@mohantn/gate-keeper 2.1.0

package/dist/daemon.js

@@ -0,0 +1,357 @@
+"use strict";
+/**
+ * gate-keeper daemon
+ *
+ * Listens on port 5379 for file paths from the hook-receiver, runs analysis,
+ * updates the SQLite cache, and broadcasts results to the dashboard (port 5378).
+ *
+ * Start with: node dist/daemon.js
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_CONFIG = exports.CONFIG_FILE = exports.PID_FILE = exports.GK_DIR = exports.IPC_PORT = void 0;
+exports.findGitRoot = findGitRoot;
+exports.main = main;
+const express_1 = __importDefault(require("express"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const child_process_1 = require("child_process");
+const universal_analyzer_1 = require("./analyzer/universal-analyzer");
+const sqlite_cache_1 = require("./cache/sqlite-cache");
+const viz_server_1 = require("./viz/viz-server");
+const watch_mode_1 = require("./daemon/watch-mode");
+exports.IPC_PORT = 5379;
+exports.GK_DIR = path.join(process.env.HOME ?? '/tmp', '.gate-keeper');
+exports.PID_FILE = path.join(exports.GK_DIR, 'daemon.pid');
+exports.CONFIG_FILE = path.join(exports.GK_DIR, 'config.json');
+exports.DEFAULT_CONFIG = {
+    minRating: 6.5,
+    scanExcludePatterns: {
+        // Any path containing "test" (case-insensitive): *.test.ts, *.test.tsx,
+        // *Tests.cs, *Test.cs, __tests__/, Tests/, etc.
+        global: [
+            '**test**',
+            // Config files (React / TypeScript / JavaScript)
+            'jest.config.*',
+            'jest.setup.*',
+            'vite.config.*',
+            'postcss.config.*',
+            'tailwind.config.*',
+            'tsconfig*.json',
+            'babel.config.*',
+            'webpack.config.*',
+            'rollup.config.*',
+            'next.config.*',
+            'eslint.config.*',
+            '.eslintrc*',
+            '.prettierrc*',
+            '.editorconfig',
+            // Config files (.NET / C#)
+            '*.csproj',
+            'appsettings*.json',
+            'launchSettings.json',
+            'NuGet.config',
+            'global.json',
+            'Directory.Build.*',
+        ],
+        csharp: [
+            '**/Migrations/*.cs',
+            '**/Migrations/**/*.cs',
+            '*.Designer.cs',
+            '*.g.cs',
+            '*.generated.cs',
+            '**/AssemblyInfo.cs',
+            '**/GlobalUsings.cs',
+        ],
+        typescript: [
+            '*.d.ts',
+            '*.min.js',
+            '*.bundle.js',
+            '**/generated/**',
+        ],
+    },
+};
+function loadConfig() {
+    try {
+        if (fs.existsSync(exports.CONFIG_FILE)) {
+            const raw = fs.readFileSync(exports.CONFIG_FILE, 'utf8');
+            const user = JSON.parse(raw);
+            // Deep-merge scanExcludePatterns: user arrays replace defaults per-key
+            const merged = { ...exports.DEFAULT_CONFIG, ...user };
+            if (user.scanExcludePatterns || exports.DEFAULT_CONFIG.scanExcludePatterns) {
+                merged.scanExcludePatterns = {
+                    global: user.scanExcludePatterns?.global ?? exports.DEFAULT_CONFIG.scanExcludePatterns?.global ?? [],
+                    csharp: user.scanExcludePatterns?.csharp ?? exports.DEFAULT_CONFIG.scanExcludePatterns?.csharp ?? [],
+                    typescript: user.scanExcludePatterns?.typescript ?? exports.DEFAULT_CONFIG.scanExcludePatterns?.typescript ?? [],
+                };
+            }
+            return merged;
+        }
+    }
+    catch { }
+    return { ...exports.DEFAULT_CONFIG };
+}
+function ensureConfigFile() {
+    if (!fs.existsSync(exports.CONFIG_FILE)) {
+        fs.writeFileSync(exports.CONFIG_FILE, JSON.stringify(exports.DEFAULT_CONFIG, null, 2));
+    }
+}
+function findGitRoot(dir) {
+    const result = (0, child_process_1.spawnSync)('git', ['rev-parse', '--show-toplevel'], {
+        cwd: dir, encoding: 'utf8', timeout: 3000
+    });
+    return (result.status === 0 && result.stdout.trim()) ? result.stdout.trim() : dir;
+}
+// ── LCOV coverage watcher ──────────────────────────────────────────────────
+// Tracks every lcov path we are already polling to prevent duplicate watchers.
