@perrylink/dsh-github 0.4.0

package/lib/approval-gate.js

@@ -0,0 +1,75 @@
+const ACTION_BY_TOOL = {
+    pr_create: 'pr.create',
+    review_post: 'review.post',
+    issue_open: 'issue.create',
+    issue_comment: 'issue.comment',
+    issue_close: 'issue.close',
+};
+/** Tools the gate intercepts; everything else delegates via next(). */
+const WRITE_TOOLS = new Set(Object.keys(ACTION_BY_TOOL));
+/** Read the frozen tool arguments as a plain object, tolerant of bad input. */
+function argumentsAsRecord(exec) {
+    return typeof exec.arguments === 'object' && exec.arguments !== null ? exec.arguments : {};
+}
+/** `"title" (body N chars)`-style preview of a titled write. */
+function titledPreview(args) {
+    const title = typeof args.title === 'string' ? args.title : '(untitled)';
+    const body = typeof args.body === 'string' ? args.body.trim() : '';
+    return body.length === 0 ? `"${title}"` : `"${title}" (body ${body.length} chars)`;
+}
+/** First line of a string, elided to `max` characters. */
+function firstLine(value, max) {
+    const line = value.split('\n')[0] ?? '';
+    return line.length > max ? `${line.slice(0, max)}…` : line;
+}
+/** Human-readable reason for the approval prompt of one write call. */
+function askReason(toolName, args, state) {
+    if (toolName === 'pr_create') {
+        return `create GitHub pull request ${titledPreview(args)}`;
+    }
+    if (toolName === 'review_post') {
+        if (typeof args.jobId !== 'string')
+            return 'post GitHub review comments';
+        const record = state.records.get(args.jobId);
+        const target = record === undefined || record.report === null
+            ? `job ${args.jobId}`
+            : `PR #${record.pr} (${record.report.findings.length} finding(s))`;
+        const mode = args.mode === 'inline' ? 'inline' : 'summary';
+        const override = typeof args.body === 'string' && args.body.trim().length > 0
+            ? `; body override: ${firstLine(args.body.trim(), 80)}`
+            : '';
+        return `post GitHub review comments for ${target} (${mode})${override}`;
+    }
+    if (toolName === 'issue_open') {
+        return `create GitHub issue ${titledPreview(args)}`;
+    }
+    if (toolName === 'issue_comment') {
+        const number = typeof args.issueNumber === 'number' ? ` #${args.issueNumber}` : '';
+        const body = typeof args.body === 'string' ? args.body.trim() : '';
+        return `comment on GitHub issue${number}${body.length === 0 ? '' : ` (body ${body.length} chars)`}`;
+    }
+    if (toolName === 'issue_close') {
+        const number = typeof args.issueNumber === 'number' ? ` #${args.issueNumber}` : '';
+        return `close GitHub issue${number}`;
+    }
+    return 'perform a GitHub write action';
+}
+/**
+ * Register the approval gate. Registration is an effect: disposing the plugin
+ * fiber removes the listener.
+ * @param ctx - plugin context; the listener lives on the shared tools pipeline.
+ * @param state - plugin state used to enrich approval reasons.
+ * @returns the effect disposer.
+ */
+export function registerApprovalGate(ctx, state) {
+    return ctx.on('tools/pre-execute', async (exec, next) => {
+        if (!WRITE_TOOLS.has(exec.name))
+            return next();
+        const action = ACTION_BY_TOOL[exec.name];
+        if (action === undefined || !state.config.allowedActions.includes(action)) {
+            return { kind: 'deny', reason: `dsh-github: action "${action ?? exec.name}" is not in allowedActions` };
+        }
+        return { kind: 'ask', reason: `dsh-github: ${askReason(exec.name, argumentsAsRecord(exec), state)}` };
+    });
+}
+//# sourceMappingURL=approval-gate.js.map

package/lib/approval-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-gate.js","sourceRoot":"","sources":["../src/approval-gate.ts"],"names":[],"mappings":"AAmBA,MAAM,cAAc,GAAiC;IACnD,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,cAAc;IAC1B,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,aAAa;CAC3B,CAAA;AAED,uEAAuE;AACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAA;AAExD,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,IAAmB;IAC5C,OAAO,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAoC,CAAC,CAAC,CAAC,EAAE,CAAA;AACvH,CAAC;AAED,gEAAgE;AAChE,SAAS,aAAa,CAAC,IAA6B;IAClD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAA;IACxE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,MAAM,SAAS,CAAA;AACpF,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACvC,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5D,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,QAAgB,EAAE,IAA6B,EAAE,KAAkB;IACpF,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,8BAA8B,aAAa,CAAC,IAAI,CAAC,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,6BAA6B,CAAA;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;YAC3D,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE;YACrB,CAAC,CAAC,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAA;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1D,MAAM,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAC3E,CAAC,CAAC,oBAAoB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,EAAE;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,OAAO,mCAAmC,MAAM,KAAK,IAAI,IAAI,QAAQ,EAAE,CAAA;IACzE,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,OAAO,uBAAuB,aAAa,CAAC,IAAI,CAAC,EAAE,CAAA;IACrD,CAAC;IACD,IAAI,QAAQ,KAAK,eAAe,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAClF,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAClE,OAAO,0BAA0B,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,SAAS,EAAE,CAAA;IACrG,CAAC;IACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QAClF,OAAO,qBAAqB,MAAM,EAAE,CAAA;IACtC,CAAC;IACD,OAAO,+BAA+B,CAAA;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,KAAkB;IACnE,OAAO,GAAG,CAAC,EAAE,CAAC,mBAAmB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAA4B,EAAE;QAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAA;QAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,MAAM,IAAI,IAAI,CAAC,IAAI,4BAA4B,EAAE,CAAA;QACzG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAA;IACvG,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/commands.d.ts

