@mastra/github-signals 0.4.1 → 0.5.0-alpha.1

package/dist/github-app-owner.d.ts

@@ -0,0 +1,13 @@
+export type GithubAppOwner = {
+    login: string;
+    type: 'User' | 'Organization';
+};
+export type GithubAppOwnerCommandRunner = (args: readonly string[]) => Promise<{
+    stdout: string;
+}>;
+export declare class GithubAppOwnerResolver {
+    #private;
+    constructor(runGhApi?: GithubAppOwnerCommandRunner);
+    getOwner(botLogin: string, isCurrentGeneration?: () => boolean): Promise<GithubAppOwner | undefined>;
+}
+//# sourceMappingURL=github-app-owner.d.ts.map

package/dist/github-app-owner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app-owner.d.ts","sourceRoot":"","sources":["../src/github-app-owner.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,cAAc,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAyBnG,qBAAa,sBAAsB;;IAIjC,YAAY,QAAQ,GAAE,2BAA6C,EAElE;IAEK,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,mBAAmB,CAAC,EAAE,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA2BzG;CAWF"}

package/dist/github-auth-env.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolve a GitHub credential from the global `gh` CLI and return an environment
+ * that presents it to a child process.
+ *
+ * gitcrawl takes the first non-empty value of the environment variable named by
+ * `[github].token_env` (default `GITHUB_TOKEN`) and only discovers it is invalid
+ * when GitHub rejects it, so a stale exported token fails `sync` outright even
+ * when `gh` can still mint a working credential. Injecting a credential here
+ * makes gitcrawl's own env lookup win, so the stale value is never consulted.
+ *
+ * `gh auth token` is asked with the token variables removed: `gh` answers with
+ * `GH_TOKEN`/`GITHUB_TOKEN` verbatim when either is set, which would hand back
+ * the very credential being replaced.
+ *
+ * Returns `undefined` when no credential can be resolved, so callers leave the
+ * inherited environment untouched rather than stripping a working token.
+ */
+export declare function resolveGithubAuthEnv(): Promise<NodeJS.ProcessEnv | undefined>;
+//# sourceMappingURL=github-auth-env.d.ts.map

package/dist/github-auth-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-auth-env.d.ts","sourceRoot":"","sources":["../src/github-auth-env.ts"],"names":[],"mappings":"AA0BA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,CAqBnF"}

