@intentius/chant 0.63.0 → 0.65.0

package/src/discovery/fold-import.ts

@@ -48,6 +48,18 @@ import { intrinsicCallFoldsEagerly, type IntrinsicDef } from "../lexicon";
 import type { BuildParamValue } from "../build-params";
 
 /**
+ * Implements judgments J2 (the per-file verdict: F-Scan, F-NoExports, F-Bind,
+ * F-Import, F-Namespace, F-Declarator, F-Call, F-Total, F-Reason,
+ * F-IsolatedRefusal), J3 (the identity-taint fixpoint: F-Capture, F-CallLeak,
+ * F-Memo, F-Count, F-Seed, F-Succ, F-Taint, F-Fix, F-Cycle — see
+ * {@link planFoldTaint}), J4's observables (F-Obs-Counters via
+ * {@link foldExecutionCounts}, F-Obs-Report via the `[fold:*]` decision
+ * lines), and the trust rule F-Host-Trust of `spec/hosts.md` (see
+ * {@link isTrustedExecutableBinding}) of the TypeScript-as-Data specification
+ * at https://github.com/INTENTIUS/typescript-as-data, normative for the subset
+ * since INTENTIUS/typescript-as-data#33. Subset changes go spec-first; see
+ * ../fold/subset.ts's module doc for the process.
+ *
  * Bridges the static folder ({@link ../fold/fold}, #1026) into discovery
  * (#1022/#1023, epic #1019): attempts to fold one source file into real
  * `Declarable`/`CompositeInstance` instances with zero execution of the

package/src/fold/fold.ts

@@ -21,6 +21,16 @@ import { isFoldableHelperName } from "./foldable-helpers";
 /**
  * fold — static AST value reducer (chant #1026/#1021/#1024, part of epic #1019)
  *
+ * Implements judgment J1 (`F-Eval-*`, `spec/judgments.md`) and the value domain
+ * (`F-Val-*`, `spec/values.md`) of the TypeScript-as-Data specification at
+ * https://github.com/INTENTIUS/typescript-as-data, which is normative for the
+ * subset since INTENTIUS/typescript-as-data#33. Each branch of {@link fold}
+ * below is one F-Eval rule — the identifier branch is F-Eval-Ident, the
+ * property-access branch F-Eval-Member (its numbered steps match), the call
+ * branch F-Eval-CallHelper / CallIntrinsic / CallLocal / CallEager / CallMethod
+ * in that order — and the envelope types here are F-Val-Domain's cases.
+ * Subset changes go spec-first; see subset.ts's module doc for the process.
+ *
  * Reduces a single-file TypeScript expression AST to a value with NO
  * module execution. The node-kind/operator/key subset it covers — literals,
  * template interpolation, object/array literals (incl. spread), `const`

package/src/fold/subset-doc-parity.test.ts

@@ -64,6 +64,16 @@ import { findSubsetViolation } from "./subset";
  * comment): moving it under a `###` heading with a fenced block, the shape
  * every other case here uses, was necessary but not sufficient — the
  * fixture still has to be run through the right function.
+ *
+ * Two more claims are checked against `fold()` the same way — chant #2348.
+ * "typescript-as-data.mdx" said a method call never folds; #1966 made that
+ * false for a method call whose receiver folds to a real value. Both the
+ * corrected supported claim ("Method calls on folded values") and the
+ * corrected unsupported one ("An array method whose callback is a function
+ * value" — right outcome, `list.map(...)` still falls back, but because the
+ * callback is a function used as a value, not because `.map` is a method
+ * call) were previously unfenced prose sentences too, invisible to this file
+ * for the same reason #2306's was.
  */
 
 const repoRoot = fileURLToPath(new URL("../../../../", import.meta.url));
@@ -193,6 +203,17 @@ describe("subset-doc-parity — supported patterns in typescript-as-data.mdx cla
     if (!wrapped) throw new Error("subset-doc-parity: nullish-coalescing fragment failed to parse");
     expect(findSubsetViolation(wrapped)).toBeUndefined();
   });
+
+  test("Method calls on folded values", () => {
+    // chant #1966/#2348 — findSubsetViolation accepts this shape
+    // unconditionally regardless of whether the receiver actually resolves
+    // (module doc, point above the CallExpression case in ./subset.ts):
+    // shape-valid here is necessary but not sufficient. The real
+    // accept/reject decision is fold()'s, checked below in the
+    // fold()-decided describe block.
+    const consts = parseConsts(extractFencedBlock("Method calls on folded values"));
+    expect(findSubsetViolation(resourceArg(consts, "store"))).toBeUndefined();
+  });
 });
 
