@reneturcios/greenlight 0.8.2 → 0.9.1

package/dist/proxy.js

@@ -0,0 +1,111 @@
+/**
+ * `greenlight proxy`: a tiny localhost forwarder that attaches the user's
+ * GitHub token server-side. Greenlight's own reads are unauthenticated at
+ * 60/hr on the shared anonymous quota; the proxy lifts a user's setup to
+ * the authenticated 5000/hr budget without their token ever touching a
+ * browser, a log, or a tool's arguments beyond one env var.
+ *
+ *   export GITHUB_TOKEN=<classic-token>
+ *   greenlight proxy &            # default 127.0.0.1:8792
+ *   export GREENLIGHT_GITHUB_BASE_URL=http://127.0.0.1:8792 GITHUB_TOKEN=proxy
+ *
+ * Security model, stated plainly: the token is read once at startup from
+ * GITHUB_TOKEN (or GH_TOKEN) and is never logged, never stored, and never
+ * echoed. Incoming Authorization headers are ignored so a stray value
+ * cannot leak through. The server binds 127.0.0.1 only, and it forwards
+ * to exactly one upstream: https://api.github.com. Absolute-form request
+ * targets (http://...) are rejected so the proxy cannot be aimed at other
+ * hosts.
+ */
+import { createServer, request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+export const PROXY_DEFAULT_PORT = 8792;
+export const PROXY_UPSTREAM = "https://api.github.com";
+/** The exact client env line the command prints on startup. */
+export function proxyClientEnv(port) {
+    return `GREENLIGHT_GITHUB_BASE_URL=http://127.0.0.1:${port} GITHUB_TOKEN=proxy`;
+}
+/**
+ * Read the proxy configuration from the environment. Pure: returns the
+ * config or the human-readable refusal, and never the token on the
+ * refusal path either.
+ */
+export function resolveProxyConfig(env, port = PROXY_DEFAULT_PORT, upstream = PROXY_UPSTREAM) {
+    const tokenVar = env.GITHUB_TOKEN ? "GITHUB_TOKEN" : env.GH_TOKEN ? "GH_TOKEN" : undefined;
+    const token = tokenVar ? env[tokenVar] : undefined;
+    if (!tokenVar || !token) {
+        return {
+            error: "greenlight proxy needs a token: export GITHUB_TOKEN=<your-classic-token> first " +
+                "(a classic personal access token; no scopes needed for public repos). The token is read once at startup and never logged or stored.",
+        };
+    }
+    return { token, tokenVar, port, upstream };
+}
+function forwardRequest(upstream, token, clientReq, clientRes) {
+    const target = clientReq.url ?? "/";
+    // Absolute-form targets would let a client aim the proxy at another
+    // host; refuse them outright.
+    if (/^https?:\/\//i.test(target)) {
+        clientRes.writeHead(400, { "content-type": "text/plain" });
+        clientRes.end("greenlight proxy: absolute-form request targets are rejected");
+        return;
+    }
+    const upstreamUrl = new URL(target, upstream);
+    const useHttps = upstreamUrl.protocol === "https:";
+    const doRequest = useHttps ? httpsRequest : httpRequest;
+    const headers = { ...clientReq.headers };
+    delete headers["authorization"];
+    delete headers["host"];
+    delete headers["connection"];
+    // The whole point: attach the startup token server-side.
+    headers["authorization"] = `Bearer ${token}`;
+    const upstreamReq = doRequest({
+        protocol: upstreamUrl.protocol,
+        hostname: upstreamUrl.hostname,
+        port: upstreamUrl.port || (useHttps ? 443 : 80),
+        path: upstreamUrl.pathname + upstreamUrl.search,
+        method: clientReq.method,
+        headers: headers,
+    }, (upstreamRes) => {
+        const out = {};
+        for (const [k, v] of Object.entries(upstreamRes.headers)) {
+            if (k.toLowerCase() === "transfer-encoding")
+                continue;
+            out[k] = v;
+        }
+        clientRes.writeHead(upstreamRes.statusCode ?? 502, out);
+        upstreamRes.pipe(clientRes);
+    });
+    upstreamReq.on("error", () => {
+        if (!clientRes.headersSent)
+            clientRes.writeHead(502, { "content-type": "text/plain" });
+        clientRes.end("greenlight proxy: upstream unreachable");
+    });
+    upstreamReq.setTimeout(60000, () => upstreamReq.destroy(new Error("upstream timeout")));
+    clientReq.pipe(upstreamReq);
+}
+/**
+ * Start the proxy. Resolves when the socket is bound; the returned stop()
+ * drains it. The token travels only in the Authorization header toward the
+ * fixed upstream.