+const watchedLcovPaths = new Set();
+// Per-repo debounce timers so rapid LCOV writes don't flood the scan pipeline.
+const lcovDebounceTimers = new Map();
+// Mirrors CoverageAnalyzer.findLcovFile() so the watcher covers the same search space.
+function coverageLcovCandidates(repoRoot) {
+    return [
+        path.join(repoRoot, 'coverage', 'lcov.info'),
+        path.join(repoRoot, 'coverage', 'lcov-report', 'lcov.info'),
+        path.join(repoRoot, 'lcov.info'),
+        path.join(repoRoot, '.coverage', 'lcov.info'),
+    ];
+}
+// Uses fs.watchFile (stat-polling) instead of fs.watch (inotify) because inotify
+// silently drops events on WSL DrvFs/NFS mounts, while polling works everywhere.
+function startLcovWatcher(repoRoot, vizServer) {
+    for (const lcovPath of coverageLcovCandidates(repoRoot)) {
+        if (watchedLcovPaths.has(lcovPath))
+            continue;
+        watchedLcovPaths.add(lcovPath);
+        fs.watchFile(lcovPath, { persistent: false, interval: 5_000 }, (curr, prev) => {
+            if (curr.mtimeMs === prev.mtimeMs)
+                return;
+            const existing = lcovDebounceTimers.get(repoRoot);
+            if (existing)
+                clearTimeout(existing);
+            lcovDebounceTimers.set(repoRoot, setTimeout(() => {
+                lcovDebounceTimers.delete(repoRoot);
+                console.error(`[gate-keeper] Coverage changed for ${path.basename(repoRoot)} — re-analyzing...`);
+                vizServer.scanRepo(repoRoot, true).catch(err => {
+                    console.error(`[gate-keeper] Coverage re-analysis error: ${err instanceof Error ? err.message : String(err)}`);
+                });
+            }, 2_000));
+        });
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const noScan = args.includes('--no-scan');
+    const watchMode = args.includes('--watch');
+    ensurePidFile();
+    ensureConfigFile();
+    const config = loadConfig();
+    const workDir = process.cwd();
+    const repoRoot = findGitRoot(workDir);
+    const cache = new sqlite_cache_1.SqliteCache();
+    const analyzer = new universal_analyzer_1.UniversalAnalyzer();
+    const vizServer = new viz_server_1.VizServer(cache, analyzer, workDir, repoRoot, config);
+    await vizServer.start();
+    // Start LCOV watchers for all repos already in the cache so that running
+    // `npm test --coverage` automatically refreshes dashboard ratings.
