@goodandready/dsh-github-ops 0.6.5 → 0.6.6

package/lib/client.js

@@ -127,6 +127,15 @@ window.__ModuleLoader__.load({
       panelPulls: 'Pull requests',
       panelRuns: 'Actions',
       panelInbox: 'Inbox',
+      panelSecurity: 'Security',
+      panelSecurityEmpty: 'No security alerts found.',
+      panelSecurityDisabled: 'Security features are disabled or token lacks security scope.',
+      panelDiagnose: 'Diagnose',
+      panelDiagnosing: 'Diagnosing…',
+      panelDiagnoseAsk: 'Ask Agent to Diagnose & Fix',
+      panelDiagnoseCopied: 'Prompt copied to clipboard!',
+      panelSteps: 'Steps',
+      panelFailedStep: 'Failed Step',
       panelOpen: 'Open in browser',
       panelEmpty: 'Nothing here yet.',
       panelLoading: 'Loading…',
@@ -240,6 +249,15 @@ window.__ModuleLoader__.load({
       panelPulls: 'Pull request',
       panelRuns: 'Actions',
       panelInbox: '收件箱',
+      panelSecurity: '安全',
+      panelSecurityEmpty: '未发现安全警报。',
+      panelSecurityDisabled: '安全功能已禁用或令牌缺少安全权限。',
+      panelDiagnose: '诊断',
+      panelDiagnosing: '诊断中…',
+      panelDiagnoseAsk: '请智能体诊断并修复',
+      panelDiagnoseCopied: '提示词已复制到剪贴板！',
+      panelSteps: '步骤',
+      panelFailedStep: '失败步骤',
       panelOpen: '在浏览器中打开',
       panelEmpty: '这里还没有内容。',
       panelLoading: '加载中…',
@@ -784,6 +802,11 @@ window.__ModuleLoader__.load({
       const [items, setItems] = React.useState({ phase: 'idle', list: [] })
       const [error, setError] = React.useState('')
       const [loading, setLoading] = React.useState(false)
+      const [securityData, setSecurityData] = React.useState({ phase: 'idle', data: null })
+      const [diagnostics, setDiagnostics] = React.useState(null)
+      const [diagnoseLoadingId, setDiagnoseLoadingId] = React.useState(null)
+      const [expandedSteps, setExpandedSteps] = React.useState({})
+      const [copiedPrompt, setCopiedPrompt] = React.useState(false)
 
       const call = React.useCallback((params) => {
         if (typeof fetch !== 'function') return Promise.reject(new Error('fetch is unavailable in this client'))
@@ -823,6 +846,37 @@ window.__ModuleLoader__.load({
           .catch((err) => { setItems({ phase: 'error', list: [] }); setError(String((err && err.message) || err)) })
       }, [call, repo])
 
+      const loadSecurity = React.useCallback(() => {
+        if (!repo) return
+        setSecurityData({ phase: 'loading', data: null })
+        call({ what: 'security', repo })
+          .then((payload) => setSecurityData({ phase: 'ready', data: payload }))
+          .catch((err) => { setSecurityData({ phase: 'error', data: null }); setError(String((err && err.message) || err)) })
+      }, [call, repo])
+
+      const loadDiagnostics = (runId) => {
+        if (!repo || !runId) return
+        setDiagnoseLoadingId(runId)
+        call({ what: 'diagnose_run', repo, runId })
+          .then((res) => {
+            setDiagnostics(res)
+            if (res.failedStep) setExpandedSteps({ [res.failedStep.name]: true })
+          })
+          .catch((err) => setError(String((err && err.message) || err)))
+          .finally(() => setDiagnoseLoadingId(null))
+      }
+
+      const askAgent = (diag) => {
+        const text = `Please diagnose and fix CI failure for repository ${repo} run #${diag.runId} (${diag.jobName || 'job'}):\nFailed Step: ${diag.failedStep ? diag.failedStep.name : 'Unknown'}\n\nTop Errors:\n` +
+          ((diag.failedStep && diag.failedStep.errorHighlights) || []).map((e) => ' - ' + e).join('\n') +
+          (diag.failedStep && diag.failedStep.lines ? `\n\nStep Log excerpt:\n` + diag.failedStep.lines.slice(-30).join('\n') : '')
+        if (typeof navigator !== 'undefined' && navigator.clipboard && navigator.clipboard.writeText) {
+          navigator.clipboard.writeText(text).catch(() => {})
+        }
+        setCopiedPrompt(true)
+        setTimeout(() => setCopiedPrompt(false), 4000)
+      }
+
       const loadInbox = React.useCallback(() => {
         setItems({ phase: 'loading', list: [] })
         call({ what: 'inbox' })
@@ -835,8 +889,9 @@ window.__ModuleLoader__.load({
         if (tab === 'tree') loadTree('')
         else if (tab === 'inbox') loadInbox()
         else if (tab === 'matrix') loadMatrix()
+        else if (tab === 'security') loadSecurity()
         else loadList(tab)
-      }, [repo, tab, loadTree, loadList, loadInbox])
+      }, [repo, tab, loadTree, loadList, loadInbox, loadSecurity])
 