package/dist/index.cjs

@@ -30,6 +30,111 @@ let _mastra_core_signals = require("@mastra/core/signals");
 let _mastra_core_tools = require("@mastra/core/tools");
 let zod = require("zod");
 zod = __toESM(zod, 1);
+//#region src/github-auth-env.ts
+let execFileAsync$2;
+/** Environment variables both gitcrawl and the `gh` CLI treat as a GitHub credential. */
+const GITHUB_TOKEN_ENV_VARS = ["GH_TOKEN", "GITHUB_TOKEN"];
+/** Remove every casing of the token variables: Windows treats environment names case-insensitively. */
+function withoutGithubTokens(env) {
+	const scrubbed = { ...env };
+	for (const name of Object.keys(scrubbed)) if (GITHUB_TOKEN_ENV_VARS.some((tokenEnv) => tokenEnv.toLowerCase() === name.toLowerCase())) delete scrubbed[name];
+	return scrubbed;
+}
+/**
+* Resolve a GitHub credential from the global `gh` CLI and return an environment
+* that presents it to a child process.
+*
+* gitcrawl takes the first non-empty value of the environment variable named by
+* `[github].token_env` (default `GITHUB_TOKEN`) and only discovers it is invalid
+* when GitHub rejects it, so a stale exported token fails `sync` outright even
+* when `gh` can still mint a working credential. Injecting a credential here
+* makes gitcrawl's own env lookup win, so the stale value is never consulted.
+*
+* `gh auth token` is asked with the token variables removed: `gh` answers with
+* `GH_TOKEN`/`GITHUB_TOKEN` verbatim when either is set, which would hand back
+* the very credential being replaced.
+*
+* Returns `undefined` when no credential can be resolved, so callers leave the
+* inherited environment untouched rather than stripping a working token.
+*/
+async function resolveGithubAuthEnv() {
+	const scrubbed = withoutGithubTokens(process.env);
+	if (!execFileAsync$2) {
+		const { execFile } = await import("child_process");
+		execFileAsync$2 = (0, util.promisify)(execFile);
+	}
+	let token;
+	try {
+		const { stdout } = await execFileAsync$2("gh", ["auth", "token"], { env: scrubbed });
+		token = stdout.trim();
+	} catch {
+		return;
+	}
+	if (!token) return void 0;
+	return {
+		...process.env,
+		GH_TOKEN: token,
+		GITHUB_TOKEN: token
+	};
+}
+//#endregion
+//#region src/github-app-owner.ts
+const OWNER_CACHE_TTL_MS = 1440 * 60 * 1e3;
+let execFileAsync$1;
+const defaultRunGhApi = async (args) => {
+	if (!execFileAsync$1) {
+		const { execFile } = await import("child_process");
+		execFileAsync$1 = (0, util.promisify)(execFile);
+	}
+	return execFileAsync$1("gh", args, { env: await resolveGithubAuthEnv() });
+};
+var GithubAppOwnerResolver = class {
+	#cache = /* @__PURE__ */ new Map();
+	#runGhApi;
+	constructor(runGhApi = defaultRunGhApi) {
+		this.#runGhApi = runGhApi;
+	}
+	async getOwner(botLogin, isCurrentGeneration) {
+		const appSlug = botLogin.replace(/\[bot\]$/i, "");
+		if (!appSlug || isCurrentGeneration && !isCurrentGeneration()) return void 0;
+		const cacheKey = appSlug.toLowerCase();
+		const cached = this.#cache.get(cacheKey);
+		if (cached?.expiresAt && cached.expiresAt > Date.now()) {
+			if (isCurrentGeneration && !isCurrentGeneration()) return void 0;
+			return cached.owner;
+		}
+		if (cached) this.#cache.delete(cacheKey);
+		try {
+			const { stdout } = await this.#runGhApi(["api", `apps/${appSlug}`]);
+			const parsed = JSON.parse(stdout);
+			const owner = this.#parseOwner(parsed);
+			if (!owner || isCurrentGeneration && !isCurrentGeneration()) return void 0;
+			this.#cache.set(cacheKey, {
+				owner,
+				expiresAt: Date.now() + OWNER_CACHE_TTL_MS
+			});
+			if (isCurrentGeneration && !isCurrentGeneration()) {
+				this.#cache.delete(cacheKey);
+				return;
+			}
+			return owner;
+		} catch {
+			return;
+		}
+	}
+	#parseOwner(value) {
+		if (!value || typeof value !== "object" || !("owner" in value)) return void 0;
+		const owner = value.owner;
+		if (!owner || typeof owner !== "object" || !("login" in owner) || !("type" in owner)) return void 0;
+		if (typeof owner.login !== "string" || !owner.login.trim()) return void 0;
+		if (owner.type !== "User" && owner.type !== "Organization") return void 0;
+		return {
+			login: owner.login,
