@joshuafolkken/kit 1.1514.0 → 1.2114.0

package/scripts/agent/codex-agent-argv.ts

@@ -1,20 +1,47 @@
-import { lstatSync, mkdirSync } from 'node:fs'
+import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync } from 'node:fs'
 import path from 'node:path'
 import { git_common_directory } from '#scripts/git/git-common-directory'
+import { durable_state } from '#scripts/josh/durable-state'
 import { OBSERVATION_LEDGER_DIRECTORY } from '#scripts/observations/observation-ledger'
 import { agent_role_profile, type AgentProfile } from './agent-role-profile'
 
 const AGENT_COMMAND = 'codex'
-const AGENT_FLAGS: ReadonlyArray<string> = ['exec', '--sandbox', 'workspace-write']
+const AGENT_FLAGS: ReadonlyArray<string> = ['exec']
 const MODEL_FLAG = '--model'
 const CONFIG_FLAG = '-c'
 const JSON_FLAG = '--json'
-const NETWORK_CONFIG = 'sandbox_workspace_write.network_access=true'
 const SQLITE_CACHE_PATH = ['node_modules', '.cache', 'josh', 'openai']
 const EPHEMERAL_FLAG = '--ephemeral'
-const ADD_DIRECTORY_FLAG = '--add-dir'
 const GIT_DIRECTORY = '.git'
 const LEDGER_DIRECTORY = path.dirname(OBSERVATION_LEDGER_DIRECTORY)
+const WORKTREE_REGISTRY = 'worktrees'
+const READ = 'read'
+const WRITE = 'write'
+
+// The sandbox is a Codex permission profile, not `--sandbox workspace-write` with `--add-dir` roots
+// (joshuafolkken/kit#4653). It reads the whole disk and writes the work tree, the temp directories, the
+// network and the common git directory — whose root a ref deletion needs: `git branch -d` and
+// `git stash drop` rewrite `packed-refs` through `packed-refs.lock` there.
+const PERMISSION_PROFILE = 'josh_lane'
+const PROFILE_CONFIG = `default_permissions="${PERMISSION_PROFILE}"`
+const NETWORK_CONFIG = `permissions.${PERMISSION_PROFILE}.network.enabled=true`
+const FILESYSTEM_KEY = `permissions.${PERMISSION_PROFILE}.filesystem`
+const BASE_GRANTS: ReadonlyArray<Grant> = [
+	[':root', READ],
+	[':workspace_roots', WRITE],
+	[':slash_tmp', WRITE],
+	[':tmpdir', WRITE],
+]
+// What git runs or follows to another directory stays read-only, so the sandbox cannot plant code that
+// runs outside it the next time anything runs git: `hooks/` and `config`, and the `commondir` and
+// `config.worktree` that would point a git directory at a planted one. An exact read-only path also
+// refuses creating, renaming and deleting it (measured on codex-cli 0.156.1).
+const PINNED_WORKTREE_ENTRIES: ReadonlyArray<string> = ['commondir', 'config.worktree']
+const PINNED_ENTRIES: ReadonlyArray<string> = ['hooks', 'config', ...PINNED_WORKTREE_ENTRIES]
+// Each registered work tree's git directory is pinned the same way; one registered after launch — a
+// later lane, or the detached tree `josh test:red` and `josh metrics` add (`base-tree.ts`) — is not.
+
+type Grant = readonly [string, string]
 
 interface CodexArgv {
 	command: string
@@ -34,20 +61,49 @@ function persistence_arguments(profile: AgentProfile): ReadonlyArray<string> {
 	return profile.role === agent_role_profile.WORKER ? [] : [EPHEMERAL_FLAG]
 }
 
-function ensure_ledger_directory(directory: string): void {
+// A granted directory is created up front — it would otherwise be created in a directory the sandbox
+// cannot write — and refused when it is not a real directory, so a symlink cannot widen the grant.
+function ensure_writable_directory(directory: string, mode?: number): void {
 	const current = lstatSync(directory, { throwIfNoEntry: false })
 
