@goodandready/dsh-github-ops 0.6.4 → 0.6.6

package/lib/client.js

@@ -127,6 +127,15 @@ window.__ModuleLoader__.load({
       panelPulls: 'Pull requests',
       panelRuns: 'Actions',
       panelInbox: 'Inbox',
+      panelSecurity: 'Security',
+      panelSecurityEmpty: 'No security alerts found.',
+      panelSecurityDisabled: 'Security features are disabled or token lacks security scope.',
+      panelDiagnose: 'Diagnose',
+      panelDiagnosing: 'Diagnosing…',
+      panelDiagnoseAsk: 'Ask Agent to Diagnose & Fix',
+      panelDiagnoseCopied: 'Prompt copied to clipboard!',
+      panelSteps: 'Steps',
+      panelFailedStep: 'Failed Step',
       panelOpen: 'Open in browser',
       panelEmpty: 'Nothing here yet.',
       panelLoading: 'Loading…',
@@ -240,6 +249,15 @@ window.__ModuleLoader__.load({
       panelPulls: 'Pull request',
       panelRuns: 'Actions',
       panelInbox: '收件箱',
+      panelSecurity: '安全',
+      panelSecurityEmpty: '未发现安全警报。',
+      panelSecurityDisabled: '安全功能已禁用或令牌缺少安全权限。',
+      panelDiagnose: '诊断',
+      panelDiagnosing: '诊断中…',
+      panelDiagnoseAsk: '请智能体诊断并修复',
+      panelDiagnoseCopied: '提示词已复制到剪贴板！',
+      panelSteps: '步骤',
+      panelFailedStep: '失败步骤',
       panelOpen: '在浏览器中打开',
       panelEmpty: '这里还没有内容。',
       panelLoading: '加载中…',
@@ -784,6 +802,11 @@ window.__ModuleLoader__.load({
       const [items, setItems] = React.useState({ phase: 'idle', list: [] })
       const [error, setError] = React.useState('')
       const [loading, setLoading] = React.useState(false)
+      const [securityData, setSecurityData] = React.useState({ phase: 'idle', data: null })
+      const [diagnostics, setDiagnostics] = React.useState(null)
+      const [diagnoseLoadingId, setDiagnoseLoadingId] = React.useState(null)
+      const [expandedSteps, setExpandedSteps] = React.useState({})
+      const [copiedPrompt, setCopiedPrompt] = React.useState(false)
 
       const call = React.useCallback((params) => {
         if (typeof fetch !== 'function') return Promise.reject(new Error('fetch is unavailable in this client'))
@@ -823,6 +846,37 @@ window.__ModuleLoader__.load({
           .catch((err) => { setItems({ phase: 'error', list: [] }); setError(String((err && err.message) || err)) })
       }, [call, repo])
 
+      const loadSecurity = React.useCallback(() => {
+        if (!repo) return
+        setSecurityData({ phase: 'loading', data: null })
+        call({ what: 'security', repo })
+          .then((payload) => setSecurityData({ phase: 'ready', data: payload }))
+          .catch((err) => { setSecurityData({ phase: 'error', data: null }); setError(String((err && err.message) || err)) })
+      }, [call, repo])
+
+      const loadDiagnostics = (runId) => {
+        if (!repo || !runId) return
+        setDiagnoseLoadingId(runId)
+        call({ what: 'diagnose_run', repo, runId })
+          .then((res) => {
+            setDiagnostics(res)
+            if (res.failedStep) setExpandedSteps({ [res.failedStep.name]: true })
+          })
+          .catch((err) => setError(String((err && err.message) || err)))
+          .finally(() => setDiagnoseLoadingId(null))
+      }
+
+      const askAgent = (diag) => {
+        const text = `Please diagnose and fix CI failure for repository ${repo} run #${diag.runId} (${diag.jobName || 'job'}):\nFailed Step: ${diag.failedStep ? diag.failedStep.name : 'Unknown'}\n\nTop Errors:\n` +
+          ((diag.failedStep && diag.failedStep.errorHighlights) || []).map((e) => ' - ' + e).join('\n') +
+          (diag.failedStep && diag.failedStep.lines ? `\n\nStep Log excerpt:\n` + diag.failedStep.lines.slice(-30).join('\n') : '')
+        if (typeof navigator !== 'undefined' && navigator.clipboard && navigator.clipboard.writeText) {
+          navigator.clipboard.writeText(text).catch(() => {})
+        }
+        setCopiedPrompt(true)
+        setTimeout(() => setCopiedPrompt(false), 4000)
+      }
+
       const loadInbox = React.useCallback(() => {
         setItems({ phase: 'loading', list: [] })
         call({ what: 'inbox' })
@@ -835,8 +889,9 @@ window.__ModuleLoader__.load({
         if (tab === 'tree') loadTree('')
         else if (tab === 'inbox') loadInbox()
         else if (tab === 'matrix') loadMatrix()
+        else if (tab === 'security') loadSecurity()
         else loadList(tab)
-      }, [repo, tab, loadTree, loadList, loadInbox])
+      }, [repo, tab, loadTree, loadList, loadInbox, loadSecurity])
 