@@ -0,0 +1,12 @@
+import type { CommandDefinition, CommandsService, JobRegistry } from './types.ts';
+import type { GithubState } from './state.ts';
+/** Register the /pr command family. */
+export declare function registerPrCommand(commands: CommandsService, state: GithubState): () => void;
+/** Register the /review command family. */
+export declare function registerReviewCommand(commands: CommandsService, jobs: JobRegistry, state: GithubState): () => void;
+/** Register the /issue command family. */
+export declare function registerIssueCommand(commands: CommandsService, state: GithubState): () => void;
+/** Register all three command families; returns the combined disposer. */
+export declare function registerCommands(commands: CommandsService, jobs: JobRegistry, state: GithubState): () => void;
+export type { CommandDefinition };
+//# sourceMappingURL=commands.d.ts.map

package/lib/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,iBAAiB,EAAoC,eAAe,EAAe,WAAW,EAAE,MAAM,YAAY,CAAA;AAChI,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAiB7C,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,IAAI,CAY3F;AAoCD,2CAA2C;AAC3C,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,IAAI,CAoClH;AAiED,0CAA0C;AAC1C,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,IAAI,CAoB9F;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,GAAG,MAAM,IAAI,CAS7G;AAED,YAAY,EAAE,iBAAiB,EAAE,CAAA"}

