@goodandready/dsh-github-ops 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.10
+
+### Fixed
+- **Settings Surface & Volatile Fields on DSH 0.2** (#76, #85): Config fields declare `.volatile()` wrappers and live settings reads are unwrapped via `plainConfig()` to comply with the DSH 0.2 live-value contract and prevent settings from being marked unavailable.
+- **Dead settingsScope.replace Removed** (#100, #86): Removed unused dead `settingsScope.replace` method that swallowed errors.
+- **Client Fetch AbortSignal Timeout** (#101): Attached 15s/120s `AbortSignal` timeouts to all `fetch` calls in `lib/client.js` to prevent the UI from hanging indefinitely on stalled requests.
+- **Git Runner Timeout** (#90): SCM route passes `timeoutMs` (120000ms) to `execFileAsync` git runner options, properly enforcing timeouts on write operations.
+- **Presenter Interpolation Format** (#94): Fixed entity number interpolation in `issue_comment` (`#${number}`) and `pr_merge` (`Merged pull request #${number}`) cards.
+- **GraphQL Thread Mutation Validation** (#88): `resolveReviewThread` validates return thread existence and throws on empty/null responses instead of reporting false success.
+- **Merged PRs Filter** (#89): `mergedPulls` in insights now verifies `mergedAt` presence instead of counting closed-unmerged pull requests.
+- **Auth Device Secret Await** (#84): Fixed missing `await auth.secret()` in `register-write.js` that was passing a Promise instance as OAuth `client_secret`.
+
+## 0.2.9
+
+### Fixed
+- **Audit Findings & Stability**: Pre-release audit bundle addressing review thread mutations, auth credentials and input validation.
+
+
 ## 0.2.8
 
 ### Fixed

package/lib/client.js

@@ -20,6 +20,13 @@ window.__ModuleLoader__.load({
     const SCM_PATH = '/dsh-github-ops/scm'
     const PANEL_PATH = '/dsh-github-ops/panel'
 
+    const fetchWithTimeout = (url, options = {}, timeoutMs = 15000) => {
+      const signal = (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function')
+        ? AbortSignal.timeout(timeoutMs)
+        : undefined
+      return fetch(url, signal ? { signal, ...options } : options)
+    }
+
     // The repository a github.com link in the conversation pointed at, so the tab and the
     // panel can follow the human instead of asking again.
     const linkState = { repo: '', enabled: false }
@@ -283,7 +290,7 @@ window.__ModuleLoader__.load({
           setState({ phase: 'error', message: 'fetch is unavailable in this client' })
           return
         }
-        fetch(cwdQuery ? `${SCM_PATH}?${cwdQuery}` : SCM_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(cwdQuery ? `${SCM_PATH}?${cwdQuery}` : SCM_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setState({ phase: 'ready', payload }))
           .catch((err) => setState({ phase: 'error', message: String((err && err.message) || err) }))
@@ -296,11 +303,11 @@ window.__ModuleLoader__.load({
         if (typeof fetch !== 'function') return
         setBusy(action)
         setActionError('')
-        fetch(SCM_PATH, {
+        fetchWithTimeout(SCM_PATH, {
           method: 'POST',
           headers: { 'content-type': 'application/json', accept: 'application/json' },
           body: JSON.stringify(repoPath ? { action, args: args || {}, cwd: repoPath } : { action, args: args || {} }),
-        })
+        }, 120000)
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => {
             setBusy('')
@@ -322,7 +329,7 @@ window.__ModuleLoader__.load({
         setSelected({ path: file.path, staged })
         setDiff({ phase: 'loading', text: '' })
         const query = `?file=${encodeURIComponent(file.path)}${staged ? '&staged=1' : ''}`
-        fetch(SCM_PATH + query, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(SCM_PATH + query, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setDiff({ phase: 'ready', text: payload.diff || '' }))
           .catch((err) => setDiff({ phase: 'error', text: String((err && err.message) || err) }))
@@ -518,7 +525,7 @@ window.__ModuleLoader__.load({
 