+    for (const { path: r } of cache.getAllRepositories()) {
+        startLcovWatcher(r, vizServer);
+    }
+    if (!noScan) {
+        // Initial workspace scan — runs in the background, non-blocking
+        vizServer.scan(false).catch(err => {
+            console.error('[gate-keeper] Initial scan failed:', err);
+        });
+    }
+    else {
+        console.error('[gate-keeper] Started with --no-scan, skipping initial scan');
+    }
+    // Graph watch mode — polls source files for mtime changes and re-analyzes
+    if (watchMode) {
+        const watcher = new watch_mode_1.WatchMode();
+        const POLL_MS = parseInt(process.env['GK_WATCH_INTERVAL'] ?? '5000', 10);
+        watcher.start(repoRoot, (changedFiles) => {
+            console.error(`[gate-keeper] Watch: ${changedFiles.length} changed file(s) — re-analyzing`);
+            for (const fp of changedFiles) {
+                // Same logic as the /analyze IPC endpoint — inline it for watch mode
+                (async () => {
+                    try {
+                        const analysis = await analyzer.analyze(fp);
+                        if (!analysis)
+                            return;
+                        analysis.repoRoot = repoRoot;
+                        cache.save(analysis);
+                        vizServer.pushAnalysis(analysis);
+                    }
+                    catch (err) {
+                        console.error(`[gate-keeper] Watch re-analysis error: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                })();
+            }
+        }, POLL_MS);
+        console.error(`[gate-keeper] Watch mode active (polling every ${POLL_MS}ms) for ${repoRoot}`);
+        process.on('exit', () => watcher.stop());
+    }
+    // IPC HTTP server — only binds to localhost
+    const ipc = (0, express_1.default)();
+    ipc.use(express_1.default.json());
+    ipc.use((_req, res, next) => {
+        res.setHeader('Access-Control-Allow-Origin', '*');
+        res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+        res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+        if (_req.method === 'OPTIONS') {
+            res.sendStatus(204);
+            return;
+        }
+        next();
+    });
+    ipc.get('/health', (_req, res) => {
+        res.json({ ok: true, pid: process.pid });
+    });
+    // Register a new repository from session_create hook
+    ipc.post('/repo-register', async (req, res) => {
+        const { action, repo } = req.body;
+        if (action !== 'register_repo' || !repo?.path) {
+            res.status(400).json({ error: 'Invalid request' });
+            return;
+        }
+        try {
+            const repoId = crypto.createHash('md5').update(repo.path).digest('hex');
+            const isNew = !cache.getRepository(repoId);
+            const metadata = {
+                id: repoId,
+                path: repo.path,
+                name: repo.name || path.basename(repo.path) || repo.path,
+                sessionId: repo.sessionId,
+                sessionType: repo.sessionType || 'unknown',
+                createdAt: repo.createdAt || Date.now(),
+                isActive: true
+            };
+            cache.saveRepository(metadata);
+            vizServer.broadcastRepoCreated(metadata);
+            startLcovWatcher(metadata.path, vizServer);
+            console.error(`[gate-keeper] Repository ${isNew ? 'registered' : 'updated'}: ${metadata.name} (${metadata.id})`);
+            res.json({ ok: true, repoId, repo: metadata, isNew });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`[gate-keeper] Repo registration error: ${msg}`);
+            res.status(500).json({ error: msg });
+        }
+    });
+    // Synchronously analyzes the file and returns the result so the hook-receiver
+    // can gate on the rating in the same PostToolUse event.
+    ipc.post('/analyze', async (req, res) => {
+        const { filePath, repoRoot: reqRepo } = req.body;
+        if (!filePath || !fs.existsSync(filePath) || !analyzer.isSupportedFile(filePath)) {
+            res.json({ analysis: null, minRating: loadConfig().minRating });
+            return;
+        }
+        try {
+            const analysis = await analyzer.analyze(filePath);
+            if (!analysis) {
+                res.json({ analysis: null, minRating: loadConfig().minRating });
+                return;
+            }
+            analysis.repoRoot = reqRepo || repoRoot;
+            cache.save(analysis);
+            vizServer.pushAnalysis(analysis);
+            const liveConfig = loadConfig();
+            console.error(`[gate-keeper] ${path.basename(filePath)} — rating: ${analysis.rating}/10, violations: ${analysis.violations.length}`);
+            res.json({ analysis, minRating: liveConfig.minRating });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`[gate-keeper] Analysis error for ${filePath}: ${msg}`);
+            res.json({ analysis: null, minRating: loadConfig().minRating });
+        }
+    });
+    // Get list of repositories
+    ipc.get('/repos', (_req, res) => {
+        const repos = cache.getAllRepositories(true);
+        res.json({ repos });
+    });
+    // Manually trigger a full re-analysis of all files in a repo so that coverage
+    // data changes (e.g. after running `npm test --coverage`) are reflected
+    // immediately without waiting for the next file-write event.
