@open-everywhere/provider-github 0.0.0-stage → 0.1.0

package/dist/agent/channels/github-post-arm.d.ts

@@ -0,0 +1,54 @@
+import { type RateLimitRetryOptions, type PostArm, type UnifiedWakeOrigin } from "@open-everywhere/core/agent/adapter-api.js";
+type GitHubOrigin = Extract<UnifiedWakeOrigin, {
+    platform: "github";
+}>;
+/** Test-only reset — drops every held installation token. */
+export declare function _resetGitHubInstallationTokenCache(): void;
+/** Exported for the reaction-feedback poll (channels/github-reaction-feedback.ts, OPE-1502), which
+ *  reads under the same App identity every other GitHub call in this bundle uses. */
+export declare function installationTokenFor(origin: GitHubOrigin): Promise<string>;
+/** GitHub's REST base. */
+export declare const GITHUB_API_BASE = "https://api.github.com";
+/** The subset of the global `fetch` this seam uses — injectable so a test drives it without GitHub. */
+export type GitHubFetchLike = (input: string, init: RequestInit) => Promise<Response>;
+/** Transport and retry seams. A test injects them; live code passes none and takes the shared
+ *  defaults from `channels/rate-limit-retry.ts`. */
+export interface GitHubWriteDeps {
+    readonly fetch?: GitHubFetchLike;
+    readonly retry?: Pick<RateLimitRetryOptions, "maxAttempts" | "capMs" | "fallbackMs" | "totalBudgetMs" | "sleep" | "now">;
+}
+/**
+ * Issue one GitHub REST write under an installation token, with the 429 backoff applied.
+ *
+ * `operation` is the vendor route name (`issues.createComment`), NOT the resolved path: it is what
+ * `RateLimitExhaustedError` reports, and a path would put an owner, a repo and an issue number into
+ * a failure that promises every field on it is safe to log.
+ */
+export declare function githubWrite(input: {
+    readonly operation: string;
+    readonly method: "POST" | "PATCH";
+    readonly path: string;
+    readonly token: string;
+    readonly body: unknown;
+}, deps?: GitHubWriteDeps): Promise<Response>;
+/** THE ONE GitHub POST: an issue/PR-timeline comment via the GitHub REST API under a SHORT-LIVED
+ *  installation token minted host-side from the App credentials. Both spines call it — the UNIFIED
+ *  window (with a frozen wake origin) and the MID-TURN `reply` tool (with a binding-resolved target,
+ *  OPE-811). The installation id rides the origin/target when the webhook carried one, with the scm
+ *  config's owner map as the fallback — a missing/mismatched installation fails VISIBLE, never a
+ *  comment into the wrong repo. */
+/** Exported for github-message-ops.ts (OPE-899's `SurfaceMessageOps.postText`) — the SAME comment
+ *  POST, never a second copy of the mint/fetch mechanics. */
+export declare function liveGitHubPost(origin: GitHubOrigin, text: string): Promise<string>;
+/** THE ONE GitHub EDIT (OPE-862): rewrite an existing issue/PR-timeline comment's body. `channelId`
+ *  is the SAME composite "owner/repo" string {@link replyDedupeLocus}/{@link unifiedDedupeLocus} in
+ *  reply-post.ts/unified-reply.ts already use for a GitHub locus — the arm parses it back apart
+ *  rather than the EditLocus contract growing a second field, mirroring how those two dedupe keys
+ *  are already built. The installation id rides no locus, so this resolves through the SAME
+ *  owner→installation fallback map `liveGitHubPost` falls back to when a target carries none. */
+/** Exported for github-message-ops.ts (OPE-899's `SurfaceMessageOps.editMessage`) — same reason as
+ *  {@link liveGitHubPost}: one PATCH implementation, never two. */
+export declare function liveGitHubEditComment(channelId: string, commentId: string, text: string): Promise<void>;
+export declare const githubPostArm: PostArm;
+export {};
+//# sourceMappingURL=github-post-arm.d.ts.map

package/dist/agent/channels/github-post-arm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-post-arm.d.ts","sourceRoot":"","sources":["../../../agent/channels/github-post-arm.ts"],"names":[],"mappings":"AAiBA,OAAO,EAUL,KAAK,qBAAqB,EAE1B,KAAK,OAAO,EAIZ,KAAK,iBAAiB,EAEvB,MAAM,4CAA4C,CAAC;AAGpD,KAAK,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,CAAC;AAiEvE,6DAA6D;AAC7D,wBAAgB,kCAAkC,IAAI,IAAI,CAEzD;AAaD;qFACqF;AACrF,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBhF;AA0DD,0BAA0B;AAC1B,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEtF;oDACoD;AACpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,qBAAqB,EAAE,aAAa,GAAG,OAAO,GAAG,YAAY,GAAG,eAAe,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC;CAC1H;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE;IACL,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,EACD,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAED;;;;;mCAKmC;AACnC;6DAC6D;AAC7D,wBAAsB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+BxF;AAiBD;;;;;iGAKiG;AACjG;mEACmE;AACnE,wBAAsB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB7G;AAmDD,eAAO,MAAM,aAAa,EAAE,OA4C3B,CAAC"}

package/dist/agent/channels/github-post-arm.js

@@ -0,0 +1,339 @@
+// github-post-arm — GitHub's POST arm for the post-arms registry (OPE-114 stage 1c). Absorbs, VERBATIM,
+// GitHub's arms out of unified-reply.ts (liveGitHubPost + its installation-token minting/caching) and
+// unified-redrive.ts (the github describe/container cases). The unified session runs on the synthetic
+// `unified` channel, so this arm mints its OWN repo-scoped CONVERSATION-WRITE installation token
+// (scm/mint.ts `CONVERSATION_WRITE_PERMISSIONS`) rather than using an eve github channel handle.