package/lib/commands.js

@@ -0,0 +1,228 @@
+/**
+ * Human slash commands: /pr, /review, /issue.
+ *
+ * Commands never perform GitHub writes themselves: command handlers run with
+ * no open turn, so the approval seam is structurally closed to them. Instead
+ * a write command gathers read-only context (git state, review records) and
+ * queues a model instruction — via followup for an idle agent, inject for a
+ * busy one — so the model calls the corresponding write tool inside a turn,
+ * where the tools/pre-execute approval gate asks the human. Read-only command
+ * work (starting or stopping a review job) runs directly in the handler.
+ * @module dsh-github/commands
+ */
+import { createUserMessage } from '@deepseek-ai/dsh-llm/message';
+import { readGitState } from "./git.js";
+import { startReviewJob } from "./jobs.js";
+const USAGE_PR = 'Usage: /pr create [title]';
+const USAGE_REVIEW = 'Usage: /review <pr> [--max-diff <n>] [--no-ci] [--no-comments] | /review stop <jobId> | /review post <jobId>';
+const USAGE_ISSUE = 'Usage: /issue open <title>';
+/** Queue a model instruction: wake an idle driver, inject into a busy one. */
+function notify(agent, text) {
+    const summary = text.split('\n')[0] ?? '';
+    const message = createUserMessage({
+        content: [{ type: 'text', text }],
+        source: { kind: 'plugin', plugin: 'dsh-github', form: 'notice', summary },
+    });
+    if (agent.status === 'idle')
+        agent.followup(message);
+    else
+        agent.inject(message);
+}
+/** Register the /pr command family. */
+export function registerPrCommand(commands, state) {
+    return commands.register({
+        name: 'pr',
+        description: 'Create a GitHub pull request (approval required)',
+        input: { hint: 'create [title]' },
+        handler: async (invocation) => {
+            const [sub, ...rest] = invocation.rawInput.trim().split(/\s+/);
+            if (sub === undefined || sub.length === 0)
+                return { kind: 'success', text: USAGE_PR };
+            if (sub !== 'create')
+                return { kind: 'error', text: `unknown /pr subcommand "${sub}". ${USAGE_PR}` };
+            return createPrDraft(invocation, rest.join(' '), state);
+        },
+    });
+}
+/** Gather git state and queue a pr_create instruction for the model. */
+async function createPrDraft(invocation, title, state) {
+    const git = await readGitState(state.workspaceDir, state.runGit, invocation.signal, state.apiHost);
+    if (git.error !== undefined) {
+        return { kind: 'error', text: `could not read git state: ${git.error}. Run /pr create inside a git checkout.` };
+    }
+    if (git.branch === null)
+        return { kind: 'error', text: 'no current branch found. Run /pr create inside a git checkout.' };
+    const repo = git.repoFromRemote ?? state.config.defaultOwnerRepo;
+    if (repo === undefined) {
+        return { kind: 'error', text: 'could not determine the target repository. Set defaultOwnerRepo in cordis.yml or add a GitHub origin remote.' };
+    }
+    const lines = [
+        `The user ran /pr create${title.length > 0 ? ` "${title}"` : ''}. Create a GitHub pull request by calling the pr_create tool.`,
+        `- ownerRepo: ${repo}`,
+        `- head: ${git.branch}`,
+        '- base: omit (repository default branch)',
+        `- title: ${title.length > 0 ? JSON.stringify(title) : 'derive one from the changes'}`,
+    ];
+    if (git.hasChanges) {
+        lines.push(`- the working tree has uncommitted changes: ${git.changedFiles.slice(0, 10).join(', ')}${git.changedFiles.length > 10 ? ' …' : ''}`);
+    }
+    if (git.commitsAhead.length > 0) {
+        lines.push(`- unpushed commits ahead of upstream:\n${git.commitsAhead.slice(0, 20).join('\n')}`);
+    }
+    lines.push(state.config.autoCommit
+        ? '- autoCommit is enabled: commit the uncommitted changes and push them to the remote via bash first (each bash write needs approval), then call pr_create.'
+        : '- do NOT commit or push anything; create the PR against the pushed head as-is.');
+    lines.push('You may polish the PR body before calling pr_create. Creating the PR asks the human for approval.');
+    notify(invocation.agent, lines.join('\n'));
+    return { kind: 'success', text: `queued a pr_create draft for ${repo} (${git.branch}). The model prepares the PR; creation requires your approval.` };
+}
+/** Register the /review command family. */
+export function registerReviewCommand(commands, jobs, state) {
+    return commands.register({
+        name: 'review',
+        description: 'Review a GitHub pull request in a background job',
+        input: { hint: '<pr> [--max-diff <n>] [--no-ci] [--no-comments] | stop <jobId> | post <jobId>' },
+        handler: async (invocation) => {
+            const input = invocation.rawInput.trim();
+            if (input.length === 0)
+                return { kind: 'success', text: USAGE_REVIEW };
+            if (input.startsWith('stop ')) {
+                const jobId = input.slice('stop '.length).trim();
+                if (jobId.length === 0)
+                    return { kind: 'error', text: USAGE_REVIEW };
+                if (!state.records.has(jobId)) {
+                    return { kind: 'error', text: `no review job "${jobId}". List jobs with job_list or check the /review output.` };
+                }
+                const outcome = jobs.kill(jobId, invocation.agent, 'user requested stop via /review stop');
+                return { kind: 'success', text: outcome === 'requested' ? `requested stop of job ${jobId}` : `job ${jobId} had already finished` };
+            }
+            if (input.startsWith('post ')) {
+                const jobId = input.slice('post '.length).trim();
+                if (jobId.length === 0)
+                    return { kind: 'error', text: USAGE_REVIEW };
+                const record = state.records.get(jobId);
+                if (record === undefined) {
+                    return { kind: 'error', text: `no review job "${jobId}". List jobs with job_list or check the /review output.` };
+                }
+                if (record.status !== 'completed' || record.report === null) {
+                    return { kind: 'error', text: `review job "${jobId}" is ${record.status}; wait for completion before posting.` };
+                }
+                notify(invocation.agent, `The user ran /review post ${jobId}. Call the review_post tool with { "jobId": "${jobId}" } to publish the review `
+                    + `for PR #${record.pr} in ${record.repo} (${record.report.findings.length} finding(s)). Use mode "inline" for line-anchored `
+                    + 'comments or "summary" for one aggregated comment. Posting asks the human for approval.');
+                return { kind: 'success', text: `queued review_post for job ${jobId} (PR #${record.pr}, ${record.report.findings.length} finding(s)). Posting requires your approval.` };
+            }
+            return startReview(invocation, input, jobs, state);
+        },
+    });
+}
+/** Parse `/review <pr>` options: --max-diff <n>, --no-ci, --no-comments. */
+function parseReviewOptions(input) {
+    const parts = input.split(/\s+/);
+    const options = { includeCi: true, includeComments: true };
+    let pr = '';
+    for (let index = 0; index < parts.length; index += 1) {
+        const part = parts[index] ?? '';
+        if (part === '--max-diff') {
+            const value = parts[index + 1];
+            if (value === undefined || !/^\d+$/.test(value))
+                throw new Error(`--max-diff needs a positive number. ${USAGE_REVIEW}`);
+            options.maxDiffChars = Number(value);
+            index += 1;
+            continue;
+        }
+        if (part === '--no-ci') {
+            options.includeCi = false;
+            continue;
+        }
+        if (part === '--no-comments') {
+            options.includeComments = false;
+            continue;
+        }
+        if (pr.length > 0)
+            throw new Error(`unexpected argument "${part}". ${USAGE_REVIEW}`);
+        pr = part;
+    }
+    if (pr.length === 0)
+        throw new Error(USAGE_REVIEW);
+    return { pr, options };
+}
+/** Start a background review job for one PR reference. */
+async function startReview(invocation, input, jobs, state) {
+    let parsed;
+    try {
+        parsed = parseReviewOptions(input);
+    }
+    catch (error) {
+        return { kind: 'error', text: error instanceof Error ? error.message : USAGE_REVIEW };
+    }
+    const ref = state.parsePrRef(parsed.pr);
+    if (ref === null) {
+        return { kind: 'error', text: `"${parsed.pr}" is not a PR reference. Use a number, "#number", "owner/repo#number", or a pull URL.` };
+    }
+    const repoResult = ref.repo !== undefined ? { ok: true, repo: ref.repo } : await state.resolveRepo(undefined, invocation.signal);
+    if (!repoResult.ok)
+        return { kind: 'error', text: `${repoResult.message}. ${repoResult.guidance}` };
+    let jobId;
+    try {
+        jobId = startReviewJob(jobs, state, {
+            repo: repoResult.repo,
+            pr: ref.number,
+            label: `review PR #${ref.number} (${repoResult.repo})`,
+            owner: invocation.agent,
+            ...parsed.options,
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        return {
+            kind: 'error',
+            text: `could not start the review job: ${detail}.\n`
+                + 'Load @deepseek-ai/dsh-tool-jobs in the agent composition (it serves the job registry and owns completion notices), then retry.',
+        };
+    }
+    return {
+        kind: 'success',
+        text: `started review job ${jobId} for PR #${ref.number} in ${repoResult.repo}.\n`
+            + `You will be notified on completion; the model reads it via job_output ${jobId}.\n`
+            + `/review post ${jobId} publishes the comment (requires your approval) · /review stop ${jobId} cancels.`,
+    };
+}
+/** Register the /issue command family. */
+export function registerIssueCommand(commands, state) {
+    return commands.register({
+        name: 'issue',
+        description: 'Open a GitHub issue (approval required)',
+        input: { hint: 'open <title>' },
+        handler: async (invocation) => {
+            const input = invocation.rawInput.trim();
+            if (input.length === 0)
+                return { kind: 'success', text: USAGE_ISSUE };
+            if (!input.startsWith('open '))
+                return { kind: 'error', text: `unknown /issue subcommand. ${USAGE_ISSUE}` };
+            const title = input.slice('open '.length).trim();
+            if (title.length === 0)
+                return { kind: 'error', text: USAGE_ISSUE };
+            const repoResult = await state.resolveRepo(undefined, invocation.signal);
+            if (!repoResult.ok)
+                return { kind: 'error', text: `${repoResult.message}. ${repoResult.guidance}` };
+            notify(invocation.agent, `The user ran /issue open "${title}". Create the issue by calling the issue_open tool with `
+                + `{ "title": ${JSON.stringify(title)}, "ownerRepo": "${repoResult.repo}" } and a concise body you write. `
+                + 'Creating the issue asks the human for approval.');
+            return { kind: 'success', text: `queued issue_open for ${repoResult.repo}. Creating the issue requires your approval.` };
+        },
+    });
+}
+/** Register all three command families; returns the combined disposer. */
+export function registerCommands(commands, jobs, state) {
+    const disposers = [
+        registerPrCommand(commands, state),
+        registerReviewCommand(commands, jobs, state),
+        registerIssueCommand(commands, state),
+    ];
+    return () => {
+        for (const dispose of disposers)
+            dispose();
+    };
+}
+//# sourceMappingURL=commands.js.map