-	if (current === undefined) mkdirSync(directory, { recursive: true })
+	if (current === undefined) mkdirSync(directory, { recursive: true, mode })
 	else if (!current.isDirectory() || current.isSymbolicLink()) {
-		throw new Error(`Ledger directory must be a real directory: ${directory}`)
+		throw new Error(`Writable root must be a real directory: ${directory}`)
 	}
 }
 
+function pinned(directory: string, entries: ReadonlyArray<string>): ReadonlyArray<Grant> {
+	return entries.map((entry) => [path.join(directory, entry), READ])
+}
+
+function registered_worktrees(common_directory: string): ReadonlyArray<string> {
+	const registry = path.join(common_directory, WORKTREE_REGISTRY)
+	if (!existsSync(registry)) return []
+
+	return readdirSync(registry, { withFileTypes: true })
+		.filter((entry) => entry.isDirectory())
+		.map((entry) => path.join(registry, entry.name))
+}
+
+// Real paths, since the sandbox matches resolved paths: a `.git` reached through a symlink is granted
+// where it lives, and an entry of it that is a symlink is not followed out of it.
+function git_grants(common_directory: string | undefined): ReadonlyArray<Grant> {
+	if (common_directory === undefined) return []
+
+	const root = realpathSync(common_directory)
+
+	return [
+		[root, WRITE],
+		...pinned(root, PINNED_ENTRIES),
+		...registered_worktrees(root).flatMap((worktree) => pinned(worktree, PINNED_WORKTREE_ENTRIES)),
+	]
+}
+
 // Only the ledger's parent directory is writable outside a lane, never the primary checkout root.
-function ledger_arguments(
+function ledger_grants(
 	common_directory: string | undefined,
 	profile: AgentProfile,
-): ReadonlyArray<string> {
+): ReadonlyArray<Grant> {
 	if (
 		common_directory === undefined ||
 		profile.role !== agent_role_profile.WORKER ||
@@ -56,27 +112,68 @@ function ledger_arguments(
 		return []
 	}
 
-	const directory = path.join(path.dirname(common_directory), LEDGER_DIRECTORY)
+	const ledger = path.join(path.dirname(common_directory), LEDGER_DIRECTORY)
+
+	ensure_writable_directory(ledger)
 
-	ensure_ledger_directory(directory)
+	return [[realpathSync(ledger), WRITE]]
+}
+
+// An inline TOML table; a JSON string is a valid TOML basic string.
+function filesystem_config(grants: ReadonlyArray<Grant>): string {
+	const pairs = grants.map(
+		([target, access]) => `${JSON.stringify(target)}=${JSON.stringify(access)}`,
+	)
 
-	return [ADD_DIRECTORY_FLAG, directory]
+	return `${FILESYSTEM_KEY}={${pairs.join(',')}}`
 }
 
-function lane_arguments(cwd: string, profile: AgentProfile): ReadonlyArray<string> {
+// A `backlogrun` parent runs in the primary checkout, where no common git directory grant is given,
+// so the run-state directory its lanes write through that grant is granted on its own — without it the
+// parent's records would fall back to the temp root, apart from its lanes'.
+function state_grants(cwd: string): ReadonlyArray<Grant> {
+	const repository = git_common_directory.repository(cwd)
+	if (repository === undefined) return []
+
+	const state = durable_state.root_for(repository)
+
+	ensure_writable_directory(state, durable_state.STATE_DIRECTORY_MODE)
+
+	return [[realpathSync(state), WRITE]]
+}
+
+function lane_grants(cwd: string | undefined, profile: AgentProfile): ReadonlyArray<Grant> {
+	if (cwd === undefined) return []
+
 	const common_directory = git_common_directory.resolve(cwd)
-	const additional_directory =
-		common_directory === undefined ? [] : [ADD_DIRECTORY_FLAG, common_directory]
+
+	if (common_directory === undefined) return state_grants(cwd)
+
+	return [...git_grants(common_directory), ...ledger_grants(common_directory, profile)]
+}
+
+function permission_arguments(
+	cwd: string | undefined,
+	profile: AgentProfile,
+): ReadonlyArray<string> {
+	const grants = [...BASE_GRANTS, ...lane_grants(cwd, profile)]
 
