@goodandready/dsh-github-ops 0.2.9 → 0.2.10

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.10
+
+### Fixed
+- **Settings Surface & Volatile Fields on DSH 0.2** (#76, #85): Config fields declare `.volatile()` wrappers and live settings reads are unwrapped via `plainConfig()` to comply with the DSH 0.2 live-value contract and prevent settings from being marked unavailable.
+- **Dead settingsScope.replace Removed** (#100, #86): Removed unused dead `settingsScope.replace` method that swallowed errors.
+- **Client Fetch AbortSignal Timeout** (#101): Attached 15s/120s `AbortSignal` timeouts to all `fetch` calls in `lib/client.js` to prevent the UI from hanging indefinitely on stalled requests.
+- **Git Runner Timeout** (#90): SCM route passes `timeoutMs` (120000ms) to `execFileAsync` git runner options, properly enforcing timeouts on write operations.
+- **Presenter Interpolation Format** (#94): Fixed entity number interpolation in `issue_comment` (`#${number}`) and `pr_merge` (`Merged pull request #${number}`) cards.
+- **GraphQL Thread Mutation Validation** (#88): `resolveReviewThread` validates return thread existence and throws on empty/null responses instead of reporting false success.
+- **Merged PRs Filter** (#89): `mergedPulls` in insights now verifies `mergedAt` presence instead of counting closed-unmerged pull requests.
+- **Auth Device Secret Await** (#84): Fixed missing `await auth.secret()` in `register-write.js` that was passing a Promise instance as OAuth `client_secret`.
+
+## 0.2.9
+
+### Fixed
+- **Audit Findings & Stability**: Pre-release audit bundle addressing review thread mutations, auth credentials and input validation.
+
+
 ## 0.2.8
 
 ### Fixed

package/lib/client.js

@@ -20,6 +20,13 @@ window.__ModuleLoader__.load({
     const SCM_PATH = '/dsh-github-ops/scm'
     const PANEL_PATH = '/dsh-github-ops/panel'
 
+    const fetchWithTimeout = (url, options = {}, timeoutMs = 15000) => {
+      const signal = (typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function')
+        ? AbortSignal.timeout(timeoutMs)
+        : undefined
+      return fetch(url, signal ? { signal, ...options } : options)
+    }
+
     // The repository a github.com link in the conversation pointed at, so the tab and the
     // panel can follow the human instead of asking again.
     const linkState = { repo: '', enabled: false }
@@ -283,7 +290,7 @@ window.__ModuleLoader__.load({
           setState({ phase: 'error', message: 'fetch is unavailable in this client' })
           return
         }
-        fetch(cwdQuery ? `${SCM_PATH}?${cwdQuery}` : SCM_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(cwdQuery ? `${SCM_PATH}?${cwdQuery}` : SCM_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setState({ phase: 'ready', payload }))
           .catch((err) => setState({ phase: 'error', message: String((err && err.message) || err) }))
@@ -296,11 +303,11 @@ window.__ModuleLoader__.load({
         if (typeof fetch !== 'function') return
         setBusy(action)
         setActionError('')
-        fetch(SCM_PATH, {
+        fetchWithTimeout(SCM_PATH, {
           method: 'POST',
           headers: { 'content-type': 'application/json', accept: 'application/json' },
           body: JSON.stringify(repoPath ? { action, args: args || {}, cwd: repoPath } : { action, args: args || {} }),
-        })
+        }, 120000)
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => {
             setBusy('')
@@ -322,7 +329,7 @@ window.__ModuleLoader__.load({
         setSelected({ path: file.path, staged })
         setDiff({ phase: 'loading', text: '' })
         const query = `?file=${encodeURIComponent(file.path)}${staged ? '&staged=1' : ''}`
-        fetch(SCM_PATH + query, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(SCM_PATH + query, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setDiff({ phase: 'ready', text: payload.diff || '' }))
           .catch((err) => setDiff({ phase: 'error', text: String((err && err.message) || err) }))
@@ -518,7 +525,7 @@ window.__ModuleLoader__.load({
 