package/lib/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAI1C,MAAM,QAAQ,GAAG,2BAA2B,CAAA;AAC5C,MAAM,YAAY,GAAG,8GAA8G,CAAA;AACnI,MAAM,WAAW,GAAG,4BAA4B,CAAA;AAEhD,8EAA8E;AAC9E,SAAS,MAAM,CAAC,KAAkB,EAAE,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,iBAAiB,CAAC;QAChC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE;KAC1E,CAAC,CAAA;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;;QAC/C,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AAC5B,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,iBAAiB,CAAC,QAAyB,EAAE,KAAkB;IAC7E,OAAO,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,EAAE,IAAI;QACV,WAAW,EAAE,kDAAkD;QAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;QACjC,OAAO,EAAE,KAAK,EAAE,UAAU,EAA0B,EAAE;YACpD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC9D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;YACrF,IAAI,GAAG,KAAK,QAAQ;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,GAAG,MAAM,QAAQ,EAAE,EAAE,CAAA;YACpG,OAAO,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;QACzD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE,KAAa,EAAE,KAAkB;IAC3F,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;IAClG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,GAAG,CAAC,KAAK,yCAAyC,EAAE,CAAA;IACjH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAAA;IACzH,MAAM,IAAI,GAAG,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAA;IAChE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,8GAA8G,EAAE,CAAA;IAChJ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,0BAA0B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,+DAA+D;QAC9H,gBAAgB,IAAI,EAAE;QACtB,WAAW,GAAG,CAAC,MAAM,EAAE;QACvB,0CAA0C;QAC1C,YAAY,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,6BAA6B,EAAE;KACvF,CAAA;IACD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,+CAA+C,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAClJ,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAClG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU;QAChC,CAAC,CAAC,2JAA2J;QAC7J,CAAC,CAAC,gFAAgF,CAAC,CAAA;IACrF,KAAK,CAAC,IAAI,CAAC,mGAAmG,CAAC,CAAA;IAE/G,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,gCAAgC,IAAI,KAAK,GAAG,CAAC,MAAM,gEAAgE,EAAE,CAAA;AACvJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,qBAAqB,CAAC,QAAyB,EAAE,IAAiB,EAAE,KAAkB;IACpG,OAAO,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kDAAkD;QAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,+EAA+E,EAAE;QAChG,OAAO,EAAE,KAAK,EAAE,UAAU,EAA0B,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;YACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;YACtE,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;gBAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;gBACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC9B,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,KAAK,yDAAyD,EAAE,CAAA;gBAClH,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,sCAAsC,CAAC,CAAA;gBAC1F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,uBAAuB,EAAE,CAAA;YACpI,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;gBAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAA;gBACpE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,KAAK,yDAAyD,EAAE,CAAA;gBAClH,CAAC;gBACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;oBAC5D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,KAAK,QAAQ,MAAM,CAAC,MAAM,uCAAuC,EAAE,CAAA;gBAClH,CAAC;gBACD,MAAM,CAAC,UAAU,CAAC,KAAK,EACrB,6BAA6B,KAAK,gDAAgD,KAAK,4BAA4B;sBACjH,WAAW,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,oDAAoD;sBAC5H,wFAAwF,CAAC,CAAA;gBAC7F,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,8BAA8B,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,+CAA+C,EAAE,CAAA;YAC1K,CAAC;YACD,OAAO,WAAW,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;QACpD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,OAAO,GAA4E,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAA;IACnI,IAAI,EAAE,GAAG,EAAE,CAAA;IACX,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;YAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,YAAY,EAAE,CAAC,CAAA;YACvH,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;YACpC,KAAK,IAAI,CAAC,CAAA;YACV,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAAC,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC/D,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;YAAC,OAAO,CAAC,eAAe,GAAG,KAAK,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC3E,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,MAAM,YAAY,EAAE,CAAC,CAAA;QACpF,EAAE,GAAG,IAAI,CAAA;IACX,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAA;IAClD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAA;AACxB,CAAC;AAED,0DAA0D;AAC1D,KAAK,UAAU,WAAW,CAAC,UAA6B,EAAE,KAAa,EAAE,IAAiB,EAAE,KAAkB;IAC5G,IAAI,MAAwG,CAAA;IAC5G,IAAI,CAAC;QACH,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAA;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACvC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,EAAE,uFAAuF,EAAE,CAAA;IACtI,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;IACzI,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAA;IAEnG,IAAI,KAAa,CAAA;IACjB,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,EAAE;YAClC,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,EAAE,EAAE,GAAG,CAAC,MAAM;YACd,KAAK,EAAE,cAAc,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,GAAG;YACtD,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,GAAG,MAAM,CAAC,OAAO;SAClB,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrE,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,mCAAmC,MAAM,KAAK;kBAChD,gIAAgI;SACrI,CAAA;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,sBAAsB,KAAK,YAAY,GAAG,CAAC,MAAM,OAAO,UAAU,CAAC,IAAI,KAAK;cAC9E,yEAAyE,KAAK,KAAK;cACnF,gBAAgB,KAAK,kEAAkE,KAAK,WAAW;KAC5G,CAAA;AACH,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,oBAAoB,CAAC,QAAyB,EAAE,KAAkB;IAChF,OAAO,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,yCAAyC;QACtD,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;QAC/B,OAAO,EAAE,KAAK,EAAE,UAAU,EAA0B,EAAE;YACpD,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;YACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YACrE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,WAAW,EAAE,EAAE,CAAA;YAC3G,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;YAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;YACnE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAA;YACxE,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAA;YACnG,MAAM,CAAC,UAAU,CAAC,KAAK,EACrB,6BAA6B,KAAK,0DAA0D;kBAC1F,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,UAAU,CAAC,IAAI,oCAAoC;kBACzG,iDAAiD,CAAC,CAAA;YACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,yBAAyB,UAAU,CAAC,IAAI,8CAA8C,EAAE,CAAA;QAC1H,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,QAAyB,EAAE,IAAiB,EAAE,KAAkB;IAC/F,MAAM,SAAS,GAAG;QAChB,iBAAiB,CAAC,QAAQ,EAAE,KAAK,CAAC;QAClC,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC;QAC5C,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC;KACtC,CAAA;IACD,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,OAAO,IAAI,SAAS;YAAE,OAAO,EAAE,CAAA;IAC5C,CAAC,CAAA;AACH,CAAC"}