 	return [
 		CONFIG_FLAG,
-		sqlite_config(cwd),
-		...persistence_arguments(profile),
-		...additional_directory,
-		...ledger_arguments(common_directory, profile),
+		PROFILE_CONFIG,
+		CONFIG_FLAG,
+		filesystem_config(grants),
+		CONFIG_FLAG,
+		NETWORK_CONFIG,
 	]
 }
 
+function lane_arguments(cwd: string | undefined, profile: AgentProfile): ReadonlyArray<string> {
+	if (cwd === undefined) return []
+
+	return [CONFIG_FLAG, sqlite_config(cwd), ...persistence_arguments(profile)]
+}
+
 function build(invocation: string, profile: AgentProfile, cwd?: string): CodexArgv {
 	return {
 		command: AGENT_COMMAND,
@@ -86,9 +183,8 @@ function build(invocation: string, profile: AgentProfile, cwd?: string): CodexAr
 			profile.model,
 			CONFIG_FLAG,
 			effort_config(profile),
-			CONFIG_FLAG,
-			NETWORK_CONFIG,
-			...(cwd === undefined ? [] : lane_arguments(cwd, profile)),
+			...permission_arguments(cwd, profile),
+			...lane_arguments(cwd, profile),
 			JSON_FLAG,
 			invocation,
 		],