 describe("subset-doc-parity — unsupported patterns in typescript-as-data.mdx classify as rejected", () => {
@@ -221,6 +242,14 @@ describe("subset-doc-parity — unsupported patterns in typescript-as-data.mdx c
     const consts = parseConsts(extractFencedBlock("Spread from dynamic sources"));
     expect(findSubsetViolation(resourceArg(consts, "store"))).toBeDefined();
   });
+
+  test("An array method whose callback is a function value", () => {
+    // chant #2348 — the callback argument, an ArrowFunction, is what
+    // findSubsetViolation rejects here (falls through to the catch-all
+    // unsupportedExpressionMessage), not the `.map(...)` method call itself.
+    const consts = parseConsts(extractFencedBlock("An array method whose callback is a function value"));
+    expect(findSubsetViolation(resourceArg(consts, "store"))).toBeDefined();
+  });
 });
 
 describe("subset-doc-parity — fold()-decided claim in typescript-as-data.mdx (#2306)", () => {
@@ -242,3 +271,34 @@ describe("subset-doc-parity — fold()-decided claim in typescript-as-data.mdx (
     expect((error as FoldError).message).toContain("unknownTag");
   });
 });
+
+describe("subset-doc-parity — fold()-decided claims in typescript-as-data.mdx (#2348)", () => {
+  test("Method calls on folded values", () => {
+    // findSubsetViolation only proves the shape is admissible (above); prove
+    // the doc's own example actually folds, and to the value the doc claims,
+    // by running it through fold() with no externals at all — the receiver
+    // (`[prefix, "data"]`) is a plain array literal, so nothing needs to
+    // resolve across a file boundary for this one.
+    const consts = parseConsts(extractFencedBlock("Method calls on folded values"));
+    const arg = resourceArg(consts, "store");
+    expect(fold(arg, consts, [])).toEqual({ name: "acct-data" });
+  });
+
+  test("An array method whose callback is a function value — real reason", () => {
+    // The doc's corrected claim: this falls back because the ARROW FUNCTION
+    // is a value fold refuses, not because `.map` is a method call. Assert
+    // the actual FoldError says so, rather than something naming ".map" or
+    // "method call".
+    const consts = parseConsts(extractFencedBlock("An array method whose callback is a function value"));
+    const arg = resourceArg(consts, "store");
+    let error: unknown;
+    try {
+      fold(arg, consts, []);
+    } catch (e) {
+      error = e;
+    }
+    expect(error).toBeInstanceOf(FoldError);
+    expect((error as FoldError).message).toContain("a function used as a value is not foldable");
+    expect((error as FoldError).message).not.toContain("method call");
+  });
+});

package/src/fold/subset-public-export.test.ts

@@ -0,0 +1,27 @@
+import { describe, test, expect } from "vitest";
+import * as ts from "typescript";
+import * as chant from "../index";
+
+/**
+ * The shape classifier is part of the public entry so a conformance adapter
+ * (INTENTIUS/typescript-as-data#11) and downstream tooling can ask "will this
+ * fold?" without running a fold. This pins the export and its two answers.
+ */
+describe("findSubsetViolation is exported from the package entry", () => {
+  const initializerOf = (src: string) => {
+    const sf = ts.createSourceFile("x.ts", src, ts.ScriptTarget.Latest, true);
+    return (sf.statements[0] as ts.VariableStatement).declarationList.declarations[0].initializer!;
+  };
+  test("is a function on the public namespace", () => {
+    expect(typeof chant.findSubsetViolation).toBe("function");
+    expect(typeof chant.checkObjectMember).toBe("function");
+  });
+  test("classifies a call as EVL001 and a literal as clean", () => {
+    const call = chant.findSubsetViolation(initializerOf("export const x = getId();"));
+    expect(call?.ruleId).toBe("EVL001");
+    expect(chant.findSubsetViolation(initializerOf('export const x = "ok";'))).toBeUndefined();
+  });
+  test("classifies a dynamic element-access key as EVL003", () => {
+    expect(chant.findSubsetViolation(initializerOf("export const x = cfg[key];"))?.ruleId).toBe("EVL003");
+  });
+});

package/src/fold/subset.ts

@@ -3,8 +3,32 @@ import { isFoldableHelperName } from "./foldable-helpers";
 import { intrinsicCallFolds, intrinsicCallFoldsEagerly, type IntrinsicDef } from "../lexicon";
 