+//
+// 🔴 THE MID-TURN ARM RIDES THE SAME TRANSPORT (OPE-811). This file used to state that GitHub has no
+// mid-turn reply arm "because eve exports no public proactive comment helper". That reasoned from the
+// EVE ENTRY, not from what this deployment can do: `liveGitHubPost` below has posted every unified
+// GitHub reply for weeks, and it needs no eve channel handle — it mints its own token and calls the
+// REST comments endpoint. So the honest availability bar ("never expose a `reply` that would throw")
+// is met, and `resolveTarget` / `dispatchReply` now sit here over the SAME function the unified spine
+// uses. A GitHub supervisor turn therefore delivers through the same `reply` tool as a Slack seat.
+// The SCM plane (mint/config) STAYS in core by doctrine (the single SCM implementation) — this arm
+// reaches its App-token minting + config through the adapter-api barrel, alongside the post-arm /
+// wake-origin / unified-reply contracts. See docs/extending/provider-bundles.md.
+import { parsePrivateKey, signAppJwt, mintInstallationToken, CONVERSATION_WRITE_PERMISSIONS, loadGitHubAppConfig, resolveGitHubInstallationId, warmCredential, markNotApplied, withRetryAfter, } from "@open-everywhere/core/agent/adapter-api.js";
+import { markGitHubConversationPosted } from "./github-reaction-scope.js";
+/**
+ * One minted token per (installation, repo), held warm by the SHARED seam (core
+ * credentials/warm.ts, OPE-134). Installation tokens live 1h; re-minting per reply would be correct
+ * but wasteful. Keyed by installation id AND repo, because the token is down-scoped to
+ * `[origin.repo]` (buildMintBody): a domain spanning two repos under ONE installation must NOT serve
+ * repo-A's repo-scoped token for a repo-B reply (GitHub 404s). `re-mint` posture with the seam's
+ * 5-minute default margin — exactly the rhythm this arm ran before, now with per-key single-flight
+ * and, crucially, a LOUD `github.token_mint_failed` audit row on failure (previously a mint failure
+ * left nothing durable behind at all: the reply just threw).
+ */
+const installationToken = warmCredential({
+    name: "github.installation-token",
+    platform: "github",
+    auditAction: "github.token_mint_failed",
+    refresh: "re-mint",
+    fallbackTtlSeconds: 3600,
+    // Non-secret by construction: an installation id and a repo name, the same key the local cache used.
+    key: (ctx) => `${ctx.installationId} ${ctx.repo}`,
+    mint: async (ctx) => {
+        const jwt = await signAppJwt(parsePrivateKey(ctx.privateKeyPem), ctx.appId, Math.floor(Date.now() / 1000));
+        // Repo-scoped CONVERSATION-WRITE set (scm/mint.ts): `issues:write` + `pull_requests:write` +
+        // `metadata:read`. NEVER `contents` — this arm must not be able to touch code.
+        //
+        // 🔴 BOTH WRITE FAMILIES, BECAUSE A CONVERSATION IS AN ISSUE OR A PR (OPE-1020). This file used
+        // to mint `{issues: "write"}` alone and call it "the narrowest permission that posts an
+        // issue/PR-timeline comment". That was WRONG for the PR half, and it made the agent MUTE on
+        // every GitHub PR thread: the wake fired, the turn ran, the spend was incurred, and the reply
+        // POST came back 403. Measured on deploy #118 — two plain issues took 201 and one PR took 403
+        // twice, same repo, same session, same endpoint. GitHub routes `/issues/{n}/comments` by the
+        // RESOURCE the number names, and lists that endpoint under BOTH permission families.
+        const minted = await mintInstallationToken({ jwt, installationId: ctx.installationId, repoNames: [ctx.repo], permissions: CONVERSATION_WRITE_PERMISSIONS });
+        // OPE-914: a 201 mint is NOT proof the token covers the repo it was asked for — GitHub can
+        // return a token whose `repositories` list omits the requested name (a stale/mismatched
+        // installation-repo mapping) without erroring the mint call itself, and the ONLY symptom
+        // downstream is a 403 on the comment POST that looks identical to a permissions gap. Check the
+        // grant here, at the one place that still holds the expected full_name, so a repo the
+        // installation does not actually cover fails LOUD (the warmCredential seam's own
+        // `github.token_mint_failed` audit row) instead of a confusing later 403.
+        const expected = `${ctx.owner}/${ctx.repo}`;
+        if (!minted.repositories.includes(expected)) {
+            throw new Error(`installation token for "${ctx.installationId}" does not cover "${expected}" — granted: [${minted.repositories.join(", ") || "none"}].`);
+        }
+        // GitHub states expiry as an ISO-8601 string. An unparseable one falls back to the declared
+        // 1h TTL rather than becoming a NaN deadline (which would compare false forever and re-mint on
+        // every single reply).