+ */
+export async function startProxy(config) {
+    const server = createServer((req, res) => forwardRequest(config.upstream, config.token, req, res));
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(config.port, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : config.port;
+    return {
+        server,
+        port,
+        stop: () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAA0D,MAAM,WAAW,CAAC;AACzH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEvD,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,+CAA+C,IAAI,qBAAqB,CAAC;AAClF,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAsB,EAAE,IAAI,GAAG,kBAAkB,EAAE,QAAQ,GAAG,cAAc;IAC7G,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EACH,iFAAiF;gBACjF,qIAAqI;SACxI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAQD,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa,EAAE,SAA0B,EAAE,SAAyB;IAC5G,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;IACpC,oEAAoE;IACpE,8BAA8B;IAC9B,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,MAAM,OAAO,GAAkD,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IACxF,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7B,yDAAyD;IACzD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,SAAS,CAC3B;QACE,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM;QAC/C,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,OAA4C;KACtD,EACD,CAAC,WAAW,EAAE,EAAE;QACd,MAAM,GAAG,GAAkD,EAAE,CAAC;QAC9D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,mBAAmB;gBAAE,SAAS;YACtD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;QACD,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,GAAG,EAAE,GAAwC,CAAC,CAAC;QAC7F,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CACF,CAAC;IACF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,IAAI,CAAC,SAAS,CAAC,WAAW;YAAE,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,SAAS,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACxF,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAmB;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACjF,OAAO;QACL,MAAM;QACN,IAAI;QACJ,IAAI,EAAE,GAAG,EAAE,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/scout.d.ts

@@ -0,0 +1,114 @@
+import { type MergeVelocityStats } from "./merge-velocity.js";
+import type { FrictionReport } from "./types.js";
+/** One row of the campaign file. */
+export interface CampaignEntry {
+    repo: string;
+    issue: number;
+    status: string;
+    pr?: string | null;
+    /** Verdict at scout time. */
+    verdict?: string;
+    /** One-line evidence summary at scout time. */
+    evidence?: string;
+    scannedAt?: string;
+}
+export interface ScoutCursor {
+    /** Index into the repo list where the next run should resume. */
+    repoIndex: number;
+}
+export interface CampaignFile {
+    entries: CampaignEntry[];
+    cursor: ScoutCursor | null;
+}
+export declare function loadCampaignFile(path: string): CampaignFile;
+export declare function saveCampaignFile(path: string, campaign: CampaignFile): void;
+export declare function campaignExists(path: string): boolean;
+/** True when the issue is already tracked in ANY status. */
+export declare function campaignHas(campaign: CampaignFile, repo: string, issue: number): boolean;
+export interface ScoutCandidate {
+    repo: string;
+    number: number;
+    title: string;
+    url: string;
+    verdict: "GO" | "RISKY";
+    reasons: string[];
+    flags: string[];
+    updatedAt: string;
+    friction: number;
+    outsideMergeShare: number;
+    medianMergeDays: number;
+    /** Rank score: higher ranks first. */
+    score: number;
+}
+/**
+ * Pure ranking: the documented formula. Friction and velocity inputs are
+ * per-repo (fetched once per repo); verdict strength and freshness are
+ * per-issue.
+ */
+export declare function rankCandidates(candidates: Array<{
+    repo: string;
+    number: number;
+    title: string;
+    url: string;
+    verdict: "GO" | "RISKY";
+    reasons: string[];
+    flags: string[];
+    updatedAt: string;
+}>, repoSignals: {
+    friction: number;
+    outsideMergeShare: number;
+    medianMergeDays: number;
+}, now: Date): ScoutCandidate[];
+export interface ScannedIssue {
+    number: number;
+    title: string;
+    url: string;
+    verdict: string;
+    reasons: string[];
+    flags: string[];
+    updatedAt: string;
+}
+export interface ScoutDeps {
+    /** List open issues for a repo (newest first). */
+    listIssues?: (owner: string, repo: string, limit: number) => Promise<ScannedIssue[]>;
+    /** The per-issue pipeline (defaults to the check pipeline). */
+    scanIssue?: (owner: string, repo: string, number: number) => Promise<ScannedIssue>;
+    friction?: (owner: string, repo: string) => Promise<FrictionReport>;
+    velocity?: (owner: string, repo: string) => Promise<MergeVelocityStats | null>;
+    /** How many API calls have been used so far. */
+    budgetUsed?: () => number;
+    now?: () => Date;
+}
+export interface ScoutOptions {
+    repos: string[];
+    campaignPath: string;
+    budget: number;
+    write: boolean;
+    /** Issues scanned per repo. */
+    scanLimit?: number;
+    /** Survivors kept per repo. */
+    keepPerRepo?: number;
+    deps?: ScoutDeps;
+    now?: Date;
+}
+export interface ScoutResult {
+    /** Ranked survivors across all processed repos. */
+    candidates: ScoutCandidate[];
+    /** Entries appended to the campaign file this run. */
+    appended: CampaignEntry[];
+    /** True when the run stopped on the budget. */
+    budgetHit: boolean;
+    /** Where the run stopped (or null when every repo completed). */
+    cursor: ScoutCursor | null;
+    /** Repos fully processed this run. */
+    reposProcessed: string[];
+    /** Repos skipped because the cursor had passed them or the budget hit. */
+    reposSkipped: string[];
+    apiCallsUsed: number;
+    markdown: string;
+    json: Record<string, unknown>;
+}
+export declare const SCOUT_DEFAULT_BUDGET = 300;
+export declare const SCOUT_DEFAULT_SCAN_LIMIT = 10;
+export declare const SCOUT_DEFAULT_KEEP_PER_REPO = 5;
+export declare function scoutCampaign(opts: ScoutOptions): Promise<ScoutResult>;

package/dist/scout.js

@@ -0,0 +1,266 @@
+/**
+ * Campaign scout mode (Greenlight v0.9.0): turn a list of repos into
+ * ranked campaign targets. For each repo it runs the same per-issue
+ * pipeline as check (legacy verdict + optional LLM layer + Claim
+ * Protocol), drops every issue already in the campaign file in ANY
+ * status, ranks the survivors, and (with --write) appends them as
+ * SCOUTED with their verdict and evidence summary.