+			type: owner.type
+		};
+	}
+};
+//#endregion
 //#region src/index.ts
 let _execFileAsync;
 async function execFileAsync(file, args, options) {
@@ -603,7 +708,8 @@ var GitcrawlSyncClient = class {
 			const { stdout, stderr } = await execFileAsync(this.#command, args, {
 				cwd: input.cwd,
 				signal: input.abortSignal,
-				maxBuffer: 10 * 1024 * 1024
+				maxBuffer: 10 * 1024 * 1024,
+				env: await resolveGithubAuthEnv()
 			});
 			return {
 				ok: true,
@@ -664,12 +770,12 @@ var GitcrawlSyncClient = class {
             join repositories r on r.id=t.repo_id
            where r.owner=${owner} and r.name=${repo} and t.number=${number} and rt.is_resolved=0`);
 		const latestComments = await this.#queryDb(`select c.author_login, c.author_type, c.is_bot, c.body, json_extract(c.raw_json, '$.html_url') as html_url,
-                 coalesce(c.updated_at_gh, c.created_at_gh) as updated_at
+                 coalesce(c.updated_at_gh, c.created_at_gh, json_extract(c.raw_json, '$.submitted_at')) as updated_at
             from comments c
             join threads t on t.id=c.thread_id
             join repositories r on r.id=t.repo_id
            where r.owner=${owner} and r.name=${repo} and t.number=${number}
-           order by coalesce(c.updated_at_gh, c.created_at_gh) desc
+           order by coalesce(c.updated_at_gh, c.created_at_gh, json_extract(c.raw_json, '$.submitted_at')) desc
            limit 20`);
 		const latestComment = latestComments[0];
 		const checks = normalizeGithubChecksForSnapshot({
@@ -794,6 +900,7 @@ var GithubSignals = class extends _mastra_core_signals.SignalProvider {
 	#options;
 	#syncClient;
 	#repositoryResolver;
+	#appOwnerResolver;
 	#polling = /* @__PURE__ */ new Map();
 	#pollingThreadGenerations = /* @__PURE__ */ new Map();
 	#pollingGeneration = 0;
@@ -807,6 +914,7 @@ var GithubSignals = class extends _mastra_core_signals.SignalProvider {
 		this.#options = options;
 		this.#syncClient = options.syncClient ?? new GitcrawlSyncClient({ command: options.gitcrawlCommand });
 		this.#repositoryResolver = options.repositoryResolver ?? new GitRemoteRepositoryResolver();
+		this.#appOwnerResolver = new GithubAppOwnerResolver();
 		if (options.getNotificationStreamOptions) this.#agentOptions = { getNotificationStreamOptions: options.getNotificationStreamOptions };
 	}
 	/**
@@ -1425,7 +1533,15 @@ var GithubSignals = class extends _mastra_core_signals.SignalProvider {
 		const normalizedUser = user.toLowerCase();
 		if (metadata.isBot === true || metadata.authorType?.toLowerCase() === "bot" || normalizedUser.endsWith("[bot]")) {
 			if ((this.#options.ignoredBots ?? []).some((bot) => bot.toLowerCase() === normalizedUser)) return false;
-			return (this.#options.authorizedBots ?? DEFAULT_AUTHORIZED_BOTS).some((bot) => bot.toLowerCase() === normalizedUser);
+			if ((this.#options.authorizedBots ?? DEFAULT_AUTHORIZED_BOTS).some((bot) => bot.toLowerCase() === normalizedUser)) return true;
+			const appOwner = await this.#appOwnerResolver.getOwner(user, isCurrentGeneration);
+			if (!appOwner || isCurrentGeneration && !isCurrentGeneration()) return false;
+			if (appOwner.type === "Organization") return appOwner.login.toLowerCase() === owner.toLowerCase();
+			if (appOwner.type !== "User") return false;
+			const permission = await this.#loadAuthorPermission(owner, repo, appOwner.login, isCurrentGeneration);
+			if (isCurrentGeneration && !isCurrentGeneration()) return false;
+			const authorizedPermissions = this.#options.authorizedPermissions ?? DEFAULT_AUTHORIZED_PERMISSIONS;
+			return !!permission && authorizedPermissions.includes(permission);
 		}
 		const permission = await this.#loadAuthorPermission(owner, repo, user, isCurrentGeneration);
 		if (isCurrentGeneration && !isCurrentGeneration()) return false;
@@ -1487,7 +1603,7 @@ var GithubSignals = class extends _mastra_core_signals.SignalProvider {
 					`repos/${owner}/${repo}/collaborators/${user}/permission`,
 					"--jq",
 					".permission"
-				]);
+				], { env: await resolveGithubAuthEnv() });
 				const raw = stdout.trim();
 				permission = [
 					"admin",