@open-everywhere/core 0.1.0

package/dist/agent/scm/broker-audit.js

@@ -0,0 +1,94 @@
+// THE AUDIT ROW FOR A MID-TURN FIREWALL RE-APPLY (OPE-1448).
+//
+// THE MEASUREMENT THIS EXISTS FOR. Ship #162's batch review found that `mergeGitReadBroker`
+// (scm/broker.ts) replaces `github.com` and `codeload.github.com` wholesale with rules that carry
+// the installation token as a header transform and declare NO method match — an un-narrowed
+// credentialed write reach, by construction, because a git clone is not a fixed verb list. The two
+// SCM tools push that policy to the firewall mid-turn. Nothing audited it. So a session's only
+// `egress.policy` row was the session-start one, whose `writeHosts` list named neither git host,
+// and an auditor reading that row concluded the session could not write through a brokered git
+// host. It could: for the length of the SCM call, and on a policy no row described.
+//
+// The fix is not a new row shape. It is the SAME `egress.policy` row the session/turn hook already
+// appends, on the same hash-chain writer (audit/audit.ts `appendAudit`, reached here through
+// `auditToolAction`), carrying the same `writeHosts` trio (`writeHostsAuditFields`) — so the three
+// rows on this action join on one set of field names and one cap.
+//
+// 🔴 ONE ROW PER SUCCESSFUL APPLY, NEVER DEDUPLICATED BY FINGERPRINT. The session/turn hook skips
+// an unchanged policy because it runs on a clock and would otherwise write a row per turn saying
+// "still the same". This path is different: every apply here is a deliberate state change inside
+// one turn, and `open_pull_request` applies TWICE on purpose — it lifts the read stamp off
+// github.com for the staging push, then re-arms the brokered policy in a `finally`. Both are real
+// firewall states, and the second is the one an operator most needs to see happened. Dropping it as
+// "identical to the state before the swap" would erase the re-arm from the record.
+//
+// A restore that FAILS therefore leaves a swap row with no re-arm row after it, and the tool throws
+// a fail-closed error naming the degraded state. The missing row is the signal; there is no row
+// claiming a policy that was not applied.
+import { openWriteHosts, writeHostsAuditFields } from "../access/egress.js";
+import { browserEgressHosts } from "../access/browser-hosts.js";
+import { egressPolicyFingerprint } from "../hooks/egress.js";
+import { auditToolAction } from "../audit/tool-action.js";
+import { GIT_BROKER_HOSTS } from "./broker.js";
+/**
+ * The attribution list to hand `openWriteHosts` for a BROKERED policy: `reachableHosts` with the
+ * git hosts removed.
+ *
+ * 🔴 WHY THE FILTER IS REQUIRED, NOT TIDYING. `openWriteHosts` attributes a stamped host by NAME,
+ * looking the host string up in the list it is given. `mergeGitReadBroker` REPLACES both git hosts'
+ * rules wholesale with the installation-token rule, so any `reachableHosts` entry for those hosts
+ * describes a rule that is no longer in the policy. Left in, a bundle that declares a `Connection`
+ * over `github.com` would make the row read `credential: "<that-connection>", credentialed: true` while the
+ * credential the firewall actually stamps is the broker's token — and if that connection had been
+ * revoked by break-glass, the row would print the REVOKED id as the stamp. That is the exact defect
+ * OPE-1448 exists to remove, reproduced on this path.
+ *
+ * Dropping them is what makes the git hosts report `{credentialed: true, credential: null}` — a credential
+ * rides, and no bundle connection names it — which is the truth about a brokered rule.
+ */
+export function brokerAttributionHosts(reachableHosts) {
+    return reachableHosts.filter((h) => !GIT_BROKER_HOSTS.includes(h.host));
+}
+/**
+ * Append the `egress.policy` row for one brokered firewall (re)apply.
+ *
+ * Call it AFTER the apply returns, never before: both apply paths (`pushEgressPolicy` and
+ * `sandbox.setNetworkPolicy`) throw on failure, so reaching this line is what makes `enforced: true`
+ * an honest claim rather than an intention.
+ *
+ * Best-effort by contract — `auditToolAction` swallows its own failures — for the reason the hook's
+ * audit is: a row that could not be written must never undo the firewall that was just applied.
+ */
+export async function auditBrokeredEgressPolicy(ctx, access, policy, reason) {
+    // 🔴 EVERYTHING BELOW IS BEST-EFFORT, INCLUDING THE DERIVATION. `auditToolAction` swallows its own
+    // failures, but `openWriteHosts` / `egressPolicyFingerprint` / the host count run before it — and
+    // in `open_pull_request` this whole call sits inside the restore's `try`, whose `catch` announces
+    // "the read-broker policy could not be restored, github.com is left on a bare allow". A throw from
+    // a REPORTING step must never make the tool claim a firewall state that is false, so the guard is
+    // here rather than at each call site.
+    try {
+        const hostCount = typeof policy === "string" ? 0 : Object.keys(policy.allow ?? {}).length;
+        // Derived from the COMPILED policy that was just pushed, exactly as the hook derives its own.
+        // The git hosts are filtered OUT of the attribution list first — see `brokerAttributionHosts`
+        // — so they report `{credentialed: true, credential: null}`: a credential rides, and no bundle
+        // connection names it, because it is the installation token scm/broker.ts minted.
+        // The declared browser hosts ride here too (OPE-1614): the broker RECOMPILES the whole policy,
+        // so a credentialed browse target is in this policy as much as in the session's own, and an
+        // attribution list that omitted it would name the same host differently on two rows.
+        const writeHosts = openWriteHosts(policy, brokerAttributionHosts(access.reachableHosts), browserEgressHosts());
+        await auditToolAction(ctx, "egress.policy", {
+            hosts: hostCount,
+            enforced: true,
+            scopeKey: access.scopeKey,
+            summary: typeof policy === "string" ? policy : `allow ${hostCount} host(s), default-deny`,
+            phase: "scm.broker",
+            reason,
+            policyFingerprint: egressPolicyFingerprint(policy),
+            ...writeHostsAuditFields(writeHosts),
+        });
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:audit] dropped the "${reason}" egress.policy row (the policy itself is applied): ${String(err)}`);
+    }
+}
+//# sourceMappingURL=broker-audit.js.map