package/lib/config.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Schemastery configuration for dsh-github.
+ *
+ * Every tunable is changeable from cordis.yml; the schema validates at load
+ * time and fails loud on invalid values. Secrets are NOT config fields: the
+ * token always travels through the credentials seam (a reference name here,
+ * never a value).
+ * @module dsh-github/config
+ */
+import z from '@deepseek-ai/schemastery';
+/** GitHub write actions the plugin may perform (each still requires approval). */
+export type GithubAction = 'pr.create' | 'review.post' | 'issue.create' | 'issue.comment' | 'issue.close';
+/** Where a GitHub token is looked up. `auto` tries them in order. */
+export type TokenSource = 'auto' | 'credentials' | 'env' | 'gh';
+export interface Config {
+    /**
+     * Token lookup order: `auto` resolves credentials-seam reference → `env`
+     * variable → `gh` CLI login, in that order. Explicit values restrict to one
+     * source and report a structured error when it is unavailable.
+     */
+    tokenSource: TokenSource;
+    /** Credentials-seam reference / environment-variable name for the token. */
+    tokenRef: string;
+    /** `owner/repo` used when a call does not name one and git has no origin. */
+    defaultOwnerRepo?: string;
+    /** Whether `/pr create` may instruct the model to commit and push first. */
+    autoCommit: boolean;
+    /** Character cap for PR diffs read into a review (diff or review job). */
+    maxDiffChars: number;
+    /** Character cap for the diff excerpt rendered into tool output. */
+    renderExcerptChars: number;
+    /** Cap for PR comments listed by gh_review. */
+    maxComments: number;
+    /** Deadline for one background review job; exceeded jobs fail with detail. */
+    reviewJobTimeoutMs: number;
+    /** Cap for in-memory review-job records; oldest settled records evict first. */
+    maxReviewRecords: number;
+    /**
+     * Review engine: `static` runs the deterministic analyzer; `model` delegates
+     * the capped diff to a one-shot subagent through the host's `subagents` seam
+     * (the owner agent is the parent). Fails loud when the seam is absent.
+     */
+    reviewMode: 'static' | 'model';
+    /** Subagent provider name for `reviewMode: "model"`; defaults to the first registered. */
+    modelReviewProvider?: string;
+    /** Maximum 429 retry attempts per GitHub API request. */
+    maxRetries: number;
+    /** Base backoff for 429 retries (doubles per attempt). */
+    retryBaseMs: number;
+    /** Ceiling for 429 retry backoff. */
+    retryMaxWaitMs: number;
+    /** GitHub REST base URL; change for GitHub Enterprise. */
+    apiBaseUrl: string;
+    /** Whitelist of write actions; everything else is denied before approval. */
+    allowedActions: GithubAction[];
+    /** Working directory for read-only git inspection; defaults to the process cwd. */
+    workspaceDir?: string;
+}
+export declare const Config: z<Config>;
+//# sourceMappingURL=config.d.ts.map