+        const parsed = Date.parse(minted.expiresAt);
+        return { value: minted.token, expiresAtMs: Number.isFinite(parsed) ? parsed : undefined };
+    },
+});
+/** Test-only reset — drops every held installation token. */
+export function _resetGitHubInstallationTokenCache() {
+    installationToken.reset();
+}
+/** GitHub App credentials for the unified reply arm: the scm plane's env pair preferred, the eve
+ *  channel's pair as fallback (same App in a normal deploy — two spellings, one identity). */
+function githubAppCreds() {
+    const scm = loadGitHubAppConfig();
+    if (scm)
+        return { appId: scm.clientId ?? scm.appId, privateKeyPem: scm.privateKeyPem, installations: scm.installations };
+    const appId = process.env.GITHUB_APP_ID;
+    const privateKeyPem = process.env.GITHUB_APP_PRIVATE_KEY;
+    if (!appId || !privateKeyPem)
+        return null;
+    return { appId, privateKeyPem, installations: {} };
+}
+/** Exported for the reaction-feedback poll (channels/github-reaction-feedback.ts, OPE-1502), which
+ *  reads under the same App identity every other GitHub call in this bundle uses. */
+export async function installationTokenFor(origin) {
+    const creds = githubAppCreds();
+    if (!creds) {
+        // DEFINITIVE (OPE-825): no App credentials ⇒ no request ever left this host.
+        throw markNotApplied(new Error("reply couldn't post to GitHub — no App credentials (set OE_GITHUB_APP_* or GITHUB_APP_ID/GITHUB_APP_PRIVATE_KEY)."));
+    }
+    // The wake's own (webhook-supplied) installation id first; then the SCM plane's composed map —
+    // OE_GITHUB_INSTALLATIONS authoritative, `installation`-webhook-discovered installs augmenting it
+    // (scm/installations.ts), so an org that self-installed resolves without an env edit.
+    const installationId = origin.installationId !== undefined ? String(origin.installationId) : await resolveGitHubInstallationId(origin.owner, creds.installations);
+    if (!installationId) {
+        // DEFINITIVE (OPE-825): unresolved before any comment request is built — nothing left this host.
+        throw markNotApplied(new Error(`reply couldn't post to GitHub — no installation id for owner "${origin.owner}" (the wake carried none, OE_GITHUB_INSTALLATIONS has no entry, and no installation webhook has registered one).`));
+    }
+    // Key by (installation, repo): the minted token is scoped to exactly [origin.repo], so a sibling
+    // repo under the same installation needs its OWN token.
+    return installationToken.get({ appId: creds.appId, privateKeyPem: creds.privateKeyPem, installationId, owner: origin.owner, repo: origin.repo });
+}
+// --- THE GITHUB WRITE SEAM (OPE-1235) ----------------------------------------------------------
+//
+// THE ONE PLACE a GitHub CHANNEL write leaves this package. Before OPE-1235 the three writes below —
+// the comment POST, the comment PATCH, the reaction POST — each called the global `fetch` with its
+// own copy of the same four headers and no 429 handling at all. GitHub answers a rate-limited write
+// with HTTP 429 and a `Retry-After` header, so every one of those writes failed on the FIRST
+// refusal: the reply threw `reply couldn't post to GitHub — 429 …` and the answer was lost.
+//
+// 🔴 "THIS PACKAGE" IS THE HONEST SCOPE, AND THE COUNTER-EXAMPLE IS ONE LINE ABOVE EVERY CALL.
+// `installationTokenFor` mints the token through core's `mintInstallationToken` (scm/mint.ts), which
+// is a bare `fetch` POST to `api.github.com/app/installations/{id}/access_tokens` with NO backoff. It
+// runs immediately before every write below, against the same vendor limiter. A 429 there loses the
+// reply exactly as a 429 here used to — one call earlier. `scm/mint.ts` is a PROTECTED PATH
+// (`scripts/upgrade-fence/manifest.ts`'s `github-permission-sets` rule), so the merge fence refuses
+// EVERY diff that touches it, whoever authored it (OPE-1315). Closing this gap needs the
+// orchestrator's explicit review-and-override.
+// Core's OTHER SCM write plane files (issue-actions.ts, pr.ts, contents.ts, refs.ts) DO carry the
+// backoff now, via `withRetryAfterLoose` (OPE-1253) — `docs/extending/provider-rate-limits.md`
+// records the mint as the one remaining gap. Do not read the paragraph above as "the mint is
+// covered".
+//
+// THE 403 SPELLING IS COVERED HERE NOW, AND ONLY HERE (OPE-1256). GitHub documents a rate-limit
+// refusal as "403 Forbidden or 429 Too Many Requests", often with `Retry-After` on either. The shared
+// primitive still branches on 429 for every other provider; this seam sets the per-seam opt-in
+// `retryForbiddenWithRetryAfter`, which admits a 403 ONLY when it carries a readable `Retry-After`. A
+// BARE 403 stays a permission refusal on every seam, this one included. GitHub's live 403 rate-limit
+// response is still UNMEASURED — `isRateLimitedForbidden` in `channels/rate-limit-retry.ts` carries
+// that residual and the argument for why the discriminator can under-fire but cannot misfire.
+// STILL OUT OF SCOPE: GitHub's OTHER paths do not set the flag — core's SCM write plane (pr.ts,
+// issue-actions.ts, contents.ts, refs.ts) and `github-read.ts` carry the 429 backoff only.
+//
+// One funnel fixes that once. It also removes the header triplication, which is the reason a fourth
+// write would have grown a fourth copy with a fourth chance to omit something.
+//
+// WHAT IT DOES, and only this:
+//   • Builds the request — base URL, method, the four fixed headers, a JSON body.
+//   • Honours a 429's `Retry-After` through `channels/rate-limit-retry.js`, bounded in attempts, in
+//     one wait, and in total wait.
+//   • Ends an outlasted 429 in the NAMED `RateLimitExhaustedError`, which states the surface and the
+//     operation and carries no token, no body and no personal data.
+//   • Returns EVERY other response untouched — a 201, a 404, a 5xx. The callers below keep reading
+//     `res.ok` and `res.status` exactly as they did, so the OPE-825 status-on-the-error posture is
+//     unchanged. A transport throw still propagates unretried: GitHub may already have applied that
+//     write, and repeating it could double a comment.