       const load = React.useCallback(() => {
         if (typeof fetch !== 'function') return
-        fetch(SCM_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(SCM_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setState({ phase: 'ready', payload }))
           .catch(() => setState({ phase: 'idle' }))
@@ -602,7 +609,7 @@ window.__ModuleLoader__.load({
       const call = React.useCallback((params) => {
         if (typeof fetch !== 'function') return Promise.reject(new Error('fetch is unavailable in this client'))
         const query = new URLSearchParams(params).toString()
-        return fetch(`${PANEL_PATH}?${query}`, { headers: { accept: 'application/json' } })
+        return fetchWithTimeout(`${PANEL_PATH}?${query}`, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
       }, [])
 
@@ -841,7 +848,7 @@ window.__ModuleLoader__.load({
           setStatusError('fetch is unavailable in this client')
           return
         }
-        fetch(STATUS_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(STATUS_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setAccessStatus(payload))
           .catch((err) => { setAccessStatus(null); setStatusError(String((err && err.message) || err)) })

package/lib/index.js

@@ -44,11 +44,12 @@ const callContext = new AsyncLocalStorage()
 
 /** git runner: never throws, always answers with a code and both streams. */
 function makeGitRunner() {
-  return async (args, { cwd, env } = {}) => {
+  return async (args, { cwd, env, timeoutMs, timeout } = {}) => {
     try {
       const { stdout, stderr } = await execFileAsync('git', args, {
         cwd: cwd || process.cwd(),
         env: { ...process.env, ...(env || {}) },
+        timeout: typeof timeoutMs === 'number' ? timeoutMs : (typeof timeout === 'number' ? timeout : undefined),
         maxBuffer: 8 * 1024 * 1024,
       })
       return { code: 0, stdout, stderr }
@@ -126,48 +127,66 @@ export function renderToolResult(toolName, value) {
   return [{ type: 'text', text }]
 }
 