       const openFile = (entry) => {
         if (entry.type === 'tree') { loadTree(entry.path); return }
@@ -887,10 +942,42 @@ window.__ModuleLoader__.load({
       const list = (() => {
         if (items.phase === 'loading') return React.createElement('div', { className: 'gho-panel-muted' }, t('panelLoading'))
         if (!items.list.length) return React.createElement('div', { className: 'gho-panel-muted' }, t('panelEmpty'))
-        return items.list.slice(0, 40).map((item, index) => React.createElement('div', { className: 'gho-panel-item', key: `${item.number || item.id || index}` },
-          React.createElement('span', { className: 'gho-panel-file' }, item.number ? `#${item.number}` : (item.name || '')),
-          React.createElement('span', null, item.title || item.displayTitle || item.reason || item.name || ''),
-          item.url || item.html_url ? React.createElement('a', { className: 'gho-link', href: item.url || item.html_url, target: '_blank', rel: 'noreferrer' }, '↗') : null,
+        return items.list.slice(0, 40).map((item, index) => React.createElement('div', { key: `${item.number || item.id || index}` },
+          React.createElement('div', { className: 'gho-panel-item' },
+            React.createElement('span', { className: 'gho-panel-file' }, item.number ? `#${item.number}` : (item.name || '')),
+            React.createElement('span', null, item.title || item.displayTitle || item.reason || item.name || ''),
+            tab === 'runs' ? React.createElement('button', {
+              type: 'button',
+              className: 'gho-diagnose-btn',
+              style: { marginLeft: '8px' },
+              onClick: (e) => { e.stopPropagation(); loadDiagnostics(item.id) },
+            }, diagnoseLoadingId === item.id ? t('panelDiagnosing') : t('panelDiagnose')) : null,
+            item.url || item.html_url ? React.createElement('a', { className: 'gho-link', href: item.url || item.html_url, target: '_blank', rel: 'noreferrer' }, '↗') : null,
+          ),
+          diagnostics && diagnostics.runId === item.id ? React.createElement('div', { style: { padding: '8px', border: '1px solid var(--dsw-alias-border-l2)', borderRadius: '6px', margin: '4px 0 8px', background: 'var(--dsw-alias-bg-layer-2)' } },
+            React.createElement('div', { style: { display: 'flex', justifyContent: 'space-between', alignItems: 'center', marginBottom: '8px' } },
+              React.createElement('span', { style: { fontWeight: 600, fontSize: '12px' } }, diagnostics.summary || t('panelSteps')),
+              React.createElement('button', {
+                type: 'button',
+                className: 'gho-diagnose-btn',
+                style: { background: 'var(--dsw-alias-color-primary, #1f6feb)', color: '#fff', border: 0 },
+                onClick: () => askAgent(diagnostics),
+              }, copiedPrompt ? t('panelDiagnoseCopied') : t('panelDiagnoseAsk')),
+            ),
+            (diagnostics.steps || []).map((step, sIdx) => {
+              const isExp = expandedSteps[step.name] ?? step.hasError
+              return React.createElement('div', { key: sIdx, className: `gho-step-folded ${step.hasError ? 'gho-step-err' : ''}`, style: { margin: '4px 0' } },
+                React.createElement('div', {
+                  style: { display: 'flex', justifyContent: 'space-between', cursor: 'pointer', padding: '4px 6px' },
+                  onClick: () => setExpandedSteps((prev) => ({ ...prev, [step.name]: !isExp })),
+                },
+                  React.createElement('span', { style: { fontSize: '12px', fontWeight: step.hasError ? 600 : 400 } }, `${isExp ? '▾' : '▸'} ${step.name} (${step.lineCount} lines)`),
+                  step.hasError ? React.createElement('span', { className: 'gho-badge gho-badge-failing' }, t('panelFailedStep')) : React.createElement('span', { style: { color: 'var(--dsw-alias-color-success, #2ea043)' } }, '✓'),
+                ),
+                isExp && step.lines && step.lines.length ? React.createElement('pre', { className: 'gho-panel-pre gho-step-lines' }, step.lines.join('\n')) : null,
+              )
+            }),
+          ) : null,
         ))
       })()
 