+//
+// 🔴 NOTHING ELSE IN THIS PACKAGE'S `agent/` MAY CALL THE GLOBAL `fetch` DIRECTLY.
+// `github-write-seam-test.ts` scans this package and reds when a bare `fetch(` appears in it. That
+// scan reaches THIS PACKAGE ONLY: a call site that imports a core SCM helper bypasses the backoff
+// with the scan still green, which is why the paragraph above names those helpers rather than
+// trusting the gate to catch them.
+//
+// `github-read.ts` holds its own read-only transport (`PrFetchFn`) — a SEPARATE seam from this one,
+// tracked as its own § 4 entry in the same scan, and it now carries the backoff too (OPE-1255, via
+// `withRetryAfterLoose`). See `channels/rate-limit-retry.ts`'s doc comment on `withRetryAfterLoose`
+// for why the loose adapter exists rather than `withRetryAfter` directly.
+/** GitHub's REST base. */
+export const GITHUB_API_BASE = "https://api.github.com";
+/**
+ * Issue one GitHub REST write under an installation token, with the 429 backoff applied.
+ *
+ * `operation` is the vendor route name (`issues.createComment`), NOT the resolved path: it is what
+ * `RateLimitExhaustedError` reports, and a path would put an owner, a repo and an issue number into
+ * a failure that promises every field on it is safe to log.
+ */
+export async function githubWrite(input, deps = {}) {
+    const send = () => (deps.fetch ?? globalThis.fetch)(`${GITHUB_API_BASE}${input.path}`, {
+        method: input.method,
+        headers: {
+            authorization: `Bearer ${input.token}`,
+            accept: "application/vnd.github+json",
+            "x-github-api-version": "2022-11-28",
+            "content-type": "application/json",
+        },
+        body: JSON.stringify(input.body),
+    });
+    // `retryForbiddenWithRetryAfter` is the PER-SEAM opt-in of OPE-1256, and this seam is the only
+    // place in the repo that sets it. GitHub is the one vendor that documents 403 as a rate-limit
+    // spelling; the primitive still refuses to retry a BARE 403 here or anywhere. The unverified half —
+    // GitHub's live 403 shape — and why it cannot misfire are written on `isRateLimitedForbidden`.
+    return withRetryAfter(send, { ...deps.retry, surface: "github", operation: input.operation, retryForbiddenWithRetryAfter: true });
+}
+/** THE ONE GitHub POST: an issue/PR-timeline comment via the GitHub REST API under a SHORT-LIVED
+ *  installation token minted host-side from the App credentials. Both spines call it — the UNIFIED
+ *  window (with a frozen wake origin) and the MID-TURN `reply` tool (with a binding-resolved target,
+ *  OPE-811). The installation id rides the origin/target when the webhook carried one, with the scm
+ *  config's owner map as the fallback — a missing/mismatched installation fails VISIBLE, never a
+ *  comment into the wrong repo. */
+/** Exported for github-message-ops.ts (OPE-899's `SurfaceMessageOps.postText`) — the SAME comment
+ *  POST, never a second copy of the mint/fetch mechanics. */
+export async function liveGitHubPost(origin, text) {
+    const token = await installationTokenFor(origin);
+    const res = await githubWrite({
+        operation: "issues.createComment",
+        method: "POST",
+        path: `/repos/${origin.owner}/${origin.repo}/issues/${origin.issueNumber}/comments`,
+        token,
+        body: { body: text },
+    });
+    if (!res.ok) {
+        // Token-free error (the response body can't contain our credential; keep it short anyway). The
+        // numeric HTTP status rides on the error (OPE-825) so the classifier can read it directly.
+        throw Object.assign(new Error(`reply couldn't post to GitHub — ${res.status} on ${origin.owner}/${origin.repo}#${origin.issueNumber}`), { status: res.status });
+    }
+    const json = (await res.json().catch(() => ({})));
+    // 🔴 ONE HALF OF THE REACTION POLL'S SCOPE RECORD (OPE-1540). This is the one place a GitHub
+    // comment leaves THIS BUNDLE, so it is where this bundle learns the agent is now in a conversation.
+    // It is NOT every comment the agent posts: eve's own poster still emits the `input.requested`
+    // comment, which this bundle does not override and this code never sees. (The native @mention
+    // leg's TERMINAL completion does claim here now — it posts through this function since OPE-1681.)
+    // The poll's gate therefore reads the ENGAGEMENT row as well — see
+    // channels/github-reaction-scope.ts, which states why one record cannot cover both posters. AFTER
+    // the post, and never a reason to fail one: the call never throws.
+    //
+    // 🔴 AND NEVER A REASON TO DELAY ONE EITHER. The comment has already landed when this runs, so the
+    // only thing this await can cost is the reply tool's RETURN — on the turn path, where an unbounded
+    // store call has no business. `markGitHubConversationPosted` owns that ceiling
+    // (`GITHUB_POSTED_MARK_TIMEOUT_MS`) rather than this call site, because the best-effort contract
+    // that says a lost mark costs a later poll and never a reply belongs with the mark.
