@opentag/github 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,3 +1,542 @@
+// src/pull-request.ts
+function buildPullRequestBody(result) {
+  const lines = ["## Summary", "", result.summary];
+  if (result.changedFiles?.length) {
+    lines.push("", "## Changed Files");
+    for (const file of result.changedFiles) {
+      lines.push(`- \`${file}\``);
+    }
+  }
+  if (result.verification?.length) {
+    lines.push("", "## Verification");
+    for (const check of result.verification) {
+      lines.push(`- \`${check.command}\`: ${check.outcome}`);
+    }
+  }
+  return lines.join("\n");
+}
+async function createPullRequestViaFetch(input, fetchImpl = fetch) {
+  const response = await fetchImpl(`https://api.github.com/repos/${input.owner}/${input.repo}/pulls`, {
+    method: "POST",
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${input.token}`,
+      "content-type": "application/json",
+      "x-github-api-version": "2022-11-28"
+    },
+    body: JSON.stringify({
+      title: input.title,
+      body: input.body,
+      head: input.head,
+      base: input.base
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`create pull request failed: ${response.status} ${await response.text()}`);
+  }
+  const body = await response.json();
+  if (!body.html_url) {
+    throw new Error("create pull request response did not include html_url");
+  }
+  return body.html_url;
+}
+
+// src/apply.ts
+function labelFromIntent(intent) {
+  const value = intent.params?.["label"];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function labelsFromIntent(intent) {
+  const value = intent.params?.["labels"];
+  if (!Array.isArray(value)) return void 0;
+  const labels = value.filter((label) => typeof label === "string" && label.length > 0);
+  return labels.length > 0 ? labels : void 0;
+}
+function assigneeFromIntent(intent) {
+  const value = intent.params?.["assignee"];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function assigneesFromIntent(intent) {
+  const value = intent.params?.["assignees"];
+  if (!Array.isArray(value)) return void 0;
+  const assignees = value.filter((assignee) => typeof assignee === "string" && assignee.length > 0);
+  return assignees.length > 0 ? assignees : void 0;
+}
+function reviewersFromIntent(intent) {
+  const reviewer = intent.params?.["reviewer"];
+  const reviewers = intent.params?.["reviewers"];
+  const values = [
+    ...typeof reviewer === "string" ? [reviewer] : [],
+    ...Array.isArray(reviewers) ? reviewers : []
+  ].filter((value) => typeof value === "string" && value.length > 0);
+  return values.length > 0 ? [...new Set(values)] : void 0;
+}
+function teamReviewersFromIntent(intent) {
+  const reviewer = intent.params?.["teamReviewer"];
+  const reviewers = intent.params?.["teamReviewers"] ?? intent.params?.["team_reviewers"];
+  const values = [
+    ...typeof reviewer === "string" ? [reviewer] : [],
+    ...Array.isArray(reviewers) ? reviewers : []
+  ].filter((value) => typeof value === "string" && value.length > 0);
+  return values.length > 0 ? [...new Set(values)] : void 0;
+}
+function stringParam(intent, ...keys) {
+  for (const key of keys) {
+    const value = intent.params?.[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return void 0;
+}
+function stringArrayParam(intent, key) {
+  const value = intent.params?.[key];
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string" && item.length > 0);
+}
+function verificationLinesFromIntent(intent) {
+  const value = intent.params?.["verification"];
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
+    const command = item["command"];
+    const outcome = item["outcome"];
+    return typeof command === "string" && typeof outcome === "string" ? `- \`${command}\`: ${outcome}` : void 0;
+  }).filter((line) => Boolean(line));
+}
+function pullRequestBodyFromIntent(intent) {
+  const explicitBody = stringParam(intent, "body");
+  const changedFiles = stringArrayParam(intent, "changedFiles");
+  const risks = stringArrayParam(intent, "risks");
+  const verification = verificationLinesFromIntent(intent);
+  const executorConditions = stringArrayParam(intent, "executorConditions");
+  const lines = explicitBody ? [explicitBody] : ["## Summary", "", intent.summary];
+  if (changedFiles.length > 0) {
+    lines.push("", "## Changed Files", ...changedFiles.map((file) => `- \`${file}\``));
+  }
+  if (risks.length > 0) {
+    lines.push("", "## Risks", ...risks.map((risk) => `- ${risk}`));
+  }
+  if (verification.length > 0) {
+    lines.push("", "## Verification", ...verification);
+  }
+  if (executorConditions.length > 0) {
+    lines.push("", "## Executor Conditions", ...executorConditions.map((condition) => `- ${condition}`));
+  }
+  return lines.join("\n");
+}
+function mappedValueFromIntent(intent) {
+  const key = intent.domain === "status" ? "status" : "priority";
+  const value = intent.params?.[key] ?? intent.params?.["value"];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function labelMappingForIntent(input) {
+  const semanticValue = mappedValueFromIntent(input.intent);
