@oss-autopilot/core 3.13.3 → 3.14.0

package/dist/core/daily-logic.d.ts

@@ -14,6 +14,7 @@
  * re-exports them at the bottom so existing imports keep working without
  * a sweep.
  */
+import type { AttentionSummary } from './pr-attention.js';
 import type { FetchedPR, FetchedPRStatus, StalenessTier, ActionReason, AgentState, ShelvedPRRef, ComputedRepoSignals, RepoGroup, CommentedIssue, CapacityAssessment, ActionableIssue, ActionMenu, StarFilter } from './types.js';
 /**
  * Statuses indicating action needed from the contributor.
@@ -38,9 +39,13 @@ export declare const STALE_STATUSES: ReadonlySet<StalenessTier>;
  *
  * @param prs - The fetched PR list to apply overrides to
  * @param state - Current agent state containing status overrides
+ * @param failures - Optional collector (#1448): a message is pushed for each
+ *   PR whose override lookup threw (that PR keeps its un-overridden status).
+ *   Call sites surface these in warnings[]/partialFailures so the silently
+ *   wrong status is visible in the envelope, not just stderr.
  * @returns New PR array with overrides applied (original array is not mutated)
  */
-export declare function applyStatusOverrides(prs: FetchedPR[], state: Readonly<AgentState>): FetchedPR[];
+export declare function applyStatusOverrides(prs: FetchedPR[], state: Readonly<AgentState>, failures?: string[]): FetchedPR[];
 /**
  * Project a PR to a lightweight ShelvedPRRef for digest output.
  * Only the fields needed for display are retained, reducing JSON payload size.
@@ -61,6 +66,22 @@ export declare function toShelvedPRRef(pr: ShelvedPRRef): ShelvedPRRef;
  * @returns Star filter with minimum threshold and known counts, or undefined on first run
  */
 export declare function buildStarFilter(state: Readonly<AgentState>): StarFilter | undefined;
+/**
+ * Look up a just-merged/closed PR's `firstMaintainerResponseAt` from the
+ * previous run's persisted digest (#1461). At detection time the PR is no
+ * longer open, so it cannot be enriched without new API calls — but if it
+ * was open during a prior enriched run, the persisted digest's openPRs carry
+ * the timestamp. Best-effort: returns undefined when the PR never appeared
+ * in a persisted digest (e.g. opened and merged between runs, or the digest
+ * predates the field).
+ *
+ * Lives in core/daily-logic.ts so both ledger writers (daily Phase 3 and
+ * dashboard-data) share one lookup. Callers must read `state.lastDigest`
+ * BEFORE the current run overwrites it via setLastDigest.
+ */
+export declare function firstMaintainerResponseFromDigest(digest: {
+    openPRs: FetchedPR[];
+} | undefined, url: string): string | undefined;
 /**
  * Group PRs by repository (#80).
  * Ensures one agent per repo during parallel dispatch, preventing branch checkout conflicts.
@@ -108,7 +129,9 @@ export declare function collectActionableIssues(prs: FetchedPR[], lastDigestAt?:
  * @param actionableIssues - Issues requiring attention
  * @param capacity - Current capacity assessment
  * @param commentedIssues - Issues with comment activity
+ * @param attention - Attention bucket counts; non-zero stuck-CI / dormant-followup buckets add a follow_up item
+ * @param unextractedMergeCount - Recently merged PRs whose learnings have not been extracted yet (#1463); non-zero adds an extract_learnings item
  * @returns Action menu with context flags for orchestration
  */
-export declare function computeActionMenu(actionableIssues: ActionableIssue[], capacity: CapacityAssessment, commentedIssues?: CommentedIssue[]): ActionMenu;
+export declare function computeActionMenu(actionableIssues: ActionableIssue[], capacity: CapacityAssessment, commentedIssues?: CommentedIssue[], attention?: Pick<AttentionSummary, 'stuckCI' | 'dormantFollowup'>, unextractedMergeCount?: number): ActionMenu;
 export { formatActionHint, formatBriefSummary, formatSummary, printDigest } from '../commands/daily-render.js';