       const openFile = (entry) => {
         if (entry.type === 'tree') { loadTree(entry.path); return }
@@ -887,10 +942,42 @@ window.__ModuleLoader__.load({
       const list = (() => {
         if (items.phase === 'loading') return React.createElement('div', { className: 'gho-panel-muted' }, t('panelLoading'))
         if (!items.list.length) return React.createElement('div', { className: 'gho-panel-muted' }, t('panelEmpty'))
-        return items.list.slice(0, 40).map((item, index) => React.createElement('div', { className: 'gho-panel-item', key: `${item.number || item.id || index}` },
-          React.createElement('span', { className: 'gho-panel-file' }, item.number ? `#${item.number}` : (item.name || '')),
-          React.createElement('span', null, item.title || item.displayTitle || item.reason || item.name || ''),
-          item.url || item.html_url ? React.createElement('a', { className: 'gho-link', href: item.url || item.html_url, target: '_blank', rel: 'noreferrer' }, '↗') : null,
+        return items.list.slice(0, 40).map((item, index) => React.createElement('div', { key: `${item.number || item.id || index}` },
+          React.createElement('div', { className: 'gho-panel-item' },
+            React.createElement('span', { className: 'gho-panel-file' }, item.number ? `#${item.number}` : (item.name || '')),
+            React.createElement('span', null, item.title || item.displayTitle || item.reason || item.name || ''),
+            tab === 'runs' ? React.createElement('button', {
+              type: 'button',
+              className: 'gho-diagnose-btn',
+              style: { marginLeft: '8px' },
+              onClick: (e) => { e.stopPropagation(); loadDiagnostics(item.id) },
+            }, diagnoseLoadingId === item.id ? t('panelDiagnosing') : t('panelDiagnose')) : null,
+            item.url || item.html_url ? React.createElement('a', { className: 'gho-link', href: item.url || item.html_url, target: '_blank', rel: 'noreferrer' }, '↗') : null,
+          ),
+          diagnostics && diagnostics.runId === item.id ? React.createElement('div', { style: { padding: '8px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', margin: '4px 0 8px', background: 'var(--dsw-alias-bg-layer-2)' } },
+            React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '8px' } },
+              React.createElement('span', { style: { fontWeight: 600, fontSize: '12px' } }, diagnostics.summary || t('panelSteps')),
+              React.createElement('button', {
+                type: 'button',
+                className: 'gho-diagnose-btn',
+                style: { background: 'var(--dsw-alias-color-primary, #1f6feb)', color: '#fff', border: 0 },
+                onClick: () => askAgent(diagnostics),
+              }, copiedPrompt ? t('panelDiagnoseCopied') : t('panelDiagnoseAsk')),
+            ),
+            (diagnostics.steps || []).map((step, sIdx) => {
+              const isExp = expandedSteps[step.name] ?? step.hasError
+              return React.createElement('div', { key: sIdx, className: `gho-step-folded ${step.hasError ? 'gho-step-err' : ''}`, style: { margin: '4px 0' } },
+                React.createElement('div', {
+                  style: { display: 'flex', justifyContent: 'space-between', cursor: 'pointer', padding: '4px 6px' },
+                  onClick: () => setExpandedSteps((prev) => ({ ...prev, [step.name]: !isExp })),
+                },
+                  React.createElement('span', { style: { fontSize: '12px', fontWeight: step.hasError ? 600 : 400 } }, `${isExp ? '▾' : '▸'} ${step.name} (${step.lineCount} lines)`),
+                  step.hasError ? React.createElement('span', { className: 'gho-badge gho-badge-failing' }, t('panelFailedStep')) : React.createElement('span', { style: { color: 'var(--dsw-alias-color-success, #2ea043)' } }, '✓'),
+                ),
+                isExp && step.lines && step.lines.length ? React.createElement('pre', { className: 'gho-panel-pre gho-step-lines' }, step.lines.join('\n')) : null,
+              )
+            }),
+          ) : null,
         ))
       })()
 
@@ -951,6 +1038,44 @@ window.__ModuleLoader__.load({
         )
       })()
 
+      const securityView = (() => {
+        if (securityData.phase === 'loading') return React.createElement('div', { className: 'gho-panel-muted' }, t('panelLoading'))
+        const data = securityData.data
+        if (!data) return React.createElement('div', { className: 'gho-panel-muted' }, t('panelEmpty'))
+
+        const allDisabled = !data.dependabot?.enabled && !data.secretScanning?.enabled && !data.codeScanning?.enabled
+        if (allDisabled) {
+          return React.createElement('div', { className: 'gho-panel-muted', style: { padding: '8px 0' } },
+            t('panelSecurityDisabled'),
+            data.dependabot?.reason ? React.createElement('div', { style: { fontSize: '11px', marginTop: '4px' } }, data.dependabot.reason) : null,
+          )
+        }
+
+        const alerts = [
+          ...(data.dependabot?.alerts || []).map((a) => ({ ...a, kind: 'dependabot' })),
+          ...(data.secretScanning?.alerts || []).map((a) => ({ ...a, kind: 'secret' })),
+          ...(data.codeScanning?.alerts || []).map((a) => ({ ...a, kind: 'code' })),
+        ]
+
+        if (!alerts.length) {
+          return React.createElement('div', { className: 'gho-panel-muted', style: { padding: '8px 0' } }, t('panelSecurityEmpty'))
+        }
+
+        return React.createElement('div', null,
+          React.createElement('div', { style: { display: 'flex', gap: '8px', margin: '4px 0 8px' } },
+            React.createElement('span', { className: 'gho-badge gho-badge-active' }, `${data.totalCount || 0} Total`),
+            data.criticalCount ? React.createElement('span', { className: 'gho-badge gho-badge-failing' }, `${data.criticalCount} Critical`) : null,
+            data.highCount ? React.createElement('span', { className: 'gho-badge gho-badge-building' }, `${data.highCount} High`) : null,
+          ),
+          alerts.map((alert, idx) => React.createElement('div', { key: alert.number || idx, className: 'gho-panel-item' },
+            React.createElement('span', { className: 'gho-panel-file' }, alert.kind === 'dependabot' ? (alert.dependency?.packageName || 'pkg') : (alert.kind === 'secret' ? (alert.secretTypeDisplayName || 'Secret') : (alert.ruleId || 'CodeQL'))),
+            React.createElement('span', { style: { flex: 1, fontSize: '12px' } }, alert.advisory?.summary || alert.message || alert.secretType || ''),
+            React.createElement('span', { className: `gho-badge gho-badge-${(alert.advisory?.severity || alert.ruleSeverity || 'active').toLowerCase() === 'critical' ? 'failing' : 'building'}` }, alert.advisory?.severity || alert.ruleSeverity || alert.state),
+            alert.url ? React.createElement('a', { className: 'gho-link', href: alert.url, target: '_blank', rel: 'noreferrer' }, '↗') : null,
+          )),
+        )
+      })()
+
       return React.createElement('div', { className: 'gho-panel' },
         header,
         React.createElement('div', { className: 'gho-panel-tabs' },
@@ -958,12 +1083,13 @@ window.__ModuleLoader__.load({
           tabButton('issues', t('panelIssues')),
           tabButton('pulls', t('panelPulls')),
           tabButton('runs', t('panelRuns')),
+          tabButton('security', t('panelSecurity')),
           tabButton('inbox', t('panelInbox')),
           tabButton('matrix', t('panelMatrix')),
           React.createElement('button', { type: 'button', className: 'gho-panel-tab', onClick: () => { setRepo(''); setFile(null) } }, t('panelRepo')),
         ),
         error ? React.createElement('div', { className: 'gho-panel-muted' }, error) : null,
-        tab === 'tree' ? treeView : (tab === 'matrix' ? matrixView : list),
+        tab === 'tree' ? treeView : (tab === 'matrix' ? matrixView : (tab === 'security' ? securityView : list)),
       )
     }
 