+  if (!semanticValue) return void 0;
+  const mapping = input.mappings.find(
+    (candidate) => candidate.adapter === "github" && candidate.domain === input.intent.domain && candidate.strategy === "label"
+  );
+  const label = mapping?.values[semanticValue];
+  if (!label || !mapping) return void 0;
+  return {
+    label,
+    removeLabels: Object.values(mapping.values).filter((mappedLabel) => mappedLabel !== label)
+  };
+}
+async function githubJson(input) {
+  const response = await input.fetchImpl(`https://api.github.com/repos/${input.target.owner}/${input.target.repo}${input.path}`, {
+    method: input.method,
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${input.target.token}`,
+      "content-type": "application/json",
+      "x-github-api-version": "2022-11-28"
+    },
+    ...input.body ? { body: JSON.stringify(input.body) } : {}
+  });
+  if (!response.ok && !(input.okStatuses ?? []).includes(response.status)) {
+    throw new Error(`${input.method} ${input.path} failed: ${response.status} ${await response.text()}`);
+  }
+  return `https://github.com/${input.target.owner}/${input.target.repo}/issues/${input.target.issueNumber}`;
+}
+async function githubJsonBody(input) {
+  const response = await input.fetchImpl(`https://api.github.com/repos/${input.target.owner}/${input.target.repo}${input.path}`, {
+    method: input.method,
+    headers: {
+      accept: "application/vnd.github+json",
+      authorization: `Bearer ${input.target.token}`,
+      "content-type": "application/json",
+      "x-github-api-version": "2022-11-28"
+    }
+  });
+  if (!response.ok && !(input.okStatuses ?? []).includes(response.status)) {
+    throw new Error(`${input.method} ${input.path} failed: ${response.status} ${await response.text()}`);
+  }
+  return await response.json();
+}
+function requestedReviewerLogins(response) {
+  return new Set((response.users ?? []).map((user) => user.login).filter((login) => typeof login === "string"));
+}
+function requestedTeamReviewerNames(response) {
+  return new Set(
+    (response.teams ?? []).flatMap((team) => [team.slug, team.name]).filter((value) => typeof value === "string" && value.length > 0)
+  );
+}
+function compileGitHubIssueMutationIntent(intent, options = {}) {
+  if (intent.action === "create_pull_request") {
+    const head = stringParam(intent, "head", "branch");
+    if (!head) {
+      return {
+        ok: false,
+        outcome: {
+          intentId: intent.intentId,
+          outcome: "failed",
+          message: "create_pull_request requires params.head or params.branch."
+        }
+      };
+    }
+    return {
+      ok: true,
+      intentId: intent.intentId,
+      operation: {
+        kind: "create_pull_request",
+        intentId: intent.intentId,
+        title: stringParam(intent, "title") ?? intent.summary,
+        body: pullRequestBodyFromIntent(intent),
+        head,
+        base: stringParam(intent, "base", "baseBranch") ?? "main"
+      }
+    };
+  }
+  if (intent.action === "request_review" || intent.domain === "review") {
+    if (options.targetKind !== "pull_request") {
+      return {
+        ok: false,
+        outcome: {
+          intentId: intent.intentId,
+          outcome: "unsupported",
+          message: "GitHub review requests require a pull request target."
+        }
+      };
+    }
+    const reviewers = reviewersFromIntent(intent);
+    const teamReviewers = teamReviewersFromIntent(intent);
+    if (!reviewers?.length && !teamReviewers?.length) {
+      return {
+        ok: false,
+        outcome: {
+          intentId: intent.intentId,
+          outcome: "failed",
+          message: "request_review requires params.reviewer, params.reviewers, or params.teamReviewers."
+        }
+      };
+    }
+    return {
+      ok: true,
+      intentId: intent.intentId,
+      operation: {
+        kind: "request_review",
+        intentId: intent.intentId,
+        reviewers: reviewers ?? [],
+        ...teamReviewers?.length ? { teamReviewers } : {}
+      }
+    };
+  }
+  if (intent.domain === "status") {
+    const mapped = labelMappingForIntent({ intent, mappings: options.mappings ?? [] });
+    if (mapped) {
+      return { ok: true, intentId: intent.intentId, operation: { kind: "replace_mapped_label", intentId: intent.intentId, ...mapped } };
+    }
+    return {
+      ok: false,
+      outcome: {
+        intentId: intent.intentId,
+        outcome: "unsupported",
+        message: "GitHub status writes require an explicit Project field or label mapping policy."
+      }
+    };
+  }
+  if (intent.domain === "priority") {
+    const mapped = labelMappingForIntent({ intent, mappings: options.mappings ?? [] });
+    if (mapped) {
+      return { ok: true, intentId: intent.intentId, operation: { kind: "replace_mapped_label", intentId: intent.intentId, ...mapped } };
+    }
+    return {
+      ok: false,
+      outcome: {
+        intentId: intent.intentId,
+        outcome: "unsupported",
+        message: "GitHub priority writes require an explicit label or Project field mapping policy."