+    await markGitHubConversationPosted(origin.owner, origin.repo, origin.issueNumber, new Date().toISOString());
+    return json.id !== undefined ? String(json.id) : "unknown";
+}
+/** The {@link GitHubOrigin} shape {@link liveGitHubPost} posts to, built from a mid-turn
+ *  {@link ReplyTarget}. The two carry the same four facts under the same names, so this is a widening
+ *  rather than a translation — stated as a function so a future divergence has one place to live. */
+function originForTarget(target) {
+    return {
+        platform: "github",
+        owner: target.owner,
+        repo: target.repo,
+        issueNumber: target.issueNumber,
+        ...(target.installationId !== undefined ? { installationId: target.installationId } : {}),
+    };
+}
+/** THE ONE GitHub EDIT (OPE-862): rewrite an existing issue/PR-timeline comment's body. `channelId`
+ *  is the SAME composite "owner/repo" string {@link replyDedupeLocus}/{@link unifiedDedupeLocus} in
+ *  reply-post.ts/unified-reply.ts already use for a GitHub locus — the arm parses it back apart
+ *  rather than the EditLocus contract growing a second field, mirroring how those two dedupe keys
+ *  are already built. The installation id rides no locus, so this resolves through the SAME
+ *  owner→installation fallback map `liveGitHubPost` falls back to when a target carries none. */
+/** Exported for github-message-ops.ts (OPE-899's `SurfaceMessageOps.editMessage`) — same reason as
+ *  {@link liveGitHubPost}: one PATCH implementation, never two. */
+export async function liveGitHubEditComment(channelId, commentId, text) {
+    const [owner, repo] = channelId.split("/");
+    if (!owner || !repo) {
+        throw markNotApplied(new Error(`edit_reply couldn't parse the GitHub locus "${channelId}" — expected "owner/repo".`));
+    }
+    const token = await installationTokenFor({ platform: "github", owner, repo, issueNumber: 0 });
+    const res = await githubWrite({
+        operation: "issues.updateComment",
+        method: "PATCH",
+        path: `/repos/${owner}/${repo}/issues/comments/${commentId}`,
+        token,
+        body: { body: text },
+    });
+    if (!res.ok) {
+        throw Object.assign(new Error(`edit_reply couldn't edit the GitHub comment — ${res.status} on ${owner}/${repo} comment ${commentId}`), { status: res.status });
+    }
+}
+const GITHUB_REACTION_MAP = {
+    "+1": "+1",
+    thumbsup: "+1",
+    "-1": "-1",
+    thumbsdown: "-1",
+    laugh: "laugh",
+    laughing: "laugh",
+    joy: "laugh",
+    confused: "confused",
+    heart: "heart",
+    hooray: "hooray",
+    tada: "hooray",
+    rocket: "rocket",
+    eyes: "eyes",
+};
+async function liveGitHubReact(origin, emoji) {
+    const content = GITHUB_REACTION_MAP[emoji.toLowerCase()];
+    if (!content) {
+        // DEFINITIVE (OPE-825): decided before any byte left this host — the model's name has no mapping.
+        throw markNotApplied(new Error(`react couldn't post to GitHub — "${emoji}" has no GitHub reaction equivalent; GitHub only supports: ${[...new Set(Object.values(GITHUB_REACTION_MAP))].join(", ")}.`));
+    }
+    const token = await installationTokenFor(origin);
+    const res = await githubWrite({
+        operation: "issues.createReaction",
+        method: "POST",
+        path: `/repos/${origin.owner}/${origin.repo}/issues/${origin.issueNumber}/reactions`,
+        token,
+        body: { content },
+    });
+    if (!res.ok) {
+        throw Object.assign(new Error(`react couldn't post to GitHub — ${res.status} on ${origin.owner}/${origin.repo}#${origin.issueNumber}`), { status: res.status });
+    }
+}
+export const githubPostArm = {
+    platform: "github",
+    // MID-TURN (OPE-811): owner + repo + the issue/PR anchor, all off the binding's post-back target
+    // (github-identity.ts `bindGitHub`), never a tool argument. A PR timeline comment anchors on the
+    // SAME `/issues/{n}/comments` endpoint, so either anchor number resolves the one target shape.
+    resolveTarget: (bag) => {
+        const owner = bag.str("owner");
+        const repo = bag.str("repo");
+        const issueNumber = bag.num("issueNumber") ?? bag.num("pullRequestNumber");
+        if (!owner || !repo || issueNumber === undefined || !Number.isFinite(issueNumber) || issueNumber <= 0)
+            return null;
+        const installationId = bag.num("installationId");
+        return { platform: "github", owner, repo, issueNumber, ...(installationId !== undefined ? { installationId } : {}) };
+    },
+    dispatchReply: (target, text) => liveGitHubPost(originForTarget(target), text),
+    dispatchUnified: (origin, text, deps) => (deps.postGitHub ?? liveGitHubPost)(origin, text),
+    // EDIT (OPE-862): PATCH the issue/PR-timeline comment `liveGitHubPost` already returns a real id
+    // for — no sentinel-id prerequisite here, unlike Linear's ambient route.
+    editMessage: (locus, messageId, text) => liveGitHubEditComment(locus.channelId, messageId, text),
+    // REACT (OPE-862): the same conversation anchor `reply` posts into — GitHub has no message-level
+    // react target the binding carries, so this resolves owner/repo/issueNumber independently of
+    // resolveTarget (see ReactTarget's doc in post-arms.ts).