@@ -998,6 +1124,10 @@ window.__ModuleLoader__.load({
         '.gho-badge-building{background:var(--dsw-alias-color-warning-bg,rgba(210,153,34,0.15));color:var(--dsw-alias-color-warning,#d29922)}',
         '.gho-badge-released{background:var(--dsw-alias-color-info-bg,rgba(56,139,253,0.15));color:var(--dsw-alias-color-info,#388bfd)}',
         '.gho-badge-active{background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-secondary)}',
+        '.gho-step-folded{border-radius:6px;background:var(--dsw-alias-bg-layer-2);margin-bottom:4px}',
+        '.gho-step-err{border-left:3px solid var(--dsw-alias-label-error,#f85149);background:rgba(248,81,73,0.08)}',
+        '.gho-step-lines{max-height:220px;overflow-y:auto;font-size:11px;padding:6px;margin:2px 0 6px}',
+        '.gho-diagnose-btn{font-size:11px;padding:2px 6px;border-radius:4px;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);background:transparent}',
         '.gho-matrix-table{width:100%;border-collapse:collapse;font-size:11px;margin-top:6px}',
         '.gho-matrix-th{text-align:left;padding:4px 6px;border-bottom:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary)}',
         '.gho-matrix-td{padding:5px 6px;border-bottom:1px solid var(--dsw-alias-border-l2);vertical-align:middle}',

package/lib/routes.js

@@ -8,13 +8,14 @@
 import { existsSync, statSync, readFileSync } from 'node:fs'
 import { join as joinPath } from 'node:path'
 
-import { statusPayload, isTrustedRequest, isTrustedWriteRequest, sendJson } from './status.js'
+import { statusPayload, isTrustedRequest, isTrustedWriteRequest, getRejectionStatus, getWriteRejectionStatus, sendJson } from './status.js'
 import { buildAction, validateCwd, validateStashRef, resolveConflictFile } from './scm-write.js'
 import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, scmPayload, mergeStateFrom, hasConflicts, parseConflictBlocks, parseDiffHunks, parseGitGraph } from './scm.js'
 import { SseEventManager } from './events.js'
 import { encodeRepoPath } from './github.js'
 import { listIssues } from './tools/issues.js'
-import { listRuns } from './tools/actions.js'
+import { listRuns, diagnoseRun } from './tools/actions.js'
+import { listSecurityAlerts } from './tools/security.js'
 import { listNotifications, repoTreeView } from './tools/panel-data.js'
 import { mirrorStatus, syncMirror } from './tools/mirror.js'
 import { matrixStatus } from './tools/matrix.js'
@@ -64,6 +65,25 @@ export function registerRoutes(ctx, deps = {}) {
     makeGitRunner = () => () => ({ code: 1, stdout: '', stderr: 'git not available' }),
     cacheStats = () => null,
   } = deps
+
+  const resolveConnection = deps.resolveConnection || (() => {
+    try {
+      if (ctx && typeof ctx.get === 'function') {
+        const c = ctx.get('connection')
+        if (c) return c
+      }
+    } catch { /* ignore */ }
+    try {
+      if (ctx && ctx.connection) return ctx.connection
+    } catch { /* ignore */ }
+    try {
+      const c = Reflect.get(ctx, 'connection')
+      if (c) return c
+    } catch { /* ignore */ }
+    return undefined
+  })
+  const routeOptions = () => ({ get connection() { return resolveConnection() } })
+
   // The card reads the access status from here instead of from a tool result: the model has
   // no business holding the access value, and the payload describes this machine's account,
   // so only a local or same-origin caller is answered.
@@ -74,7 +94,10 @@ export function registerRoutes(ctx, deps = {}) {
         path: STATUS_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (!isTrustedRequest(req, routeOptions())) {
+            const status = getRejectionStatus(req, routeOptions()) || 403
+            return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+          }
           const access = await resolveToken()
           let identity = null
           let rateLimit = null
@@ -120,9 +143,15 @@ export function registerRoutes(ctx, deps = {}) {
           try {
           if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
           if (req.method === 'POST') {
-            if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedWriteRequest(req, routeOptions())) {
+              const status = getWriteRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
           } else {
-            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedRequest(req, routeOptions())) {
+              const status = getRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
           }
           const git = makeGitRunner()
           const url = new URL(req.url || '/', 'http://localhost')
@@ -306,7 +335,10 @@ export function registerRoutes(ctx, deps = {}) {
         path: PANEL_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (!isTrustedRequest(req, routeOptions())) {
+            const status = getRejectionStatus(req, routeOptions()) || 403
+            return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+          }
           const access = await resolveToken()
           if (!access.value) return sendJson(res, 200, { configured: false, guidance: access.guidance })
           const url = new URL(req.url || '/', 'http://localhost')
@@ -360,6 +392,17 @@ export function registerRoutes(ctx, deps = {}) {
               const result = await listRuns(github, { ...repo, limit: 20 })
               return sendJson(res, 200, { configured: true, items: result.runs })
             }
+            if (what === 'security') {
+              const severity = url.searchParams.get('severity') || undefined
+              const result = await listSecurityAlerts(github, { ...repo, state, severity, limit: 50 })
+              return sendJson(res, 200, { configured: true, ...result })
+            }
+            if (what === 'diagnose_run') {
+              const runId = Number(url.searchParams.get('runId'))
+              const jobId = url.searchParams.get('jobId') ? Number(url.searchParams.get('jobId')) : undefined
+              const result = await diagnoseRun(github, { ...repo, runId, jobId })
+              return sendJson(res, 200, { configured: true, ...result })
+            }
             if (what === 'inbox') {
               const result = await listNotifications(github, { limit: 30 })
               return sendJson(res, 200, { configured: true, ...result })
@@ -381,9 +424,15 @@ export function registerRoutes(ctx, deps = {}) {
           try {
             if (req.method !== 'GET' && req.method !== 'POST') return sendJson(res, 405, { error: 'method not allowed' })
             if (req.method === 'POST') {
-              if (!isTrustedWriteRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+              if (!isTrustedWriteRequest(req, routeOptions())) {
+                const status = getWriteRejectionStatus(req, routeOptions()) || 403
+                return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+              }
             } else {
-              if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+              if (!isTrustedRequest(req, routeOptions())) {
+                const status = getRejectionStatus(req, routeOptions()) || 403
+                return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+              }
             }
             const git = makeGitRunner()
             const url = new URL(req.url || '/', 'http://localhost')
@@ -451,7 +500,10 @@ export function registerRoutes(ctx, deps = {}) {
         handler: async (req, res) => {
           try {
             if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedRequest(req, routeOptions())) {
+              const status = getRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
             const access = await resolveToken()
             if (!access.value) return sendJson(res, 200, { configured: false, guidance: access.guidance })
             const url = new URL(req.url || '/', 'http://localhost')
@@ -474,7 +526,10 @@ export function registerRoutes(ctx, deps = {}) {
         handler: async (req, res) => {
           try {
             if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-            if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+            if (!isTrustedRequest(req, routeOptions())) {
+              const status = getRejectionStatus(req, routeOptions()) || 403
+              return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+            }
             const git = makeGitRunner()
             const url = new URL(req.url || '/', 'http://localhost')
             const requested = validateCwd(url.searchParams.get('cwd') || '')
@@ -515,7 +570,10 @@ export function registerRoutes(ctx, deps = {}) {
         path: EVENTS_PATH,
         handler: async (req, res) => {
           if (req.method !== 'GET') return sendJson(res, 405, { error: 'method not allowed' })
-          if (!isTrustedRequest(req)) return sendJson(res, 403, { error: 'forbidden' })
+          if (!isTrustedRequest(req, routeOptions())) {
+            const status = getRejectionStatus(req, routeOptions()) || 403
+            return sendJson(res, status, { error: status === 401 ? 'unauthorized' : 'forbidden' })
+          }
           res.writeHead(200, {
             'Content-Type': 'text/event-stream',
             'Cache-Control': 'no-cache, no-transform',

package/lib/status.js

@@ -8,8 +8,46 @@ import { auditTokenScopes } from './token-audit.js'
 // The payload never contains the access value. The route answers only a local or same-origin
 // caller, because the payload describes the machine's account.
 