package/dist/core/daily-logic.js

@@ -52,9 +52,13 @@ const VALID_OVERRIDE_STATUSES = new Set(['needs_addressing', 'waiting_on_maintai
  *
  * @param prs - The fetched PR list to apply overrides to
  * @param state - Current agent state containing status overrides
+ * @param failures - Optional collector (#1448): a message is pushed for each
+ *   PR whose override lookup threw (that PR keeps its un-overridden status).
+ *   Call sites surface these in warnings[]/partialFailures so the silently
+ *   wrong status is visible in the envelope, not just stderr.
  * @returns New PR array with overrides applied (original array is not mutated)
  */
-export function applyStatusOverrides(prs, state) {
+export function applyStatusOverrides(prs, state, failures) {
     const overrides = state.config.statusOverrides;
     if (!overrides || Object.keys(overrides).length === 0)
         return prs;
@@ -82,7 +86,9 @@ export function applyStatusOverrides(prs, state) {
                 return { ...pr, status: override.status, waitReason: undefined, actionReason: 'needs_response' };
             }
             catch (err) {
-                warn('daily-logic', `Failed to apply status override for ${pr.url}: ${errorMessage(err)}`);
+                const message = `Failed to apply status override for ${pr.url}: ${errorMessage(err)}`;
+                warn('daily-logic', message);
+                failures?.push(message);
                 return pr;
             }
         });
@@ -152,6 +158,22 @@ export function buildStarFilter(state) {
         return undefined;
     return { minStars, knownStarCounts };
 }
+/**
+ * Look up a just-merged/closed PR's `firstMaintainerResponseAt` from the
+ * previous run's persisted digest (#1461). At detection time the PR is no
+ * longer open, so it cannot be enriched without new API calls — but if it
+ * was open during a prior enriched run, the persisted digest's openPRs carry
+ * the timestamp. Best-effort: returns undefined when the PR never appeared
+ * in a persisted digest (e.g. opened and merged between runs, or the digest
+ * predates the field).
+ *
+ * Lives in core/daily-logic.ts so both ledger writers (daily Phase 3 and
+ * dashboard-data) share one lookup. Callers must read `state.lastDigest`
+ * BEFORE the current run overwrites it via setLastDigest.
+ */
+export function firstMaintainerResponseFromDigest(digest, url) {
+    return digest?.openPRs.find((pr) => pr.url === url)?.firstMaintainerResponseAt;
+}
 /**
  * Group PRs by repository (#80).
  * Ensures one agent per repo during parallel dispatch, preventing branch checkout conflicts.
@@ -328,9 +350,11 @@ export function collectActionableIssues(prs, lastDigestAt) {
  * @param actionableIssues - Issues requiring attention
  * @param capacity - Current capacity assessment
  * @param commentedIssues - Issues with comment activity
+ * @param attention - Attention bucket counts; non-zero stuck-CI / dormant-followup buckets add a follow_up item
+ * @param unextractedMergeCount - Recently merged PRs whose learnings have not been extracted yet (#1463); non-zero adds an extract_learnings item
  * @returns Action menu with context flags for orchestration
  */
-export function computeActionMenu(actionableIssues, capacity, commentedIssues = []) {
+export function computeActionMenu(actionableIssues, capacity, commentedIssues = [], attention, unextractedMergeCount) {
     const issueResponses = commentedIssues.filter((i) => i.status === 'new_response');
     const items = [];
     const hasActionableIssues = actionableIssues.length > 0;
@@ -355,6 +379,37 @@ export function computeActionMenu(actionableIssues, capacity, commentedIssues =
             description: 'Maintainers responded to your comments on issues',
         });
     }
+    // Follow-up nudges (#1462) — the stuck_ci / dormant_followup buckets from
+    // summarizeAttentionBuckets get a menu path to workflows/dormant-pr-follow-up.md
+    // instead of only a headline count. Emitted only when a bucket is non-zero,
+    // so menus without stuck/dormant PRs are unchanged.
+    const stuckCI = attention?.stuckCI ?? 0;
+    const dormantFollowup = attention?.dormantFollowup ?? 0;
+    if (stuckCI > 0 || dormantFollowup > 0) {
+        const parts = [];
+        if (stuckCI > 0)
+            parts.push(`${stuckCI} stuck-CI`);
+        if (dormantFollowup > 0)
+            parts.push(`${dormantFollowup} dormant`);
+        const total = stuckCI + dormantFollowup;
+        items.push({
+            key: 'follow_up',
+            label: `Follow up on ${parts.join(' and ')} PR${total === 1 ? '' : 's'}`,
+            description: 'Waiting PRs that may need a nudge (pending CI or no review activity)',
+        });
+    }
+    // Extract-learnings nudge (#1463) — recently merged PRs whose ledger
+    // entries carry no learningsExtractedAt stamp get a menu path to
+    // workflows/extract-learnings.md. The nudge persists across runs for the
+    // recently-merged window until the extraction runs, then self-clears.
+    const unextracted = unextractedMergeCount ?? 0;
+    if (unextracted > 0) {
+        items.push({
+            key: 'extract_learnings',
+            label: `Extract learnings from ${unextracted} recently merged PR${unextracted === 1 ? '' : 's'}`,
+            description: 'Distill maintainer review feedback into per-repo contribution guidelines',
+        });
+    }
     // The orchestration layer (commands/oss.md Action Menu section) may insert issue-list
     // options before the search item when a curated list is available.
     const searchItem = {