+    resolveReactTarget: (bag) => {
+        const owner = bag.str("owner");
+        const repo = bag.str("repo");
+        const issueNumber = bag.num("issueNumber") ?? bag.num("pullRequestNumber");
+        if (!owner || !repo || issueNumber === undefined || !Number.isFinite(issueNumber) || issueNumber <= 0)
+            return null;
+        const installationId = bag.num("installationId");
+        return { platform: "github", owner, repo, issueNumber, ...(installationId !== undefined ? { installationId } : {}) };
+    },
+    react: (target, emoji) => {
+        const t = target;
+        return liveGitHubReact({ platform: "github", owner: t.owner, repo: t.repo, issueNumber: t.issueNumber, ...(t.installationId !== undefined ? { installationId: t.installationId } : {}) }, emoji);
+    },
+    describeRedriveTarget: (origin) => {
+        const o = origin;
+        return `github ${o.owner}/${o.repo}#${o.issueNumber}`;
+    },
+    redriveContainerId: (origin) => {
+        const o = origin;
+        return `${o.owner}/${o.repo}`;
+    },
+};
+//# sourceMappingURL=github-post-arm.js.map

package/dist/agent/channels/github-post-arm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-post-arm.js","sourceRoot":"","sources":["../../../agent/channels/github-post-arm.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,sGAAsG;AACtG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,mGAAmG;AACnG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,mGAAmG;AAEnG,mGAAmG;AACnG,kGAAkG;AAClG,iFAAiF;AACjF,OAAO,EACL,eAAe,EACf,UAAU,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,mBAAmB,EACnB,2BAA2B,EAC3B,cAAc,EACd,cAAc,EACd,cAAc,GASf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAe1E;;;;;;;;;GASG;AACH,MAAM,iBAAiB,GAAG,cAAc,CAAoB;IAC1D,IAAI,EAAE,2BAA2B;IACjC,QAAQ,EAAE,QAAQ;IAClB,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE,SAAS;IAClB,kBAAkB,EAAE,IAAI;IACxB,qGAAqG;IACrG,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,IAAI,EAAE;IACjD,IAAI,EAAE,KAAK,EAAE,GAAG,EAA2B,EAAE;QAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC3G,6FAA6F;QAC7F,+EAA+E;QAC/E,EAAE;QACF,gGAAgG;QAChG,wFAAwF;QACxF,4FAA4F;QAC5F,8FAA8F;QAC9F,8FAA8F;QAC9F,6FAA6F;QAC7F,qFAAqF;QACrF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC5J,2FAA2F;QAC3F,wFAAwF;QACxF,yFAAyF;QACzF,+FAA+F;QAC/F,sFAAsF;QACtF,iFAAiF;QACjF,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,cAAc,qBAAqB,QAAQ,iBAAiB,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,IAAI,CACxI,CAAC;QACJ,CAAC;QACD,4FAA4F;QAC5F,+FAA+F;QAC/F,uBAAuB;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5F,CAAC;CACF,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,UAAU,kCAAkC;IAChD,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED;8FAC8F;AAC9F,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IACzH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACxC,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;AACrD,CAAC;AAED;qFACqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAoB;IAC7D,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,6EAA6E;QAC7E,MAAM,cAAc,CAAC,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC,CAAC;IACvJ,CAAC;IACD,+FAA+F;IAC/F,kGAAkG;IAClG,sFAAsF;IACtF,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,2BAA2B,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAClK,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,iGAAiG;QACjG,MAAM,cAAc,CAAC,IAAI,KAAK,CAC5B,iEAAiE,MAAM,CAAC,KAAK,kHAAkH,CAChM,CAAC,CAAC;IACL,CAAC;IACD,iGAAiG;IACjG,wDAAwD;IACxD,OAAO,iBAAiB,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACnJ,CAAC;AAED,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,oGAAoG;AACpG,6FAA6F;AAC7F,4FAA4F;AAC5F,EAAE;AACF,+FAA+F;AAC/F,qGAAqG;AACrG,sGAAsG;AACtG,oGAAoG;AACpG,4FAA4F;AAC5F,oGAAoG;AACpG,yFAAyF;AACzF,+CAA+C;AAC/C,kGAAkG;AAClG,+FAA+F;AAC/F,6FAA6F;AAC7F,YAAY;AACZ,EAAE;AACF,gGAAgG;AAChG,sGAAsG;AACtG,+FAA+F;AAC/F,sGAAsG;AACtG,qGAAqG;AACrG,oGAAoG;AACpG,8FAA8F;AAC9F,gGAAgG;AAChG,2FAA2F;AAC3F,EAAE;AACF,oGAAoG;AACpG,+EAA+E;AAC/E,EAAE;AACF,+BAA+B;AAC/B,kFAAkF;AAClF,oGAAoG;AACpG,mCAAmC;AACnC,qGAAqG;AACrG,oEAAoE;AACpE,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,sDAAsD;AACtD,EAAE;AACF,mFAAmF;AACnF,mGAAmG;AACnG,kGAAkG;AAClG,8FAA8F;AAC9F,mCAAmC;AACnC,EAAE;AACF,oGAAoG;AACpG,mGAAmG;AACnG,oGAAoG;AACpG,0EAA0E;AAE1E,0BAA0B;AAC1B,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAYxD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAMC,EACD,IAAI,GAAoB,EAAE;IAE1B,MAAM,IAAI,GAAG,GAAsB,EAAE,CACnC,CAAC,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAAyB,CAAC,CAAC,GAAG,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE;QACvF,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE;YACtC,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;YACpC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KACjC,CAAC,CAAC;IACL,+FAA+F;IAC/F,8FAA8F;IAC9F,oGAAoG;IACpG,+FAA+F;IAC/F,OAAO,cAAc,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;AACpI,CAAC;AAED;;;;;mCAKmC;AACnC;6DAC6D;AAC7D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;QAC5B,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,UAAU,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,WAAW,WAAW;QACnF,KAAK;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,+FAA+F;QAC/F,2FAA2F;QAC3F,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClK,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAoB,CAAC;IACrE,6FAA6F;IAC7