package/scripts/agent/usage-limit-reset.ts

@@ -0,0 +1,179 @@
+// When a Claude usage limit resets, read off the harness's own limit sentence (joshuafolkken/kit#4745):
+// `resets 10am (Asia/Tokyo)`, `resets 3:30pm (America/New_York)`, `resets Oct 25, 10am (Asia/Tokyo)`, or
+// the older `Claude AI usage limit reached|<epoch seconds>`. The wall clock is turned into an instant in
+// its named zone with the platform's `Intl`, so no time-zone table is kept here. A sentence that names
+// no readable time, or an unknown zone, answers `undefined` — the caller re-checks on an interval.
+
+const RESET_PATTERN = /resets (?<when>[^(]*)\((?<zone>[^)]*)\)/iu
+const TIME_PATTERN = /\b(?<hour>\d{1,2})(?::(?<minute>\d{2}))? ?(?<meridiem>am|pm)\b/iu
+const DATE_PATTERN = /\b(?<month>[a-z]+)\.? (?<day>\d{1,2})\b/iu
+const MONTH_PREFIX = 3
+const EPOCH_PATTERN = /\|(?<epoch>\d{10})\b/u
+const MONTHS = ['jan', 'feb', 'mar', 'apr', 'may', 'jun', 'jul', 'aug', 'sep', 'oct', 'nov', 'dec']
+const MS_PER_SECOND = 1000
+const MS_PER_MINUTE = 60_000
+const HALF_YEAR_MS = 15_778_800_000
+const HOURS_PER_HALF_DAY = 12
+const PM = 'pm'
+const NOT_FOUND = -1
+
+interface ZoneFields {
+	year: number
+	month: number
+	day: number
+	hour: number
+	minute: number
+}
+
+interface WallClock {
+	// The named date, where the sentence carries one — a weekly limit's reset can be days away.
+	date: Pick<ZoneFields, 'month' | 'day'> | undefined
+	hour: number
+	minute: number
+	zone: string
+}
+
+type Groups = Readonly<Record<string, string | undefined>>
+
+function epoch_ms(text: string): number | undefined {
+	const epoch = EPOCH_PATTERN.exec(text)?.groups?.['epoch']
+
+	return epoch === undefined ? undefined : Number(epoch) * MS_PER_SECOND
+}
+
+// A word that is no month's name — `resets at 10am` — names no date.
+function dated(groups: Groups): WallClock['date'] {
+	const month = MONTHS.indexOf(String(groups['month']).slice(0, MONTH_PREFIX).toLowerCase())
+
+	return month === NOT_FOUND ? undefined : { month, day: Number(groups['day']) }
+}
+
+function date_of(when: string): WallClock['date'] {
+	const groups = DATE_PATTERN.exec(when)?.groups
+
+	return groups === undefined ? undefined : dated(groups)
+}
+
+function hour_of(time: Groups): number {
+	const half = time['meridiem']?.toLowerCase() === PM ? HOURS_PER_HALF_DAY : 0
+
+	return (Number(time['hour']) % HOURS_PER_HALF_DAY) + half
+}
+
+function wall_of(when: string, zone: string): WallClock | undefined {
+	const time = TIME_PATTERN.exec(when)?.groups
+
+	if (time === undefined) return undefined
+
+	return { date: date_of(when), hour: hour_of(time), minute: Number(time['minute'] ?? 0), zone }
+}
+
+function zone_format(zone: string): Intl.DateTimeFormat {
+	return new Intl.DateTimeFormat('en-US', {
+		timeZone: zone,
+		hourCycle: 'h23',
+		year: 'numeric',
+		month: 'numeric',
+		day: 'numeric',
+		hour: 'numeric',
+		minute: 'numeric',
+	})
+}
+
+// The wall clock the zone reads at an instant. Throws `RangeError` on a zone `Intl` does not know.
+function zone_fields(at_ms: number, zone: string): ZoneFields {
+	const parts = zone_format(zone).formatToParts(at_ms)
+	const read = new Map(parts.map((part) => [part.type, Number(part.value)]))
+
+	function field(type: Intl.DateTimeFormatPartTypes): number {
+		return read.get(type) ?? 0
+	}
+
+	return {
+		year: field('year'),
+		month: field('month') - 1,
+		day: field('day'),
+		hour: field('hour'),
+		minute: field('minute'),
+	}
+}
+
+function utc_of(fields: ZoneFields): number {
+	return Date.UTC(fields.year, fields.month, fields.day, fields.hour, fields.minute)
+}
+
+// How far the zone's wall clock runs ahead of UTC at an instant, to the minute.
+function offset_ms(at_ms: number, zone: string): number {
+	return utc_of(zone_fields(at_ms, zone)) - (at_ms - (at_ms % MS_PER_MINUTE))
+}
+
+// The instant the zone's wall clock reads `fields`, the offset read again at the first guess so a
+// daylight-saving change between the two is followed.
+function instant_of(fields: ZoneFields, zone: string): number {
+	const guess = utc_of(fields)
+
+	return guess - offset_ms(guess - offset_ms(guess, zone), zone)
+}
+
+// The years to move a named date in this year by so it lies within half a year of `now_ms`: a January
+// date read in December is next year's, a December date read in January last year's.
+function year_shift(at_ms: number, now_ms: number): number {
+	if (now_ms - at_ms > HALF_YEAR_MS) return 1
+
+	return at_ms - now_ms > HALF_YEAR_MS ? -1 : 0
+}
+
+// A named date's nearest occurrence. One just past stays past, for the caller's re-check.
+function dated_instant(fields: ZoneFields, zone: string, now_ms: number): number {
+	const at_ms = instant_of(fields, zone)
+	const shift = year_shift(at_ms, now_ms)
+
+	return shift === 0 ? at_ms : instant_of({ ...fields, year: fields.year + shift }, zone)
+}
+
+// An undated hour's next occurrence: today's, else the next day's.
+function undated_instant(fields: ZoneFields, zone: string, now_ms: number): number {
+	const at_ms = instant_of(fields, zone)
+
+	return at_ms > now_ms ? at_ms : instant_of({ ...fields, day: fields.day + 1 }, zone)
+}
+
+function next_instant(wall: WallClock, now_ms: number): number {
+	const today = zone_fields(now_ms, wall.zone)
+	const fields = { ...today, ...wall.date, hour: wall.hour, minute: wall.minute }
+
+	if (wall.date === undefined) return undated_instant(fields, wall.zone, now_ms)
+
+	return dated_instant(fields, wall.zone, now_ms)
+}
+
+function wall_in(text: string): WallClock | undefined {
+	const groups = RESET_PATTERN.exec(text)?.groups
+
+	if (groups === undefined) return undefined
+
+	return wall_of(String(groups['when']), String(groups['zone']).trim())
+}
+
+// A zone `Intl` does not know reads as no time.
+function known_instant(wall: WallClock, now_ms: number): number | undefined {
+	try {
+		return next_instant(wall, now_ms)
+	} catch {
+		return undefined
+	}
+}
+
+function clock_ms(text: string, now_ms: number): number | undefined {
+	const wall = wall_in(text)
+
+	return wall === undefined ? undefined : known_instant(wall, now_ms)
+}
+
+function reset_ms(text: string, now_ms: number): number | undefined {
+	return epoch_ms(text) ?? clock_ms(text, now_ms)
+}
+
+const usage_limit_reset = { reset_ms }
+
+export { usage_limit_reset }