package/dist/core/gist-health.d.ts

@@ -0,0 +1,81 @@
+/**
+ * One health source and one warning renderer for gist persistence (#1444).
+ *
+ * "Are we degraded?" used to be answered by three independent predicates
+ * (`config.persistence === 'gist' && !isGistMode()`, the
+ * `GistPersistenceStatus` union, `isGistMode() && isGistDegraded()`), each
+ * re-rendering its own warning prose. `StateManager.getGistHealth()` is now
+ * the single predicate for live-manager surfaces (daily warnings, dashboard
+ * probes), and {@link renderGistWarning} is the single prose renderer for
+ * every surface (CLI envelope, MCP injection, bootstrapGistBestEffort,
+ * daily warnings).
+ */
+/**
+ * Degradation causes a live StateManager can attest to from its own fields
+ * (see `StateManager.getGistHealth()`):
+ *
+ * - `configured-but-local`: config says `persistence: 'gist'` but this
+ *   process's manager has no gist store — init never ran here, or fell back
+ *   to a local-only manager. Mutations save locally and will not sync.
+ * - `bootstrap-degraded`: the manager IS gist-backed, but the bootstrap fell
+ *   back to the local cache and the store is disarmed (#1443) — reads may be
+ *   stale and pushes fail.
+ */
+export type GistHealthDegradedCause = 'configured-but-local' | 'bootstrap-degraded';
+/**
+ * Causes {@link renderGistWarning} can name. Superset of
+ * {@link GistHealthDegradedCause}: the process-level bootstrap outcomes are
+ * observed by config-peek paths (`ensureGistPersistence`, the MCP init memo)
+ * that run before or around manager creation, where there is no
+ * StateManager to ask:
+ *
+ * - `no-token`: gist is configured but no GitHub token was available.
+ * - `state-unreadable`: the state file could not be read for this attempt.
+ * - `init-fallback`: init resolved degraded — `ensureGistPersistence`
+ *   reported `'degraded'` (transient network fallback, or a #1443 degraded
+ *   bootstrap, which it deliberately conflates at that layer).
+ */
+export type GistWarningCause = GistHealthDegradedCause | 'no-token' | 'state-unreadable' | 'init-fallback';
+/**
+ * Snapshot of gist persistence health from the one source of truth
+ * (`StateManager.getGistHealth()`), shaped per #1444.
+ */
+export interface GistHealth {
+    /** `'gist'` when the manager is gist-backed (a GistStateStore is attached),
+     * `'local'` otherwise — regardless of what the config asks for. */
+    mode: 'local' | 'gist';
+    /** `null` when healthy: either genuinely local (config agrees) or
+     * gist-backed with an armed store. Non-null when this process is not
+     * reliably syncing to the Gist. */
+    degraded: null | {
+        cause: GistHealthDegradedCause;
+        /** ISO timestamp when the degradation was first observed, when known
+         * (a degraded bootstrap seeds the staleness marker; a
+         * configured-but-local manager has no marker to date it by). */
+        since?: string;
+        /** Whether a later init/recovery attempt can heal this without user
+         * action. Both manager-level causes are recoverable by re-running
+         * `ensureGistPersistence` with a token (#1415/#1443); a PERMANENT halt
+         * (e.g. token lacking the gist scope) surfaces as a thrown
+         * ConfigurationError at the surface that attempted recovery — the
+         * manager itself cannot observe it, so it never reports false here. */
+        recoverable: boolean;
+    };
+}
+/**
+ * Render the one gist-degradation warning shown by every surface (#1444).
+ *
+ * Accepts either a known {@link GistWarningCause} or `{ reason }` for the
+ * hard-error paths (ConfigurationError repair carve-outs) whose reason text
+ * is built from the underlying error.
+ *
+ * @param cause - Known cause, or a free-form reason for hard init errors.
+ * @param opts.retryHint - Optional trailing sentence describing the
+ *   surface-specific retry behavior (e.g. the MCP's "Will retry on the next
+ *   tool call.").
+ */
+export declare function renderGistWarning(cause: GistWarningCause | {
+    reason: string;
+}, opts?: {
+    retryHint?: string;
+}): string;