F,oGAAoG;IACpG,8FAA8F;IAC9F,8FAA8F;IAC9F,kGAAkG;IAClG,mEAAmE;IACnE,kGAAkG;IAClG,mEAAmE;IACnE,EAAE;IACF,mGAAmG;IACnG,mGAAmG;IACnG,+EAA+E;IAC/E,iGAAiG;IACjG,oFAAoF;IACpF,MAAM,4BAA4B,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5G,OAAO,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAID;;qGAEqG;AACrG,SAAS,eAAe,CAAC,MAAyB;IAChD,OAAO;QACL,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;;;iGAKiG;AACjG;mEACmE;AACnE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,SAAiB,EAAE,IAAY;IAC5F,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,cAAc,CAAC,IAAI,KAAK,CAAC,+CAA+C,SAAS,4BAA4B,CAAC,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;QAC5B,SAAS,EAAE,sBAAsB;QACjC,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,UAAU,KAAK,IAAI,IAAI,oBAAoB,SAAS,EAAE;QAC5D,KAAK;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,OAAO,KAAK,IAAI,IAAI,YAAY,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACjK,CAAC;AACH,CAAC;AAYD,MAAM,mBAAmB,GAAoD;IAC3E,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;IACd,IAAI,EAAE,IAAI;IACV,UAAU,EAAE,IAAI;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,OAAO;IACjB,GAAG,EAAE,OAAO;IACZ,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,MAAoB,EAAE,KAAa;IAChE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,kGAAkG;QAClG,MAAM,cAAc,CAClB,IAAI,KAAK,CACP,oCAAoC,KAAK,8DAA8D,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtK,CACF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC;QAC5B,SAAS,EAAE,uBAAuB;QAClC,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,UAAU,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,WAAW,MAAM,CAAC,WAAW,YAAY;QACpF,KAAK;QACL,IAAI,EAAE,EAAE,OAAO,EAAE;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,OAAO,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClK,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,QAAQ,EAAE,QAAQ;IAClB,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,aAAa,EAAE,CAAC,GAAqB,EAAsB,EAAE;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvH,CAAC;IACD,aAAa,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,eAAe,CAAC,MAA2B,CAAC,EAAE,IAAI,CAAC;IACnG,eAAe,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,IAAsB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC,CAAC,MAAsB,EAAE,IAAI,CAAC;IAC5H,iGAAiG;IACjG,yEAAyE;IACzE,WAAW,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC;IAChG,iGAAiG;IACjG,6FAA6F;IAC7F,yDAAyD;IACzD,kBAAkB,EAAE,CAAC,GAAqB,EAAsB,EAAE;QAChE,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnH,MAAM,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACjD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvH,CAAC;IACD,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,MAA2B,CAAC;QACtC,OAAO,eAAe,CACpB,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACjK,KAAK,CACN,CAAC;IACJ,CAAC;IACD,qBAAqB,EAAE,CAAC,MAAM,EAAE,EAAE;QAChC,MAAM,CAAC,GAAG,MAAsB,CAAC;QACjC,OAAO,UAAU,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,CAAC;IACD,kBAAkB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAsB,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;CACF,CAAC"}

package/dist/agent/channels/github-reaction-feedback.d.ts

@@ -0,0 +1,97 @@
+import { type ReactionIngestOutcome, type PrFetchFn, type ReactionSinkDeps } from "@open-everywhere/core/agent/adapter-api.js";
+/** The conversation one accepted delivery names — everything the poll needs and nothing else. */
+export interface GitHubReactionPollTarget {
+    readonly owner: string;
+    readonly repo: string;
+    readonly number: number;
+    readonly installationId?: number;
+    readonly repoPrivate?: boolean;
+}
+/** One of the agent's timeline comments, narrowed to what the poll reads. */
+export interface GitHubPolledComment {
+    readonly id: number;
+    readonly authorLogin?: string;
+    /** GitHub's `user.type` — `"Bot"` for an App's comment. */
+    readonly authorType?: string;
+    /** `reactions.total_count`. Zero ⇒ the arm never asks for the reactions. */
+    readonly reactionCount?: number;
+}
+/** One reaction on one of those comments. */
+export interface GitHubPolledReaction {
+    /** GitHub's fixed eight-value `content` enum (`+1`, `-1`, `laugh`, `confused`, `heart`, `hooray`,
+     *  `rocket`, `eyes`) — passed through as the emoji DATA, bucketed by core. */
+    readonly content: string;
+    /** WHO reacted. GitHub sends a `user.type` beside it, and this shape deliberately drops it: the
+     *  agent's own reaction is identified by its EXACT login, and adding the type could only widen
+     *  what counts as ours. That is the opposite of {@link GitHubPolledComment}, where the type is a
+     *  second signal that must AGREE before a comment counts as the agent's. */
+    readonly userLogin?: string;
+}
+/** Injected seams, so parse + filter + dedupe + record is unit-tested with no live installation. */
+export interface GitHubReactionFeedbackDeps {
+    readonly sink: ReactionSinkDeps;
+    /** The app's own bot login (`<slug>[bot]`). Absent ⇒ the arm polls nothing — see the header. */
+    readonly botLogin?: string;
+    readonly listComments: (target: GitHubReactionPollTarget) => Promise<readonly GitHubPolledComment[]>;
+    readonly listReactions: (target: GitHubReactionPollTarget, commentId: number) => Promise<readonly GitHubPolledReaction[]>;
+    /** Has this exact reaction already been recorded? The keyed dedupe's read half — see the header.