package/scripts/auth/claude-token-output.ts

@@ -1,11 +1,11 @@
 import { stripVTControlCharacters } from 'node:util'
+import { token_shape } from '#scripts/lib/token-shape'
 
 // What `claude setup-token` printed, split into the token and the text that may be shown: the token
 // is replaced, so it reaches neither the screen nor a log.
 
-const REDACTED = '[REDACTED]'
+const { REDACTED, ANTHROPIC_OAUTH_TOKEN: TOKEN_PATTERN } = token_shape
 const TOKEN_START = 'sk-ant-oat'
-const TOKEN_PATTERN = /sk-ant-oat\d+-[\w-]+/u
 const EVERY_TOKEN_PATTERN = new RegExp(TOKEN_PATTERN.source, 'gu')
 // A narrow terminal wraps the token onto lines of its own characters alone, so a continuation is a
 // whole such line and the prose after the token never joins it.

package/scripts/auto-ok/auto-ok-author.ts

@@ -0,0 +1,53 @@
+import { epic_graph, type EpicChild } from '#scripts/epic/epic-graph'
+import { gh_author_association } from '#scripts/gh/gh-author-association'
+import type { OpenIssueData } from '#scripts/git/git-schemas'
+
+// Whether an unattended run may act on an opted-in issue's body. The run takes that body as its
+// specification, and on a public repository anyone can file an issue — the `auto-ok` a person applied
+// says nothing about a body its author rewrote after the label. So only an issue whose author has
+// write access is runnable, and a lookup that failed is not trust; the rest wait on a person.
+
+async function with_trust(issue: OpenIssueData): Promise<OpenIssueData> {
+	const author = gh_author_association.author_of(issue)
+
+	return { ...issue, author_trusted: await gh_author_association.is_trusted(author) }
+}
+
+async function with_author_trust(
+	issues: ReadonlyArray<OpenIssueData>,
+): Promise<Array<OpenIssueData>> {
+	return await Promise.all(issues.map(async (issue) => await with_trust(issue)))
+}
+
+function is_author_trusted(issue: OpenIssueData): boolean {
+	return issue.author_trusted === true
+}
+
+// An epic child's body is run just the same, so the same rule holds for it (joshuafolkken/kit#4633).
+// The write-access lookup asks *this* repository's collaborators, which says nothing about access to
+// another one — so a child elsewhere is asked with no login, which `trust_of` answers for `OWNER` alone.
+async function is_child_trusted(child: EpicChild, repo: string): Promise<boolean> {
+	const author = gh_author_association.author_of(child)
+
+	return await gh_author_association.is_trusted(
+		child.repo === repo ? author : { ...author, login: undefined },
+	)
+}
+
+// The keys of the open children whose author is not trusted — a child read without author fields
+// among them, since an unknown author is not a trusted one.
+async function untrusted_child_keys(
+	children: ReadonlyArray<EpicChild>,
+	repo: string,
+): Promise<ReadonlySet<string>> {
+	const open = children.filter((child) => child.state === 'OPEN')
+	const trusted = await Promise.all(open.map(async (child) => await is_child_trusted(child, repo)))
+
+	const untrusted = open.filter((_, index) => trusted[index] !== true)
+
+	return new Set(untrusted.map((child) => epic_graph.key_of(child)))
+}
+
+const auto_ok_author = { is_author_trusted, untrusted_child_keys, with_author_trust }
+
+export { auto_ok_author }