@@ -951,6 +1038,44 @@ window.__ModuleLoader__.load({
         )
       })()
 
+      const securityView = (() => {
+        if (securityData.phase === 'loading') return React.createElement('div', { className: 'gho-panel-muted' }, t('panelLoading'))
+        const data = securityData.data
+        if (!data) return React.createElement('div', { className: 'gho-panel-muted' }, t('panelEmpty'))
+
+        const allDisabled = !data.dependabot?.enabled && !data.secretScanning?.enabled && !data.codeScanning?.enabled
+        if (allDisabled) {
+          return React.createElement('div', { className: 'gho-panel-muted', style: { padding: '8px 0' } },
+            t('panelSecurityDisabled'),
+            data.dependabot?.reason ? React.createElement('div', { style: { fontSize: '11px', marginTop: '4px' } }, data.dependabot.reason) : null,
+          )
+        }
+
+        const alerts = [
+          ...(data.dependabot?.alerts || []).map((a) => ({ ...a, kind: 'dependabot' })),
+          ...(data.secretScanning?.alerts || []).map((a) => ({ ...a, kind: 'secret' })),
+          ...(data.codeScanning?.alerts || []).map((a) => ({ ...a, kind: 'code' })),
+        ]
+
+        if (!alerts.length) {
+          return React.createElement('div', { className: 'gho-panel-muted', style: { padding: '8px 0' } }, t('panelSecurityEmpty'))
+        }
+
+        return React.createElement('div', null,
+          React.createElement('div', { style: { display: 'flex', gap: '8px', margin: '4px 0 8px' } },
+            React.createElement('span', { className: 'gho-badge gho-badge-active' }, `${data.totalCount || 0} Total`),
+            data.criticalCount ? React.createElement('span', { className: 'gho-badge gho-badge-failing' }, `${data.criticalCount} Critical`) : null,
+            data.highCount ? React.createElement('span', { className: 'gho-badge gho-badge-building' }, `${data.highCount} High`) : null,
+          ),
+          alerts.map((alert, idx) => React.createElement('div', { key: alert.number || idx, className: 'gho-panel-item' },
+            React.createElement('span', { className: 'gho-panel-file' }, alert.kind === 'dependabot' ? (alert.dependency?.packageName || 'pkg') : (alert.kind === 'secret' ? (alert.secretTypeDisplayName || 'Secret') : (alert.ruleId || 'CodeQL'))),
+            React.createElement('span', { style: { flex: 1, fontSize: '12px' } }, alert.advisory?.summary || alert.message || alert.secretType || ''),
+            React.createElement('span', { className: `gho-badge gho-badge-${(alert.advisory?.severity || alert.ruleSeverity || 'active').toLowerCase() === 'critical' ? 'failing' : 'building'}` }, alert.advisory?.severity || alert.ruleSeverity || alert.state),
+            alert.url ? React.createElement('a', { className: 'gho-link', href: alert.url, target: '_blank', rel: 'noreferrer' }, '↗') : null,
+          )),
+        )
+      })()
+
       return React.createElement('div', { className: 'gho-panel' },
         header,
         React.createElement('div', { className: 'gho-panel-tabs' },
@@ -958,12 +1083,13 @@ window.__ModuleLoader__.load({
           tabButton('issues', t('panelIssues')),
           tabButton('pulls', t('panelPulls')),
           tabButton('runs', t('panelRuns')),
+          tabButton('security', t('panelSecurity')),
           tabButton('inbox', t('panelInbox')),
           tabButton('matrix', t('panelMatrix')),
           React.createElement('button', { type: 'button', className: 'gho-panel-tab', onClick: () => { setRepo(''); setFile(null) } }, t('panelRepo')),
         ),
         error ? React.createElement('div', { className: 'gho-panel-muted' }, error) : null,
-        tab === 'tree' ? treeView : (tab === 'matrix' ? matrixView : list),
+        tab === 'tree' ? treeView : (tab === 'matrix' ? matrixView : (tab === 'security' ? securityView : list)),
       )
     }
 