+ *
+ * A --budget caps total GitHub API calls; when it hits, the campaign
+ * file keeps a resume cursor and the scout exits cleanly saying where
+ * it stopped. A rerun resumes from the cursor.
+ *
+ * Ranking formula (also documented in `greenlight scout --help`):
+ *
+ *   score = 30 * verdictWeight
+ *         + 0.25 * friction              (0..100, higher = easier)
+ *         + 20 * outsideMergeShare       (0..1)
+ *         + 15 / (1 + medianMergeDays / 14)
+ *         + 5 * freshness                (1 / (1 + daysSinceUpdated / 30))
+ *
+ *   verdictWeight: GO = 2, RISKY = 1 (other verdicts never reach ranking).
+ *
+ * Everything network-shaped comes in on ScoutDeps, so fixtures prove
+ * dedupe, ranking order, and budget stop + resume without touching the
+ * API.
+ */
+import { apiGet, apiCallsUsed } from "./github.js";
+import { checkIssueWithProtocol } from "./protocol-fetch.js";
+import { fetchFrictionSummary } from "./friction.js";
+import { fetchMergeVelocity } from "./merge-velocity.js";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+export function loadCampaignFile(path) {
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        if (parsed && typeof parsed === "object" && Array.isArray(parsed.entries)) {
+            return {
+                entries: parsed.entries,
+                cursor: parsed.cursor ?? null,
+            };
+        }
+    }
+    catch {
+        // Missing or broken: start empty.
+    }
+    return { entries: [], cursor: null };
+}
+export function saveCampaignFile(path, campaign) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(campaign, null, 2) + "\n", "utf8");
+}
+export function campaignExists(path) {
+    return existsSync(path);
+}
+/** True when the issue is already tracked in ANY status. */
+export function campaignHas(campaign, repo, issue) {
+    return campaign.entries.some((e) => e.repo.toLowerCase() === repo.toLowerCase() && e.issue === issue);
+}
+/* ------------------------------------------------------------------ */
+/* Ranking                                                             */
+/* ------------------------------------------------------------------ */
+const VERDICT_WEIGHT = { GO: 2, RISKY: 1 };
+/**
+ * Pure ranking: the documented formula. Friction and velocity inputs are
+ * per-repo (fetched once per repo); verdict strength and freshness are
+ * per-issue.