+      }
+    };
+  }
+  if (intent.domain !== "labels" && intent.domain !== "assignee") {
+    return {
+      ok: false,
+      outcome: {
+        intentId: intent.intentId,
+        outcome: "unsupported",
+        message: `GitHub apply supports labels and assignee only, not ${intent.domain}.`
+      }
+    };
+  }
+  if (intent.domain === "assignee") {
+    if (intent.action === "set_assignee") {
+      const assignee = assigneeFromIntent(intent);
+      return assignee ? { ok: true, intentId: intent.intentId, operation: { kind: "set_assignees", intentId: intent.intentId, assignees: [assignee] } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "set_assignee requires params.assignee." } };
+    }
+    if (intent.action === "set_assignees") {
+      const assignees = assigneesFromIntent(intent);
+      return assignees ? { ok: true, intentId: intent.intentId, operation: { kind: "set_assignees", intentId: intent.intentId, assignees } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "set_assignees requires params.assignees." } };
+    }
+    if (intent.action === "add_assignee") {
+      const assignee = assigneeFromIntent(intent);
+      return assignee ? { ok: true, intentId: intent.intentId, operation: { kind: "add_assignee", intentId: intent.intentId, assignee } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "add_assignee requires params.assignee." } };
+    }
+    if (intent.action === "remove_assignee") {
+      const assignee = assigneeFromIntent(intent);
+      return assignee ? { ok: true, intentId: intent.intentId, operation: { kind: "remove_assignee", intentId: intent.intentId, assignee } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "remove_assignee requires params.assignee." } };
+    }
+    return {
+      ok: false,
+      outcome: {
+        intentId: intent.intentId,
+        outcome: "unsupported",
+        message: `GitHub apply does not support assignee action ${intent.action}.`
+      }
+    };
+  }
+  if (intent.action === "add_label") {
+    const label = labelFromIntent(intent);
+    return label ? { ok: true, intentId: intent.intentId, operation: { kind: "add_label", intentId: intent.intentId, label } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "add_label requires params.label." } };
+  }
+  if (intent.action === "remove_label") {
+    const label = labelFromIntent(intent);
+    return label ? { ok: true, intentId: intent.intentId, operation: { kind: "remove_label", intentId: intent.intentId, label } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "remove_label requires params.label." } };
+  }
+  if (intent.action === "set_labels") {
+    const labels = labelsFromIntent(intent);
+    return labels ? { ok: true, intentId: intent.intentId, operation: { kind: "set_labels", intentId: intent.intentId, labels } } : { ok: false, outcome: { intentId: intent.intentId, outcome: "failed", message: "set_labels requires params.labels." } };
+  }
+  return {
+    ok: false,
+    outcome: {
+      intentId: intent.intentId,
+      outcome: "unsupported",
+      message: `GitHub apply does not support labels action ${intent.action}.`
+    }
+  };
+}
+function compileGitHubIssueMutationIntents(intents, options = {}) {
+  return intents.map((intent) => compileGitHubIssueMutationIntent(intent, options));
+}
+function createGitHubIssueMutationCompiler(options = {}) {
+  return {
+    adapter: "github",
+    compile(intent) {
+      const compilation = compileGitHubIssueMutationIntent(intent, options);
+      if (!compilation.ok) {
+        return {
+          ok: false,
+          adapter: "github",
+          outcome: compilation.outcome
+        };
+      }
+      return {
+        ok: true,
+        adapter: "github",
+        intentId: compilation.intentId,
+        operation: compilation.operation
+      };
+    }
+  };
+}
+async function applyGitHubIssueMutationOperation(input) {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  try {
+    if (input.operation.kind === "create_pull_request") {
+      const externalUri2 = await createPullRequestViaFetch(
+        {
+          token: input.target.token,
+          owner: input.target.owner,
+          repo: input.target.repo,
+          title: input.operation.title,
+          body: input.operation.body,
+          head: input.operation.head,
+          base: input.operation.base
+        },
+        fetchImpl
+      );
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    if (input.operation.kind === "request_review") {
+      const pullRequestNumber = input.target.pullRequestNumber;
+      if (typeof pullRequestNumber !== "number") {
+        return {
+          intentId: input.operation.intentId,
+          outcome: "failed",
+          message: "request_review requires target.pullRequestNumber."
+        };
+      }
+      const requested = await githubJsonBody({
+        target: input.target,
+        fetchImpl,
+        method: "GET",
+        path: `/pulls/${pullRequestNumber}/requested_reviewers`
+      });
+      const existingReviewers = requestedReviewerLogins(requested);
+      const existingTeamReviewers = requestedTeamReviewerNames(requested);
+      const reviewers = input.operation.reviewers.filter((reviewer) => !existingReviewers.has(reviewer));
+      const teamReviewers = input.operation.teamReviewers?.filter((reviewer) => !existingTeamReviewers.has(reviewer));
+      if (reviewers.length === 0 && (!teamReviewers || teamReviewers.length === 0)) {
+        return {
+          intentId: input.operation.intentId,
+          outcome: "applied",
+          externalUri: `https://github.com/${input.target.owner}/${input.target.repo}/pull/${pullRequestNumber}`,
+          message: "Requested reviewers were already present; skipped GitHub notification retry."