+// Unwrap Volatile boxes before any caller reads a value. A volatile field holds a box
+// rather than its value, and the Loader mutates those boxes in place.
+export function plainConfig(value) {
+  if (value === null || typeof value !== 'object') return value
+  if (Array.isArray(value)) return value.map(plainConfig)
+  if (typeof value.get === 'function') return plainConfig(value.get())
+  return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, plainConfig(v)]))
+}
+
 export const Config = Schema.object({
-  tokenEnv: Schema.string().role('credential-ref').default('GITHUB_TOKEN')
+  tokenEnv: Schema.string().volatile().role('credential-ref').default('GITHUB_TOKEN')
     .description('Name used to look up access: the DSH credential, then the environment variable, then the gh CLI. The value itself is never stored in settings.'),
-  tokenSource: Schema.string().default('auto')
+  tokenSource: Schema.string().volatile().default('auto')
     .description('Where access comes from: "auto" tries the DSH credential, then the environment variable, then the gh CLI; pin it to "credentials", "env" or "gh" to use one source only.'),
-  defaultRepository: Schema.string().default('')
+  defaultRepository: Schema.string().volatile().default('')
     .description('Default repository as "owner/repo"; used when a tool call omits the repository.'),
-  baseUrl: Schema.string().default('https://api.github.com')
+  baseUrl: Schema.string().volatile().default('https://api.github.com')
     .description('GitHub API base URL; change it for GitHub Enterprise.'),
-  timeoutMs: Schema.number().default(30000)
+  timeoutMs: Schema.number().volatile().default(30000)
     .description('Per-request timeout in milliseconds.'),
-  maxRetries: Schema.number().default(2)
+  maxRetries: Schema.number().volatile().default(2)
     .description('Retries for a read (GET/HEAD) on a network failure, a timeout or a 5xx. Writes are never retried automatically.'),
-  reviewRulesJson: Schema.string().default('')
+  reviewRulesJson: Schema.string().volatile().default('')
     .description('Optional review-rule overrides as JSON: sensitivePaths, sensitiveSeverity, attentionPaths, migrationPaths, testsRequired, sourcePatterns, testPatterns, largeDiffLines.'),
-  oauthClientId: Schema.string().default(DEFAULT_CLIENT_ID)
+  oauthClientId: Schema.string().volatile().default(DEFAULT_CLIENT_ID)
     .description('OAuth application id used by gh_auth_login. The default is the public GitHub CLI application.'),
-  oauthScope: Schema.string().default(DEFAULT_SCOPE)
+  oauthScope: Schema.string().volatile().default(DEFAULT_SCOPE)
     .description('OAuth scope requested by gh_auth_login.'),
-  oauthClientSecretRef: Schema.string().role('credential-ref').default('')
+  oauthClientSecretRef: Schema.string().volatile().role('credential-ref').default('')
     .description('Optional credential holding the OAuth client secret, for apps that require one.'),
-  accessFile: Schema.string().default('')
+  accessFile: Schema.string().volatile().default('')
     .description('Where gh_auth_login stores its sign-in (default: $DSH_HOME/github-ops-auth.json, mode 0600).'),
-  interceptLinks: Schema.boolean().default(false)
+  interceptLinks: Schema.boolean().volatile().default(false)
     .description('Let a github.com link clicked in the conversation also select that repository for the Source control tab and the sidebar panel. Off by default: the link always opens in the browser either way.'),
-  guidance: Schema.boolean().default(true)
+  guidance: Schema.boolean().volatile().default(true)
     .description('Add a short paragraph about this plugin to the system prompt: which tool for which question, when the repository argument can be omitted, and that approvals belong to the host.'),
-  guidanceText: Schema.string().default('')
+  guidanceText: Schema.string().volatile().default('')
     .description('Replace the default guidance paragraph with your own text.'),
-  cacheTtlMs: Schema.number().default(60000)
+  cacheTtlMs: Schema.number().volatile().default(60000)
     .description('How long a read stays cached, in milliseconds. A composed report then costs one request set instead of many; writes always go to the network.'),
-  reviewJobTimeoutMs: Schema.number().default(120000)
+  reviewJobTimeoutMs: Schema.number().volatile().default(120000)
     .description('How long a background review job may run before it is cancelled.'),
 })
 
 export function apply(ctx, rawConfig) {
-  const config = { ...Config(), ...(rawConfig || {}) }
+  const config = plainConfig({ ...Config(), ...(rawConfig || {}) })
   let settingsScope = null
 
   ctx.inject(['settings'], (sctx) => {
     try {
-      settingsScope = sctx.settings.register(name, Config, { base: config })
+      settingsScope = {
+        get: () => {
+          try {
+            const row = sctx.settings?.describe?.().find((r) => r && (r.ns === name || r.ns === '@goodandready/dsh-github-ops'))
+            return plainConfig(row?.value ?? config ?? {})
+          } catch {
+            return plainConfig(config ?? {})
+          }
+        },
+      }
     } catch (err) {
       ctx.logger?.warn?.('[dsh-github-ops] settings namespace unavailable:', err && err.message)
     }
@@ -189,9 +208,9 @@ export function apply(ctx, rawConfig) {
   function liveConfig() {
     try {
       const fromScope = settingsScope && settingsScope.get && settingsScope.get()
-      return { ...config, ...(fromScope || {}) }
+      return plainConfig({ ...config, ...(fromScope || {}) })
     } catch {
-      return config
+      return plainConfig(config)
     }
   }
 