+    ipc.post('/reanalyze-coverage', (req, res) => {
+        const { repoRoot: reqRepo } = req.body;
+        const target = reqRepo || repoRoot;
+        res.json({ ok: true, message: `Re-analysis started for ${target}` });
+        vizServer.scanRepo(target, true).catch(err => {
+            console.error(`[gate-keeper] /reanalyze-coverage error: ${err instanceof Error ? err.message : String(err)}`);
+        });
+    });
+    ipc.listen(exports.IPC_PORT, '127.0.0.1', () => {
+        console.error(`[gate-keeper] IPC ready on 127.0.0.1:${exports.IPC_PORT}`);
+        console.error(`[gate-keeper] Min rating: ${config.minRating} (edit ${exports.CONFIG_FILE} to change)`);
+    });
+    // Only register signal handlers once per process
+    if (process._gateKeeperSignalsRegistered !== true) {
+        process.on('SIGTERM', () => shutdown(cache));
+        process.on('SIGINT', () => shutdown(cache));
+        process._gateKeeperSignalsRegistered = true;
+    }
+    console.error(`[gate-keeper] Daemon started (PID ${process.pid})`);
+}
+function ensurePidFile() {
+    const dir = path.dirname(exports.PID_FILE);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(exports.PID_FILE, String(process.pid));
+}
+function shutdown(cache) {
+    try {
+        fs.unlinkSync(exports.PID_FILE);
+    }
+    catch { }
+    for (const p of watchedLcovPaths)
+        fs.unwatchFile(p);
+    for (const t of lcovDebounceTimers.values())
+        clearTimeout(t);
+    cache.close();
+    process.exit(0);
+}
+// Only run main() if this is the entry point (not in tests)
+if (process.env.NODE_ENV !== 'test') {
+    main().catch(err => {
+        console.error('[gate-keeper] Fatal:', err);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=daemon.js.map

package/dist/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../src/daemon.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoGH,kCAKC;AA0CD,oBAgLC;AAjUD,sDAA8B;AAC9B,uCAAyB;AACzB,2CAA6B;AAC7B,+CAAiC;AACjC,iDAA0C;AAC1C,sEAAkE;AAClE,uDAAmD;AACnD,iDAA6C;AAE7C,oDAAgD;AAUnC,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,EAAE,cAAc,CAAC,CAAC;AAC/D,QAAA,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAM,EAAE,YAAY,CAAC,CAAC;AAC3C,QAAA,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,cAAM,EAAE,aAAa,CAAC,CAAC;AAE/C,QAAA,cAAc,GAAW;IACpC,SAAS,EAAE,GAAG;IACd,mBAAmB,EAAE;QACnB,wEAAwE;QACxE,gDAAgD;QAChD,MAAM,EAAE;YACN,UAAU;YACV,iDAAiD;YACjD,eAAe;YACf,cAAc;YACd,eAAe;YACf,kBAAkB;YAClB,mBAAmB;YACnB,gBAAgB;YAChB,gBAAgB;YAChB,kBAAkB;YAClB,iBAAiB;YACjB,eAAe;YACf,iBAAiB;YACjB,YAAY;YACZ,cAAc;YACd,eAAe;YACf,2BAA2B;YAC3B,UAAU;YACV,mBAAmB;YACnB,qBAAqB;YACrB,cAAc;YACd,aAAa;YACb,mBAAmB;SACpB;QACD,MAAM,EAAE;YACN,oBAAoB;YACpB,uBAAuB;YACvB,eAAe;YACf,QAAQ;YACR,gBAAgB;YAChB,oBAAoB;YACpB,oBAAoB;SACrB;QACD,UAAU,EAAE;YACV,QAAQ;YACR,UAAU;YACV,aAAa;YACb,iBAAiB;SAClB;KACF;CACF,CAAC;AAEF,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,mBAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,mBAAW,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;YAChD,uEAAuE;YACvE,MAAM,MAAM,GAAW,EAAE,GAAG,sBAAc,EAAE,GAAG,IAAI,EAAE,CAAC;YACtD,IAAI,IAAI,CAAC,mBAAmB,IAAI,sBAAc,CAAC,mBAAmB,EAAE,CAAC;gBACnE,MAAM,CAAC,mBAAmB,GAAG;oBAC3B,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,sBAAc,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;oBAC5F,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,IAAI,sBAAc,CAAC,mBAAmB,EAAE,MAAM,IAAI,EAAE;oBAC5F,UAAU,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,IAAI,sBAAc,CAAC,mBAAmB,EAAE,UAAU,IAAI,EAAE;iBACzG,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;IACX,OAAO,EAAE,GAAG,sBAAc,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,mBAAW,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,aAAa,CAAC,mBAAW,EAAE,IAAI,CAAC,SAAS,CAAC,sBAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;QAChE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI;KAC1C,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAC3C,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE7D,uFAAuF;AACvF,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAgB,EAAE,SAAoB;IAC9D,KAAK,MAAM,QAAQ,IAAI,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,SAAS;QAC7C,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE/B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;gBAAE,OAAO;YAE1C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,QAAQ;gBAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,GAAG,EAAE;gBAC/C,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;gBACjG,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;oBAC7C,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjH,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,IAAI;IACxB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE3C,aAAa,EAAE,CAAC;IAChB,gBAAgB,EAAE,CAAC;IAEnB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAEtC,MAAM,KAAK,GAAG,IAAI,0BAAW,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,sCAAiB,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,sBAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE5E,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;IAExB,yEAAyE;IACzE,mEAAmE;IACnE,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,KAAK,CAAC,kBAAkB,EAAE,EAAE,CAAC;QACrD,gBAAgB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gEAAgE;QAChE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAChC,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/E,CAAC;IAED,0EAA0E;IAC1E,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,sBAAS,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,MAAM,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,EAAE;YACvC,OAAO,CAAC,KAAK,CAAC,wBAAwB,YAAY,CAAC,MAAM,iCAAiC,CAAC,CAAC;YAC5F,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;gBAC9B,qEAAqE;gBACrE,CAAC,KAAK,IAAI,EAAE;oBACV,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;wBAC5C,IAAI,CAAC,QAAQ;4BAAE,OAAO;wBACtB,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;wBAC7B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;wBACrB,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;oBACnC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,CAAC,KAAK,CAAC,0CAA0C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC9G,CAAC;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,CAAC;QACH,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,kDAAkD,OAAO,WAAW,QAAQ,EAAE,CAAC,CAAC;QAC9F,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED,4CAA4C;IAC5C,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxB,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC1B,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,iCAAiC,CAAC,CAAC;QACjF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/D,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,qDAAqD;IACrD,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAG5B,CAAC;QAEF,IAAI,MAAM,KAAK,eAAe,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,QAAQ,GAAiB;gBAC7B,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;gBACxD,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,WAAW,EAAG,IAAI,CAAC,WAA2C,IAAI,SAAS;gBAC3E,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;gBACvC,QAAQ,EAAE,IAAI;aACf,CAAC;YAEF,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/B,SAAS,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;YACzC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAE3C,OAAO,CAAC,KAAK,CAAC,4BAA4B,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAEjH,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,wDAAwD;IACxD,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAqB,CAAC;QAElE,IAAI,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,QAAQ,GAAG,OAAO,IAAI,QAAQ,CAAC;YAExC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEjC,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,KAAK,CACX,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,QAAQ,CAAC,MAAM,oBAAoB,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CACtH,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,oCAAoC,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,2BAA2B;IAC3B,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,wEAAwE;IACxE,6DAA6D;IAC7D,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAA6B,CAAC;QAChE,MAAM,MAAM,GAAG,OAAO,IAAI,QAAQ,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;YAC3C,OAAO,CAAC,KAAK,CAAC,4CAA4C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,gBAAQ,EAAE,WAAW,EAAE,GAAG,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,wCAAwC,gBAAQ,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,UAAU,mBAAW,aAAa,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,IAAI,OAAO,CAAC,4BAA4B,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC;IAC9C,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,qCAAqC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAQ,CAAC,CAAC;IACnC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,EAAE,CAAC,aAAa,CAAC,gBAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAkB;IAClC,IAAI,CAAC;QAAC,EAAE,CAAC,UAAU,CAAC,gBAAQ,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,gBAAgB;QAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,MAAM,EAAE;QAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7D,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,4DAA4D;AAC5D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;IACpC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;QACjB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/github/app.d.ts

@@ -0,0 +1,34 @@
+/**
+ * GitHub App webhook handler.