-/** Whether a request may read the status payload. Fail-closed. */
-function isTrustedHost(host) {
+/** Whether an address or host string represents local loopback. */
+export function isLoopbackAddress(val) {
+  if (!val || typeof val !== 'string') return false
+  let h = val.trim().toLowerCase()
+  if (h.startsWith('[')) {
+    const end = h.indexOf(']')
+    if (end > 0) h = h.slice(1, end)
+  } else if (h.includes(':')) {
+    const colons = h.split(':').length - 1
+    if (colons === 1) h = h.split(':')[0]
+  }
+  const clean = h.replace(/^::ffff:/, '')
+  return clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.') || clean === 'localhost' || clean === 'localhost.' || clean === '[::1]'
+}
+export const isLoopback = isLoopbackAddress
+
+/** Whether an address or host string represents a private LAN network. */
+export function isLanAddress(ip) {
+  if (!ip || typeof ip !== 'string') return false
+  let h = ip.trim().toLowerCase()
+  if (h.startsWith('[')) {
+    const end = h.indexOf(']')
+    if (end > 0) h = h.slice(1, end)
+  } else if (h.includes(':')) {
+    const colons = h.split(':').length - 1
+    if (colons === 1) h = h.split(':')[0]
+  }
+  const clean = h.replace(/^::ffff:/, '')
+  if (isLoopbackAddress(clean)) return true
+  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
+  const match172 = clean.match(/^172\.(\d+)\./)
+  if (match172) {
+    const octet = parseInt(match172[1], 10)
+    if (octet >= 16 && octet <= 31) return true
+  }
+  return false
+}
+
+/** Whether a host header passes DNS-rebinding guards. Fail-closed. */
+export function isTrustedHost(host) {
   if (!host || typeof host !== 'string') return false
   let hostname = host.trim()
   if (hostname.startsWith('[')) {
@@ -24,146 +62,226 @@ function isTrustedHost(host) {
   hostname = hostname.toLowerCase()
   if (!hostname) return false
   if (hostname === 'localhost' || hostname.endsWith('.local') || hostname.endsWith('.lan')) return true
-  const clean = hostname.replace(/^::ffff:/, '')
-  if (clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.')) return true
-  if (clean.startsWith('10.') || clean.startsWith('192.168.')) return true
-  const match172 = clean.match(/^172\.(\d+)\./)
-  if (match172) {
-    const octet = parseInt(match172[1], 10)
-    if (octet >= 16 && octet <= 31) return true
-  }
-  return false
+  return isLoopbackAddress(hostname) || isLanAddress(hostname)
 }
 
-/** Whether an address or host string represents local loopback. */
-function isLoopback(val) {
-  if (!val || typeof val !== 'string') return false
-  let h = val.trim().toLowerCase()
-  if (h.startsWith('[')) {
-    const end = h.indexOf(']')
-    if (end > 0) h = h.slice(1, end)
-  } else if (h.includes(':')) {
-    const colons = h.split(':').length - 1
-    if (colons === 1) h = h.split(':')[0]
-  }
-  const clean = h.replace(/^::ffff:/, '')
-  return clean === '127.0.0.1' || clean === '::1' || clean.startsWith('127.') || clean === 'localhost' || clean === 'localhost.'
+/** Resolves remote client IP from socket or request metadata. */
+export function getClientIp(req) {
+  return (
+    req?.socket?.remoteAddress ||
+    req?.socket?.address?.()?.address ||
+    req?.connection?.remoteAddress ||
+    req?.info?.remoteAddress ||
+    ''
+  )
 }
 
-/** Whether a request may read the status payload. Fail-closed. */
-export function isTrustedRequest(req) {
-  if (!req) return false
+/**
+ * Evaluates whether an incoming HTTP request is trusted and authenticated (#129).
+ *
+ * Requirements:
+ * 1. If DSH connection service is available (options.connection), requestRejection(req)
+ *    is the authoritative gate for browser session authentication and trusted network access.
+ *    If rejection is returned, the numeric status (e.g. 401 or 403) is returned.
+ * 2. Host header, if present, must pass isTrustedHost (prevents DNS rebinding).
+ * 3. Cross-site requests (sec-fetch-site: cross-site) are strictly rejected with 403.
+ * 4. Origin & Referer headers (if present) must match Host or a trusted host.
+ * 5. Fallback when connection service is absent (unit tests, standalone runner):
+ *    - Loopback callers (127.0.0.1, ::1) are allowed.
+ *    - Remote / LAN callers without connection authentication are rejected with 403 (fail closed).
+ *    - Unknown remote address (socket present but empty remoteAddress) fails closed with 403.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
+ */
+export function getRejectionStatus(req, options = {}) {
+  if (!req) return 403
 
-  // Fail-closed against cross-site fetches regardless of source IP
-  const secFetchSite = header(req, 'sec-fetch-site')
-  if (secFetchSite === 'cross-site') return false
+  const connection = options?.connection
+  if (connection && typeof connection.requestRejection === 'function') {
+    try {
+      const rejection = connection.requestRejection(req)
+      if (rejection !== undefined) {
+        if (typeof rejection === 'number' && Number.isInteger(rejection) && rejection >= 400 && rejection < 600) {
+          return rejection
+        }
+        return rejection === 401 ? 401 : 403
+      }
+    } catch {
+      // Fail closed if connection service throws
+      return 403
+    }
+  }
 
-  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
-  const cleanIp = address.replace(/^::ffff:/, '')
-  const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
+  const host = header(req, 'host')
 
-  // If socket remoteAddress is present, it MUST be a trusted local/private IP (never an untrusted remote IP)
-  if (cleanIp && !isTrustedHost(cleanIp)) return false
+  // 1. Host header must be present and trusted if provided
+  if (host && !isTrustedHost(host)) {
+    return 403
+  }
 
-  const host = header(req, 'host')
-  // If host is provided, it MUST be a trusted local/private host (DNS rebinding guard)
-  if (host && !isTrustedHost(host)) return false
+  // 2. Strict rejection of cross-site requests
+  const site = header(req, 'sec-fetch-site')
+  if (site === 'cross-site') {
+    return 403
+  }
 