package/lib/present.js

@@ -102,7 +102,7 @@ const PRESENTATIONS = {
   },
   issue_comment: {
     call: (args) => pending(`Comment on #${args.number}`, pick(args, ['repository', 'number'])),
-    result: (_args, r) => failure('Comment not posted', r) || text(`Commented on #${r.data.id ? '' : ''}`, `comment id ${r.data.id}`),
+    result: (_args, r) => failure('Comment not posted', r) || text(`Commented on #${_args?.number || (r.data && r.data.id) || ''}`, `comment id ${r.data.id}`),
   },
   issue_close: {
     call: (args) => pending(`Close #${args.number}`, pick(args, ['repository', 'number', 'stateReason'])),
@@ -126,7 +126,7 @@ const PRESENTATIONS = {
   pr_merge: {
     call: (args) => pending(`Merge pull request #${args.number}`, pick(args, ['repository', 'number', 'method', 'deleteBranch'])),
     result: (_args, r) => failure('Pull request not merged', r)
-      || text(r.data.merged ? `Merged #${'pull request'}` : 'Merge not performed', `${r.data.message || ''}${r.data.sha ? `\n${String(r.data.sha).slice(0, 7)}` : ''}${r.data.branchDeleted ? `\nhead branch ${r.data.branchDeleted} deleted` : ''}`),
+      || text(r.data.merged ? `Merged pull request #${_args?.number || (r.data && r.data.number) || ''}` : 'Merge not performed', `${r.data.message || ''}${r.data.sha ? `\n${String(r.data.sha).slice(0, 7)}` : ''}${r.data.branchDeleted ? `\nhead branch ${r.data.branchDeleted} deleted` : ''}`),
   },
   gh_review: {
     call: (args) => pending(`Review pull request #${args.number}`, pick(args, ['repository', 'number', 'maxDiffChars'])),

package/lib/tools/insights.js

@@ -102,7 +102,7 @@ export async function weeklyDigest(client, { owner, repo, days = 7, limit = 10 }
     since,
     releases: releases.releases.filter((r) => after(r.publishedAt || r.createdAt)),
     newIssues: issues.issues.filter((i) => after(i.createdAt)),
-    mergedPulls: pulls.issues.filter((i) => after(i.closedAt || i.updatedAt)),
+    mergedPulls: pulls.issues.filter((i) => Boolean(i.mergedAt) && after(i.mergedAt)),
     commits: commits.commits,
   }
 }

package/lib/tools/issues.js

@@ -26,6 +26,7 @@ export function normalizeIssue(data, { mine = '' } = {}) {
     createdAt: data.created_at,
     updatedAt: data.updated_at,
     closedAt: data.closed_at,
+    mergedAt: (data.pull_request && data.pull_request.merged_at) || data.merged_at || null,
     url: data.html_url,
     body: typeof data.body === 'string' ? data.body : '',
     isMine: mine ? (data.user && data.user.login) === mine : undefined,

package/lib/tools/pulls.js

@@ -329,8 +329,12 @@ export async function resolveReviewThread(client, { owner, repo, threadId, resol
     ? data?.resolveReviewThread?.thread
     : data?.unresolveReviewThread?.thread
 
+  if (!thread) {
+    throw new Error(`failed to ${shouldResolve ? 'resolve' : 'unresolve'} review thread: mutation returned no thread`)
+  }
+
   return {
     threadId,
-    isResolved: thread ? Boolean(thread.isResolved) : shouldResolve,
+    isResolved: Boolean(thread.isResolved),
   }
 }

package/lib/tools/register-write.js

@@ -188,7 +188,7 @@ export function registerWriteTools({ tool, asRepo, client, liveConfig, auth }) {
       const cfg = authConfig()
       const outcome = await pollDeviceFlow({
         clientId: cfg.clientId || DEFAULT_CLIENT_ID,
-        clientSecret: auth.secret(),
+        clientSecret: await auth.secret(),
         deviceCode: pending.deviceCode,
         intervalSeconds: pending.intervalSeconds,
         maxWaitMs: args.maxWaitMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",
@@ -41,14 +41,14 @@
     "@deepseek-ai/dsh-credentials": "^0.1.7-rc.2 || ^0.2.0-rc.1",
     "@deepseek-ai/dsh-settings": "^0.1.7-rc.2 || ^0.2.0-rc.1",
     "@deepseek-ai/dsh-tools": "^0.1.7-rc.2 || ^0.2.0-rc.1",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-credentials": "^0.1.0-rc.8",
     "@deepseek-ai/dsh-settings": "^0.1.0-rc.8",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.8",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "repository": {
     "type": "git",