package/lib/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,kFAAkF;AAClF,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,cAAc,GAAG,eAAe,GAAG,aAAa,CAAA;AAEzG,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,KAAK,GAAG,IAAI,CAAA;AAE/D,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAA;IACxB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAA;IAChB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4EAA4E;IAC5E,UAAU,EAAE,OAAO,CAAA;IACnB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAA;IACpB,oEAAoE;IACpE,kBAAkB,EAAE,MAAM,CAAA;IAC1B,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAA;IACnB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAA;IAC1B,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC9B,0FAA0F;IAC1F,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAA;IAClB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,cAAc,EAAE,MAAM,CAAA;IACtB,0DAA0D;IAC1D,UAAU,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,cAAc,EAAE,YAAY,EAAE,CAAA;IAC9B,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAID,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAmD3B,CAAA"}

package/lib/config.js

@@ -0,0 +1,64 @@
+/**
+ * Schemastery configuration for dsh-github.
+ *
+ * Every tunable is changeable from cordis.yml; the schema validates at load
+ * time and fails loud on invalid values. Secrets are NOT config fields: the
+ * token always travels through the credentials seam (a reference name here,
+ * never a value).
+ * @module dsh-github/config
+ */
+import z from '@deepseek-ai/schemastery';
+const OWNER_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+export const Config = z.object({
+    tokenSource: z.union(['auto', 'credentials', 'env', 'gh'])
+        .default('auto')
+        .description('Token lookup source: auto tries credentials → env → gh in order.'),
+    tokenRef: z.string()
+        .pattern(/^[A-Za-z_][A-Za-z0-9_]*$/)
+        .default('GITHUB_TOKEN')
+        .description('Credential reference / environment variable name holding the token.'),
+    defaultOwnerRepo: z.string()
+        .pattern(OWNER_REPO_PATTERN)
+        .description('Fallback owner/repo when neither the call nor git names one.'),
+    autoCommit: z.boolean()
+        .default(false)
+        .description('Whether /pr create may instruct the model to commit and push first.'),
+    maxDiffChars: z.number().step(1).min(1)
+        .default(8000)
+        .description('Character cap for PR diffs read into a review.'),
+    renderExcerptChars: z.number().step(1).min(1)
+        .default(2000)
+        .description('Character cap for the diff excerpt rendered into tool output.'),
+    maxComments: z.number().step(1).min(1)
+        .default(20)
+        .description('Cap for PR comments listed by gh_review.'),
+    reviewJobTimeoutMs: z.number().step(1).min(1000)
+        .default(600_000)
+        .description('Deadline for one background review job.'),
+    maxReviewRecords: z.number().step(1).min(1)
+        .default(50)
+        .description('Cap for in-memory review-job records; oldest settled records evict first.'),
+    reviewMode: z.union(['static', 'model'])
+        .default('static')
+        .description('Review engine: static (deterministic analyzer) or model (one-shot subagent through the subagents seam).'),
+    modelReviewProvider: z.string()
+        .description('Subagent provider name for model review; defaults to the first registered provider.'),
+    maxRetries: z.number().step(1).min(0)
+        .default(3)
+        .description('Maximum 429 retry attempts per GitHub API request.'),
+    retryBaseMs: z.number().step(1).min(1)
+        .default(500)
+        .description('Base backoff for 429 retries (doubles per attempt).'),
+    retryMaxWaitMs: z.number().step(1).min(1)
+        .default(60_000)
+        .description('Ceiling for 429 retry backoff.'),
+    apiBaseUrl: z.string()
+        .default('https://api.github.com')
+        .description('GitHub REST base URL (change for GitHub Enterprise).'),
+    allowedActions: z.array(z.union(['pr.create', 'review.post', 'issue.create', 'issue.comment', 'issue.close']))
+        .default(['pr.create', 'review.post', 'issue.create', 'issue.comment', 'issue.close'])
+        .description('Write actions this plugin may perform; each still requires approval.'),
+    workspaceDir: z.string()
+        .description('Working directory for read-only git inspection (defaults to process cwd).'),
+});
+//# sourceMappingURL=config.js.map