package/dist/agent/scm/broker-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker-audit.js","sourceRoot":"","sources":["../../../agent/scm/broker-audit.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,4FAA4F;AAC5F,kGAAkG;AAClG,4FAA4F;AAC5F,mGAAmG;AACnG,+FAA+F;AAC/F,iGAAiG;AACjG,+FAA+F;AAC/F,oFAAoF;AACpF,EAAE;AACF,mGAAmG;AACnG,6FAA6F;AAC7F,mGAAmG;AACnG,kEAAkE;AAClE,EAAE;AACF,kGAAkG;AAClG,iGAAiG;AACjG,iGAAiG;AACjG,2FAA2F;AAC3F,kGAAkG;AAClG,oGAAoG;AACpG,mFAAmF;AACnF,EAAE;AACF,oGAAoG;AACpG,gGAAgG;AAChG,0CAA0C;AAK1C,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,cAAwC;IAC7E,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACjG,CAAC;AAMD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAoB,EACpB,MAAuB,EACvB,MAA4B,EAC5B,MAAyB;IAEzB,mGAAmG;IACnG,kGAAkG;IAClG,kGAAkG;IAClG,mGAAmG;IACnG,kGAAkG;IAClG,sCAAsC;IACtC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC1F,8FAA8F;QAC9F,8FAA8F;QAC9F,+FAA+F;QAC/F,kFAAkF;QAClF,+FAA+F;QAC/F,4FAA4F;QAC5F,qFAAqF;QACrF,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC/G,MAAM,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE;YAC1C,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,OAAO,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,SAAS,wBAAwB;YACzF,KAAK,EAAE,YAAY;YACnB,MAAM;YACN,iBAAiB,EAAE,uBAAuB,CAAC,MAAM,CAAC;YAClD,GAAG,qBAAqB,CAAC,UAAU,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,MAAM,uDAAuD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;AACH,CAAC"}

package/dist/agent/scm/broker.d.ts

@@ -0,0 +1,56 @@
+import type { SandboxNetworkPolicy } from "eve/sandbox";
+import { type EgressRule } from "../access/egress.js";
+import type { GitHubApp } from "./app.js";
+/** Hosts the git read-broker authenticates — mirrors Eve's own broker's pair exactly. DECLARED in
+ *  access/reserved-hosts.ts, a module that imports nothing, and re-exported here (through
+ *  access/egress.ts) because FOUR rungs RESERVE the set: the access lint and the resolve-time refusal
+ *  against bundle connections (OPE-1684), and the browser host declaration's own lint and the policy
+ *  compile against a declared browse target (OPE-1708). See that declaration for why one list has to
+ *  answer all four. */
+export { GIT_BROKER_HOSTS } from "../access/egress.js";
+/** `Authorization: Basic base64("x-access-token:<token>")` — Eve's own broker header shape. */
+export declare function brokerAuthHeader(token: string): Record<string, string>;
+export interface GitReadBrokerResult {
+    /** owner → the firewall rule carrying that owner's scoped read token. */
+    readonly rulesByOwner: ReadonlyMap<string, EgressRule>;
+    /** Granted repos whose owner has no linked installation (same shape as tokensForRepos). */
+    readonly ungranted: readonly string[];
+}
+/**
+ * Mint the union-scoped READ token(s) for `repos` (a session's full granted set — see
+ * access.repos) and build the per-owner firewall rule for each. GitHub rejects a mint
+ * over MAX_MINT_REPOS repositories in one call; the caller asked for firewall-visible
+ * enforcement, so silently slicing the list would quietly narrow what's actually
+ * reachable instead of surfacing the misconfiguration — this throws instead, naming the
+ * offending owner and count.
+ */
+export declare function mintGitReadBroker(app: GitHubApp, repos: readonly string[]): Promise<GitReadBrokerResult>;
+/**
+ * Merge the git read-broker's owner-scoped rules into a standing compiled policy.
+ * github.com and codeload.github.com are REPLACED wholesale (not appended) — the base
+ * compiler emits at most a BARE allow for github.com (egress.ts's repos>0 fallback, for
+ * the unenforced path), and a plain merge would leave that sitting alongside these as an
+ * unauthenticated duplicate. Empty `rulesByOwner` (no granted repos, or no owner had a
+ * usable installation) leaves the base policy untouched, including `"deny-all"`.
+ */
+export declare function mergeGitReadBroker(base: SandboxNetworkPolicy, rulesByOwner: ReadonlyMap<string, EgressRule>): SandboxNetworkPolicy;
+/**
+ * Lift the read-broker's credential stamp off ONE host: return a copy of `policy` with
+ * `host`'s rules replaced by a BARE allow (allowed, no transform, no match). This is the
+ * #104 fix seam. checkout_repo installs the READ installation token as a firewall header
+ * TRANSFORM over all github.com traffic (mintGitReadBroker above); the firewall SETS
+ * (overrides) the request's Authorization header, so a gated staging push — which injects
+ * the WRITE token inline via `git -c http.extraheader` — arrives read-authenticated and
+ * 403s ("Write access to repository not granted"). Around that single push
+ * (tools/open_pull_request.ts) the caller swaps github.com to this bare allow so only git's
+ * inline write token rides, then restores the brokered policy immediately.
+ *
+ * Everything else is preserved byte-for-byte — every other host, and codeload's own broker
+ * rule — so the swapped policy stays complete (setNetworkPolicy replaces the WHOLE policy)
+ * and the restore is exact. A string policy ("deny-all"/"allow-all") is returned unchanged:
+ * there is no per-host rule to lift, and manufacturing an allow map would WIDEN a deny-all
+ * (fail-closed). Lifting a host's transform is strictly NARROWING — it can only drop an
+ * injected credential, never grant reach the base policy didn't already allow.
+ */
+export declare function withBareAllowHost(policy: SandboxNetworkPolicy, host: string): SandboxNetworkPolicy;
+//# sourceMappingURL=broker.d.ts.map