+  // 3. Origin header validation if present
   const origin = header(req, 'origin')
-  const referer = header(req, 'referer')
-
-  // Check origin header first
   if (origin) {
+    if (origin === 'null') return 403
     try {
       const originUrl = new URL(origin)
-      if (!isTrustedHost(originUrl.hostname)) return false
-      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
-      return true
+      if (!isTrustedHost(originUrl.hostname)) return 403
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return 403
     } catch {
-      return false
+      return 403
     }
   }
 
-  // Check referer header
+  // 4. Referer header validation if present
+  const referer = header(req, 'referer')
   if (referer) {
     try {
       const refUrl = new URL(referer)
       if (refUrl.protocol === 'http:' || refUrl.protocol === 'https:') {
-        if (!isTrustedHost(refUrl.hostname)) return false
-        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return false
-        return true
-      }
-      // Non-http referer (e.g. dsh-app://app/ in DSH Desktop Electron):
-      // Desktop removes origin/sec-fetch-site and sets custom scheme referer.
-      // Accept only if caller is loopback (socket or loopback host).
-      const hostIsLoopback = host ? isLoopback(host) : false
-      if (loopback || (!address && hostIsLoopback)) {
-        return true
+        if (!isTrustedHost(refUrl.hostname)) return 403
+        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return 403
+      } else {
+        // Non-http custom scheme referer (e.g. dsh-app://app/ in DSH Desktop Electron):
+        // Permitted only from local loopback
+        const ip = getClientIp(req)
+        const hostIsLoopback = host ? isLoopbackAddress(host) : false
+        const isLocal = ip ? isLoopbackAddress(ip) : hostIsLoopback
+        if (!isLocal) return 403
       }
-      return false
     } catch {
-      return false
+      return 403
     }
   }
 
-  // If browser headers (origin/referer/sec-fetch-site) are absent and caller is loopback, allow local caller
-  if (!secFetchSite && loopback) return true
+  // 5. Network boundary validation when connection service is absent:
+  const hasSocket = !!(req.socket || req.connection)
+  const ip = getClientIp(req)
 
-  // Non-loopback caller without origin/referer is refused
-  if (!loopback) return false
+  if (hasSocket) {
+    // Fail closed on missing/unknown remoteAddress
+    if (!ip) {
+      return 403
+    }
+    // Remote / LAN callers without connection authentication are rejected (fail closed!)
+    if (!isLoopbackAddress(ip)) {
+      if (!connection) {
+        return 403
+      }
+    }
+  } else if (!connection) {
+    // Synthetic mock request without socket: allow loopback host for unit tests
+    if (host && !isLoopbackAddress(host)) {
+      return 403
+    }
+  }
 
-  return true
-}
+  // If browser headers are absent and caller is non-loopback without connection
+  if (!connection) {
+    const isLocal = ip ? isLoopbackAddress(ip) : (host ? isLoopbackAddress(host) : false)
+    if (!isLocal) return 403
+  }
 
-/** Whether a write/mutating request (e.g. POST /scm) is safe. Strict write guard against CSRF. */
-export function isTrustedWriteRequest(req) {
-  if (!req) return false
-  if (!isTrustedRequest(req)) return false
+  return undefined
+}
 
-  const secFetchSite = header(req, 'sec-fetch-site')
-  if (secFetchSite && secFetchSite !== 'same-origin' && secFetchSite !== 'none') {
-    return false
+/**
+ * Evaluates whether an incoming HTTP write request is safe for mutation (#129).
+ *
+ * Additional Write Requirements:
+ * 1. Must satisfy all getRejectionStatus checks (including connection.requestRejection).
+ * 2. If Origin header is present:
+ *    - must match Host exactly (same-origin).
+ * 3. If Referer header is present:
+ *    - must match Host exactly (same-origin).
+ * 4. If Sec-Fetch-Site header is present:
+ *    - must be "same-origin" or "none" (same-site and cross-site are rejected).
+ * 5. If connection service is absent, only local loopback callers are allowed for writes.
+ *
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{ connection?: { requestRejection?: (req: any) => number | undefined } }} [options]
+ * @returns {number|undefined} Rejection HTTP status code (401, 403), or undefined if allowed.
+ */
+export function getWriteRejectionStatus(req, options = {}) {
+  const readStatus = getRejectionStatus(req, options)
+  if (readStatus !== undefined) {
+    return readStatus
   }
 
-  const address = (req.socket && (req.socket.remoteAddress || req.socket.address?.().address)) || ''
-  const cleanIp = address.replace(/^::ffff:/, '')
-  const loopback = cleanIp === '127.0.0.1' || cleanIp === '::1' || cleanIp.startsWith('127.')
-
-  if (cleanIp && !isTrustedHost(cleanIp)) return false
+  const site = header(req, 'sec-fetch-site')
+  if (site && site !== 'same-origin' && site !== 'none') {
+    return 403
+  }
 
   const host = header(req, 'host')
   const origin = header(req, 'origin')
   const referer = header(req, 'referer')
+  const ip = getClientIp(req)
+  const connection = options?.connection
 
   if (origin) {
+    if (origin === 'null') return 403
     try {
       const originUrl = new URL(origin)
-      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return false
+      if (host && originUrl.host.toLowerCase() !== host.toLowerCase()) return 403
     } catch {
-      return false
+      return 403
     }
   } else if (referer) {
     try {
       const refUrl = new URL(referer)
       if (refUrl.protocol === 'http:' || refUrl.protocol === 'https:') {
-        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return false
+        if (host && refUrl.host.toLowerCase() !== host.toLowerCase()) return 403
       } else {
-        // Non-http custom scheme referer from loopback: permitted as local loopback writer
-        const hostIsLoopback = host ? isLoopback(host) : false
-        if (!loopback && (address || !hostIsLoopback)) return false
+        const hostIsLoopback = host ? isLoopbackAddress(host) : false
+        const isLocal = ip ? isLoopbackAddress(ip) : hostIsLoopback
+        if (!isLocal) return 403
       }
     } catch {
-      return false
+      return 403
     }
   } else {
     // Write request without origin/referer: only permit local loopback
-    if (!loopback) return false
+    const hostIsLoopback = host ? isLoopbackAddress(host) : false
+    const isLocal = ip ? isLoopbackAddress(ip) : hostIsLoopback
+    if (!isLocal) return 403
   }
 
-  return true
+  // If connection service is absent, only local loopback callers are allowed for writes
+  if (!connection) {
+    const hasSocket = !!(req.socket || req.connection)
+    if (hasSocket) {
+      if (!ip || !isLoopbackAddress(ip)) {
+        return 403
+      }
+    } else {
+      if (!host || !isLoopbackAddress(host)) {
+        return 403
+      }
+    }
+  }
+
+  return undefined
+}
+
+/** Whether a request may read the status payload. Fail-closed. */
+export function isTrustedRequest(req, options = {}) {
+  return getRejectionStatus(req, options) === undefined
+}
+
+/** Whether a write/mutating request (e.g. POST /scm) is safe. Strict write guard against CSRF. */
+export function isTrustedWriteRequest(req, options = {}) {
+  return getWriteRejectionStatus(req, options) === undefined
 }
 