+        };
+      }
+      await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "POST",
+        path: `/pulls/${pullRequestNumber}/requested_reviewers`,
+        body: {
+          ...reviewers.length ? { reviewers } : {},
+          ...teamReviewers?.length ? { team_reviewers: teamReviewers } : {}
+        }
+      });
+      return {
+        intentId: input.operation.intentId,
+        outcome: "applied",
+        externalUri: `https://github.com/${input.target.owner}/${input.target.repo}/pull/${pullRequestNumber}`
+      };
+    }
+    const issueNumber = input.target.issueNumber;
+    if (typeof issueNumber !== "number") {
+      return {
+        intentId: input.operation.intentId,
+        outcome: "failed",
+        message: "GitHub issue mutation requires target.issueNumber."
+      };
+    }
+    if (input.operation.kind === "set_assignees") {
+      const externalUri2 = await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "PATCH",
+        path: `/issues/${issueNumber}`,
+        body: { assignees: input.operation.assignees }
+      });
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    if (input.operation.kind === "add_assignee") {
+      const externalUri2 = await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "POST",
+        path: `/issues/${issueNumber}/assignees`,
+        body: { assignees: [input.operation.assignee] }
+      });
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    if (input.operation.kind === "remove_assignee") {
+      const externalUri2 = await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "DELETE",
+        path: `/issues/${issueNumber}/assignees`,
+        body: { assignees: [input.operation.assignee] }
+      });
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    if (input.operation.kind === "replace_mapped_label") {
+      for (const label of input.operation.removeLabels) {
+        await githubJson({
+          target: input.target,
+          fetchImpl,
+          method: "DELETE",
+          path: `/issues/${issueNumber}/labels/${encodeURIComponent(label)}`,
+          okStatuses: [200, 404]
+        });
+      }
+      const externalUri2 = await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "POST",
+        path: `/issues/${issueNumber}/labels`,
+        body: { labels: [input.operation.label] }
+      });
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    if (input.operation.kind === "add_label") {
+      const externalUri2 = await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "POST",
+        path: `/issues/${issueNumber}/labels`,
+        body: { labels: [input.operation.label] }
+      });
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    if (input.operation.kind === "remove_label") {
+      const externalUri2 = await githubJson({
+        target: input.target,
+        fetchImpl,
+        method: "DELETE",
+        path: `/issues/${issueNumber}/labels/${encodeURIComponent(input.operation.label)}`
+      });
+      return { intentId: input.operation.intentId, outcome: "applied", externalUri: externalUri2 };
+    }
+    const externalUri = await githubJson({
+      target: input.target,
+      fetchImpl,
+      method: "PUT",
+      path: `/issues/${issueNumber}/labels`,
+      body: { labels: input.operation.labels }
+    });
+    return { intentId: input.operation.intentId, outcome: "applied", externalUri };
+  } catch (error) {
+    return {
+      intentId: input.operation.intentId,
+      outcome: "failed",
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function applyGitHubIssueMutationIntent(input) {
+  const compiled = compileGitHubIssueMutationIntent(input.intent, {
+    ...input.mappings ? { mappings: input.mappings } : {},
+    ...input.targetKind ? { targetKind: input.targetKind } : {}
+  });
+  if (!compiled.ok) return compiled.outcome;
+  return applyGitHubIssueMutationOperation({
+    target: input.target,
+    operation: compiled.operation,
+    ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+  });
+}
+async function applyGitHubIssueMutationIntents(input) {
+  const outcomes = [];
+  for (const intent of input.intents) {
+    outcomes.push(
+      await applyGitHubIssueMutationIntent({
+        target: input.target,
+        intent,
+        ...input.mappings ? { mappings: input.mappings } : {},
+        ...input.targetKind ? { targetKind: input.targetKind } : {},
+        ...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+      })
+    );
+  }
+  return outcomes;
+}
+
+// src/ingress.ts
+import { createHmac, randomUUID, timingSafeEqual } from "crypto";
+import { serve } from "@hono/node-server";
+import { createOpenTagClient } from "@opentag/client";
+import { parseThreadActionCommand } from "@opentag/core";
+import { Hono } from "hono";
+
 // src/normalize.ts
 import { parseOpenTagMention } from "@opentag/core";
 function permissionsForIntent(intent) {
@@ -29,9 +568,77 @@ function permissionsForIntent(intent) {
   }
   return permissions;
 }
+function permissionsForPullRequestReviewCommentIntent(intent) {