@@ -998,6 +1124,10 @@ window.__ModuleLoader__.load({
         '.gho-badge-building{background:var(--dsw-alias-color-warning-bg,rgba(210,153,34,0.15));color:var(--dsw-alias-color-warning,#d29922)}',
         '.gho-badge-released{background:var(--dsw-alias-color-info-bg,rgba(56,139,253,0.15));color:var(--dsw-alias-color-info,#388bfd)}',
         '.gho-badge-active{background:var(--dsw-alias-bg-layer-3);color:var(--dsw-alias-label-secondary)}',
+        '.gho-step-folded{border-radius:6px;background:var(--dsw-alias-bg-layer-2);margin-bottom:4px}',
+        '.gho-step-err{border-left:3px solid var(--dsw-alias-label-error,#f85149);background:rgba(248,81,73,0.08)}',
+        '.gho-step-lines{max-height:220px;overflow-y:auto;font-size:11px;padding:6px;margin:2px 0 6px}',
+        '.gho-diagnose-btn{font-size:11px;padding:2px 6px;border-radius:4px;cursor:pointer;border:1px solid var(--dsw-alias-border-l2);background:transparent}',
         '.gho-matrix-table{width:100%;border-collapse:collapse;font-size:11px;margin-top:6px}',
         '.gho-matrix-th{text-align:left;padding:4px 6px;border-bottom:1px solid var(--dsw-alias-border-l2);color:var(--dsw-alias-label-secondary)}',
         '.gho-matrix-td{padding:5px 6px;border-bottom:1px solid var(--dsw-alias-border-l2);vertical-align:middle}',

package/lib/routes.js

@@ -14,7 +14,8 @@ import { parseStatus, parseBranches, parseStashes, parseWorktrees, parseCount, s
 import { SseEventManager } from './events.js'
 import { encodeRepoPath } from './github.js'
 import { listIssues } from './tools/issues.js'
-import { listRuns } from './tools/actions.js'
+import { listRuns, diagnoseRun } from './tools/actions.js'
+import { listSecurityAlerts } from './tools/security.js'
 import { listNotifications, repoTreeView } from './tools/panel-data.js'
 import { mirrorStatus, syncMirror } from './tools/mirror.js'
 import { matrixStatus } from './tools/matrix.js'
@@ -391,6 +392,17 @@ export function registerRoutes(ctx, deps = {}) {
               const result = await listRuns(github, { ...repo, limit: 20 })
               return sendJson(res, 200, { configured: true, items: result.runs })
             }
+            if (what === 'security') {
+              const severity = url.searchParams.get('severity') || undefined
+              const result = await listSecurityAlerts(github, { ...repo, state, severity, limit: 50 })
+              return sendJson(res, 200, { configured: true, ...result })
+            }
+            if (what === 'diagnose_run') {
+              const runId = Number(url.searchParams.get('runId'))
+              const jobId = url.searchParams.get('jobId') ? Number(url.searchParams.get('jobId')) : undefined
+              const result = await diagnoseRun(github, { ...repo, runId, jobId })
+              return sendJson(res, 200, { configured: true, ...result })
+            }
             if (what === 'inbox') {
               const result = await listNotifications(github, { limit: 30 })
               return sendJson(res, 200, { configured: true, ...result })