+ *
+ * Listens for push and pull_request webhooks from GitHub, runs graph analysis
+ * on changed files, and logs impact summaries to stderr.
+ *
+ * Configure via:
+ *   EXPOSE_GITHUB_APP=true GK_WEBHOOK_SECRET=<secret> GK_GITHUB_TOKEN=<token> npx tsx src/github/app.ts
+ *
+ * GK_GITHUB_TOKEN is required for pull_request analysis (used to fetch changed files from the GitHub API).
+ */
+import { GraphNodeSummary } from './commenter';
+export declare function verifySignature(payload: string, signature: string | undefined): boolean;
+export declare function getRepoFullName(payload: Record<string, unknown>): string | null;
+type GraphNode = {
+    id: string;
+    label: string;
+    rating: number;
+    violations: Array<{
+        severity: string;
+    }>;
+};
+type GraphEdge = {
+    source: string;
+    target: string;
+};
+type GraphData = {
+    nodes: GraphNode[];
+    edges: GraphEdge[];
+};
+export declare function buildPushSummaries(allFiles: Set<string>, graph: GraphData): GraphNodeSummary[];
+export declare function startGitHubApp(): void;
+export {};
+//# sourceMappingURL=app.d.ts.map

package/dist/github/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/github/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,EAA+B,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAsB5E,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CASvF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAG/E;AAED,KAAK,SAAS,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AACxG,KAAK,SAAS,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AACpD,KAAK,SAAS,GAAG;IAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAAC,KAAK,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC;AAE5D,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,GAAG,gBAAgB,EAAE,CAiB9F;AAmHD,wBAAgB,cAAc,IAAI,IAAI,CAiCrC"}

package/dist/github/app.js

@@ -0,0 +1,261 @@
+"use strict";
+/**
+ * GitHub App webhook handler.
+ *
+ * Listens for push and pull_request webhooks from GitHub, runs graph analysis
+ * on changed files, and logs impact summaries to stderr.