+  const permissions = permissionsForIntent(intent);
+  if (intent === "review") {
+    permissions.push({
+      scope: "pr:update",
+      reason: "request reviewers on the source pull request after explicit approval"
+    });
+  }
+  return permissions;
+}
+function contextPointersForCommand(command, privateRepo) {
+  const visibility = privateRepo ? "private" : "public";
+  const context = [];
+  for (const reference of command.parsed?.references ?? []) {
+    if (reference.kind === "url") {
+      context.push({
+        kind: "url",
+        uri: reference.uri,
+        visibility,
+        title: reference.title ?? "Command URL reference"
+      });
+      continue;
+    }
+    if (reference.kind === "file" || reference.kind === "path" || reference.kind === "line" || reference.kind === "range") {
+      context.push({
+        kind: "file",
+        uri: reference.uri,
+        ...reference.line ? { line: reference.line } : {},
+        ...reference.startLine ? { startLine: reference.startLine } : {},
+        ...reference.endLine ? { endLine: reference.endLine } : {},
+        visibility,
+        title: referenceTitle(reference)
+      });
+    }
+  }
+  return context;
+}
+function referenceTitle(reference) {
+  return reference.title ?? "Command file reference";
+}
+function githubWorkItem(input) {
+  return {
+    provider: "github",
+    kind: input.kind,
+    externalId: `${input.owner}/${input.repo}#${input.number}`,
+    uri: input.uri,
+    ownerContainer: {
+      provider: "github",
+      id: `${input.owner}/${input.repo}`,
+      uri: `https://github.com/${input.owner}/${input.repo}`
+    }
+  };
+}
+function commandMetadata(command) {
+  if (!command.parsed) return {};
+  return {
+    commandParser: command.parsed.version,
+    commandDiagnostics: command.parsed.diagnostics,
+    ...command.parsed.approval ? { approval: command.parsed.approval } : {},
+    ...command.parsed.network ? { network: command.parsed.network } : {}
+  };
+}
 function normalizeGitHubIssueComment(input) {
   const mention = parseOpenTagMention(input.commentBody);
   if (!mention.matched) return null;
+  const command = {
+    rawText: mention.rawText,
+    intent: mention.intent,
+    args: mention.args,
+    ...mention.parsed ? { parsed: mention.parsed } : {}
+  };
   return {
     id: `evt_github_comment_${input.id}`,
     source: "github",
@@ -44,35 +651,44 @@ function normalizeGitHubIssueComment(input) {
     },
     target: {
       mention: "@opentag",
-      agentId: "opentag"
-    },
-    command: {
-      rawText: mention.rawText,
-      intent: mention.intent,
-      args: mention.args
+      agentId: "opentag",
+      ...mention.parsed?.executorHint ? { executorHint: mention.parsed.executorHint } : {}
     },
+    command,
     context: [
       {
-        kind: "github.issue",
+        provider: "github",
+        kind: "issue",
         uri: input.issueUrl,
         visibility: input.private ? "private" : "public"
       },
       {
-        kind: "github.comment",
+        provider: "github",
+        kind: "comment",
         uri: input.commentUrl,
         visibility: input.private ? "private" : "public"
-      }
+      },
+      ...contextPointersForCommand(command, input.private)
     ],
+    workItem: githubWorkItem({
+      owner: input.owner,
+      repo: input.repo,
+      kind: "issue",
+      number: input.issueNumber,
+      uri: input.issueUrl
+    }),
     permissions: permissionsForIntent(mention.intent),
     callback: {
       provider: "github",
       uri: input.apiCommentsUrl,
-      threadKey: `${input.owner}/${input.repo}`
+      threadKey: `${input.owner}/${input.repo}#${input.issueNumber}`
     },
     metadata: {
+      repoProvider: "github",
       owner: input.owner,
       repo: input.repo,
       issueNumber: input.issueNumber,
+      ...commandMetadata(command),
       ...typeof input.installationId === "number" ? { installationId: input.installationId } : {}
     }
   };
@@ -80,6 +696,12 @@ function normalizeGitHubIssueComment(input) {
 function normalizeGitHubPullRequestReviewComment(input) {
   const mention = parseOpenTagMention(input.commentBody);
   if (!mention.matched) return null;
+  const command = {
+    rawText: mention.rawText,
+    intent: mention.intent,
+    args: mention.args,
+    ...mention.parsed ? { parsed: mention.parsed } : {}
+  };
   return {
     id: `evt_github_pr_review_comment_${input.id}`,
     source: "github",
@@ -92,84 +714,339 @@ function normalizeGitHubPullRequestReviewComment(input) {
     },
     target: {
       mention: "@opentag",
-      agentId: "opentag"
-    },
-    command: {
-      rawText: mention.rawText,
-      intent: mention.intent,
-      args: mention.args
+      agentId: "opentag",
+      ...mention.parsed?.executorHint ? { executorHint: mention.parsed.executorHint } : {}
     },
+    command,
     context: [
       {
-        kind: "github.pull_request",
+        provider: "github",