package/dist/core/gist-health.js

@@ -0,0 +1,39 @@
+/**
+ * One health source and one warning renderer for gist persistence (#1444).
+ *
+ * "Are we degraded?" used to be answered by three independent predicates
+ * (`config.persistence === 'gist' && !isGistMode()`, the
+ * `GistPersistenceStatus` union, `isGistMode() && isGistDegraded()`), each
+ * re-rendering its own warning prose. `StateManager.getGistHealth()` is now
+ * the single predicate for live-manager surfaces (daily warnings, dashboard
+ * probes), and {@link renderGistWarning} is the single prose renderer for
+ * every surface (CLI envelope, MCP injection, bootstrapGistBestEffort,
+ * daily warnings).
+ */
+/** Cause → human reason, the MCP's former `gistWarningText` mapping promoted
+ * to core (#1444). Keep these one-line and append-only: surfaces interpolate
+ * them mid-sentence. */
+const GIST_DEGRADED_REASON = {
+    'no-token': 'no GitHub token was available',
+    'state-unreadable': 'the state file could not be read',
+    'init-fallback': 'initialization hit a transient network failure',
+    'configured-but-local': 'this process is running local-only (Gist init has not succeeded)',
+    'bootstrap-degraded': 'the Gist bootstrap fell back to the local cache (reads may be stale and pushes are failing)',
+};
+/**
+ * Render the one gist-degradation warning shown by every surface (#1444).
+ *
+ * Accepts either a known {@link GistWarningCause} or `{ reason }` for the
+ * hard-error paths (ConfigurationError repair carve-outs) whose reason text
+ * is built from the underlying error.
+ *
+ * @param cause - Known cause, or a free-form reason for hard init errors.
+ * @param opts.retryHint - Optional trailing sentence describing the
+ *   surface-specific retry behavior (e.g. the MCP's "Will retry on the next
+ *   tool call.").
+ */
+export function renderGistWarning(cause, opts = {}) {
+    const reason = typeof cause === 'string' ? GIST_DEGRADED_REASON[cause] : cause.reason;
+    return (`Gist persistence is configured but ${reason}; writes are LOCAL-ONLY and may be ` +
+        `overwritten by the next successful Gist sync.${opts.retryHint ? ` ${opts.retryHint}` : ''}`);
+}

package/dist/core/gist-state-store.d.ts

@@ -232,7 +232,9 @@ export declare class GistStateStore {
     push(): Promise<boolean>;
     /**
      * Re-fetch the Gist and update the in-memory cache.
-     * Throttled to at most once per 30 seconds.
+     * Throttled to at most once per 30 seconds — ATTEMPTS, not just successes:
+     * a failed fetch stamps the throttle too (#1443), so an outage does not
+     * turn every SPA poll into an immediate full re-fetch.
      *
      * Returns a discriminated union so callers can tell apart the four
      * outcomes that previously collapsed into a single boolean (#1209 L9):

package/dist/core/gist-state-store.js

@@ -522,7 +522,9 @@ export class GistStateStore {
     }
     /**
      * Re-fetch the Gist and update the in-memory cache.
-     * Throttled to at most once per 30 seconds.
+     * Throttled to at most once per 30 seconds — ATTEMPTS, not just successes:
+     * a failed fetch stamps the throttle too (#1443), so an outage does not
+     * turn every SPA poll into an immediate full re-fetch.
      *
      * Returns a discriminated union so callers can tell apart the four
      * outcomes that previously collapsed into a single boolean (#1209 L9):
@@ -541,9 +543,12 @@ export class GistStateStore {
         if (sinceLastMs < GistStateStore.REFRESH_THROTTLE_MS) {
             return { status: 'throttled', sinceLastMs };
         }
+        // Stamp the ATTEMPT, success or failure (#1443): the success-only stamp
+        // let failed refreshes bypass the throttle entirely, contradicting the
+        // doc comment and hammering the API during an outage.
+        this.lastRefreshAt = now;
         try {
             await this.fetchAndCache(this.gistId);
-            this.lastRefreshAt = now;
             this.lastRefreshError = null;
             return { status: 'refreshed' };
         }

package/dist/core/github-stats.d.ts

@@ -45,7 +45,7 @@ export declare function fetchRecentlyMergedPRs(octokit: Octokit, config: {
 /**
  * Fetch merged PRs since a watermark date for incremental storage.
  * If no watermark is provided (first-ever fetch), fetches all merged PRs (up to pagination cap).
- * Returns StoredMergedPR[] (minimal: url, title, mergedAt) for state persistence.
+ * Returns StoredMergedPR[] (url, title, mergedAt, openedAt) for state persistence.
  */
 export declare function fetchMergedPRsSince(octokit: Octokit, config: {
     githubUsername: string;
@@ -53,7 +53,7 @@ export declare function fetchMergedPRsSince(octokit: Octokit, config: {
 /**
  * Fetch closed-without-merge PRs since a watermark date for incremental storage.
  * If no watermark is provided (first-ever fetch), fetches all closed PRs (up to pagination cap).
- * Returns StoredClosedPR[] (minimal: url, title, closedAt) for state persistence.
+ * Returns StoredClosedPR[] (url, title, closedAt, openedAt) for state persistence.
  * Uses `is:unmerged` to exclude merged PRs (which are also "closed" in GitHub's model).
  */
 export declare function fetchClosedPRsSince(octokit: Octokit, config: {