 /**
- * subset — the single canonical definition of chant's statically-foldable
- * expression subset (chant #1024, epic #1019).
+ * subset — chant's implementation of the SHAPE layer of the TypeScript-as-Data
+ * specification (chant #1024, epic #1019).
+ *
+ * ## The specification is normative; this file implements it
+ *
+ * Since INTENTIUS/typescript-as-data#33 (2026-09-10) the subset is defined by
+ * the specification at https://github.com/INTENTIUS/typescript-as-data, not by
+ * this file. The rules this module implements are the `S-*` productions of
+ * `spec/grammar.md` §2 — S-Unwrap, S-Literal, S-Ident, S-Template, S-Tagged,
+ * S-Object (S-Prop / S-Shorthand / S-SpreadProp), S-Array, S-Member, S-Index,
+ * S-Unary, S-Binary, S-Conditional, S-New, the S-Call forms (S-CallHelper,
+ * S-CallIntrinsic, S-CallEager, S-CallMethod, S-CompositeStep) and S-Reject —
+ * and the direction rule `F-Direction` of `spec/divergence.md`: this classifier
+ * may accept what `fold()` rejects, never the reverse, outside the two named
+ * exceptions F-Exc-Lazy and F-Exc-Registry. The "environment-dependent
+ * exceptions" enumerated below are `spec/divergence.md`'s F-Div-* rows, kept
+ * here as implementation notes on WHY each resolution is out of this module's
+ * reach.
+ *
+ * Changing the subset goes spec-first: propose and land the rule there (with a
+ * fixture), then implement it here citing the identifier, then release. The
+ * provisional path for a change needed before the rule can be written: land it
+ * with the affected rule marked PROVISIONAL in this doc naming the spec issue;
+ * a provisional marker may survive at most one release, and the docs may not
+ * describe the change as supported until the rule exists. See
+ * `spec/README.md` "Ownership" and chant #2354.
  *
  * `fold()` ({@link "./fold"}, the enforcement layer — a construct outside
  * this subset simply has no case there) and EVL001/EVL003

package/src/identity.ts

@@ -161,7 +161,7 @@ export const REDACTED = "[redacted]";
  * name, so a lexicon that echoes one of these into an identity string has the
  * value removed before it is printed or serialized.
  */
-const CREDENTIAL_ENV_NAME =
+export const CREDENTIAL_ENV_NAME =
   /(SECRET|TOKEN|PASSWORD|PASSWD|CREDENTIAL|PRIVATE_KEY|APIKEY|API_KEY|ACCESS_KEY|SESSION_KEY|AUTH)/i;
 
 /** Shortest env value worth redacting. Below this a "secret" is a false positive. */
@@ -171,7 +171,7 @@ const MIN_CREDENTIAL_LENGTH = 8;
  * Literal credential shapes. Each is something a principal string cannot be,
  * so matching one is proof rather than a guess.
  */
-const CREDENTIAL_SHAPES: RegExp[] = [
+export const CREDENTIAL_SHAPES: RegExp[] = [
   // A PEM block of any key type.
   /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
   // A JWT: three base64url segments, the first starting with the `{"` header.
@@ -180,6 +180,32 @@ const CREDENTIAL_SHAPES: RegExp[] = [
   /\b(?:Bearer|Basic)\s+[A-Za-z0-9\-._~+/]{16,}={0,2}/g,
 ];
 