       const load = React.useCallback(() => {
         if (typeof fetch !== 'function') return
-        fetch(SCM_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(SCM_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setState({ phase: 'ready', payload }))
           .catch(() => setState({ phase: 'idle' }))
@@ -602,7 +609,7 @@ window.__ModuleLoader__.load({
       const call = React.useCallback((params) => {
         if (typeof fetch !== 'function') return Promise.reject(new Error('fetch is unavailable in this client'))
         const query = new URLSearchParams(params).toString()
-        return fetch(`${PANEL_PATH}?${query}`, { headers: { accept: 'application/json' } })
+        return fetchWithTimeout(`${PANEL_PATH}?${query}`, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
       }, [])
 
@@ -841,7 +848,7 @@ window.__ModuleLoader__.load({
           setStatusError('fetch is unavailable in this client')
           return
         }
-        fetch(STATUS_PATH, { headers: { accept: 'application/json' } })
+        fetchWithTimeout(STATUS_PATH, { headers: { accept: 'application/json' } })
           .then((response) => (response.ok ? response.json() : Promise.reject(new Error(`HTTP ${response.status}`))))
           .then((payload) => setAccessStatus(payload))
           .catch((err) => { setAccessStatus(null); setStatusError(String((err && err.message) || err)) })

package/lib/index.js

@@ -44,11 +44,12 @@ const callContext = new AsyncLocalStorage()
 
 /** git runner: never throws, always answers with a code and both streams. */
 function makeGitRunner() {
-  return async (args, { cwd, env } = {}) => {
+  return async (args, { cwd, env, timeoutMs, timeout } = {}) => {
     try {
       const { stdout, stderr } = await execFileAsync('git', args, {
         cwd: cwd || process.cwd(),
         env: { ...process.env, ...(env || {}) },
+        timeout: typeof timeoutMs === 'number' ? timeoutMs : (typeof timeout === 'number' ? timeout : undefined),
         maxBuffer: 8 * 1024 * 1024,
       })
       return { code: 0, stdout, stderr }
@@ -171,25 +172,21 @@ export const Config = Schema.object({
 })
 
 export function apply(ctx, rawConfig) {
-  const config = { ...Config(), ...(rawConfig || {}) }
+  const config = plainConfig({ ...Config(), ...(rawConfig || {}) })
   let settingsScope = null
 
   ctx.inject(['settings'], (sctx) => {
     try {
       settingsScope = {
-      get: () => {
-        try {
-          const row = sctx.settings?.describe?.().find((r) => r && r.ns === name);
-          return row?.value ?? config  ?? {};
-        } catch { return config  ?? {}; }
-      },
-      replace: async (next) => {
-        try {
-          const row = sctx.settings?.describe?.().find((r) => r && r.ns === name);
-          return await sctx.settings?.replace?.(name, next, row?.revision);
-        } catch {}
-      },
-    }
+        get: () => {
+          try {
+            const row = sctx.settings?.describe?.().find((r) => r && (r.ns === name || r.ns === '@goodandready/dsh-github-ops'))
+            return plainConfig(row?.value ?? config ?? {})
+          } catch {
+            return plainConfig(config ?? {})
+          }
+        },
+      }
     } catch (err) {
       ctx.logger?.warn?.('[dsh-github-ops] settings namespace unavailable:', err && err.message)
     }
@@ -211,9 +208,9 @@ export function apply(ctx, rawConfig) {
   function liveConfig() {
     try {
       const fromScope = settingsScope && settingsScope.get && settingsScope.get()
-      return { ...config, ...(fromScope || {}) }
+      return plainConfig({ ...config, ...(fromScope || {}) })
     } catch {
-      return config
+      return plainConfig(config)
     }
   }
 