package/dist/core/github-stats.js

@@ -214,6 +214,8 @@ export async function fetchRecentlyClosedPRs(octokit, config, days = 7) {
         number,
         title: item.title,
         closedAt: item.closed_at || '',
+        // Free on the search result — feeds the outcome ledger (#1461).
+        openedAt: item.created_at || undefined,
     }));
 }
 /**
@@ -232,6 +234,8 @@ export async function fetchRecentlyMergedPRs(octokit, config, days = 7) {
             number,
             title: item.title,
             mergedAt: mergedAt || item.closed_at || '',
+            // Free on the search result — feeds the outcome ledger (#1461).
+            openedAt: item.created_at || undefined,
         };
     });
 }
@@ -286,7 +290,7 @@ async function fetchPRsSince(octokit, config, adapter, since) {
 /**
  * Fetch merged PRs since a watermark date for incremental storage.
  * If no watermark is provided (first-ever fetch), fetches all merged PRs (up to pagination cap).
- * Returns StoredMergedPR[] (minimal: url, title, mergedAt) for state persistence.
+ * Returns StoredMergedPR[] (url, title, mergedAt, openedAt) for state persistence.
  */
 export async function fetchMergedPRsSince(octokit, config, since) {
     return fetchPRsSince(octokit, config, {
@@ -294,13 +298,19 @@ export async function fetchMergedPRsSince(octokit, config, since) {
         dateNoun: 'merge',
         buildQuery: (u, s) => `is:pr is:merged author:${u} -user:${u}${s ? ` merged:>${s}` : ''}`,
         extractDate: (item) => item.pull_request?.merged_at || item.closed_at || '',
-        buildRecord: (item, date) => ({ url: item.html_url, title: item.title, mergedAt: date }),
+        buildRecord: (item, date) => ({
+            url: item.html_url,
+            title: item.title,
+            mergedAt: date,
+            // Free on the search result — feeds the outcome ledger (#1461).
+            openedAt: item.created_at || undefined,
+        }),
     }, since);
 }
 /**
  * Fetch closed-without-merge PRs since a watermark date for incremental storage.
  * If no watermark is provided (first-ever fetch), fetches all closed PRs (up to pagination cap).
- * Returns StoredClosedPR[] (minimal: url, title, closedAt) for state persistence.
+ * Returns StoredClosedPR[] (url, title, closedAt, openedAt) for state persistence.
  * Uses `is:unmerged` to exclude merged PRs (which are also "closed" in GitHub's model).
  */
 export async function fetchClosedPRsSince(octokit, config, since) {
@@ -309,6 +319,12 @@ export async function fetchClosedPRsSince(octokit, config, since) {
         dateNoun: 'close',
         buildQuery: (u, s) => `is:pr is:closed is:unmerged author:${u} -user:${u}${s ? ` closed:>${s}` : ''}`,
         extractDate: (item) => item.closed_at || '',
-        buildRecord: (item, date) => ({ url: item.html_url, title: item.title, closedAt: date }),
+        buildRecord: (item, date) => ({
+            url: item.html_url,
+            title: item.title,
+            closedAt: date,
+            // Free on the search result — feeds the outcome ledger (#1461).
+            openedAt: item.created_at || undefined,
+        }),
     }, since);
 }