+     *  {@link liveGitHubReactionRecorded} answers it off the durable claim store. */
+    readonly recorded: (partition: GitHubReactionPartition, key: string) => Promise<boolean>;
+    /** Claim this reaction as recorded. Called ONLY after the sink reports the row written, which is
+     *  what makes a failed write retryable rather than lost. */
+    readonly markRecorded: (partition: GitHubReactionPartition, key: string, atIso: string) => Promise<void>;
+    /** GATE 1 (OPE-1540): is the agent IN this conversation — has this bundle posted here, or did an
+     *  @mention engage the container? Refusing here is what makes a delivery in a conversation the
+     *  agent is not in cost ZERO REST calls. */
+    readonly inScope: (target: GitHubReactionPollTarget, partition: GitHubReactionPartition) => Promise<boolean>;
+    /** GATE 2 (OPE-1540): spend one poll from this repository's hourly budget. False refuses the poll
+     *  and the refusal is audited by the scope module, not here. */
+    readonly spendBudget: (target: GitHubReactionPollTarget, partition: GitHubReactionPartition, atIso: string) => Promise<boolean>;
+    /** Say out loud that {@link GitHubReactionFeedbackDeps.recorded} threw during this poll, and how
+     *  many reactions the fail-closed dedupe skipped because of it. Called AT MOST ONCE per poll —
+     *  see the write's own header in channels/github-reaction-scope.ts for why the count rides the row
+     *  rather than the row riding each reaction. Absent ⇒ the poll writes nothing, which is what the
+     *  unit stubs take. */
+    readonly auditClaimUnreadable?: (target: GitHubReactionPollTarget, partition: GitHubReactionPartition, atIso: string, skipped: number) => Promise<void>;
+    /** How many of the agent's own comments one poll examines, newest first. Bounds the REST cost of a
+     *  long thread; defaults to {@link GITHUB_REACTION_POLL_COMMENT_BUDGET}. */
+    readonly commentBudget?: number;
+    readonly now?: () => string;
+}
+/** The partition coordinates the audit read and the ingest share. */
+export interface GitHubReactionPartition {
+    readonly org: string;
+    readonly workspace: string;
+    readonly surfaceKey: string;
+}
+/** One poll examines at most this many of the agent's own comments, newest first. A conversation
+ *  with more agent comments than this is one where the older ones stopped attracting reactions. */
+export declare const GITHUB_REACTION_POLL_COMMENT_BUDGET = 10;
+/**
+ * The conversation one delivery names, or null when the delivery names none. NEVER THROWS.
+ *
+ * It reads the SAME body the stop leg and the ambient leg read, and it accepts a delivery those two
+ * refuse — an `issues` event, or an `issue_comment` the agent itself wrote. The poll is about the
+ * CONVERSATION, so any accepted delivery naming one is a valid occasion to look.
+ */
+export declare function parseGitHubReactionPollTarget(body: string, eventType: string): GitHubReactionPollTarget | null;
+/** Is this comment the agent's own? `user.type === "Bot"` AND the configured `<slug>[bot]` login —
+ *  both, because either alone is wrong: every App's comment is type `Bot`, and a human account may
+ *  legally be named to look like one. */
+export declare function githubCommentIsOwn(comment: GitHubPolledComment, botLogin: string | undefined): boolean;
+/** The identity of one recorded reaction — a comment, a reactor and a glyph. The dedupe key, and the
+ *  same three fields `liveReactionSink` writes into the audit row. */
+export declare function githubReactionKey(messageId: string, reactorId: string, emoji: string): string;
+/**
+ * Poll one conversation and record every reaction on the agent's own comments that is not recorded
+ * yet. Returns one outcome per NEW reaction — an empty array when there is nothing new, which is the
+ * ordinary case on a busy conversation.
+ *
+ * NEVER THROWS: a failed read or a failed sink must never cost the ingress its ack. A comment whose
+ * reactions cannot be read is skipped, and the rest of the poll continues.
+ */
+export declare function routeGitHubReactionFeedback(target: GitHubReactionPollTarget, deps: GitHubReactionFeedbackDeps): Promise<readonly ReactionIngestOutcome[]>;
+/** Production deps for the poll. `botLogin` is `<GITHUB_APP_SLUG>[bot]` — absent when the slug is
+ *  unset, which is exactly the fail-closed case {@link routeGitHubReactionFeedback} refuses on. */
+export declare function liveGitHubReactionFeedbackDeps(appSlug: string | undefined, fetchFn?: PrFetchFn): GitHubReactionFeedbackDeps;
+//# sourceMappingURL=github-reaction-feedback.d.ts.map

package/dist/agent/channels/github-reaction-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-reaction-feedback.d.ts","sourceRoot":"","sources":["../../../agent/channels/github-reaction-feedback.ts"],"names":[],"mappings":"AA+FA,OAAO,EAOL,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,gBAAgB,EACtB,MAAM,4CAA4C,CAAC;AAWpD,iGAAiG;AACjG,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB;IACnC;kFAC8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;gFAG4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,oGAAoG;AACpG,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,OAAO,CAAC,SAAS,mBAAmB,EAAE,CAAC,CAAC;IACrG,QAAQ,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAC;IAC1H;qFACiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF;gEAC4D;IAC5D,QAAQ,CAAC,YAAY,EAAE,CAAC,SAAS,EAAE,uBAAuB,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzG;;gDAE4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,uBAAuB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7G;oEACgE;IAChE,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChI;;;;2BAIuB;IACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,wBAAwB,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxJ;gFAC4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;mGACmG;AACnG,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAkBtD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,wBAAwB,GAAG,IAAI,CAuB9G;AAED;;yCAEyC;AACzC,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAKtG;AAED;sEACsE;AACtE,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7F;AAED;;;;;;;GAOG;AACH,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,wBAAwB,EAChC,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CA0G3C;AAoDD;mGACmG;AACnG,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,GAAE,SAA+B,GAAG,0BAA0B,CA+DhJ"}