+        kind: "pull_request",
         uri: input.pullRequestUrl,
         visibility: input.private ? "private" : "public"
       },
       {
-        kind: "github.comment",
+        provider: "github",
+        kind: "comment",
         uri: input.commentUrl,
         visibility: input.private ? "private" : "public"
-      }
+      },
+      ...contextPointersForCommand(command, input.private)
     ],
-    permissions: permissionsForIntent(mention.intent),
+    workItem: githubWorkItem({
+      owner: input.owner,
+      repo: input.repo,
+      kind: "pull_request",
+      number: input.pullRequestNumber,
+      uri: input.pullRequestUrl
+    }),
+    permissions: permissionsForPullRequestReviewCommentIntent(mention.intent),
     callback: {
       provider: "github",
       uri: input.apiCommentsUrl,
       threadKey: `${input.owner}/${input.repo}#${input.pullRequestNumber}`
     },
     metadata: {
+      repoProvider: "github",
       owner: input.owner,
       repo: input.repo,
       pullRequestNumber: input.pullRequestNumber,
+      ...commandMetadata(command),
       ...typeof input.installationId === "number" ? { installationId: input.installationId } : {}
     }
   };
 }
 
-// src/pull-request.ts
-function buildPullRequestBody(result) {
-  const lines = ["## Summary", "", result.summary];
-  if (result.changedFiles?.length) {
-    lines.push("", "## Changed Files");
-    for (const file of result.changedFiles) {
-      lines.push(`- \`${file}\``);
-    }
+// src/ingress.ts
+function computeGitHubSignature(input) {
+  const digest = createHmac("sha256", input.webhookSecret).update(input.rawBody).digest("hex");
+  return `sha256=${digest}`;
+}
+function verifyGitHubSignature(input) {
+  const expected = computeGitHubSignature(input);
+  const expectedBuffer = Buffer.from(expected);
+  const actualBuffer = Buffer.from(input.signature);
+  return expectedBuffer.length === actualBuffer.length && timingSafeEqual(expectedBuffer, actualBuffer);
+}
+function parseJsonPayload(rawBody) {
+  try {
+    return JSON.parse(rawBody);
+  } catch {
+    return null;
   }
-  if (result.verification?.length) {
-    lines.push("", "## Verification");
-    for (const check of result.verification) {
-      lines.push(`- \`${check.command}\`: ${check.outcome}`);
-    }
+}
+async function handleIssueCommentCreated(input) {
+  if (input.payload.action && input.payload.action !== "created") return;
+  if (parseThreadActionCommand(input.payload.comment.body) && input.submitThreadAction) {
+    await input.submitThreadAction({
+      id: `approval_github_comment_${input.payload.comment.id}`,
+      rawText: input.payload.comment.body,
+      actor: {
+        provider: "github",
+        providerUserId: String(input.payload.sender.id),
+        handle: input.payload.sender.login
+      },
+      callback: {
+        provider: "github",
+        uri: input.payload.issue.comments_url,
+        threadKey: `${input.payload.repository.owner.login}/${input.payload.repository.name}#${input.payload.issue.number}`
+      },
+      metadata: {
+        repoProvider: "github",
+        owner: input.payload.repository.owner.login,
+        repo: input.payload.repository.name,
+        issueNumber: input.payload.issue.number,
+        commentUrl: input.payload.comment.html_url
+      }
+    });
+    return;
+  }
+  const event = normalizeGitHubIssueComment({
+    id: String(input.payload.comment.id),
+    commentBody: input.payload.comment.body,
+    commentUrl: input.payload.comment.html_url,
+    apiCommentsUrl: input.payload.issue.comments_url,
+    issueUrl: input.payload.issue.html_url,
+    issueNumber: input.payload.issue.number,
+    owner: input.payload.repository.owner.login,
+    repo: input.payload.repository.name,
+    actorId: input.payload.sender.id,
+    actorLogin: input.payload.sender.login,
+    private: input.payload.repository.private,
+    receivedAt: input.now(),
+    ...input.payload.installation ? { installationId: input.payload.installation.id } : {}
+  });
+  if (event) {
+    await input.createRun(event);
   }
-  return lines.join("\n");
 }
-async function createPullRequestViaFetch(input, fetchImpl = fetch) {
-  const response = await fetchImpl(`https://api.github.com/repos/${input.owner}/${input.repo}/pulls`, {
-    method: "POST",
-    headers: {
-      accept: "application/vnd.github+json",
-      authorization: `Bearer ${input.token}`,
-      "content-type": "application/json",
-      "x-github-api-version": "2022-11-28"
-    },
-    body: JSON.stringify({
-      title: input.title,
-      body: input.body,
-      head: input.head,
-      base: input.base
-    })
+async function handlePullRequestReviewCommentCreated(input) {
+  if (input.payload.action && input.payload.action !== "created") return;
+  const owner = input.payload.repository.owner.login;
+  const repo = input.payload.repository.name;
+  if (parseThreadActionCommand(input.payload.comment.body) && input.submitThreadAction) {
+    await input.submitThreadAction({