package/dist/agent/scm/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../../../agent/scm/broker.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAG1C;;;;;uBAKuB;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAKvD,+FAA+F;AAC/F,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEtE;AAED,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvD,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA2B9G;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,oBAAoB,EAC1B,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAC5C,oBAAoB,CAMtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,CAOlG"}

package/dist/agent/scm/broker.js

@@ -0,0 +1,113 @@
+// The firewall-brokered git READ credential — the prod-hardening path from
+// docs/capabilities/source-control.md. Mints ONE installation token per owner, scoped
+// to the UNION of the session's granted repo set (not just the one repo being checked
+// out), and turns it into firewall rules that checkout_repo merges into the standing
+// egress policy at SCM-call time. The token is injected as a header TRANSFORM at the
+// sandbox firewall (Vercel's `setNetworkPolicy`) — it never rides in the git command or
+// touches the clone's config. Header shape mirrors Eve's own GitHub-channel checkout
+// broker (buildBrokerNetworkPolicy in eve/dist/src/public/channels/github/checkout.js)
+// exactly, so this is the SAME auth form GitHub's own actions/checkout and Eve's native
+// channel use, not a bespoke one: `Authorization: Basic base64("x-access-token:<token>")`.
+//
+// One token can't span installations (each GitHub App installation is owner-scoped), so
+// "union-scoped" means union WITHIN each owner; a session whose granted repos span
+// multiple owners gets one rule per owner, narrowed by an `/<owner>/` path prefix so
+// each owner's token only ever rides toward that owner's own repos.
+//
+// WRITE stays out of this plane entirely (see tools/open_pull_request.ts / stagePushCommand):
+// a standing firewall header is reachable by ANY concurrent sandbox code, not just the
+// tool that minted it, so only the read-only token is ever installed here.
+import { GIT_BROKER_HOSTS } from "../access/egress.js";
+import { READ_PERMISSIONS } from "./mint.js";
+/** Hosts the git read-broker authenticates — mirrors Eve's own broker's pair exactly. DECLARED in
+ *  access/reserved-hosts.ts, a module that imports nothing, and re-exported here (through
+ *  access/egress.ts) because FOUR rungs RESERVE the set: the access lint and the resolve-time refusal
+ *  against bundle connections (OPE-1684), and the browser host declaration's own lint and the policy
+ *  compile against a declared browse target (OPE-1708). See that declaration for why one list has to
+ *  answer all four. */
+export { GIT_BROKER_HOSTS } from "../access/egress.js";
+/** GitHub's cap on repositories per installation-token mint. */
+const MAX_MINT_REPOS = 500;
+/** `Authorization: Basic base64("x-access-token:<token>")` — Eve's own broker header shape. */
+export function brokerAuthHeader(token) {
+    return { Authorization: `Basic ${Buffer.from(`x-access-token:${token}`, "utf-8").toString("base64")}` };
+}
+/**
+ * Mint the union-scoped READ token(s) for `repos` (a session's full granted set — see
+ * access.repos) and build the per-owner firewall rule for each. GitHub rejects a mint
+ * over MAX_MINT_REPOS repositories in one call; the caller asked for firewall-visible
+ * enforcement, so silently slicing the list would quietly narrow what's actually
+ * reachable instead of surfacing the misconfiguration — this throws instead, naming the
+ * offending owner and count.
+ */
+export async function mintGitReadBroker(app, repos) {
+    const perOwnerCount = new Map();
+    for (const ref of repos) {
+        const slash = ref.indexOf("/");
+        if (slash <= 0)
+            continue; // malformed — tokensForRepos below drops it the same way
+        const owner = ref.slice(0, slash);
+        perOwnerCount.set(owner, (perOwnerCount.get(owner) ?? 0) + 1);
+    }
+    for (const [owner, count] of perOwnerCount) {
+        if (count > MAX_MINT_REPOS) {
+            throw new Error(`owner "${owner}" has ${count} repos granted to this session — GitHub caps a single installation ` +
+                `token mint at ${MAX_MINT_REPOS} repositories. Narrow the grant (split it across more bundles/scopes) ` +
+                `rather than widen this cap.`);
+        }
+    }
+    const { tokens, ungranted } = await app.tokensForRepos(repos, READ_PERMISSIONS);
+    const rulesByOwner = new Map();
+    for (const [owner, tok] of tokens) {
+        rulesByOwner.set(owner, {