package/dist/core/index.d.ts

@@ -3,22 +3,23 @@
  * Re-exports all core functionality for convenient imports
  */
 export { StateManager, getStateManager, getStateManagerAsync, ensureGistPersistence, bootstrapGistBestEffort, type GistPersistenceStatus, maybeCheckpoint, resetStateManager, type Stats, } from './state.js';
+export { renderGistWarning, type GistHealth, type GistHealthDegradedCause, type GistWarningCause, } from './gist-health.js';
 export { GistStateStore } from './gist-state-store.js';
 export { guidelinesFilename, repoFromGuidelinesFilename, GUIDELINES_FILE_PREFIX, GUIDELINES_MAX_BYTES, GuidelinesNotAvailableError, GuidelinesTooLargeError, } from './guidelines-store.js';
 export { PRMonitor, type PRCheckFailure, type FetchPRsResult, computeDisplayLabel, classifyCICheck, classifyFailingChecks, } from './pr-monitor.js';
 export { IssueConversationMonitor } from './issue-conversation.js';
 export { isBotAuthor, isAcknowledgmentComment } from './comment-utils.js';
-export { wrapUntrustedContent, fenceFetchedPR, extractFromFence, safeExtractFromFence, UNTRUSTED_OPEN_TAG_NAME, UNTRUSTED_CLOSE_TAG, type UntrustedContentMeta, } from './untrusted-content.js';
+export { wrapUntrustedContent, fenceFetchedPR, fenceFetchedPRTitles, labelGuidelinesContent, GUIDELINES_PROVENANCE_NOTE, extractFromFence, safeExtractFromFence, UNTRUSTED_OPEN_TAG_NAME, UNTRUSTED_CLOSE_TAG, type UntrustedContentMeta, } from './untrusted-content.js';
 export { getOctokit, checkRateLimit, type RateLimitInfo } from './github.js';
 export { parseGitHubUrl, splitRepo, isOwnRepo } from './urls.js';
 export { daysBetween, formatRelativeTime, byDateDescending } from './dates.js';
 export { getCLIVersion, getDataDir, getStatePath, getBackupDir, getCacheDir, stateFileExists } from './paths.js';
 export { getGitHubToken, getGitHubTokenAsync, requireGitHubToken, resetGitHubTokenCache, detectGitHubUsername, } from './auth.js';
 export { DEFAULT_CONCURRENCY } from './concurrency.js';
-export { OssAutopilotError, ConfigurationError, ValidationError, GistPermissionError, errorMessage, getHttpStatusCode, isRateLimitError, isRateLimitOrAuthError, nonFatalCatch, resolveErrorCode, } from './errors.js';
+export { OssAutopilotError, ConfigurationError, ValidationError, GistPermissionError, ConcurrencyError, GistConcurrencyError, errorMessage, getHttpStatusCode, isRateLimitError, isRateLimitOrAuthError, nonFatalCatch, resolveErrorCode, } from './errors.js';
 export { enableDebug, isDebugEnabled, debug, info, warn, timed } from './logger.js';
 export { HttpCache, getHttpCache, cachedRequest, type CacheEntry } from './http-cache.js';
-export { CRITICAL_STATUSES, applyStatusOverrides, computeRepoSignals, groupPRsByRepo, assessCapacity, collectActionableIssues, computeActionMenu, toShelvedPRRef, buildStarFilter, formatActionHint, formatBriefSummary, formatSummary, printDigest, } from './daily-logic.js';
+export { CRITICAL_STATUSES, applyStatusOverrides, computeRepoSignals, groupPRsByRepo, assessCapacity, collectActionableIssues, computeActionMenu, toShelvedPRRef, buildStarFilter, firstMaintainerResponseFromDigest, formatActionHint, formatBriefSummary, formatSummary, printDigest, } from './daily-logic.js';
 export { computeContributionStats, type ContributionStats, type ComputeStatsInput } from './stats.js';
 export { fetchPRTemplate, type PRTemplateResult } from './pr-template.js';
 export { classifyLinkedPR, isLinkedPRStalled, STALLED_PR_THRESHOLD_DAYS, type LinkedPR, type LinkedPRClassification, type LinkedPRState, } from './linked-pr-classification.js';

package/dist/core/index.js

@@ -3,23 +3,24 @@
  * Re-exports all core functionality for convenient imports
  */
 export { StateManager, getStateManager, getStateManagerAsync, ensureGistPersistence, bootstrapGistBestEffort, maybeCheckpoint, resetStateManager, } from './state.js';
+export { renderGistWarning, } from './gist-health.js';
 export { GistStateStore } from './gist-state-store.js';
 export { guidelinesFilename, repoFromGuidelinesFilename, GUIDELINES_FILE_PREFIX, GUIDELINES_MAX_BYTES, GuidelinesNotAvailableError, GuidelinesTooLargeError, } from './guidelines-store.js';
 export { PRMonitor, computeDisplayLabel, classifyCICheck, classifyFailingChecks, } from './pr-monitor.js';
 // Search/vetting now delegated to @oss-scout/core via commands/scout-bridge.ts
 export { IssueConversationMonitor } from './issue-conversation.js';
 export { isBotAuthor, isAcknowledgmentComment } from './comment-utils.js';
-export { wrapUntrustedContent, fenceFetchedPR, extractFromFence, safeExtractFromFence, UNTRUSTED_OPEN_TAG_NAME, UNTRUSTED_CLOSE_TAG, } from './untrusted-content.js';
+export { wrapUntrustedContent, fenceFetchedPR, fenceFetchedPRTitles, labelGuidelinesContent, GUIDELINES_PROVENANCE_NOTE, extractFromFence, safeExtractFromFence, UNTRUSTED_OPEN_TAG_NAME, UNTRUSTED_CLOSE_TAG, } from './untrusted-content.js';
 export { getOctokit, checkRateLimit } from './github.js';
 export { parseGitHubUrl, splitRepo, isOwnRepo } from './urls.js';
 export { daysBetween, formatRelativeTime, byDateDescending } from './dates.js';
 export { getCLIVersion, getDataDir, getStatePath, getBackupDir, getCacheDir, stateFileExists } from './paths.js';
 export { getGitHubToken, getGitHubTokenAsync, requireGitHubToken, resetGitHubTokenCache, detectGitHubUsername, } from './auth.js';
 export { DEFAULT_CONCURRENCY } from './concurrency.js';
-export { OssAutopilotError, ConfigurationError, ValidationError, GistPermissionError, errorMessage, getHttpStatusCode, isRateLimitError, isRateLimitOrAuthError, nonFatalCatch, resolveErrorCode, } from './errors.js';
+export { OssAutopilotError, ConfigurationError, ValidationError, GistPermissionError, ConcurrencyError, GistConcurrencyError, errorMessage, getHttpStatusCode, isRateLimitError, isRateLimitOrAuthError, nonFatalCatch, resolveErrorCode, } from './errors.js';
 export { enableDebug, isDebugEnabled, debug, info, warn, timed } from './logger.js';
 export { HttpCache, getHttpCache, cachedRequest } from './http-cache.js';
-export { CRITICAL_STATUSES, applyStatusOverrides, computeRepoSignals, groupPRsByRepo, assessCapacity, collectActionableIssues, computeActionMenu, toShelvedPRRef, buildStarFilter, formatActionHint, formatBriefSummary, formatSummary, printDigest, } from './daily-logic.js';
+export { CRITICAL_STATUSES, applyStatusOverrides, computeRepoSignals, groupPRsByRepo, assessCapacity, collectActionableIssues, computeActionMenu, toShelvedPRRef, buildStarFilter, firstMaintainerResponseFromDigest, formatActionHint, formatBriefSummary, formatSummary, printDigest, } from './daily-logic.js';
 export { computeContributionStats } from './stats.js';
 export { fetchPRTemplate } from './pr-template.js';
 export { classifyLinkedPR, isLinkedPRStalled, STALLED_PR_THRESHOLD_DAYS, } from './linked-pr-classification.js';