+/**
+ * Provider-prefixed access tokens, by their issuer's own prefix (#2356).
+ *
+ * Separate from {@link CREDENTIAL_SHAPES} because these are a **denylist of
+ * known formats** rather than proof-by-shape. A prefix nobody has added here —
+ * a new provider, an internal issuer, a bare random string — passes every one
+ * of them, and any caller relying on this must say so rather than claim
+ * coverage. What it does buy is that the tokens people actually paste are
+ * caught wherever they appear, whatever the field is called.
+ *
+ * The suffix bound is deliberately short. The prefix is the signal; a truncated
+ * or example token is still somebody having written a credential down.
+ */
+export const CREDENTIAL_TOKEN_SHAPES: { name: string; re: RegExp }[] = [
+  { name: "a GitHub token", re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{6,}\b/g },
+  { name: "a GitHub fine-grained token", re: /\bgithub_pat_[A-Za-z0-9_]{6,}\b/g },
+  { name: "a GitLab personal access token", re: /\bglpat-[A-Za-z0-9_-]{3,}\b/g },
+  { name: "an OpenAI-style secret key", re: /\bsk-(?:live-|proj-|test-)?[A-Za-z0-9]{6,}\b/g },
+  { name: "a Stripe key", re: /\b[rs]k_(?:live|test)_[A-Za-z0-9]{6,}\b/g },
+  { name: "a Slack token", re: /\bxox[abposr]-[A-Za-z0-9-]{6,}\b/g },
+  { name: "an AWS access key id", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  { name: "a Google API key", re: /\bAIza[0-9A-Za-z_-]{20,}\b/g },
+  { name: "a Google OAuth token", re: /\bya29\.[0-9A-Za-z_-]{10,}/g },
+  { name: "an npm token", re: /\bnpm_[A-Za-z0-9]{10,}\b/g },
+];
+
 /**
  * Strip credential material from one reported field.
  *
@@ -205,6 +231,9 @@ export function redactCredentialMaterial(
     out = out.split(secret).join(REDACTED);
   }
   for (const shape of CREDENTIAL_SHAPES) out = out.replace(shape, REDACTED);
+  // Provider-prefixed tokens too (#2356): these are the ones people paste, and
+  // the three shapes above match none of them.
+  for (const { re } of CREDENTIAL_TOKEN_SHAPES) out = out.replace(re, REDACTED);
   return out;
 }
 

package/src/index.ts

@@ -39,6 +39,11 @@ export * from "./graph-layout";
 export * from "./graph-lens";
 export * from "./detectLexicon";
 export * from "./fold/fold";
+// The shape classifier is the predicate downstream tooling asks "will this
+// fold?" of without running a fold (subset.ts module doc, point 2c), and the
+// half of the fold subset a conformance adapter needs that `fold()` alone
+// does not expose. INTENTIUS/typescript-as-data#11.
+export { findSubsetViolation, checkObjectMember, type SubsetViolation, type SubsetRuleId } from "./fold/subset";
 export * from "./lint/parser";
 export * from "./lint/rule";
 export * from "./lint/rules";
@@ -57,6 +62,7 @@ export * from "./observation";
 export * from "./identity";
 export * from "./apply";
 export * from "./deep-observation";
+export * from "./behaviour";
 export * from "./claimed-fields";
 export * from "./fold-provenance";
 export * from "./owner-chain";

package/src/lexicon.ts

@@ -23,6 +23,7 @@ import type { IREdge } from "./graph-ir";
 import type { DescribeResourcesResult, UnobservedReason } from "./observation";
 import type { DescribeIdentityOptions, DescribeIdentityResult } from "./identity";
 import type { DeepNormalizationHooks, DeepObservationResult } from "./deep-observation";
+import type { BehaviourResult, PredictBehaviourOptions } from "./behaviour";
 import type { DisruptionQuery, DisruptionVerdict } from "./lifecycle/disruption";
 import type { OwnerChainVerdict } from "./owner-chain";
 import type { CommandGroup } from "./cli/command-group";
@@ -1413,6 +1414,51 @@ export interface LexiconPlugin {
    */
   deepNormalizationHooks?: DeepNormalizationHooks;
 