+            match: { path: { startsWith: `/${owner}/` } },
+            transform: [{ headers: brokerAuthHeader(tok.token) }],
+        });
+    }
+    return { rulesByOwner, ungranted };
+}
+/**
+ * Merge the git read-broker's owner-scoped rules into a standing compiled policy.
+ * github.com and codeload.github.com are REPLACED wholesale (not appended) — the base
+ * compiler emits at most a BARE allow for github.com (egress.ts's repos>0 fallback, for
+ * the unenforced path), and a plain merge would leave that sitting alongside these as an
+ * unauthenticated duplicate. Empty `rulesByOwner` (no granted repos, or no owner had a
+ * usable installation) leaves the base policy untouched, including `"deny-all"`.
+ */
+export function mergeGitReadBroker(base, rulesByOwner) {
+    if (rulesByOwner.size === 0)
+        return base;
+    const rules = [...rulesByOwner.values()];
+    const allow = typeof base === "string" ? {} : { ...base.allow };
+    for (const host of GIT_BROKER_HOSTS)
+        allow[host] = rules;
+    return { allow };
+}
+/**
+ * Lift the read-broker's credential stamp off ONE host: return a copy of `policy` with
+ * `host`'s rules replaced by a BARE allow (allowed, no transform, no match). This is the
+ * #104 fix seam. checkout_repo installs the READ installation token as a firewall header
+ * TRANSFORM over all github.com traffic (mintGitReadBroker above); the firewall SETS
+ * (overrides) the request's Authorization header, so a gated staging push — which injects
+ * the WRITE token inline via `git -c http.extraheader` — arrives read-authenticated and
+ * 403s ("Write access to repository not granted"). Around that single push
+ * (tools/open_pull_request.ts) the caller swaps github.com to this bare allow so only git's
+ * inline write token rides, then restores the brokered policy immediately.
+ *
+ * Everything else is preserved byte-for-byte — every other host, and codeload's own broker
+ * rule — so the swapped policy stays complete (setNetworkPolicy replaces the WHOLE policy)
+ * and the restore is exact. A string policy ("deny-all"/"allow-all") is returned unchanged:
+ * there is no per-host rule to lift, and manufacturing an allow map would WIDEN a deny-all
+ * (fail-closed). Lifting a host's transform is strictly NARROWING — it can only drop an
+ * injected credential, never grant reach the base policy didn't already allow.
+ */
+export function withBareAllowHost(policy, host) {
+    if (typeof policy === "string")
+        return policy;
+    const allow = { ...policy.allow };
+    allow[host] = [];
+    // Spread the source policy so any non-`allow` field (e.g. a future `subnets`) survives the
+    // swap/restore round-trip — this helper must only ever touch the one host's rules.
+    return { ...policy, allow };
+}
+//# sourceMappingURL=broker.js.map

package/dist/agent/scm/broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.js","sourceRoot":"","sources":["../../../agent/scm/broker.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,sFAAsF;AACtF,sFAAsF;AACtF,qFAAqF;AACrF,qFAAqF;AACrF,wFAAwF;AACxF,qFAAqF;AACrF,uFAAuF;AACvF,wFAAwF;AACxF,2FAA2F;AAC3F,EAAE;AACF,wFAAwF;AACxF,mFAAmF;AACnF,qFAAqF;AACrF,oEAAoE;AACpE,EAAE;AACF,8FAA8F;AAC9F,uFAAuF;AACvF,2EAA2E;AAG3E,OAAO,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAExE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C;;;;;uBAKuB;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,gEAAgE;AAChE,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,+FAA+F;AAC/F,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,EAAE,aAAa,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;AAC1G,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAc,EAAE,KAAwB;IAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS,CAAC,yDAAyD;QACnF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,aAAa,EAAE,CAAC;QAC3C,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,SAAS,KAAK,qEAAqE;gBAChG,iBAAiB,cAAc,wEAAwE;gBACvG,6BAA6B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;YACtB,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,KAAK,GAAG,EAAE,EAAE;YAC7C,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAA0B,EAC1B,YAA6C;IAE7C,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAiC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,KAAsC,EAAE,CAAC;IAChI,KAAK,MAAM,IAAI,IAAI,gBAAgB;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACzD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA4B,EAAE,IAAY;IAC1E,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,KAAK,GAAiC,EAAE,GAAI,MAAM,CAAC,KAAsC,EAAE,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACjB,2FAA2F;IAC3F,mFAAmF;IACnF,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC"}