package/dist/core/issue-conversation.js

@@ -7,7 +7,7 @@
  */
 import { getOctokit } from './github.js';
 import { isBotAuthor, isAcknowledgmentComment } from './comment-utils.js';
-import { paginateAll } from './pagination.js';
+import { paginateAllDetailed } from './pagination.js';
 import { getStateManager } from './state.js';
 import { daysBetween } from './dates.js';
 import { splitRepo, extractOwnerRepo, isOwnRepo } from './urls.js';
@@ -142,13 +142,19 @@ export class IssueConversationMonitor {
      */
     async analyzeIssueConversation(item, repoFullName, username) {
         const { owner, repo } = splitRepo(repoFullName);
-        const allComments = await paginateAll((page) => this.octokit.issues.listComments({
+        const { items: allComments, truncated } = await paginateAllDetailed((page) => this.octokit.issues.listComments({
             owner,
             repo,
             issue_number: item.number,
             per_page: 100,
             page,
         }));
+        if (truncated) {
+            // Comments arrive oldest-first, so hitting the pagination cap drops
+            // the NEWEST responses — conversation status for this issue may be
+            // stale (#1456). Same log-only channel as the search truncation above.
+            warn(MODULE, `Comment pagination cap reached for ${repoFullName}#${item.number}; the newest comments were not fetched and conversation status may be stale.`);
+        }
         const timeline = [];
         for (const comment of allComments) {
             if (!comment.user?.login)

package/dist/core/issue-grading.d.ts

@@ -59,6 +59,15 @@ export declare function deriveGradeSignals(params: {
  * End-to-end helper for vet callers: reads the repo score, derives
  * signals from a scout candidate, and returns the grade. Callers pass
  * the `projectHealth` straight through from `scout.vetIssue()`.
+ *
+ * Which "repo score" this grades from (#1465): the `getRepoScore` input is
+ * the cached HISTORY record (the user's own merge outcomes, see
+ * docs/repo-scores.md §History score) — NOT `repo-vet`'s fresh health
+ * rubric. The fresh side only enters through `projectHealth`, and only when
+ * scout actually fetched it: the `search` surface passes a `checkFailed`
+ * sentinel (health not fetched per candidate), so search grades purely from
+ * history-side signals, while `vet` re-grades with fresh health. Same letter
+ * scale, different inputs — the two surfaces can legitimately disagree.
  */
 export declare function gradeFromCandidate(params: {
     repo: string;

package/dist/core/issue-grading.js

@@ -100,6 +100,15 @@ export function deriveGradeSignals(params) {
  * End-to-end helper for vet callers: reads the repo score, derives
  * signals from a scout candidate, and returns the grade. Callers pass
  * the `projectHealth` straight through from `scout.vetIssue()`.
+ *
+ * Which "repo score" this grades from (#1465): the `getRepoScore` input is
+ * the cached HISTORY record (the user's own merge outcomes, see
+ * docs/repo-scores.md §History score) — NOT `repo-vet`'s fresh health
+ * rubric. The fresh side only enters through `projectHealth`, and only when
+ * scout actually fetched it: the `search` surface passes a `checkFailed`
+ * sentinel (health not fetched per candidate), so search grades purely from
+ * history-side signals, while `vet` re-grades with fresh health. Same letter
+ * scale, different inputs — the two surfaces can legitimately disagree.
  */
 export function gradeFromCandidate(params) {
     const repoScore = params.getRepoScore(params.repo);