package/lib/present.js

@@ -102,7 +102,7 @@ const PRESENTATIONS = {
   },
   issue_comment: {
     call: (args) => pending(`Comment on #${args.number}`, pick(args, ['repository', 'number'])),
-    result: (_args, r) => failure('Comment not posted', r) || text(`Commented on #${r.data.id ? '' : ''}`, `comment id ${r.data.id}`),
+    result: (_args, r) => failure('Comment not posted', r) || text(`Commented on #${_args?.number || (r.data && r.data.id) || ''}`, `comment id ${r.data.id}`),
   },
   issue_close: {
     call: (args) => pending(`Close #${args.number}`, pick(args, ['repository', 'number', 'stateReason'])),
@@ -126,7 +126,7 @@ const PRESENTATIONS = {
   pr_merge: {
     call: (args) => pending(`Merge pull request #${args.number}`, pick(args, ['repository', 'number', 'method', 'deleteBranch'])),
     result: (_args, r) => failure('Pull request not merged', r)
-      || text(r.data.merged ? `Merged #${'pull request'}` : 'Merge not performed', `${r.data.message || ''}${r.data.sha ? `\n${String(r.data.sha).slice(0, 7)}` : ''}${r.data.branchDeleted ? `\nhead branch ${r.data.branchDeleted} deleted` : ''}`),
+      || text(r.data.merged ? `Merged pull request #${_args?.number || (r.data && r.data.number) || ''}` : 'Merge not performed', `${r.data.message || ''}${r.data.sha ? `\n${String(r.data.sha).slice(0, 7)}` : ''}${r.data.branchDeleted ? `\nhead branch ${r.data.branchDeleted} deleted` : ''}`),
   },
   gh_review: {
     call: (args) => pending(`Review pull request #${args.number}`, pick(args, ['repository', 'number', 'maxDiffChars'])),

package/lib/tools/insights.js

@@ -102,7 +102,7 @@ export async function weeklyDigest(client, { owner, repo, days = 7, limit = 10 }
     since,
     releases: releases.releases.filter((r) => after(r.publishedAt || r.createdAt)),
     newIssues: issues.issues.filter((i) => after(i.createdAt)),
-    mergedPulls: pulls.issues.filter((i) => after(i.closedAt || i.updatedAt)),
+    mergedPulls: pulls.issues.filter((i) => Boolean(i.mergedAt) && after(i.mergedAt)),
     commits: commits.commits,
   }
 }

package/lib/tools/issues.js

@@ -26,6 +26,7 @@ export function normalizeIssue(data, { mine = '' } = {}) {
     createdAt: data.created_at,
     updatedAt: data.updated_at,
     closedAt: data.closed_at,
+    mergedAt: (data.pull_request && data.pull_request.merged_at) || data.merged_at || null,
     url: data.html_url,
     body: typeof data.body === 'string' ? data.body : '',
     isMine: mine ? (data.user && data.user.login) === mine : undefined,

package/lib/tools/pulls.js

@@ -329,8 +329,12 @@ export async function resolveReviewThread(client, { owner, repo, threadId, resol
     ? data?.resolveReviewThread?.thread
     : data?.unresolveReviewThread?.thread
 
+  if (!thread) {
+    throw new Error(`failed to ${shouldResolve ? 'resolve' : 'unresolve'} review thread: mutation returned no thread`)
+  }
+
   return {
     threadId,
-    isResolved: thread ? Boolean(thread.isResolved) : shouldResolve,
+    isResolved: Boolean(thread.isResolved),
   }
 }

package/lib/tools/register-write.js

@@ -188,7 +188,7 @@ export function registerWriteTools({ tool, asRepo, client, liveConfig, auth }) {
       const cfg = authConfig()
       const outcome = await pollDeviceFlow({
         clientId: cfg.clientId || DEFAULT_CLIENT_ID,
-        clientSecret: auth.secret(),
+        clientSecret: await auth.secret(),
         deviceCode: pending.deviceCode,
         intervalSeconds: pending.intervalSeconds,
         maxWaitMs: args.maxWaitMs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",