package/dist/agent/scm/capability-fit.d.ts

@@ -0,0 +1,59 @@
+import { type RepoCapability } from "../access/repo-capabilities.js";
+/** One family a named capability needs that the installation does not grant at the needed grade. */
+export interface CapabilityShortfall {
+    readonly capability: RepoCapability;
+    /** The GitHub permission family, in GitHub's own spelling (what the owner sees on the consent screen). */
+    readonly family: string;
+    /** The grade the mint will ask for. */
+    readonly need: string;
+    /** What the installation grants today for that family — absent when it grants none. */
+    readonly granted?: string;
+}
+export interface CapabilityFit {
+    /** True when every named capability is supported, or when the installation did not report. */
+    readonly ok: boolean;
+    /** False when the installation could not report its granted families — `ok` is then not a claim. */
+    readonly reported: boolean;
+    readonly missing: readonly CapabilityShortfall[];
+}
+/**
+ * PURE. Join the named capability sets to the installation's reported permission families and
+ * report every shortfall. `granted === undefined` means the installation did not report: the fit
+ * is `reported: false` with no shortfalls, which reads as "cannot tell", never as "supported".
+ *
+ * An unknown capability name is skipped rather than thrown on: config load already refuses one
+ * (`assertBundlesValid`), and this path must stay total so a stale name can never take down the
+ * report that would explain it.
+ */
+export declare function capabilityInstallationFit(capabilities: readonly RepoCapability[], granted: Readonly<Record<string, string>> | undefined): CapabilityFit;
+/**
+ * Where the installation OWNER accepts an App permission update. GitHub routes a permission change
+ * to the installing account for approval; an org installation and a user installation live at
+ * different settings paths, and we cannot tell which an owner is from the owner login alone — so
+ * both are named rather than one guessed.
+ */
+export declare function installationApprovalUrls(owner: string, installationId: string): readonly string[];
+/** The owner half of an "owner/name" repo ref, or "" when the ref is malformed. */
+export declare function repoOwner(repo: string): string;
+/** What one repo's capability picture looks like — every implemented set, with its status here. */
+export interface RepoCapabilityRow {
+    readonly repo: string;
+    readonly capability: RepoCapability;
+    /** True when a binding in this scope already opted the repo into the set. */
+    readonly declared: boolean;
+    /** The installation fit for JUST this capability. */
+    readonly fit: CapabilityFit;
+}
+/**
+ * PURE. Join this scope's repo grants to the implemented capability sets and to each owner's
+ * reported installation families. One row per (repo, capability) — including the sets NOT taken,
+ * which is the half that answers "what would it take to let this domain do X?".
+ */
+export declare function repoCapabilityRows(repos: readonly string[], declared: Readonly<Record<string, readonly RepoCapability[]>>, grantedByOwner: Readonly<Record<string, Readonly<Record<string, string>> | undefined>>): readonly RepoCapabilityRow[];
+/**
+ * The report section, as lines — the ask-time answer for a whole domain's repo grants. Each line
+ * names the capability, whether this scope already has it, the exact config edit, and whether the
+ * App installation can honour it today.
+ */
+export declare function renderRepoCapabilityRows(rows: readonly RepoCapabilityRow[], installationIdByOwner?: Readonly<Record<string, string | undefined>>): string[];
+//# sourceMappingURL=capability-fit.d.ts.map

package/dist/agent/scm/capability-fit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-fit.d.ts","sourceRoot":"","sources":["../../../agent/scm/capability-fit.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAGxF,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,0GAA0G;IAC1G,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uCAAuC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAClD;AAQD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,SAAS,cAAc,EAAE,EACvC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,GACpD,aAAa,CAYf;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAKjG;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,mGAAmG;AACnG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,qDAAqD;IACrD,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,EAC7D,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,GACrF,SAAS,iBAAiB,EAAE,CAW9B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,SAAS,iBAAiB,EAAE,EAClC,qBAAqB,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAM,GACvE,MAAM,EAAE,CA+BV"}