+ *
+ * Configure via:
+ *   EXPOSE_GITHUB_APP=true GK_WEBHOOK_SECRET=<secret> GK_GITHUB_TOKEN=<token> npx tsx src/github/app.ts
+ *
+ * GK_GITHUB_TOKEN is required for pull_request analysis (used to fetch changed files from the GitHub API).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifySignature = verifySignature;
+exports.getRepoFullName = getRepoFullName;
+exports.buildPushSummaries = buildPushSummaries;
+exports.startGitHubApp = startGitHubApp;
+const express_1 = __importDefault(require("express"));
+const crypto = __importStar(require("crypto"));
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const commenter_1 = require("./commenter");
+const PORT = parseInt(process.env['GK_GH_PORT'] ?? '5432', 10);
+const WEBHOOK_SECRET = process.env['GK_WEBHOOK_SECRET'] ?? '';
+const DAEMON_PORT = 5378;
+// ── Helpers ────────────────────────────────────────────────
+function fetchDaemonApi(urlPath) {
+    return new Promise((resolve) => {
+        const req = http.get(`http://127.0.0.1:${DAEMON_PORT}${urlPath}`, { timeout: 5000 }, (res) => {
+            let body = '';
+            res.on('data', (chunk) => { body += chunk; });
+            res.on('end', () => {
+                try {
+                    resolve(JSON.parse(body));
+                }
+                catch {
+                    resolve(null);
+                }
+            });
+        });
+        req.on('error', () => resolve(null));
+        req.on('timeout', () => { req.destroy(); resolve(null); });
+    });
+}
+function verifySignature(payload, signature) {
+    if (!WEBHOOK_SECRET)
+        return true;
+    if (!signature)
+        return false;
+    const sig = `sha256=${crypto.createHmac('sha256', WEBHOOK_SECRET).update(payload).digest('hex')}`;
+    try {
+        return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(signature));
+    }
+    catch {
+        return false;
+    }
+}
+function getRepoFullName(payload) {
+    const repo = payload['repository'];
+    return repo ? `${repo['owner']}/${repo['name']}` : null;
+}
+function buildPushSummaries(allFiles, graph) {
+    const summaries = [];
+    for (const file of allFiles) {
+        const node = graph.nodes.find(n => n.id.endsWith(file));
+        if (!node)
+            continue;
+        const dependents = graph.edges.filter(e => e.target === node.id);
+        const fragile = graph.nodes.filter(n => dependents.some(d => d.source === n.id) && n.rating < 6);
+        summaries.push({
+            path: file,
+            rating: node.rating,
+            directDependents: dependents.length,
+            fragileDependents: fragile.length,
+            errors: node.violations.filter(v => v.severity === 'error').length,
+            warnings: node.violations.filter(v => v.severity === 'warning').length,
+        });
+    }
+    return summaries;
+}
+// ── Webhook handlers ──────────────────────────────────────
+async function handlePush(payload) {
+    const repoName = getRepoFullName(payload);
+    const commits = (payload['commits'] ?? []);
+    const allFiles = new Set();
+    for (const c of commits) {
+        for (const f of c.modified ?? [])
+            allFiles.add(f);
+        for (const f of c.added ?? [])
+            allFiles.add(f);
+    }
+    if (allFiles.size === 0 || !repoName)
+        return;
+    const graphRaw = await fetchDaemonApi(`/api/graph`);
+    if (!graphRaw)
+        return;
+    const summaries = buildPushSummaries(allFiles, graphRaw);
+    if (summaries.length === 0)
+        return;
+    const ref = payload['ref'] ?? 'unknown';
+    const pr = {
+        number: 0,
+        title: `Push to ${ref}`,
+        author: payload['pusher']?.['name'] ?? 'unknown',
+        baseBranch: ref.replace('refs/heads/', ''),
+        headBranch: ref.replace('refs/heads/', ''),
+    };
+    const comment = (0, commenter_1.formatPRComment)(pr, summaries, repoName, graphRaw.nodes.length);
+    process.stderr.write(`[gate-keeper-github] Push analysis: ${summaries.length} files changed, verdict=${comment.verdict}\n`);
+    for (const s of summaries) {
+        process.stderr.write(`[gate-keeper-github]   ${s.path}: ${s.rating}/10, ${s.fragileDependents} fragile\n`);
+    }
+}
+async function handlePullRequest(payload) {