package/scripts/auto-ok/auto-ok-cli.ts

@@ -1,5 +1,4 @@
-#!/usr/bin/env tsx
-import { fileURLToPath } from 'node:url'
+import { auto_ok_author } from '#scripts/auto-ok/auto-ok-author'
 import { epic_bundle_gaps } from '#scripts/epic/epic-bundle-gaps'
 import { epic_index, type FetchedEpics } from '#scripts/epic/epic-index'
 import { epic_issue } from '#scripts/epic/epic-issue'
@@ -10,6 +9,8 @@ import { cutoff_cause, cutoff_of, type ScanCutoff } from '#scripts/git/listing-c
 import { read_json_listing } from '#scripts/git/parse-json-array'
 import { git_next_issues } from '#scripts/issue/git-next-issues'
 import { AUTO_OK_LABEL } from '#scripts/issue/issue-labels'
+import { issue_not_before } from '#scripts/issue/issue-not-before'
+import { issue_sample_prime } from '#scripts/issue/issue-sample-prime'
 import { session_cite } from '#scripts/issue/session-cite'
 
 // `josh auto-ok:next` — which issue outside the epic an unattended run picks up next.
@@ -20,7 +21,6 @@ import { session_cite } from '#scripts/issue/session-cite'
 // nothing checks it. The contract is `epic:next`'s: one token on standard output, every explanation
 // on standard error, so `answer=$(pnpm josh auto-ok:next)` reads it.
 
-const ARGV_OFFSET = 2
 const SUCCESS_EXIT_CODE = 0
 const FAILURE_EXIT_CODE = 1
 const EXCLUDE_FLAG = '--exclude'
@@ -210,7 +210,15 @@ async function fetch_opted_in(): Promise<OptedInRead> {
 		LISTING_LIMIT,
 	)
 
-	return json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
+	const read = json === undefined ? await classify_failed_read() : parse_listing(json, is_capped)
+
+	if (read.kind !== 'read') return read
+
+	const issues = await auto_ok_author.with_author_trust(read.issues)
+
+	await issue_sample_prime.prime(issues.map((issue) => issue.body))
+
+	return { ...read, issues }
 }
 
 // Whether every issue this one declares as a blocker has closed. `blockedBy` is the same native
@@ -327,14 +335,25 @@ async function fetch_tracking(count: number): Promise<TrackingRead> {
 // by the native `blockedBy` relations `is_unblocked` already refuses to run past.
 // `tracked` is the narrowed set `epic_index.withheld_children` builds, not
 // every tracked child; this function only applies it.
+// What the issue itself must hold: an author with write access (`auto-ok-author.ts`), every blocker
+// closed, and its declared start date reached.
+function is_ready(issue: OpenIssueData, now: number): boolean {
+	return (
+		auto_ok_author.is_author_trusted(issue) &&
+		is_unblocked(issue) &&
+		issue_not_before.is_due(issue.body, now)
+	)
+}
+
 function is_runnable(
 	issue: OpenIssueData,
 	tracked: ReadonlyMap<number, number>,
 	exclude: ReadonlyArray<number>,
+	now: number = Date.now(),
 ): boolean {
 	if (tracked.has(issue.number)) return false
 
-	return is_unblocked(issue) && !exclude.includes(issue.number)
+	return !exclude.includes(issue.number) && is_ready(issue, now)
 }
 
 function pick_next(
@@ -351,7 +370,7 @@ function pick_next(
 function none_reason(count: number): string {
 	if (count === 0) return NONE_OPTED_IN_MESSAGE
 