-function header(req, name) {
+export function header(req, name) {
   if (!req || !req.headers) return ''
   const value = req.headers[name] || req.headers[name.toLowerCase()]
   return typeof value === 'string' ? value.trim() : ''

package/lib/tools/actions.js

@@ -185,3 +185,148 @@ export async function getJobLogSummary(client, { owner, repo, runId, jobId, maxL
     errorHighlights,
   }
 }
+
+export function parseFoldedLog(rawText) {
+  if (!rawText || typeof rawText !== 'string') {
+    return { steps: [], failedStep: null }
+  }
+  const stripped = rawText.replace(/\u001b\[[0-9;]*[a-zA-Z]/g, '').replace(/\r/g, '')
+  const masked = stripped
+    .replace(/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}/g, '[REDACTED_TOKEN]')
+    .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED_TOKEN]')
+
+  const lines = masked.split('\n')
+  const steps = []
+  let currentStep = {
+    name: 'Setup',
+    lines: [],
+    hasError: false,
+    errorHighlights: [],
+  }
+
+  const pushCurrent = () => {
+    if (currentStep.lines.length > 0 || currentStep.name !== 'Setup') {
+      currentStep.errorHighlights = currentStep.lines
+        .filter((l) => /\b(error|failed|failure|fatal)\b|##\[error\]|npm err!/i.test(l))
+        .slice(-10)
+      steps.push(currentStep)
+    }
+  }
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\s?/, '')
+    const groupMatch = line.match(/^##\[group\](.*)$/)
+    if (groupMatch) {
+      pushCurrent()
+      currentStep = {
+        name: groupMatch[1].trim() || 'Step',
+        lines: [],
+        hasError: false,
+        errorHighlights: [],
+      }
+      continue
+    }
+
+    if (line.startsWith('##[endgroup]')) {
+      pushCurrent()
+      currentStep = {
+        name: 'Step',
+        lines: [],
+        hasError: false,
+        errorHighlights: [],
+      }
+      continue
+    }
+
+    if (/\b(error|failed|failure|fatal)\b|##\[error\]|npm err!/i.test(line)) {
+      currentStep.hasError = true
+    }
+    currentStep.lines.push(line)
+  }
+
+  pushCurrent()
+
+  const validSteps = steps.filter((s) => s.lines.length > 0)
+  const failed = validSteps.slice().reverse().find((s) => s.hasError) || null
+
+  return {
+    steps: validSteps.map((s) => ({
+      name: s.name,
+      lineCount: s.lines.length,
+      hasError: s.hasError,
+      errorHighlights: s.errorHighlights,
+      lines: s.lines,
+    })),
+    failedStep: failed ? {
+      name: failed.name,
+      lineCount: failed.lines.length,
+      hasError: true,
+      lines: failed.lines,
+      errorHighlights: failed.errorHighlights,
+    } : null,
+  }
+}
+
+export async function diagnoseRun(client, { owner, repo, runId, jobId, maxLines = 150 } = {}) {
+  ensureRepo({ owner, repo })
+  let targetJobId = jobId
+  let targetJobName = ''
+
+  if (!targetJobId) {
+    if (!runId) throw new Error('either runId or jobId is required')
+    const { jobs } = await listRunJobs(client, { owner, repo, runId })
+    const failedJob = jobs.find((j) => j.conclusion === 'failure') || jobs[0]
+    if (!failedJob) {
+      return { note: `No jobs found for run ${runId}`, steps: [], failedStep: null, summary: 'No jobs found.' }
+    }
+    targetJobId = failedJob.id
+    targetJobName = failedJob.name
+  }
+
+  let logText = ''
+  try {
+    const res = await client.getRaw(`/repos/${owner}/${repo}/actions/jobs/${targetJobId}/logs`)
+    logText = typeof res === 'string' ? res : (res && res.data ? res.data : String(res || ''))
+  } catch (err) {
+    return {
+      runId,
+      jobId: targetJobId,
+      jobName: targetJobName,
+      error: `Could not retrieve logs: ${err && err.message}`,
+      steps: [],
+      failedStep: null,
+      summary: `Failed to fetch logs: ${err && err.message}`,
+    }
+  }
+
+  const parsed = parseFoldedLog(logText)
+  const cap = Math.max(1, Math.min(Number(maxLines) || 150, 500))
+
+  let failedStep = parsed.failedStep
+  if (failedStep && failedStep.lines.length > cap) {
+    failedStep = {
+      ...failedStep,
+      lines: failedStep.lines.slice(-cap),
+      lineCount: failedStep.lines.length,
+    }
+  }
+
+  const summary = failedStep
+    ? `Failed in job "${targetJobName || targetJobId}" at step "${failedStep.name}". Error lines:\n` +
+      failedStep.errorHighlights.map((e) => `• ${e}`).join('\n')
+    : `No failing step detected in job "${targetJobName || targetJobId}".`
+
+  return {
+    runId,
+    jobId: targetJobId,
+    jobName: targetJobName,
+    steps: parsed.steps.map((s) => ({
+      name: s.name,
+      lineCount: s.lineCount,
+      hasError: s.hasError,
+      errorHighlights: s.errorHighlights,
+    })),
+    failedStep,
+    summary,
+  }
+}

package/lib/tools/insights.js

@@ -1,3 +1,4 @@
+import { listSecurityAlerts } from './security.js'
 // Composed reports: the answers a person actually asks for.
 //
 // Each function is a small composition over the plain reads, so the cache in the client
@@ -58,14 +59,23 @@ export async function listContributors(client, { owner, repo, limit = 10 } = {})
 export async function repoReport(client, { owner, repo, commits: commitLimit = 5, issues: issueLimit = 5, contributors: contributorLimit = 5 } = {}) {
   ensureRepo({ owner, repo })
   const overview = await getRepo(client, { owner, repo })
-  const [releases, openIssues, commitList, contributorList] = await Promise.all([
+  const [releases, openIssues, commitList, contributorList, securityAlerts] = await Promise.all([
     listReleases(client, { owner, repo, limit: 1 }).catch(() => ({ releases: [] })),
     listIssues(client, { owner, repo, state: 'open', limit: issueLimit }).catch(() => ({ issues: [] })),
     listCommits(client, { owner, repo, branch: overview.defaultBranch, limit: commitLimit }).catch(() => ({ commits: [] })),
     listContributors(client, { owner, repo, limit: contributorLimit }).catch(() => ({ contributors: [] })),
+    listSecurityAlerts(client, { owner, repo, limit: 10 }).catch(() => null),
   ])
   return {
     repo: overview.fullName,
+    security: securityAlerts ? {
+      totalCount: securityAlerts.totalCount,
+      criticalCount: securityAlerts.criticalCount,
+      highCount: securityAlerts.highCount,
+      dependabotEnabled: securityAlerts.dependabot?.enabled,
+      secretScanningEnabled: securityAlerts.secretScanning?.enabled,
+      codeScanningEnabled: securityAlerts.codeScanning?.enabled,
+    } : { enabled: false },
     description: overview.description,
     stars: overview.stars,
     forks: overview.forks,
@@ -137,7 +147,7 @@ export async function listNotifications(client, { all = false, participating = f
  * A transparent maintenance heuristic. Every point of the score carries its evidence, and the
  * result states plainly that it is not a security audit.
  */
-export function healthOf({ repo, releases = [], issues = [], pulls = [], commits = [] } = {}) {
+export function healthOf({ repo, releases = [], issues = [], pulls = [], commits = [], security = null } = {}) {
   const dimensions = []
   const daysSince = (value) => (value ? Math.floor((Date.now() - Date.parse(value)) / (24 * 60 * 60 * 1000)) : null)
 