+    const action = payload['action'];
+    if (action !== 'opened' && action !== 'synchronize')
+        return;
+    const repoName = getRepoFullName(payload);
+    const pr = payload['pull_request'];
+    if (!repoName || !pr)
+        return;
+    const token = process.env['GK_GITHUB_TOKEN'];
+    if (!token) {
+        process.stderr.write(`[gate-keeper-github] PR #${payload['number']} ${action} — set GK_GITHUB_TOKEN to enable PR file analysis\n`);
+        return;
+    }
+    const [owner, repo] = repoName.split('/');
+    if (!owner || !repo)
+        return;
+    const prFiles = await fetchPRFiles(owner, repo, payload['number'], token);
+    if (prFiles.length === 0)
+        return;
+    const allFiles = new Set(prFiles.map(f => f.filename));
+    const graphRaw = await fetchDaemonApi('/api/graph');
+    if (!graphRaw)
+        return;
+    const summaries = buildPushSummaries(allFiles, graphRaw);
+    if (summaries.length === 0)
+        return;
+    const prMeta = {
+        number: payload['number'],
+        title: pr['title'] ?? 'Untitled PR',
+        author: (pr['user']?.['login']) ?? 'unknown',
+        baseBranch: (pr['base']?.['ref']) ?? 'main',
+        headBranch: (pr['head']?.['ref']) ?? 'feature',
+    };
+    const comment = (0, commenter_1.formatPRComment)(prMeta, summaries, repoName, graphRaw.nodes.length);
+    process.stderr.write(`[gate-keeper-github] PR #${prMeta.number} (${action}): ${summaries.length} files analyzed, verdict=${comment.verdict}\n`);
+    for (const s of summaries) {
+        process.stderr.write(`[gate-keeper-github]   ${s.path}: ${s.rating}/10, ${s.fragileDependents} fragile\n`);
+    }
+}
+function fetchPRFiles(owner, repo, prNumber, token) {
+    return new Promise((resolve) => {
+        const req = https.get({
+            hostname: 'api.github.com',
+            path: `/repos/${owner}/${repo}/pulls/${prNumber}/files`,
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'User-Agent': 'gate-keeper',
+                Accept: 'application/vnd.github+json',
+            },
+            timeout: 5000,
+        }, (res) => {
+            let body = '';
+            res.on('data', (chunk) => { body += chunk; });
+            res.on('end', () => {
+                try {
+                    resolve(JSON.parse(body));
+                }
+                catch {
+                    resolve([]);
+                }
+            });
+        });
+        req.on('error', () => resolve([]));
+        req.on('timeout', () => { req.destroy(); resolve([]); });
+    });
+}
+async function dispatchWebhookEvent(event, payload) {
+    if (event === 'push') {
+        await handlePush(payload);
+    }
+    else if (event === 'pull_request') {
+        await handlePullRequest(payload);
+    }
+}
+// ── Server ─────────────────────────────────────────────────
+function startGitHubApp() {
+    const app = (0, express_1.default)();
+    app.post('/webhook', express_1.default.json({
+        verify: (req, _res, buf) => {
+            req['rawBody'] = buf;
+        },
+    }), async (req, res) => {
+        const rawBody = req['rawBody'];
+        const signature = req.headers['x-hub-signature-256'];
+        const event = req.headers['x-github-event'];
+        if (!verifySignature(rawBody?.toString() ?? '', signature)) {
+            res.status(401).json({ error: 'Invalid signature' });
+            return;
+        }
+        res.status(202).json({ ok: true });
+        try {
+            await dispatchWebhookEvent(event, req.body);
+        }
+        catch (err) {
+            process.stderr.write(`[gate-keeper-github] Webhook error: ${err instanceof Error ? err.message : String(err)}\n`);
+        }
+    });
+    app.get('/health', (_req, res) => {
+        res.json({ ok: true, app: 'gate-keeper-github' });
+    });
+    app.listen(PORT, () => {
+        process.stderr.write(`[gate-keeper-github] Webhook server on :${PORT} (secret: ${WEBHOOK_SECRET ? 'set' : 'NOT SET'})\n`);
+    });
+}
+if (require.main === module) {
+    if (!process.env['EXPOSE_GITHUB_APP']) {
+        process.stderr.write('Set EXPOSE_GITHUB_APP=true to start the GitHub App webhook server.\n');
+        process.exit(0);
+    }
+    startGitHubApp();
+}
+//# sourceMappingURL=app.js.map