+  /**
+   * Predict what the declared estate would *do* at a stated traffic level
+   * (#2356) — cost per hour, headroom, an error-rate expectation, a resilience
+   * verdict under a named failure, and a right-size hint, per entity, every
+   * figure carrying its provenance. Opt-in, and the fourth member of the
+   * observation family beside {@link describeResources}, {@link
+   * observeResourcesDeep} and {@link listArtifacts}.
+   *
+   * It is the odd one out in that family, and the type says so. The other three
+   * report what a substrate was asked and answered. This one reports what an
+   * engine believes would happen at a level nobody has run yet, so it is
+   * `predict`, not `observe`, and its result can never be read as a
+   * measurement or a bill: money exists only as a `PredictedRate` for one
+   * imagined hour, every entity states the `at` its figures answer, and
+   * `provenance.basis` says `modeled` or `validated` on every one of them. See
+   * `../behaviour.ts` for the full argument.
+   *
+   * Options mirror {@link observeResourcesDeep}'s field for field, plus
+   * `traffic` — a caller already driving the deep read drives this with the
+   * same object. What the options deliberately cannot carry is a credential:
+   * every name for one is declared `?: never`, because the engine is handed the
+   * resource graph and nothing else, reaches no account, and writes nothing.
+   *
+   * Three verdicts per entity, on the tri-state discipline #1089 established
+   * and a stricter total: PREDICTED (a key in `entities`),
+   * NOT-PREDICTABLE-FOR-THIS-KIND (`unpredicted` with `unsupported-kind` — an
+   * engine with no model for a kind says so and never returns zero), and
+   * NOT-PREDICTED (`unpredicted` with another reason). Every name the caller
+   * asked about lands in one map or the other; unlike the thin read there is no
+   * third position, because a prediction has no equivalent of "the provider
+   * says it is not there".
+   *
+   * A missing or unreachable engine is a `BehaviourRefusalReport` — the other
+   * arm of the result union, with no `entities` map to be empty and no total to
+   * be zero — carrying a named cause and a message that names the variable it
+   * wanted, in the style of `noGitlabNoteTokenMessage`
+   * (`./op/activities/reconcile.ts`). Build one with
+   * `noBehaviourEngineRefusal` / `unreachableBehaviourEngineRefusal` rather
+   * than by hand.
+   *
+   * Throwing is the whole-lexicon failure, same as the other reads. Prefer the
+   * refusal: it says which variable, and a stack trace does not.
+   */
+  predictBehaviour?(options: PredictBehaviourOptions): Promise<BehaviourResult>;
+
   /**
    * Report the live status of one deploy unit by its deployed name. Opt-in.
    *

package/src/op/activities/reconcile.test.ts

@@ -18,6 +18,7 @@ import {
   suppliedMarker,
   noIssueTokenMessage,
   postOrUpdateGithubIssue,
+  ghCredentialEnv,
 } from "./reconcile";
 
 // ── The `gh` stub (chant #2291) ──────────────────────────────────────────────
@@ -251,6 +252,32 @@ describe("commentTokenFrom (#2291)", () => {
   });
 });
 
+describe("ghCredentialEnv (#2333)", () => {
+  const token = { value: "resolved-token", source: "CHANT_FORGEJO_TOKEN" };
+
+  test("carries the resolved value under GH_ENTERPRISE_TOKEN, the variable a non-github.com host reads", () => {
+    expect(ghCredentialEnv({}, token).GH_ENTERPRISE_TOKEN).toBe("resolved-token");
+  });
+
+  test("carries it under GH_TOKEN too, so github.com reads the same value it always did", () => {
+    expect(ghCredentialEnv({}, token).GH_TOKEN).toBe("resolved-token");
+  });
+
+  test("the two never disagree — one resolution, whichever class gh puts the host in", () => {
+    const env = ghCredentialEnv({ GH_TOKEN: "stale-ambient" }, token);
+    expect(env.GH_TOKEN).toBe(env.GH_ENTERPRISE_TOKEN);
+  });
+
+  test("sets no GH_HOST: the full URL already names the host, and GH_HOST is the default for calls that do not", () => {
+    expect(ghCredentialEnv({}, token)).not.toHaveProperty("GH_HOST");
+  });
+
+  test("passes the rest of the base environment through untouched", () => {
+    expect(ghCredentialEnv({ PATH: "/usr/bin", GITHUB_API_URL: "http://forgejo.example/api/v1" }, token))
+      .toMatchObject({ PATH: "/usr/bin", GITHUB_API_URL: "http://forgejo.example/api/v1" });
+  });
+});
+
 describe("reconcilePr comment mode posts a full-URL `gh api` call (#2291)", () => {
   const repo = "acme/infra";
 
@@ -341,6 +368,43 @@ describe("reconcilePr comment mode posts a full-URL `gh api` call (#2291)", () =
     }
   });
 