@@ -166,12 +176,14 @@ export function healthOf({ repo, releases = [], issues = [], pulls = [], commits
   if (!(repo && repo.license)) risks.push('no license declared')
   if (!(repo && repo.description)) risks.push('no description')
   if (openCount > 10) risks.push('large open issue backlog')
+  if (security && security.criticalCount > 0) risks.push(`${security.criticalCount} critical security alert(s) detected`)
 
   const nextActions = []
   if (!releases.length) nextActions.push('publish the first release')
   if (!(repo && repo.license)) nextActions.push('add a LICENSE')
   if (!(repo && repo.description)) nextActions.push('write a repository description')
   if (pushed !== null && pushed > 90) nextActions.push('push a change or archive the repository')
+  if (security && security.criticalCount > 0) nextActions.push('resolve critical security alerts')
 
   return {
     repo: repo && repo.fullName,
@@ -187,14 +199,15 @@ export function healthOf({ repo, releases = [], issues = [], pulls = [], commits
 /** Repository health for one repository, gathering its own evidence. */
 export async function repoHealth(client, { owner, repo } = {}) {
   ensureRepo({ owner, repo })
-  const [repository, releases, issues, pulls, commits] = await Promise.all([
+  const [repository, releases, issues, pulls, commits, security] = await Promise.all([
     getRepo(client, { owner, repo }),
     listReleases(client, { owner, repo, limit: 3 }).catch(() => ({ releases: [] })),
     listIssues(client, { owner, repo, state: 'open', limit: 30 }).catch(() => ({ issues: [] })),
     listIssues(client, { owner, repo, state: 'open', kind: 'pr', limit: 30 }).catch(() => ({ issues: [] })),
     listCommits(client, { owner, repo, limit: 10 }).catch(() => ({ commits: [] })),
+    listSecurityAlerts(client, { owner, repo, limit: 10 }).catch(() => null),
   ])
-  return healthOf({ repo: repository, releases: releases.releases, issues: issues.issues, pulls: pulls.issues, commits: commits.commits })
+  return healthOf({ repo: repository, releases: releases.releases, issues: issues.issues, pulls: pulls.issues, commits: commits.commits, security })
 }
 
 /** Two repositories side by side, with numeric deltas. */

package/lib/tools/register-insights.js

@@ -1,3 +1,4 @@
+import { listSecurityAlerts, getDependabotAlert } from './security.js'
 // Registrations for the composed reports: the answers a person asks for in one call.
 
 import {
@@ -123,4 +124,33 @@ export function registerInsightTools({ tool, asRepo, client, liveConfig }) {
       return listCommits(await client(), { owner, repo, branch: args.branch, since: args.since, limit: args.limit })
     },
   )
+
+  tool(
+    'gh_security_alerts',
+    'Summary of Dependabot, Secret Scanning, and CodeQL alerts for a repository. Gracefully degrades if alerts are disabled or token lacks security scope. Read-only.',
+    repoParams({
+      state: { type: 'string', description: 'Filter by state (open, fixed, dismissed, all; default "open").' },
+      severity: { type: 'string', description: 'Filter by severity (critical, high, medium, low).' },
+      limit: { type: 'number', description: 'Max alerts per category (default 30, max 100).' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return listSecurityAlerts(await client(), {
+        owner, repo, state: args.state, severity: args.severity, limit: args.limit,
+      })
+    },
+  )
+
+  tool(
+    'gh_dependabot_alert_view',
+    'Read details of a Dependabot alert: vulnerable package, advisory summary, CVSS score, and recommended safe version. Read-only.',
+    repoParams({
+      alertNumber: { type: 'number', description: 'The Dependabot alert number.' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      const num = args.alertNumber ?? args.alert_number
+      return getDependabotAlert(await client(), { owner, repo, alertNumber: num })
+    },
+  )
 }

package/lib/tools/register-ops.js

@@ -13,6 +13,7 @@ import {
   getRunLogsUrl,
   dispatchWorkflow,
   getJobLogSummary,
+  diagnoseRun,
 } from './actions.js'
 import {
   listVariables,
@@ -146,6 +147,19 @@ export function registerOpsTools({ tool, asRepo, client, liveConfig }) {
     })),
   )
 
+  tool(
+    'gh_run_diagnose',
+    'Diagnose a GitHub Actions workflow run failure: parses the job log into folded steps, identifies the failing step, strips ANSI codes, and extracts error highlights and root causes. Read-only.',
+    repoParams({
+      runId: { type: 'number', description: 'Workflow run id (e.g. from gh_run_list).' },
+      jobId: { type: 'number', description: 'Specific job id to inspect (optional, defaults to first failed job).' },
+      maxLines: { type: 'number', description: 'Maximum log lines to return for the failed step (default 150, max 500).' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => diagnoseRun(await client(), {
+      owner, repo, runId: args.runId, jobId: args.jobId, maxLines: args.maxLines,
+    })),
+  )
+
   // ---------------------------------------------------------------- variables
 