+      id: `approval_github_pr_review_comment_${input.payload.comment.id}`,
+      rawText: input.payload.comment.body,
+      actor: {
+        provider: "github",
+        providerUserId: String(input.payload.sender.id),
+        handle: input.payload.sender.login
+      },
+      callback: {
+        provider: "github",
+        uri: `https://api.github.com/repos/${owner}/${repo}/issues/${input.payload.pull_request.number}/comments`,
+        threadKey: `${owner}/${repo}#${input.payload.pull_request.number}`
+      },
+      metadata: {
+        repoProvider: "github",
+        owner,
+        repo,
+        pullRequestNumber: input.payload.pull_request.number,
+        commentUrl: input.payload.comment.html_url
+      }
+    });
+    return;
+  }
+  const event = normalizeGitHubPullRequestReviewComment({
+    id: String(input.payload.comment.id),
+    commentBody: input.payload.comment.body,
+    commentUrl: input.payload.comment.html_url,
+    pullRequestUrl: input.payload.pull_request.html_url,
+    apiCommentsUrl: `https://api.github.com/repos/${owner}/${repo}/issues/${input.payload.pull_request.number}/comments`,
+    owner,
+    repo,
+    pullRequestNumber: input.payload.pull_request.number,
+    actorId: input.payload.sender.id,
+    actorLogin: input.payload.sender.login,
+    private: input.payload.repository.private,
+    receivedAt: input.now(),
+    ...input.payload.installation ? { installationId: input.payload.installation.id } : {}
   });
-  if (!response.ok) {
-    throw new Error(`create pull request failed: ${response.status} ${await response.text()}`);
+  if (event) {
+    await input.createRun(event);
   }
-  const body = await response.json();
-  if (!body.html_url) {
-    throw new Error("create pull request response did not include html_url");
+}
+function createGitHubWebhookApp(input) {
+  const app = new Hono();
+  const webhookPath = input.webhookPath ?? "/github/webhooks";
+  if (!webhookPath.startsWith("/")) {
+    throw new Error("GitHub webhook path must start with /.");
   }
-  return body.html_url;
+  app.post(webhookPath, async (c) => {
+    const signature = c.req.header("x-hub-signature-256");
+    if (!signature) {
+      return c.json({ error: "missing_signature_header" }, 401);
+    }
+    const rawBody = await c.req.text();
+    if (!verifyGitHubSignature({ webhookSecret: input.webhookSecret, rawBody, signature })) {
+      return c.json({ error: "invalid_signature" }, 401);
+    }
+    const eventName = c.req.header("x-github-event");
+    const payload = parseJsonPayload(rawBody);
+    if (!payload || typeof payload !== "object") {
+      return c.json({ error: "invalid_json" }, 400);
+    }
+    if (eventName === "ping") {
+      return c.json({ ok: true });
+    }
+    if (eventName === "issue_comment") {
+      await handleIssueCommentCreated({
+        payload,
+        createRun: input.createRun,
+        ...input.submitThreadAction ? { submitThreadAction: input.submitThreadAction } : {},
+        now: input.now
+      });
+      return c.json({ ok: true });
+    }
+    if (eventName === "pull_request_review_comment") {
+      await handlePullRequestReviewCommentCreated({
+        payload,
+        createRun: input.createRun,
+        ...input.submitThreadAction ? { submitThreadAction: input.submitThreadAction } : {},
+        now: input.now
+      });
+      return c.json({ ok: true });
+    }
+    return c.json({ ok: true, ignored: "unsupported_event" });
+  });
+  return app;
+}
+function startGitHubIngress(config) {
+  const dispatcherClient = createOpenTagClient({
+    dispatcherUrl: config.dispatcherUrl,
+    ...config.dispatcherToken ? { pairingToken: config.dispatcherToken } : {}
+  });
+  const port = config.port ?? 3e3;
+  const hostname = config.hostname ?? "127.0.0.1";
+  const webhookPath = config.webhookPath ?? "/github/webhooks";
+  const server = serve({
+    fetch: createGitHubWebhookApp({
+      webhookSecret: config.webhookSecret,
+      webhookPath,
+      async createRun(event) {
+        const runId = `run_${randomUUID()}`;
+        const created = await dispatcherClient.createRun({ runId, event });
+        return created.outcome === "run_created" ? { runId: created.run.id } : {};
+      },
+      async submitThreadAction(action) {
+        await dispatcherClient.submitThreadAction(action);
+      },
+      now: () => (/* @__PURE__ */ new Date()).toISOString()
+    }).fetch,
+    port,
+    hostname
+  });
+  return {
+    url: `http://${hostname}:${port}`,
+    webhookPath,
+    server,
+    close() {
+      return new Promise((resolve, reject) => {
+        server.close((error) => {
+          if (error) {
+            reject(error);
+            return;
+          }
+          resolve();
+        });
+      });
+    }
+  };
 }
 
 // src/render.ts
+import { suggestedActionCandidatesFromResult } from "@opentag/core";
+function nextActionSummary(result) {
+  if (!result.nextAction) return void 0;
+  if (typeof result.nextAction === "string") return result.nextAction;
