path.basename(filePath)
+  const mimeType = contentType || 'application/octet-stream'
+
+  const baseUrl = client.baseUrl || 'https://api.github.com'
+  const uploadsBase = baseUrl.includes('api.github.com') ? 'https://uploads.github.com' : baseUrl
+  const targetUrl = `${uploadsBase}/repos/${owner}/${repo}/releases/${id}/assets`
+
+  const { data } = await client.call({
+    method: 'POST',
+    url: targetUrl,
+    query: { name: assetName, ...(label ? { label } : {}) },
+    body: fileBuffer,
+    headers: {
+      'content-type': mimeType,
+      'content-length': String(fileBuffer.length),
+    },
+  })
+  return normalizeAsset(data)
+}
+
+export async function deleteReleaseAsset(client, { owner, repo, assetId }) {
+  ensureRepo({ owner, repo })
+  if (!assetId) throw new Error('assetId is required')
+  await client.del(`/repos/${owner}/${repo}/releases/assets/${assetId}`)
+  return { deleted: true, assetId: Number(assetId) }
+}
+
+export async function generateReleaseNotes(client, { owner, repo, tag, target, previousTag, configFile }) {
+  ensureRepo({ owner, repo })
+  if (!tag) throw new Error('tag is required')
+  const payload = { tag_name: tag }
+  if (target) payload.target_commitish = target
+  if (previousTag) payload.previous_tag_name = previousTag
+  if (configFile) payload.configuration_file_path = configFile
+  const { data } = await client.post(`/repos/${owner}/${repo}/releases/generate-notes`, payload)
+  return {
+    name: data && data.name ? data.name : tag,
+    body: typeof data?.body === 'string' ? data.body : '',
+    tag,
+    previousTag: previousTag || '',
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",