package/dist/agent/scm/capability-fit.js

@@ -0,0 +1,122 @@
+// THE ASK-TIME CHECK (OPE-1024) — "can the App installation honour this capability expansion?"
+//
+// 🔴 ASK TIME IS THE ONLY IMPLEMENTATION POINT (Tommy, 2026-08-23). There is deliberately NO
+// deploy-chain preflight rung and NO boot-time drift check. The always-on backstop for drift is
+// GitHub itself: a mint that asks past the installation is refused, and the refusal is audited
+// (`github.token_mint_failed`). This module is the UX half — it turns "the mint will 403 later"
+// into "here is the config line, and here is the owner-approval step you will need first".
+//
+// 🔴 IT IS NOT AN INTROSPECTION VERB, and that shapes the API. There is no "enumerate what this
+// credential can do" entry point: `capabilityInstallationFit` answers only about the closed set of
+// capability names we implement, and only for a caller that already named a concrete config change.
+// The risk of the answer itself is accepted as low — an installation's grants are org-internal
+// metadata, not a secret — but knowing what is grantable grants nothing: the config PR, the merge
+// and the mint body remain the enforcement.
+//
+// FAIL-SOFT, ON PURPOSE. This check gates nothing. A vendor that cannot report its granted families
+// (the contract models grant-reporting as OPTIONAL) degrades to "unreported", never to a refusal.
+// A hard fail here would convert a UX affordance into an outage the moment GitHub's App API blips.
+import { REPO_CAPABILITIES } from "../access/repo-capabilities.js";
+import { REPO_CAPABILITY_PERMISSIONS } from "./mint.js";
+/** Is `granted` at least as strong as `need`? "write" covers "read"; absent covers nothing. */
+function covers(granted, need) {
+    if (granted === undefined)
+        return false;
+    return granted === "write" || granted === need;
+}
+/**
+ * PURE. Join the named capability sets to the installation's reported permission families and
+ * report every shortfall. `granted === undefined` means the installation did not report: the fit
+ * is `reported: false` with no shortfalls, which reads as "cannot tell", never as "supported".
+ *
+ * An unknown capability name is skipped rather than thrown on: config load already refuses one
+ * (`assertBundlesValid`), and this path must stay total so a stale name can never take down the
+ * report that would explain it.
+ */
+export function capabilityInstallationFit(capabilities, granted) {
+    if (granted === undefined)
+        return { ok: true, reported: false, missing: [] };
+    const missing = [];
+    for (const capability of capabilities) {
+        const families = REPO_CAPABILITY_PERMISSIONS[capability];
+        if (!families)
+            continue;
+        for (const [family, need] of Object.entries(families)) {
+            const has = Object.hasOwn(granted, family) ? granted[family] : undefined;
+            if (!covers(has, need))
+                missing.push({ capability, family, need, ...(has === undefined ? {} : { granted: has }) });
+        }
+    }
+    return { ok: missing.length === 0, reported: true, missing };
+}
+/**
+ * Where the installation OWNER accepts an App permission update. GitHub routes a permission change
+ * to the installing account for approval; an org installation and a user installation live at
+ * different settings paths, and we cannot tell which an owner is from the owner login alone — so
+ * both are named rather than one guessed.
+ */
+export function installationApprovalUrls(owner, installationId) {
+    return [
+        `https://github.com/organizations/${owner}/settings/installations/${installationId}`,
+        `https://github.com/settings/installations/${installationId}`,
+    ];
+}
+/** The owner half of an "owner/name" repo ref, or "" when the ref is malformed. */
+export function repoOwner(repo) {
+    const slash = repo.indexOf("/");
+    return slash > 0 ? repo.slice(0, slash) : "";
+}
+/**
+ * PURE. Join this scope's repo grants to the implemented capability sets and to each owner's
+ * reported installation families. One row per (repo, capability) — including the sets NOT taken,
+ * which is the half that answers "what would it take to let this domain do X?".
+ */
+export function repoCapabilityRows(repos, declared, grantedByOwner) {
+    const rows = [];
+    for (const repo of [...repos].sort()) {
+        const owner = repoOwner(repo);
+        const granted = Object.hasOwn(grantedByOwner, owner) ? grantedByOwner[owner] : undefined;
+        const here = new Set(declared[repo] ?? []);
+        for (const capability of Object.keys(REPO_CAPABILITIES).sort()) {
+            rows.push({ repo, capability, declared: here.has(capability), fit: capabilityInstallationFit([capability], granted) });
+        }
+    }
+    return rows;
+}
+/**
+ * The report section, as lines — the ask-time answer for a whole domain's repo grants. Each line
+ * names the capability, whether this scope already has it, the exact config edit, and whether the
+ * App installation can honour it today.
+ */
+export function renderRepoCapabilityRows(rows, installationIdByOwner = {}) {
+    if (rows.length === 0)
+        return ["No GitHub repos are granted to this domain, so there is nothing to expand."];
+    const lines = [];
+    let repo = "";
+    for (const row of rows) {
+        if (row.repo !== repo) {
+            repo = row.repo;
+            lines.push(`${repo}:`);
+        }
+        const spec = REPO_CAPABILITIES[row.capability];
+        const state = row.declared ? "declared" : "not declared";
+        const fit = !row.fit.reported
+            ? "installation not reported"
+            : row.fit.ok
+                ? "the installation grants it"
+                : `the installation does NOT grant ${row.fit.missing.map((m) => `${m.family}:${m.need}`).join(", ")}`;
+        lines.push(`  ${row.capability} — ${state}; ${fit}. ${spec?.summary ?? ""}`);
+        if (!row.declared) {
+            lines.push(`    to add: repos: [{ repo: "${row.repo}", capabilities: ["${row.capability}"] }] in agent/access/bundles.ts`);
+        }
+        if (row.fit.reported && !row.fit.ok) {
+            const owner = repoOwner(row.repo);
+            const id = installationIdByOwner[owner];
+            lines.push(`    first: update the GitHub App's repository permissions, then the installation owner (${owner}) approves the update at ` +
+                (id ? installationApprovalUrls(owner, id).join(" or ") : "the installation's settings page") +
+                ".");
+        }
+    }
+    return lines;
+}
+//# sourceMappingURL=capability-fit.js.map