+  // #2333: the full URL #2291 built reached Forgejo, but `gh` scopes
+  // GH_TOKEN to github.com and ghe.com subdomains, so the POST/PATCH arrived
+  // with no Authorization header and a real instance answered 401.
+  test("every comment-mode `gh` call carries GH_ENTERPRISE_TOKEN, which is what a Forgejo host reads (#2333)", async () => {
+    stubPrEnv("http://forgejo.example/api/v1");
+    vi.stubEnv("CHANT_FORGEJO_TOKEN", "cross-instance-token");
+    ghReplies = [
+      { match: "--paginate", stdout: "" },
+      { match: "--method POST", stdout: "http://forgejo.example/acme/infra/issues/5#issuecomment-1\n" },
+    ];
+    try {
+      await reconcilePr({ env: "app", mode: "comment", body: "the plan" });
+      expect(ghCalls.length).toBeGreaterThan(0);
+      for (const call of ghCalls) {
+        expect(call.opts.env?.GH_ENTERPRISE_TOKEN).toBe("cross-instance-token");
+      }
+    } finally {
+      vi.unstubAllEnvs();
+    }
+  });
+
+  test("the PATCH branch carries it too, not only the POST (#2333)", async () => {
+    stubPrEnv("http://forgejo.example/api/v1");
+    vi.stubEnv("CHANT_FORGEJO_TOKEN", "cross-instance-token");
+    ghReplies = [
+      { match: "--paginate", stdout: "4242\n" },
+      { match: "--method PATCH", stdout: "http://forgejo.example/acme/infra/issues/5#issuecomment-1\n" },
+    ];
+    try {
+      await reconcilePr({ env: "app", mode: "comment", body: "the plan" });
+      const patch = ghCalls.find((c) => c.cmd.includes("--method PATCH"));
+      expect(patch?.opts.env?.GH_ENTERPRISE_TOKEN).toBe("cross-instance-token");
+    } finally {
+      vi.unstubAllEnvs();
+    }
+  });
+
   test("a pull request with no token at all is refused by name, before any `gh` call", async () => {
     stubPrEnv("http://forgejo.example/api/v1");
     vi.stubEnv("GH_TOKEN", "");
@@ -1292,6 +1356,26 @@ describe("reconcilePr issue mode sends the token it resolved (#2320)", () => {
     }
   });
 
+  // #2333: the same credential hole comment mode had. Issue mode's writes
+  // were already refused by the forgejo generator for exactly this reason.
+  test("every issue-mode `gh` call carries GH_ENTERPRISE_TOKEN as well (#2333)", async () => {
+    stubForgejoIssueEnv();
+    vi.stubEnv("CHANT_FORGEJO_TOKEN", "forgejo-cross-instance");
+    ghReplies = [
+      { match: "--paginate", stdout: "" },
+      { match: "--method POST", stdout: "https://other.forgejo.example/acme/infra/issues/1\n" },
+    ];
+    try {
+      await reconcilePr({ env: "app", op: "nightly", mode: "issue", body: "plan" });
+      expect(ghCalls).toHaveLength(2);
+      for (const call of ghCalls) {
+        expect(call.opts.env?.GH_ENTERPRISE_TOKEN).toBe("forgejo-cross-instance");
+      }
+    } finally {
+      vi.unstubAllEnvs();
+    }
+  });
+
   test("falls back to GH_TOKEN then GITHUB_TOKEN, the same order comment mode uses", async () => {
     stubForgejoIssueEnv();
     vi.stubEnv("CHANT_FORGEJO_TOKEN", "");

package/src/op/activities/reconcile.ts

@@ -65,18 +65,22 @@ const execAsync = promisify(exec);
  * half works — plain paginated listing (no `/search/issues`, confirmed
  * absent from Forgejo's own OpenAPI spec) and the `.pull_request == null`
  * filter both behave exactly as they do against github.com. The *write*
- * half does not, for a reason no mock could have caught: `gh`'s own
+ * half did not, for a reason no mock could have caught: `gh`'s own
  * `GH_TOKEN`/`GITHUB_TOKEN` only authenticate a request to github.com or a
  * ghe.com subdomain (`gh help environment`), never a self-hosted Forgejo,
- * and this function's POST/PATCH calls (like `postOrUpdateComment`'s) carry
- * only `GH_TOKEN` — no `GH_HOST`, no `GH_ENTERPRISE_TOKEN`. Every write this
- * mode makes on a real Forgejo instance fails with `{"message":"token is
- * required"}` (HTTP 401), confirmed with `GH_DEBUG=api` sending no
- * `Authorization` header at all. The forgejo Op generator refuses
- * `findingMode: "issue"` by name for this reason (chant #2315); this
- * activity's own behavior is unchanged; a hand-authored (non-generated)
- * workflow that calls it directly against a Forgejo host will hit the same
- * 401 the generator now refuses to produce.
+ * and both this function's POST/PATCH calls and `postOrUpdateComment`'s
+ * carried only `GH_TOKEN`. Every write either made on a real Forgejo
+ * instance failed with `{"message":"token is required"}` (HTTP 401), with
+ * `GH_DEBUG=api` showing no `Authorization` header at all — which is what
+ * shipped in 0.62.0 and 0.63.0, `comment` mode included.
+ *
+ * Both paths now forward that credential as `GH_ENTERPRISE_TOKEN` as well as
+ * `GH_TOKEN`, which is the variable `gh` reads for a host in neither of those
+ * two classes (chant #2333). Re-run against the same live instance from a
+ * shell with no stored `gh auth login`, the identical POST now sends
+ * `Authorization: token …` and returns HTTP 201. See {@link ghCredentialEnv}
+ * for the whole probe, for why `GH_HOST` turned out not to be needed
+ * alongside it, and for why github.com's own behavior is untouched.
  */
 export type ReconcileMode = "pull-request" | "issue" | "report" | "comment";
 