package/lib/tools/actions.js

@@ -185,3 +185,148 @@ export async function getJobLogSummary(client, { owner, repo, runId, jobId, maxL
     errorHighlights,
   }
 }
+
+export function parseFoldedLog(rawText) {
+  if (!rawText || typeof rawText !== 'string') {
+    return { steps: [], failedStep: null }
+  }
+  const stripped = rawText.replace(/\u001b\[[0-9;]*[a-zA-Z]/g, '').replace(/\r/g, '')
+  const masked = stripped
+    .replace(/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}/g, '[REDACTED_TOKEN]')
+    .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED_TOKEN]')
+
+  const lines = masked.split('\n')
+  const steps = []
+  let currentStep = {
+    name: 'Setup',
+    lines: [],
+    hasError: false,
+    errorHighlights: [],
+  }
+
+  const pushCurrent = () => {
+    if (currentStep.lines.length > 0 || currentStep.name !== 'Setup') {
+      currentStep.errorHighlights = currentStep.lines
+        .filter((l) => /\b(error|failed|failure|fatal)\b|##\[error\]|npm err!/i.test(l))
+        .slice(-10)
+      steps.push(currentStep)
+    }
+  }
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z\s?/, '')
+    const groupMatch = line.match(/^##\[group\](.*)$/)
+    if (groupMatch) {
+      pushCurrent()
+      currentStep = {
+        name: groupMatch[1].trim() || 'Step',
+        lines: [],
+        hasError: false,
+        errorHighlights: [],
+      }
+      continue
+    }
+
+    if (line.startsWith('##[endgroup]')) {
+      pushCurrent()
+      currentStep = {
+        name: 'Step',
+        lines: [],
+        hasError: false,
+        errorHighlights: [],
+      }
+      continue
+    }
+
+    if (/\b(error|failed|failure|fatal)\b|##\[error\]|npm err!/i.test(line)) {
+      currentStep.hasError = true
+    }
+    currentStep.lines.push(line)
+  }
+
+  pushCurrent()
+
+  const validSteps = steps.filter((s) => s.lines.length > 0)
+  const failed = validSteps.slice().reverse().find((s) => s.hasError) || null
+
+  return {
+    steps: validSteps.map((s) => ({
+      name: s.name,
+      lineCount: s.lines.length,
+      hasError: s.hasError,
+      errorHighlights: s.errorHighlights,
+      lines: s.lines,
+    })),
+    failedStep: failed ? {
+      name: failed.name,
+      lineCount: failed.lines.length,
+      hasError: true,
+      lines: failed.lines,
+      errorHighlights: failed.errorHighlights,
+    } : null,
+  }
+}
+
+export async function diagnoseRun(client, { owner, repo, runId, jobId, maxLines = 150 } = {}) {
+  ensureRepo({ owner, repo })
+  let targetJobId = jobId
+  let targetJobName = ''
+
+  if (!targetJobId) {
+    if (!runId) throw new Error('either runId or jobId is required')
+    const { jobs } = await listRunJobs(client, { owner, repo, runId })
+    const failedJob = jobs.find((j) => j.conclusion === 'failure') || jobs[0]
+    if (!failedJob) {
+      return { note: `No jobs found for run ${runId}`, steps: [], failedStep: null, summary: 'No jobs found.' }
+    }
+    targetJobId = failedJob.id
+    targetJobName = failedJob.name
+  }
+
+  let logText = ''
+  try {
+    const res = await client.getRaw(`/repos/${owner}/${repo}/actions/jobs/${targetJobId}/logs`)
+    logText = typeof res === 'string' ? res : (res && res.data ? res.data : String(res || ''))
+  } catch (err) {
+    return {
+      runId,
+      jobId: targetJobId,
+      jobName: targetJobName,
+      error: `Could not retrieve logs: ${err && err.message}`,
+      steps: [],
+      failedStep: null,
+      summary: `Failed to fetch logs: ${err && err.message}`,
+    }
+  }
+
+  const parsed = parseFoldedLog(logText)
+  const cap = Math.max(1, Math.min(Number(maxLines) || 150, 500))
+
+  let failedStep = parsed.failedStep
+  if (failedStep && failedStep.lines.length > cap) {
+    failedStep = {
+      ...failedStep,
+      lines: failedStep.lines.slice(-cap),
+      lineCount: failedStep.lines.length,
+    }
+  }
+
+  const summary = failedStep
+    ? `Failed in job "${targetJobName || targetJobId}" at step "${failedStep.name}". Error lines:\n` +
+      failedStep.errorHighlights.map((e) => `• ${e}`).join('\n')
+    : `No failing step detected in job "${targetJobName || targetJobId}".`
+
+  return {
+    runId,
+    jobId: targetJobId,
+    jobName: targetJobName,
+    steps: parsed.steps.map((s) => ({
+      name: s.name,
+      lineCount: s.lineCount,
+      hasError: s.hasError,
+      errorHighlights: s.errorHighlights,
+    })),
+    failedStep,
+    summary,
+  }
+}

package/lib/tools/insights.js

@@ -1,3 +1,4 @@
+import { listSecurityAlerts } from './security.js'
 // Composed reports: the answers a person actually asks for.
 //
 // Each function is a small composition over the plain reads, so the cache in the client
@@ -58,14 +59,23 @@ export async function listContributors(client, { owner, repo, limit = 10 } = {})
 export async function repoReport(client, { owner, repo, commits: commitLimit = 5, issues: issueLimit = 5, contributors: contributorLimit = 5 } = {}) {
   ensureRepo({ owner, repo })
   const overview = await getRepo(client, { owner, repo })
-  const [releases, openIssues, commitList, contributorList] = await Promise.all([
+  const [releases, openIssues, commitList, contributorList, securityAlerts] = await Promise.all([
     listReleases(client, { owner, repo, limit: 1 }).catch(() => ({ releases: [] })),
     listIssues(client, { owner, repo, state: 'open', limit: issueLimit }).catch(() => ({ issues: [] })),
     listCommits(client, { owner, repo, branch: overview.defaultBranch, limit: commitLimit }).catch(() => ({ commits: [] })),
     listContributors(client, { owner, repo, limit: contributorLimit }).catch(() => ({ contributors: [] })),
+    listSecurityAlerts(client, { owner, repo, limit: 10 }).catch(() => null),
   ])
   return {
     repo: overview.fullName,
+    security: securityAlerts ? {
+      totalCount: securityAlerts.totalCount,
+      criticalCount: securityAlerts.criticalCount,
+      highCount: securityAlerts.highCount,
+      dependabotEnabled: securityAlerts.dependabot?.enabled,
+      secretScanningEnabled: securityAlerts.secretScanning?.enabled,
+      codeScanningEnabled: securityAlerts.codeScanning?.enabled,
+    } : { enabled: false },
     description: overview.description,
     stars: overview.stars,
     forks: overview.forks,
@@ -137,7 +147,7 @@ export async function listNotifications(client, { all = false, participating = f
  * A transparent maintenance heuristic. Every point of the score carries its evidence, and the
  * result states plainly that it is not a security audit.
  */
-export function healthOf({ repo, releases = [], issues = [], pulls = [], commits = [] } = {}) {
+export function healthOf({ repo, releases = [], issues = [], pulls = [], commits = [], security = null } = {}) {
   const dimensions = []
   const daysSince = (value) => (value ? Math.floor((Date.now() - Date.parse(value)) / (24 * 60 * 60 * 1000)) : null)
 