package/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAqDxC,MAAM,kBAAkB,GAAG,oCAAoC,CAAA;AAE/D,MAAM,CAAC,MAAM,MAAM,GAAc,CAAC,CAAC,MAAM,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,CAAU,CAAC;SAChE,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,kEAAkE,CAAC;IAClF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;SACjB,OAAO,CAAC,0BAA0B,CAAC;SACnC,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,qEAAqE,CAAC;IACrF,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;SACzB,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,8DAA8D,CAAC;IAC9E,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;SACpB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qEAAqE,CAAC;IACrF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACpC,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,gDAAgD,CAAC;IAChE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SAC1C,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CAAC,+DAA+D,CAAC;IAC/E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACnC,OAAO,CAAC,EAAE,CAAC;SACX,WAAW,CAAC,0CAA0C,CAAC;IAC1D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;SAC7C,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,yCAAyC,CAAC;IACzD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACxC,OAAO,CAAC,EAAE,CAAC;SACX,WAAW,CAAC,2EAA2E,CAAC;IAC3F,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;SAC9C,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yGAAyG,CAAC;IACzH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC5B,WAAW,CAAC,qFAAqF,CAAC;IACrG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SAClC,OAAO,CAAC,CAAC,CAAC;SACV,WAAW,CAAC,oDAAoD,CAAC;IACpE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACnC,OAAO,CAAC,GAAG,CAAC;SACZ,WAAW,CAAC,qDAAqD,CAAC;IACrE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACtC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gCAAgC,CAAC;IAChD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,sDAAsD,CAAC;IACtE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,CAAU,CAAC,CAAC;SACpH,OAAO,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;SACrF,WAAW,CAAC,sEAAsE,CAAC;IACtF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;SACrB,WAAW,CAAC,2EAA2E,CAAC;CAC5F,CAAC,CAAA"}

package/lib/credential.d.ts

@@ -0,0 +1,42 @@
+import type { CredentialProvider } from '@deepseek-ai/dsh-credentials';
+import type { TokenSource } from './config.ts';
+/** A resolved non-empty token and the source layer that supplied it. */
+export interface ResolvedToken {
+    value: string;
+    source: Exclude<TokenSource, 'auto'>;
+}
+/** Structured, token-free explanation of a failed resolution. */
+export interface TokenResolutionError {
+    code: 'no-token';
+    message: string;
+    guidance: string;
+}
+export type TokenResolution = {
+    ok: true;
+    token: ResolvedToken;
+} | {
+    ok: false;
+    error: TokenResolutionError;
+};
+/** Runs one `gh` CLI invocation; injectable for tests. */
+export type GhRunner = (args: string[], signal?: AbortSignal) => Promise<{
+    stdout: string;
+}>;
+/** Run the real `gh` CLI with stdout captured (never logged). */
+export declare function runGhCli(args: string[], signal?: AbortSignal): Promise<{
+    stdout: string;
+}>;
+/**
+ * Resolve the GitHub token for one operation.
+ *
+ * `auto` order: credentials seam → `GITHUB_TOKEN`-style environment variable →
+ * `gh` CLI logged-in token. An explicit source restricts to that one source.
+ * @param credentials - the credentials seam (`ctx.credentials`).
+ * @param tokenSource - configured lookup policy.
+ * @param tokenRef - reference / environment-variable name.
+ * @param runGh - `gh` CLI runner; the real one by default.
+ * @param signal - aborts the `gh` lookup.
+ * @returns the token with its source, or a structured error with guidance.
+ */
+export declare function resolveToken(credentials: CredentialProvider, tokenSource: TokenSource, tokenRef: string, runGh?: GhRunner, signal?: AbortSignal): Promise<TokenResolution>;
+//# sourceMappingURL=credential.d.ts.map