@@ -485,6 +489,69 @@ export function commentTokenFrom(env: Record<string, string | undefined>): Comme
   return undefined;
 }
 
+/**
+ * The environment a `gh api` call carries {@link commentTokenFrom}'s resolved
+ * credential in (chant #2333).
+ *
+ * `GH_TOKEN` alone is not enough, and that is `gh`'s documented behavior
+ * rather than a bug in it. `gh` picks the token per *request host*:
+ * `GH_TOKEN`/`GITHUB_TOKEN` are scoped to github.com and `ghe.com`
+ * subdomains, and every other host — a self-hosted Forgejo, a self-hosted
+ * GitHub Enterprise Server — reads `GH_ENTERPRISE_TOKEN`/
+ * `GITHUB_ENTERPRISE_TOKEN` instead (`gh help environment`). #2291 fixed the
+ * *URL* half of reaching a non-github.com host and left this half untouched,
+ * so 0.62.0 and 0.63.0 both shipped a `comment` mode that posts to Forgejo
+ * with no `Authorization` header at all.
+ *
+ * Confirmed against a real Forgejo 12.0.4+gitea-1.22.0 instance under #2333,
+ * from a shell whose `GH_CONFIG_DIR` held no `gh auth login` — the condition
+ * a fresh Actions checkout starts from, and the one #2304's verification did
+ * not reproduce. Driving this function's own POST with `GH_DEBUG=api`:
+ * `GH_TOKEN` alone sent no `Authorization` header and got HTTP 401
+ * `{"message":"token is required"}`, `GH_TOKEN` with `GITHUB_TOKEN` beside it
+ * got the same 401, and `GH_TOKEN` with `GH_HOST` beside it got the same 401
+ * again. `GH_ENTERPRISE_TOKEN` sent `Authorization: token …` and got HTTP 201.
+ *
+ * So the fix is one variable, set to the same value: whichever class `gh`
+ * decides the host falls into, the credential it finds there is the one
+ * {@link commentTokenFrom} resolved. That is why this does not branch on the
+ * forge, and why it needs no host detection of chant's own — the thing that
+ * broke was `gh`'s host classification, and setting both classes to one value
+ * is what stops chant depending on it.
+ *
+ * ## Why `GH_HOST` is deliberately not set
+ *
+ * #2333 proposed `GH_ENTERPRISE_TOKEN` *plus* a `GH_HOST` derived from
+ * `GITHUB_API_URL`, on the reading that the pair was needed. It is not: the
+ * live instance took `GH_ENTERPRISE_TOKEN` on its own, with no `GH_HOST`
+ * anywhere in the environment, because {@link githubApiBaseFrom} already
+ * hands `gh api` a full URL and `gh` reads the host off that URL rather than
+ * off its default. `GH_HOST` sets the *default* host for calls that name no
+ * host — which is what `gh issue create`'s ambient fallback below relies on —
+ * so setting it would buy nothing here and put a variable into the
+ * environment of calls that do not want one.
+ *
+ * ## Why github.com is unchanged
+ *
+ * Both variables carry the same value, so the question is only which one
+ * `gh` reads, and github.com reads `GH_TOKEN`. Probed against the real
+ * api.github.com the same way: a valid `GH_TOKEN` with a deliberately
+ * garbage `GH_ENTERPRISE_TOKEN` beside it succeeded, and a garbage `GH_TOKEN`
+ * with a valid `GH_ENTERPRISE_TOKEN` beside it failed `Bad credentials`.
+ * `GH_TOKEN` wins on github.com whatever the enterprise variable holds, so
+ * the header a github.com call sends is byte-identical to the one it sent
+ * before this change.
+ *
+ * A *self-hosted* GHES host is in the same class as Forgejo and was equally
+ * broken — same `gh` code path, same missing header — so it is fixed by the
+ * same variable rather than merely preserved. That was inferred from `gh`'s
+ * documented scoping in #2332 and is not exercised here: no GHES instance was
+ * available to test against.
+ */
+export function ghCredentialEnv(base: NodeJS.ProcessEnv, token: CommentToken): NodeJS.ProcessEnv {
+  return { ...base, GH_TOKEN: token.value, GH_ENTERPRISE_TOKEN: token.value };
+}
+
 /** What a `comment`-mode step says on a pull request it has no credential for. */
 export function noCommentTokenMessage(repo: string, number: number): string {
   return (
@@ -518,10 +585,12 @@ export function noIssueTokenMessage(repo: string): string {
  * Every call targets a full URL built from {@link githubApiBaseFrom} rather
  * than the bare relative path this used before #2291 — see that function for
  * why a bare path broke Forgejo specifically. The token is resolved
- * explicitly via {@link commentTokenFrom} and forwarded as `GH_TOKEN`, which
- * is a strict superset of `gh`'s own ambient resolution: same value in the
- * common case, a named refusal instead of `gh`'s opaque 401 when neither is
- * set.
+ * explicitly via {@link commentTokenFrom} and forwarded through {@link
+ * ghCredentialEnv}, which is a strict superset of `gh`'s own ambient
+ * resolution: same value in the common case, a named refusal instead of
+ * `gh`'s opaque 401 when neither is set, and — since chant #2333 — the same
+ * value under `GH_ENTERPRISE_TOKEN` too, without which the full URL #2291
+ * built reached Forgejo carrying no credential.
  */
 async function postOrUpdateComment(
   ctx: PullRequestContext,
@@ -531,7 +600,7 @@ async function postOrUpdateComment(
 ): Promise<string> {
   const token = commentTokenFrom(process.env);
   if (!token) throw new Error(noCommentTokenMessage(ctx.repo, ctx.number));
-  const env = { ...process.env, GH_TOKEN: token.value };
+  const env = ghCredentialEnv(process.env, token);
 