+  return result.nextAction.summary;
+}
+function stringParam2(params, key) {
+  const value = params?.[key];
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function stringArrayParam2(params, key) {
+  const value = params?.[key];
+  if (!Array.isArray(value)) return [];
+  return value.filter((item) => typeof item === "string" && item.length > 0);
+}
+function renderVerificationParams(params) {
+  const value = params?.["verification"];
+  if (!Array.isArray(value)) return [];
+  return value.map((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return void 0;
+    const command = item["command"];
+    const outcome = item["outcome"];
+    const summary = item["summary"];
+    if (typeof outcome !== "string") return void 0;
+    const prefix = typeof command === "string" && command.length > 0 ? `\`${command}\`: ${outcome}` : outcome;
+    return typeof summary === "string" && summary.length > 0 ? `  - ${prefix} - ${summary}` : `  - ${prefix}`;
+  }).filter((line) => Boolean(line));
+}
+function renderSuggestedActionDetails(params, action) {
+  if (action !== "create_pull_request") return [];
+  const lines = [];
+  const title = stringParam2(params, "title");
+  const head = stringParam2(params, "head") ?? stringParam2(params, "branch");
+  const base = stringParam2(params, "base") ?? stringParam2(params, "baseBranch");
+  const changedFiles = stringArrayParam2(params, "changedFiles");
+  const risks = stringArrayParam2(params, "risks");
+  const verification = renderVerificationParams(params);
+  if (title) lines.push(`- Title: ${title}`);
+  if (head || base) lines.push(`- Branch: \`${head ?? "unknown"}\` -> \`${base ?? "main"}\``);
+  if (changedFiles.length > 0) lines.push(`- Changed files: ${changedFiles.map((file) => `\`${file}\``).join(", ")}`);
+  if (risks.length > 0) {
+    lines.push("- Risks:");
+    for (const risk of risks) {
+      lines.push(`  - ${risk}`);
+    }
+  }
+  if (verification.length > 0) {
+    lines.push("- Verification:");
+    lines.push(...verification);
+  }
+  return lines;
+}
+function renderSuggestedActions(result) {
+  const candidates = suggestedActionCandidatesFromResult(result);
+  if (candidates.length === 0) return [];
+  const lines = [
+    "### Suggested actions:",
+    "",
+    "Source-thread approval: choose one command in this GitHub thread to apply a protocolized mutation or PR action to the system of record."
+  ];
+  for (const candidate of candidates) {
+    lines.push(
+      "",
+      `#### Action ${candidate.index}: ${candidate.intent.summary}`,
+      "",
+      `- System-of-record action: \`${candidate.intent.action}\` (\`${candidate.intent.domain}\`)`,
+      `- Proposal: \`${candidate.proposalId}\``,
+      `- Intent ID: \`${candidate.intent.intentId}\``
+    );
+    lines.push(...renderSuggestedActionDetails(candidate.intent.params, candidate.intent.action));
+    if (candidate.proposalPreconditions?.length) {
+      lines.push("- Preconditions:");
+      for (const precondition of candidate.proposalPreconditions) {
+        lines.push(`  - ${precondition}`);
+      }
+    }
+    lines.push(
+      "",
+      "**Approve in this thread**",
+      "",
+      `| Decision | Comment command | Effect |`,
+      `| --- | --- | --- |`,
+      `| Apply now | \`apply ${candidate.index}\` | Applies this action to the system of record. |`,
+      `| Approve only | \`approve ${candidate.index}\` | Records approval without applying yet. |`,
+      `| Continue | \`continue ${candidate.index}\` | Starts a follow-up run from this proposal. |`,
+      `| Reject | \`reject ${candidate.index}\` | Rejects this action. |`
+    );
+  }
+  lines.push("", "Bulk shortcut: comment `apply all` to apply every supported approved action in this thread.");
+  return lines;
+}
 function renderAcknowledgement(runId) {
   return `OpenTag picked this up. Run: \`${runId}\``;
 }
@@ -184,18 +1061,33 @@ function renderFinalResult(result) {
       lines.push(`- \`${check.command}\`: ${check.outcome}`);
     }
   }
-  if (result.nextAction) {
-    lines.push("", `Next action: ${result.nextAction}`);
+  const nextAction = nextActionSummary(result);
+  if (nextAction) {
+    lines.push("", `Next action: ${nextAction}`);
+  }
+  const suggestedActions = renderSuggestedActions(result);
+  if (suggestedActions.length > 0) {
+    lines.push("", ...suggestedActions);
   }
   return lines.join("\n");
 }
 export {
+  applyGitHubIssueMutationIntent,
+  applyGitHubIssueMutationIntents,
+  applyGitHubIssueMutationOperation,
   buildPullRequestBody,
+  compileGitHubIssueMutationIntent,
+  compileGitHubIssueMutationIntents,
+  computeGitHubSignature,
+  createGitHubIssueMutationCompiler,
+  createGitHubWebhookApp,
   createPullRequestViaFetch,
   normalizeGitHubIssueComment,
   normalizeGitHubPullRequestReviewComment,
   renderAcknowledgement,
   renderFinalResult,
-  renderProgress
+  renderProgress,
+  startGitHubIngress,
+  verifyGitHubSignature
 };
 //# sourceMappingURL=index.js.map