   tool(

package/lib/tools/security.js

@@ -0,0 +1,204 @@
+// GitHub Security Alerts: Dependabot, Secret Scanning, and CodeQL (Code Scanning).
+//
+// These endpoints return 404 or 403 if the repository does not have the feature enabled
+// or if the token lacks the security_events / repo scope. The tools degrade gracefully
+// with { enabled: false, reason: "..." } instead of failing the caller.
+
+function ensureRepo({ owner, repo }) {
+  if (!owner || !repo) {
+    throw new Error('owner and repo are required (pass "repository": "owner/repo" or set defaults in settings)')
+  }
+}
+
+function redactSecrets(text) {
+  if (typeof text !== 'string') return text
+  return text
+    .replace(/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}/g, '[REDACTED_TOKEN]')
+    .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED_TOKEN]')
+}
+
+async function safeAlertCall(client, path, query, featureName) {
+  try {
+    const { data } = await client.get(path, { query })
+    return { enabled: true, data: Array.isArray(data) ? data : [] }
+  } catch (err) {
+    const status = err && err.status
+    if (status === 404 || status === 403) {
+      return {
+        enabled: false,
+        reason: `${featureName} is not enabled or token lacks required security scope (HTTP ${status})`,
+        data: [],
+      }
+    }
+    throw err
+  }
+}
+
+export function normalizeDependabotAlert(item) {
+  if (!item || typeof item !== 'object') return item
+  const adv = item.security_advisory || {}
+  const dep = item.dependency || {}
+  const pkg = dep.package || {}
+  const vuln = item.security_vulnerability || {}
+  return {
+    number: item.number,
+    state: item.state,
+    dependency: {
+      packageName: pkg.name || '',
+      ecosystem: pkg.ecosystem || '',
+      manifestPath: dep.manifest_path || '',
+      scope: dep.scope || '',
+    },
+    advisory: {
+      ghsaId: adv.ghsa_id || '',
+      cveId: adv.cve_id || '',
+      summary: redactSecrets(adv.summary || ''),
+      severity: adv.severity || '',
+      cvssScore: (adv.cvss && adv.cvss.score) ?? null,
+    },
+    fixedIn: (vuln.first_patched_version && vuln.first_patched_version.identifier) || null,
+    url: item.html_url || '',
+    createdAt: item.created_at || '',
+  }
+}
+
+export function normalizeSecretAlert(item) {
+  if (!item || typeof item !== 'object') return item
+  return {
+    number: item.number,
+    secretType: item.secret_type || '',
+    secretTypeDisplayName: item.secret_type_display_name || item.secret_type || '',
+    state: item.state || '',
+    resolution: item.resolution || null,
+    url: item.html_url || '',
+    createdAt: item.created_at || '',
+  }
+}
+
+export function normalizeCodeScanningAlert(item) {
+  if (!item || typeof item !== 'object') return item
+  const rule = item.rule || {}
+  const inst = item.most_recent_instance || {}
+  const loc = inst.location || {}
+  return {
+    number: item.number,
+    ruleId: rule.id || '',
+    ruleSeverity: rule.security_severity_level || rule.severity || '',
+    ruleDescription: rule.description || '',
+    state: item.state || '',
+    message: redactSecrets((inst.message && inst.message.text) || ''),
+    path: loc.path || '',
+    startLine: loc.start_line ?? null,
+    url: item.html_url || '',
+    createdAt: item.created_at || '',
+  }
+}
+
+/**
+ * List security alerts across Dependabot, Secret Scanning, and CodeQL.
+ * Gracefully degrades if any feature is disabled or permissions are missing.
+ */
+export async function listSecurityAlerts(client, { owner, repo, state = 'open', severity, limit = 30 } = {}) {
+  ensureRepo({ owner, repo })
+  const perPage = Math.max(1, Math.min(Number(limit) || 30, 100))
+
+  const depQuery = { per_page: perPage }
+  if (state && state !== 'all') depQuery.state = state
+  if (severity) depQuery.severity = severity
+
+  const secQuery = { per_page: perPage }
+  if (state && state !== 'all') secQuery.state = state === 'fixed' || state === 'dismissed' ? 'resolved' : state
+
+  const codeQuery = { per_page: perPage }
+  if (state && state !== 'all') codeQuery.state = state
+  if (severity) codeQuery.severity = severity
+
+  const [depRes, secRes, codeRes] = await Promise.all([
+    safeAlertCall(client, `/repos/${owner}/${repo}/dependabot/alerts`, depQuery, 'Dependabot'),
+    safeAlertCall(client, `/repos/${owner}/${repo}/secret-scanning/alerts`, secQuery, 'Secret Scanning'),
+    safeAlertCall(client, `/repos/${owner}/${repo}/code-scanning/alerts`, codeQuery, 'Code Scanning'),
+  ])
+
+  const dependabotAlerts = depRes.data.map(normalizeDependabotAlert)
+  const secretAlerts = secRes.data.map(normalizeSecretAlert)
+  const codeAlerts = codeRes.data.map(normalizeCodeScanningAlert)
+
+  let criticalCount = 0
+  let highCount = 0
+  let mediumCount = 0
+  let lowCount = 0
+
+  for (const a of dependabotAlerts) {
+    const s = String(a.advisory?.severity || '').toLowerCase()
+    if (s === 'critical') criticalCount++
+    else if (s === 'high') highCount++
+    else if (s === 'medium') mediumCount++
+    else if (s === 'low') lowCount++
+  }
+
+  for (const a of codeAlerts) {
+    const s = String(a.ruleSeverity || '').toLowerCase()
+    if (s === 'critical') criticalCount++
+    else if (s === 'high' || s === 'error') highCount++
+    else if (s === 'medium' || s === 'warning') mediumCount++
+    else if (s === 'low' || s === 'note') lowCount++
+  }
+
+  for (const a of secretAlerts) {
+    if (a.state === 'open') criticalCount++
+  }
+
+  const totalCount = dependabotAlerts.length + secretAlerts.length + codeAlerts.length
+
+  return {
+    owner,
+    repo,
+    totalCount,
+    criticalCount,
+    highCount,
+    mediumCount,
+    lowCount,
+    dependabot: {
+      enabled: depRes.enabled,
+      reason: depRes.reason,
+      count: dependabotAlerts.length,
+      alerts: dependabotAlerts,
+    },
+    secretScanning: {
+      enabled: secRes.enabled,
+      reason: secRes.reason,
+      count: secretAlerts.length,
+      alerts: secretAlerts,
+    },
+    codeScanning: {
+      enabled: codeRes.enabled,
+      reason: codeRes.reason,
+      count: codeAlerts.length,
+      alerts: codeAlerts,
+    },
+  }
+}
+
+/**
+ * Get details for a single Dependabot alert.
+ */
+export async function getDependabotAlert(client, { owner, repo, alertNumber }) {
+  ensureRepo({ owner, repo })
+  if (!alertNumber) throw new Error('alertNumber is required')
+  const num = Number(alertNumber)
+  const { data } = await client.get(`/repos/${owner}/${repo}/dependabot/alerts/${num}`)
+  const norm = normalizeDependabotAlert(data)
+  const adv = (data && data.security_advisory) || {}
+  return {
+    ...norm,
+    advisory: {
+      ...norm.advisory,
+      description: redactSecrets(adv.description || ''),
+      references: (adv.references || []).map((r) => r.url || r),
+    },
+    updatedAt: data.updated_at || '',
+    dismissedAt: data.dismissed_at || '',
+    dismissReason: data.dismiss_reason || '',
+    fixedAt: data.fixed_at || '',
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.6.4",
+  "version": "0.6.6",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",