@@ -166,12 +176,14 @@ export function healthOf({ repo, releases = [], issues = [], pulls = [], commits
   if (!(repo && repo.license)) risks.push('no license declared')
   if (!(repo && repo.description)) risks.push('no description')
   if (openCount > 10) risks.push('large open issue backlog')
+  if (security && security.criticalCount > 0) risks.push(`${security.criticalCount} critical security alert(s) detected`)
 
   const nextActions = []
   if (!releases.length) nextActions.push('publish the first release')
   if (!(repo && repo.license)) nextActions.push('add a LICENSE')
   if (!(repo && repo.description)) nextActions.push('write a repository description')
   if (pushed !== null && pushed > 90) nextActions.push('push a change or archive the repository')
+  if (security && security.criticalCount > 0) nextActions.push('resolve critical security alerts')
 
   return {
     repo: repo && repo.fullName,
@@ -187,14 +199,15 @@ export function healthOf({ repo, releases = [], issues = [], pulls = [], commits
 /** Repository health for one repository, gathering its own evidence. */
 export async function repoHealth(client, { owner, repo } = {}) {
   ensureRepo({ owner, repo })
-  const [repository, releases, issues, pulls, commits] = await Promise.all([
+  const [repository, releases, issues, pulls, commits, security] = await Promise.all([
     getRepo(client, { owner, repo }),
     listReleases(client, { owner, repo, limit: 3 }).catch(() => ({ releases: [] })),
     listIssues(client, { owner, repo, state: 'open', limit: 30 }).catch(() => ({ issues: [] })),
     listIssues(client, { owner, repo, state: 'open', kind: 'pr', limit: 30 }).catch(() => ({ issues: [] })),
     listCommits(client, { owner, repo, limit: 10 }).catch(() => ({ commits: [] })),
+    listSecurityAlerts(client, { owner, repo, limit: 10 }).catch(() => null),
   ])
-  return healthOf({ repo: repository, releases: releases.releases, issues: issues.issues, pulls: pulls.issues, commits: commits.commits })
+  return healthOf({ repo: repository, releases: releases.releases, issues: issues.issues, pulls: pulls.issues, commits: commits.commits, security })
 }
 
 /** Two repositories side by side, with numeric deltas. */

package/lib/tools/register-insights.js

@@ -1,3 +1,4 @@
+import { listSecurityAlerts, getDependabotAlert } from './security.js'
 // Registrations for the composed reports: the answers a person asks for in one call.
 
 import {
@@ -123,4 +124,33 @@ export function registerInsightTools({ tool, asRepo, client, liveConfig }) {
       return listCommits(await client(), { owner, repo, branch: args.branch, since: args.since, limit: args.limit })
     },
   )
+
+  tool(
+    'gh_security_alerts',
+    'Summary of Dependabot, Secret Scanning, and CodeQL alerts for a repository. Gracefully degrades if alerts are disabled or token lacks security scope. Read-only.',
+    repoParams({
+      state: { type: 'string', description: 'Filter by state (open, fixed, dismissed, all; default "open").' },
+      severity: { type: 'string', description: 'Filter by severity (critical, high, medium, low).' },
+      limit: { type: 'number', description: 'Max alerts per category (default 30, max 100).' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      return listSecurityAlerts(await client(), {
+        owner, repo, state: args.state, severity: args.severity, limit: args.limit,
+      })
+    },
+  )
+
+  tool(
+    'gh_dependabot_alert_view',
+    'Read details of a Dependabot alert: vulnerable package, advisory summary, CVSS score, and recommended safe version. Read-only.',
+    repoParams({
+      alertNumber: { type: 'number', description: 'The Dependabot alert number.' },
+    }),
+    async (args) => {
+      const { owner, repo } = await asRepo(args, liveConfig())
+      const num = args.alertNumber ?? args.alert_number
+      return getDependabotAlert(await client(), { owner, repo, alertNumber: num })
+    },
+  )
 }

package/lib/tools/register-ops.js

@@ -13,6 +13,7 @@ import {
   getRunLogsUrl,
   dispatchWorkflow,
   getJobLogSummary,
+  diagnoseRun,
 } from './actions.js'
 import {
   listVariables,
@@ -146,6 +147,19 @@ export function registerOpsTools({ tool, asRepo, client, liveConfig }) {
     })),
   )
 