   const base = githubApiBaseFrom(process.env);
   const listUrl = `${base}/repos/${ctx.repo}/issues/${ctx.number}/comments`;
@@ -598,8 +667,8 @@ export type GhExec = (
  * Server the same way it reaches github.com.
  *
  * The credential is resolved and forwarded the same way too (chant #2320),
- * through {@link commentTokenFrom} and out as `GH_TOKEN` on every call. It
- * did not used to be: `reconcilePr` handed this `(cmd) => execAsync(cmd, {
+ * through {@link commentTokenFrom} and out through {@link ghCredentialEnv} on
+ * every call. It did not used to be: `reconcilePr` handed this `(cmd) => execAsync(cmd, {
  * signal })` with no `env` at all, so `CHANT_FORGEJO_TOKEN` never reached
  * `gh` and the one case that variable exists for — posting to a Forgejo
  * instance other than the one the job runs on, where `github.token`'s scope
@@ -643,10 +712,9 @@ export type GhExec = (
  *    open` on a real Forgejo 12.0.4+gitea-1.22.0 instance interleaves pull
  *    requests with issues exactly as GitHub's endpoint does, and the
  *    `.pull_request == null` filter below excludes them correctly. The write
- *    calls this function makes do not clear the same instance — see the
- *    module doc's `issue` bullet for why, and why the forgejo Op generator
- *    refuses this mode rather than generating a job that would 401 on every
- *    run.
+ *    calls this function makes did not clear the same instance until chant
+ *    #2333 gave them a credential `gh` would apply to that host — see the
+ *    module doc's `issue` bullet and {@link ghCredentialEnv}.
  *
  * So this reuses the recipe `postOrUpdateComment` already proved for PR
  * comments: list, `--paginate`, filter with `--jq` by an exact `startswith`
@@ -686,7 +754,7 @@ export async function postOrUpdateGithubIssue(
 ): Promise<string> {
   const token = commentTokenFrom(process.env);
   if (!token) throw new Error(noIssueTokenMessage(repo));
-  const env = { ...process.env, GH_TOKEN: token.value };
+  const env = ghCredentialEnv(process.env, token);
 
   const base = githubApiBaseFrom(process.env);
   const listUrl = `${base}/repos/${repo}/issues?state=open`;