package/lib/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAA;AAEtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAE9C,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;CACrC;AAED,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,UAAU,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAE7G,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAO5F,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAO1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,kBAAkB,EAC/B,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,QAAmB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,CAsC1B"}

package/lib/credential.js

@@ -0,0 +1,80 @@
+/**
+ * GitHub token resolution across the three supported sources.
+ *
+ * The token value never leaves this module except through a {@link ResolvedToken}
+ * handed to the REST client: it is never written into model-visible text,
+ * session events, logs, or error messages. Every resolution is per operation —
+ * nothing is cached across operations, so a rotated credential reaches the
+ * very next call (credentials-seam contract).
+ * @module dsh-github/credential
+ */
+import { credentialRef } from '@deepseek-ai/dsh-credentials';
+import { execFile } from 'node:child_process';
+const NO_TOKEN_GUIDANCE = 'Configure one of: 1) a dsh credential for this reference (recommended; ' +
+    '$DSH_HOME/.credentials.yaml), 2) the same-named environment variable, or ' +
+    '3) `gh auth login` for the gh CLI. Set `tokenSource` in cordis.yml to pin one source.';
+/** Run the real `gh` CLI with stdout captured (never logged). */
+export function runGhCli(args, signal) {
+    return new Promise((resolve, reject) => {
+        execFile('gh', args, { windowsHide: true, signal, maxBuffer: 1024 * 1024 }, (error, stdout) => {
+            if (error)
+                reject(error);
+            else
+                resolve({ stdout });
+        });
+    });
+}
+/**
+ * Resolve the GitHub token for one operation.
+ *
+ * `auto` order: credentials seam → `GITHUB_TOKEN`-style environment variable →
+ * `gh` CLI logged-in token. An explicit source restricts to that one source.
+ * @param credentials - the credentials seam (`ctx.credentials`).
+ * @param tokenSource - configured lookup policy.
+ * @param tokenRef - reference / environment-variable name.
+ * @param runGh - `gh` CLI runner; the real one by default.
+ * @param signal - aborts the `gh` lookup.
+ * @returns the token with its source, or a structured error with guidance.
+ */
+export async function resolveToken(credentials, tokenSource, tokenRef, runGh = runGhCli, signal) {
+    const order = tokenSource === 'auto' ? ['credentials', 'env', 'gh'] : [tokenSource];
+    for (const source of order) {
+        if (source === 'credentials') {
+            let ref;
+            try {
+                ref = credentialRef(tokenRef);
+            }
+            catch {
+                return { ok: false, error: { code: 'no-token', message: `credential ref "${tokenRef}" is not a valid identifier`, guidance: NO_TOKEN_GUIDANCE } };
+            }
+            const resolved = await credentials.resolve(ref);
+            if (resolved)
+                return { ok: true, token: { value: resolved.value, source: 'credentials' } };
+            continue;
+        }
+        if (source === 'env') {
+            const value = process.env[tokenRef];
+            if (value && value.length > 0)
+                return { ok: true, token: { value, source: 'env' } };
+            continue;
+        }
+        try {
+            const { stdout } = await runGh(['auth', 'token'], signal);
+            const value = stdout.trim();
+            if (value.length > 0)
+                return { ok: true, token: { value, source: 'gh' } };
+        }
+        catch {
+            // gh missing or not logged in: fall through to the structured error.
+        }
+    }
+    return {
+        ok: false,
+        error: {
+            code: 'no-token',
+            message: `no GitHub token found (source: ${tokenSource === 'auto' ? 'credentials/env/gh' : tokenSource})`,
+            guidance: NO_TOKEN_GUIDANCE,
+        },
+    };
+}
+//# sourceMappingURL=credential.js.map

package/lib/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../src/credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAA;AAE5D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAqB7C,MAAM,iBAAiB,GACrB,yEAAyE;IACzE,2EAA2E;IAC3E,uFAAuF,CAAA;AAEzF,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,IAAc,EAAE,MAAoB;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC5F,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAA;;gBACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;QAC1B,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAA+B,EAC/B,WAAwB,EACxB,QAAgB,EAChB,QAAkB,QAAQ,EAC1B,MAAoB;IAEpB,MAAM,KAAK,GACT,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IAEvE,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,IAAI,GAAqC,CAAA;YACzC,IAAI,CAAC;gBACH,GAAG,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,QAAQ,6BAA6B,EAAE,QAAQ,EAAE,iBAAiB,EAAE,EAAE,CAAA;YACnJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC/C,IAAI,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,CAAA;YAC1F,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YACnC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAA;YACnF,SAAQ;QACV,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;YACzD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,kCAAkC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,WAAW,GAAG;YACzG,QAAQ,EAAE,iBAAiB;SAC5B;KACF,CAAA;AACH,CAAC"}