package/dist/core/pagination.d.ts

@@ -1,7 +1,34 @@
+/** Result of {@link paginateAllDetailed}: the items plus a truncation signal. */
+export interface PaginateAllResult<T> {
+    items: T[];
+    /**
+     * True when the page cap was reached with a full final page — more data
+     * may exist on the server beyond what was fetched. GitHub list endpoints
+     * return oldest-first, so on truncation it is the NEWEST entries that are
+     * missing. Callers should surface this through their warning channel
+     * rather than silently presenting a partial view (#1456).
+     */
+    truncated: boolean;
+}
+/**
+ * Auto-paginate an Octokit list endpoint, reporting whether the page cap
+ * truncated the results. Fetches additional pages when the result count
+ * equals per_page (indicating more data may exist).
+ *
+ * @param fetchPage Function that fetches a single page given a page number
+ * @param perPage Items per page (default 100)
+ * @param maxPages Maximum pages to fetch (default 10 = 1000 items)
+ */
+export declare function paginateAllDetailed<T>(fetchPage: (page: number) => Promise<{
+    data: T[];
+}>, perPage?: number, maxPages?: number): Promise<PaginateAllResult<T>>;
 /**
  * Auto-paginate an Octokit list endpoint. Fetches additional pages when
  * the result count equals per_page (indicating more data may exist).
  *
+ * Silently drops anything past `maxPages` — use {@link paginateAllDetailed}
+ * when the caller needs to know the results were truncated.
+ *
  * @param fetchPage Function that fetches a single page given a page number
  * @param perPage Items per page (default 100)
  * @param maxPages Maximum pages to fetch (default 10 = 1000 items)

package/dist/core/pagination.js

@@ -1,20 +1,38 @@
 /** Maximum pages to fetch to prevent runaway pagination */
 const MAX_PAGES = 10;
 /**
- * Auto-paginate an Octokit list endpoint. Fetches additional pages when
- * the result count equals per_page (indicating more data may exist).
+ * Auto-paginate an Octokit list endpoint, reporting whether the page cap
+ * truncated the results. Fetches additional pages when the result count
+ * equals per_page (indicating more data may exist).
  *
  * @param fetchPage Function that fetches a single page given a page number
  * @param perPage Items per page (default 100)
  * @param maxPages Maximum pages to fetch (default 10 = 1000 items)
  */
-export async function paginateAll(fetchPage, perPage = 100, maxPages = MAX_PAGES) {
+export async function paginateAllDetailed(fetchPage, perPage = 100, maxPages = MAX_PAGES) {
     const allItems = [];
     for (let page = 1; page <= maxPages; page++) {
         const { data } = await fetchPage(page);
         allItems.push(...data);
         if (data.length < perPage)
-            break; // No more pages
+            return { items: allItems, truncated: false }; // No more pages
     }
-    return allItems;
+    // Every fetched page (including the last allowed one) was full — more
+    // data may exist beyond the cap.
+    return { items: allItems, truncated: true };
+}
+/**
+ * Auto-paginate an Octokit list endpoint. Fetches additional pages when
+ * the result count equals per_page (indicating more data may exist).
+ *
+ * Silently drops anything past `maxPages` — use {@link paginateAllDetailed}
+ * when the caller needs to know the results were truncated.
+ *
+ * @param fetchPage Function that fetches a single page given a page number
+ * @param perPage Items per page (default 100)
+ * @param maxPages Maximum pages to fetch (default 10 = 1000 items)
+ */
+export async function paginateAll(fetchPage, perPage = 100, maxPages = MAX_PAGES) {
+    const { items } = await paginateAllDetailed(fetchPage, perPage, maxPages);
+    return items;
 }

package/dist/core/pr-comments-fetcher.d.ts

@@ -52,6 +52,13 @@ export interface PRCommentBundle {
     reviews: PRReviewEntry[];
     reviewComments: PRReviewCommentEntry[];
     issueComments: PRIssueCommentEntry[];
+    /**
+     * Set to true when any of the three comment streams hit the pagination
+     * cap (#1456). These endpoints return oldest-first, so a truncated bundle
+     * is missing the NEWEST reviewer voices — corpus consumers should treat
+     * the bundle as partial. Omitted when every stream fetched completely.
+     */
+    truncated?: boolean;
 }
 /**
  * Fetch a single PR's comment bundle. Filters out the authenticated user's