+  tool(
+    'gh_run_diagnose',
+    'Diagnose a GitHub Actions workflow run failure: parses the job log into folded steps, identifies the failing step, strips ANSI codes, and extracts error highlights and root causes. Read-only.',
+    repoParams({
+      runId: { type: 'number', description: 'Workflow run id (e.g. from gh_run_list).' },
+      jobId: { type: 'number', description: 'Specific job id to inspect (optional, defaults to first failed job).' },
+      maxLines: { type: 'number', description: 'Maximum log lines to return for the failed step (default 150, max 500).' },
+    }),
+    async (args) => withRepo(args, async ({ owner, repo }) => diagnoseRun(await client(), {
+      owner, repo, runId: args.runId, jobId: args.jobId, maxLines: args.maxLines,
+    })),
+  )
+
   // ---------------------------------------------------------------- variables
 
   tool(

package/lib/tools/security.js

@@ -0,0 +1,204 @@
+// GitHub Security Alerts: Dependabot, Secret Scanning, and CodeQL (Code Scanning).
+//
+// These endpoints return 404 or 403 if the repository does not have the feature enabled
+// or if the token lacks the security_events / repo scope. The tools degrade gracefully
+// with { enabled: false, reason: "..." } instead of failing the caller.
+
+function ensureRepo({ owner, repo }) {
+  if (!owner || !repo) {
+    throw new Error('owner and repo are required (pass "repository": "owner/repo" or set defaults in settings)')
+  }
+}
+
+function redactSecrets(text) {
+  if (typeof text !== 'string') return text
+  return text
+    .replace(/(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}/g, '[REDACTED_TOKEN]')
+    .replace(/Bearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED_TOKEN]')
+}
+
+async function safeAlertCall(client, path, query, featureName) {
+  try {
+    const { data } = await client.get(path, { query })
+    return { enabled: true, data: Array.isArray(data) ? data : [] }
+  } catch (err) {
+    const status = err && err.status
+    if (status === 404 || status === 403) {
+      return {
+        enabled: false,
+        reason: `${featureName} is not enabled or token lacks required security scope (HTTP ${status})`,
+        data: [],
+      }
+    }
+    throw err
+  }
+}
+
+export function normalizeDependabotAlert(item) {
+  if (!item || typeof item !== 'object') return item
+  const adv = item.security_advisory || {}
+  const dep = item.dependency || {}
+  const pkg = dep.package || {}
+  const vuln = item.security_vulnerability || {}
+  return {
+    number: item.number,
+    state: item.state,
+    dependency: {
+      packageName: pkg.name || '',
+      ecosystem: pkg.ecosystem || '',
+      manifestPath: dep.manifest_path || '',
+      scope: dep.scope || '',
+    },
+    advisory: {
+      ghsaId: adv.ghsa_id || '',
+      cveId: adv.cve_id || '',
+      summary: redactSecrets(adv.summary || ''),
+      severity: adv.severity || '',
+      cvssScore: (adv.cvss && adv.cvss.score) ?? null,
+    },
+    fixedIn: (vuln.first_patched_version && vuln.first_patched_version.identifier) || null,
+    url: item.html_url || '',
+    createdAt: item.created_at || '',
+  }
+}
+
+export function normalizeSecretAlert(item) {
+  if (!item || typeof item !== 'object') return item
+  return {
+    number: item.number,
+    secretType: item.secret_type || '',
+    secretTypeDisplayName: item.secret_type_display_name || item.secret_type || '',
+    state: item.state || '',
+    resolution: item.resolution || null,
+    url: item.html_url || '',
+    createdAt: item.created_at || '',
+  }
+}
+
+export function normalizeCodeScanningAlert(item) {
+  if (!item || typeof item !== 'object') return item
+  const rule = item.rule || {}
+  const inst = item.most_recent_instance || {}
+  const loc = inst.location || {}
+  return {
+    number: item.number,
+    ruleId: rule.id || '',
+    ruleSeverity: rule.security_severity_level || rule.severity || '',
+    ruleDescription: rule.description || '',
+    state: item.state || '',
+    message: redactSecrets((inst.message && inst.message.text) || ''),
+    path: loc.path || '',