package/dist/agent/scm/capability-fit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-fit.js","sourceRoot":"","sources":["../../../agent/scm/capability-fit.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,EAAE;AACF,6FAA6F;AAC7F,gGAAgG;AAChG,+FAA+F;AAC/F,gGAAgG;AAChG,2FAA2F;AAC3F,EAAE;AACF,gGAAgG;AAChG,mGAAmG;AACnG,oGAAoG;AACpG,+FAA+F;AAC/F,kGAAkG;AAClG,4CAA4C;AAC5C,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AAEnG,OAAO,EAAE,iBAAiB,EAAuB,MAAM,gCAAgC,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,WAAW,CAAC;AAqBxD,+FAA+F;AAC/F,SAAS,MAAM,CAAC,OAA2B,EAAE,IAAY;IACvD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,IAAI,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAAuC,EACvC,OAAqD;IAErD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAa,EAAE,cAAsB;IAC5E,OAAO;QACL,oCAAoC,KAAK,2BAA2B,cAAc,EAAE;QACpF,6CAA6C,cAAc,EAAE;KAC9D,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAwB,EACxB,QAA6D,EAC7D,cAAsF;IAEtF,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAsB,EAAE,CAAC;YACnF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,yBAAyB,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACzH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,IAAkC,EAClC,qBAAqB,GAAiD,EAAE;IAExE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,4EAA4E,CAAC,CAAC;IAC7G,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtB,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC;QACzD,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ;YAC3B,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;gBACV,CAAC,CAAC,4BAA4B;gBAC9B,CAAC,CAAC,mCAAmC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1G,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,UAAU,MAAM,KAAK,KAAK,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,IAAI,sBAAsB,GAAG,CAAC,UAAU,kCAAkC,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACxC,KAAK,CAAC,IAAI,CACR,2FAA2F,KAAK,2BAA2B;gBACzH,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC;gBAC5F,GAAG,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/agent/scm/config-repo-token.d.ts

@@ -0,0 +1,3 @@
+/** A minted WRITE installation token for the deployment's config repo, or the PAT fallback. */
+export declare function resolveConfigRepoWriteToken(repo: string): Promise<string>;
+//# sourceMappingURL=config-repo-token.d.ts.map

package/dist/agent/scm/config-repo-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-repo-token.d.ts","sourceRoot":"","sources":["../../../agent/scm/config-repo-token.ts"],"names":[],"mappings":"AAwCA,+FAA+F;AAC/F,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/E"}

package/dist/agent/scm/config-repo-token.js

@@ -0,0 +1,43 @@
+// THE ONE MINTED WRITE TOKEN FOR THE CONFIG-REPO BOT-PR FLOWS (OPE-1823).
+//
+// Five flows open a bot-PR against the DEPLOYMENT'S OWN CONFIG REPO, and each held its own copy of
+// the eight-line mint below: approvals/access-request.ts, approvals/agent-create.ts,
+// approvals/webhook-declare.ts, credentials/config-pr-github.ts and identity/groups-delivery.ts.
+// The copies had not drifted. OPE-1794 is what happens when copies of this body do drift, so the
+// copies are gone and the five mint here.
+//
+// 🔴 CAPABILITIES ARE `[]`, AND THAT IS A PROPERTY, NOT AN OMISSION.
+//
+// A repo capability (access/repo-capabilities.ts) is declared BY A BINDING, on a repo that binding
+// grants, and is read as `access.repoCapabilities[repo]` from a resolved `EffectiveAccess`. None of
+// the five can read one, and none should:
+//
+//  1. THE REPO IS NOT NAMED BY A BINDING. It is `AccessRequestsConfig.configRepo`, an operator
+//     setting (`OE_ACCESS_CONFIG_REPO`), so there is no `access.repoCapabilities[repo]` entry to
+//     read for it. A `repoAllowed(repo, access.repos)` check would also be the WRONG fence: it
+//     would refuse every requester whose own scope does not grant the config repo, which is the
+//     normal case and the exact case these flows exist to serve. Note the two sets are not
+//     disjoint — this deployment DOES grant its own repo, in `agent/access/bundles.ts`'s `coding`
+//     bundle — which is a further reason the requester's bundle set is not the fence here. The
+//     fence these flows have is the fail-closed config gate plus the human merge.
+//  2. THERE IS NO ACCESS TO RESOLVE FROM. `ActionKind.execute(args, decidedBy)` takes no context by
+//     contract — it sees only what was frozen at propose time — `deliverGroupsOverlay(plan, deps)`
+//     takes none, and `ConfigPrProvider.resolveWriteToken(repo)` takes only the repo.
+//     `resolveAccessFor` needs a `BindableContext`; none of the five holds one.
+//  3. WIDENING HERE WOULD RUN THE WRONG WAY. The config repo holds the grants. A token minted for
+//     it on a MEMBER'S request, widened by that member's own binding, would let the binding decide
+//     what the credential that edits the grants may do. The narrow default job set is the point.
+//
+// What the five write is a single overlay file each — the grants, agents, hooks, credential
+// bindings or person-group module — and its bytes are always TypeScript emitted by a deterministic
+// codemod. Each path is an operator setting with a code default (`OE_ACCESS_GRANTS_PATH`,
+// `agentsPath`, `OE_WEBHOOK_HOOKS_PATH`, `OE_CREDENTIAL_BINDINGS_PATH`, `groupsPath`); nothing
+// validates one against `.github/workflows/**`, and no default sits there. So none of the five
+// needs the `workflows` capability that OPE-1794 was about. An operator who pointed one of those
+// settings under `.github/workflows/**` would fail closed at GitHub's own push refusal.
+import { resolvePrWriteToken } from "./write-token.js";
+/** A minted WRITE installation token for the deployment's config repo, or the PAT fallback. */
+export async function resolveConfigRepoWriteToken(repo) {
+    return resolvePrWriteToken(repo, [], "the config repo");
+}
+//# sourceMappingURL=config-repo-token.js.map