-	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, blocked by an open issue, or the one just merged.`
+	return `All ${String(count)} open \`${AUTO_OK_LABEL}\` issue(s) are excluded — tracked by an opted-in epic, an epic itself, already in progress, parked, filed by an author without write access (waiting on a person), blocked by an open issue, not due until its start time, or the one just merged.`
 }
 
 // Said only when the cap actually bit, and worded from the answer rather than before it: the one run
@@ -457,14 +476,6 @@ async function run(argv: ReadonlyArray<string>): Promise<number> {
 	return await answer(read, options.exclude)
 }
 
-// `process.exitCode` rather than `process.exit()`: the answer is written with `console.info`, and on
-// macOS a write to a pipe is asynchronous — `process.exit()` can tear the process down before it has
-// drained, and this command's whole contract is `answer=$(pnpm josh auto-ok:next)`. The same shape
-// is already in `scripts/cost-runtime/cost-cli.ts`, which met the truncation first.
-async function main(argv: ReadonlyArray<string>): Promise<void> {
-	process.exitCode = await run(argv)
-}
-
 const auto_ok_cli = {
 	USAGE,
 	NONE_TOKEN,
@@ -486,7 +497,5 @@ const auto_ok_cli = {
 	run,
 }
 
-if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
-
 export { auto_ok_cli }
 export type { NextOptions, OptedInRead, PickupContext, TrackingRead }

package/scripts/auto-ok/auto-ok-judge-read.ts

@@ -1,3 +1,4 @@
+import { gh_author_association } from '#scripts/gh/gh-author-association'
 import { git_gh_command } from '#scripts/gh/git-gh-command'
 import { issue_label_schema } from '#scripts/git/git-schemas'
 import { read_json_listing } from '#scripts/git/parse-json-array'
@@ -25,6 +26,8 @@ const row_schema = z.looseObject({
 	body: z.string().nullish(),
 	labels: z.array(issue_label_schema),
 	updatedAt: z.string(),
+	author_association: z.string().nullish(),
+	user: z.looseObject({ login: z.string() }).nullish(),
 })
 
 interface JudgeRow extends JudgeIssue {
@@ -35,13 +38,17 @@ interface JudgeRow extends JudgeIssue {
 // An issue's number to the `updatedAt` it was last seen judged at.
 type JudgedCache = Map<number, string>
 
-function to_row(raw: z.infer<typeof row_schema>): JudgeRow {
+async function to_row(raw: z.infer<typeof row_schema>): Promise<JudgeRow> {
 	return {
 		number: raw.number,
 		title: raw.title,
 		body: raw.body ?? '',
 		labels: raw.labels.map((label) => label.name),
 		updated_at: raw.updatedAt,
+		is_trusted: await gh_author_association.is_trusted({
+			login: raw.user?.login,
+			association: raw.author_association,
+		}),
 	}
 }
 
@@ -55,7 +62,9 @@ async function read_candidates(): Promise<ReadonlyArray<JudgeRow> | undefined> {
 
 	if (listing.kind !== 'read') return undefined
 
-	return listing.rows.map((raw) => to_row(raw)).filter((row) => auto_ok_judge.is_candidate(row))
+	const rows = await Promise.all(listing.rows.map(async (raw) => await to_row(raw)))
+
+	return rows.filter((row) => auto_ok_judge.is_candidate(row))
 }
 
 // `true` only for an issue known to owe a judgement: a failed comment read learns nothing, so it is
@@ -63,7 +72,7 @@ async function read_candidates(): Promise<ReadonlyArray<JudgeRow> | undefined> {
 async function owes_judgement(row: JudgeRow, cache: JudgedCache): Promise<boolean> {
 	if (cache.get(row.number) === row.updated_at) return false
 
-	const comments = issue_watch_diff.parse_comments(
+	const comments = await issue_watch_diff.parse_comments(
 		await git_gh_command.issue_list_comments(String(row.number)),
 	)