+    startLine: loc.start_line ?? null,
+    url: item.html_url || '',
+    createdAt: item.created_at || '',
+  }
+}
+
+/**
+ * List security alerts across Dependabot, Secret Scanning, and CodeQL.
+ * Gracefully degrades if any feature is disabled or permissions are missing.
+ */
+export async function listSecurityAlerts(client, { owner, repo, state = 'open', severity, limit = 30 } = {}) {
+  ensureRepo({ owner, repo })
+  const perPage = Math.max(1, Math.min(Number(limit) || 30, 100))
+
+  const depQuery = { per_page: perPage }
+  if (state && state !== 'all') depQuery.state = state
+  if (severity) depQuery.severity = severity
+
+  const secQuery = { per_page: perPage }
+  if (state && state !== 'all') secQuery.state = state === 'fixed' || state === 'dismissed' ? 'resolved' : state
+
+  const codeQuery = { per_page: perPage }
+  if (state && state !== 'all') codeQuery.state = state
+  if (severity) codeQuery.severity = severity
+
+  const [depRes, secRes, codeRes] = await Promise.all([
+    safeAlertCall(client, `/repos/${owner}/${repo}/dependabot/alerts`, depQuery, 'Dependabot'),
+    safeAlertCall(client, `/repos/${owner}/${repo}/secret-scanning/alerts`, secQuery, 'Secret Scanning'),
+    safeAlertCall(client, `/repos/${owner}/${repo}/code-scanning/alerts`, codeQuery, 'Code Scanning'),
+  ])
+
+  const dependabotAlerts = depRes.data.map(normalizeDependabotAlert)
+  const secretAlerts = secRes.data.map(normalizeSecretAlert)
+  const codeAlerts = codeRes.data.map(normalizeCodeScanningAlert)
+
+  let criticalCount = 0
+  let highCount = 0
+  let mediumCount = 0
+  let lowCount = 0
+
+  for (const a of dependabotAlerts) {
+    const s = String(a.advisory?.severity || '').toLowerCase()
+    if (s === 'critical') criticalCount++
+    else if (s === 'high') highCount++
+    else if (s === 'medium') mediumCount++
+    else if (s === 'low') lowCount++
+  }
+
+  for (const a of codeAlerts) {
+    const s = String(a.ruleSeverity || '').toLowerCase()
+    if (s === 'critical') criticalCount++
+    else if (s === 'high' || s === 'error') highCount++
+    else if (s === 'medium' || s === 'warning') mediumCount++
+    else if (s === 'low' || s === 'note') lowCount++
+  }
+
+  for (const a of secretAlerts) {
+    if (a.state === 'open') criticalCount++
+  }
+
+  const totalCount = dependabotAlerts.length + secretAlerts.length + codeAlerts.length
+
+  return {
+    owner,
+    repo,
+    totalCount,
+    criticalCount,
+    highCount,
+    mediumCount,
+    lowCount,
+    dependabot: {
+      enabled: depRes.enabled,
+      reason: depRes.reason,
+      count: dependabotAlerts.length,
+      alerts: dependabotAlerts,
+    },
+    secretScanning: {
+      enabled: secRes.enabled,
+      reason: secRes.reason,
+      count: secretAlerts.length,
+      alerts: secretAlerts,
+    },
+    codeScanning: {
+      enabled: codeRes.enabled,
+      reason: codeRes.reason,
+      count: codeAlerts.length,
+      alerts: codeAlerts,
+    },
+  }
+}
+
+/**
+ * Get details for a single Dependabot alert.
+ */
+export async function getDependabotAlert(client, { owner, repo, alertNumber }) {
+  ensureRepo({ owner, repo })
+  if (!alertNumber) throw new Error('alertNumber is required')
+  const num = Number(alertNumber)
+  const { data } = await client.get(`/repos/${owner}/${repo}/dependabot/alerts/${num}`)
+  const norm = normalizeDependabotAlert(data)
+  const adv = (data && data.security_advisory) || {}
+  return {
+    ...norm,
+    advisory: {
+      ...norm.advisory,
+      description: redactSecrets(adv.description || ''),
+      references: (adv.references || []).map((r) => r.url || r),
+    },
+    updatedAt: data.updated_at || '',
+    dismissedAt: data.dismissed_at || '',
+    dismissReason: data.dismiss_reason || '',
+    fixedAt: data.fixed_at || '',
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-github-ops",
-  "version": "0.6.5",
+  "version": "0.6.6",
   "description": "GitHub operations for DeepSeek Harness: releases, tags, a guarded generic API pass-through, workflow runs, secrets and sanitized mirror publication.",
   "license": "MIT",
   "type": "module",