package/dist/agent/scm/config-repo-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-repo-token.js","sourceRoot":"","sources":["../../../agent/scm/config-repo-token.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,mGAAmG;AACnG,qFAAqF;AACrF,iGAAiG;AACjG,iGAAiG;AACjG,0CAA0C;AAC1C,EAAE;AACF,qEAAqE;AACrE,EAAE;AACF,mGAAmG;AACnG,oGAAoG;AACpG,0CAA0C;AAC1C,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAChG,2FAA2F;AAC3F,kGAAkG;AAClG,+FAA+F;AAC/F,kFAAkF;AAClF,oGAAoG;AACpG,mGAAmG;AACnG,sFAAsF;AACtF,gFAAgF;AAChF,kGAAkG;AAClG,mGAAmG;AACnG,iGAAiG;AACjG,EAAE;AACF,4FAA4F;AAC5F,mGAAmG;AACnG,0FAA0F;AAC1F,+FAA+F;AAC/F,+FAA+F;AAC/F,iGAAiG;AACjG,wFAAwF;AAExF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,IAAY;IAC5D,OAAO,mBAAmB,CAAC,IAAI,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC1D,CAAC"}

package/dist/agent/scm/config.d.ts

@@ -0,0 +1,3 @@
+import type { GitHubAppConfig } from "./types.js";
+export declare function loadGitHubAppConfig(env?: NodeJS.ProcessEnv): GitHubAppConfig | null;
+//# sourceMappingURL=config.d.ts.map

package/dist/agent/scm/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../agent/scm/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,eAAe,GAAG,IAAI,CA6BhG"}

package/dist/agent/scm/config.js

@@ -0,0 +1,36 @@
+// Load the org-level GitHub App config from the environment. The plane is OPTIONAL:
+// returns null when not configured (no app id / key / slug), so the agent simply has no
+// source-control capability rather than erroring. Secrets are read from env (secretRef);
+// the private key is never inlined in repo config.
+export function loadGitHubAppConfig(env = process.env) {
+    const appId = env.OE_GITHUB_APP_ID;
+    const privateKeyPem = env.OE_GITHUB_APP_PRIVATE_KEY;
+    const appSlug = env.OE_GITHUB_APP_SLUG;
+    if (!appId || !privateKeyPem || !appSlug)
+        return null;
+    // owner → installation id. JSON map covers multi-org; a single org can also use the
+    // OE_GITHUB_OWNER + OE_GITHUB_INSTALLATION_ID pair.
+    let installations = {};
+    if (env.OE_GITHUB_INSTALLATIONS) {
+        try {
+            const parsed = JSON.parse(env.OE_GITHUB_INSTALLATIONS);
+            if (parsed && typeof parsed === "object")
+                installations = parsed;
+        }
+        catch {
+            // ignore malformed map; the single-owner pair below may still apply
+        }
+    }
+    if (env.OE_GITHUB_OWNER && env.OE_GITHUB_INSTALLATION_ID) {
+        installations[env.OE_GITHUB_OWNER] = env.OE_GITHUB_INSTALLATION_ID;
+    }
+    return {
+        appId,
+        clientId: env.OE_GITHUB_APP_CLIENT_ID,
+        privateKeyPem,
+        appSlug,
+        botUserId: env.OE_GITHUB_BOT_USER_ID,
+        installations,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/agent/scm/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../agent/scm/config.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,wFAAwF;AACxF,yFAAyF;AACzF,mDAAmD;AAInD,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtE,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACnC,MAAM,aAAa,GAAG,GAAG,CAAC,yBAAyB,CAAC;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,kBAAkB,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAEtD,oFAAoF;IACpF,oDAAoD;IACpD,IAAI,aAAa,GAA2B,EAAE,CAAC;IAC/C,IAAI,GAAG,CAAC,uBAAuB,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAA2B,CAAC;YACjF,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,aAAa,GAAG,MAAM,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,yBAAyB,EAAE,CAAC;QACzD,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,yBAAyB,CAAC;IACrE,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,GAAG,CAAC,uBAAuB;QACrC,aAAa;QACb,OAAO;QACP,SAAS,EAAE,GAAG,CAAC,qBAAqB;QACpC,aAAa;KACd,CAAC;AACJ,CAAC"}