+ */
+export function rankCandidates(candidates, repoSignals, now) {
+    const out = [];
+    for (const c of candidates) {
+        const daysSinceUpdated = Math.max(0, (now.getTime() - new Date(c.updatedAt).getTime()) / 86400000);
+        const freshness = 1 / (1 + daysSinceUpdated / 30);
+        const score = 30 * (VERDICT_WEIGHT[c.verdict] ?? 0) +
+            0.25 * repoSignals.friction +
+            20 * repoSignals.outsideMergeShare +
+            15 / (1 + repoSignals.medianMergeDays / 14) +
+            5 * freshness;
+        out.push({
+            ...c,
+            friction: repoSignals.friction,
+            outsideMergeShare: repoSignals.outsideMergeShare,
+            medianMergeDays: repoSignals.medianMergeDays,
+            score,
+        });
+    }
+    out.sort((a, b) => b.score - a.score || a.number - b.number);
+    return out;
+}
+async function defaultListIssues(owner, repo, limit) {
+    const q = encodeURIComponent(`repo:${owner}/${repo} type:issue state:open sort:updated-desc`);
+    const data = (await apiGet(`/search/issues?q=${q}&per_page=${limit}`));
+    return (data.items ?? []).map((i) => ({
+        number: Number(i.number),
+        title: String(i.title ?? ""),
+        url: String(i.html_url ?? `https://github.com/${owner}/${repo}/issues/${i.number}`),
+        verdict: "",
+        reasons: [],
+        flags: [],
+        updatedAt: String(i.updated_at ?? new Date(0).toISOString()),
+    }));
+}
+async function defaultScanIssue(owner, repo, number) {
+    const { snapshot, merged } = await checkIssueWithProtocol(owner, repo, number, {});
+    return {
+        number,
+        title: snapshot.title,
+        url: snapshot.sourceUrl,
+        verdict: merged.verdict,
+        reasons: merged.reasons,
+        flags: merged.flags,
+        updatedAt: snapshot.updatedAt,
+    };
+}
+function parseRepoRef(ref) {
+    const m = /^([^/]+)\/([^/]+)$/.exec(ref.trim());
+    return m ? { owner: m[1], repo: m[2] } : null;
+}
+export const SCOUT_DEFAULT_BUDGET = 300;
+export const SCOUT_DEFAULT_SCAN_LIMIT = 10;
+export const SCOUT_DEFAULT_KEEP_PER_REPO = 5;
+export async function scoutCampaign(opts) {
+    const deps = opts.deps ?? {};
+    const now = opts.now ?? new Date();
+    const scanLimit = opts.scanLimit ?? SCOUT_DEFAULT_SCAN_LIMIT;
+    const keepPerRepo = opts.keepPerRepo ?? SCOUT_DEFAULT_KEEP_PER_REPO;
+    const budgetUsed = deps.budgetUsed ?? apiCallsUsed;
+    const listIssues = deps.listIssues ?? defaultListIssues;
+    const scanIssue = deps.scanIssue ?? defaultScanIssue;
+    const friction = deps.friction ?? fetchFrictionSummary;
+    const velocity = deps.velocity ?? fetchMergeVelocity;
+    const campaign = loadCampaignFile(opts.campaignPath);
+    const resumeAt = campaign.cursor?.repoIndex ?? 0;
+    const candidates = [];
+    const appended = [];
+    const reposProcessed = [];
+    const reposSkipped = [];
+    let budgetHit = false;
+    let stoppedAt = null;
+    for (let i = 0; i < opts.repos.length; i++) {
+        if (i < resumeAt) {
+            reposSkipped.push(opts.repos[i]);
+            continue;
+        }
+        if (budgetUsed() >= opts.budget) {
+            budgetHit = true;
+            stoppedAt = i;
+            reposSkipped.push(...opts.repos.slice(i));
+            break;
+        }
+        const ref = parseRepoRef(opts.repos[i]);
+        if (!ref) {
+            reposSkipped.push(opts.repos[i]);
+            continue;
+        }
+        const repoTag = `${ref.owner}/${ref.repo}`;
+        const raw = await listIssues(ref.owner, ref.repo, scanLimit);
+        const ranked = [];
+        // Fetch repo-level ranking inputs once per repo, in parallel with the
+        // first issue's verdict only when needed: keep the budget check cheap
+        // by doing friction/velocity up front (2 calls) then the issues.
+        const [frictionReport, mergeVelocity] = await Promise.all([
+            friction(ref.owner, ref.repo).catch(() => null),
+            velocity(ref.owner, ref.repo).catch(() => null),
+        ]);
+        const repoSignals = {
+            friction: frictionReport?.score ?? 50,
+            outsideMergeShare: mergeVelocity?.externalShare ?? 0,
+            medianMergeDays: mergeVelocity?.medianMergeDays ?? 14,
+        };
+        const issues = [];
+        for (const item of raw) {
+            if (budgetUsed() >= opts.budget) {
+                budgetHit = true;
+                break;
+            }
+            try {
+                issues.push(await scanIssue(ref.owner, ref.repo, item.number));
+            }
+            catch {
+                // One bad issue never kills the repo scan.
+            }
+        }
+        if (budgetHit) {
+            stoppedAt = i;
+            reposSkipped.push(...opts.repos.slice(i + 1));
+            // The survivors already found for this repo are kept in memory and
+            // reported; the cursor restarts at this repo so the rerun rescans
+            // it (the campaign dedupe keeps appended entries idempotent).
+        }
+        const survivors = issues.filter((s) => (s.verdict === "GO" || s.verdict === "RISKY") &&
+            !campaignHas(campaign, repoTag, s.number) &&
+            !appended.some((a) => a.repo.toLowerCase() === repoTag.toLowerCase() && a.issue === s.number));
+        const withRepo = survivors.map((s) => ({ ...s, repo: repoTag, verdict: s.verdict }));
+        for (const c of rankCandidates(withRepo, repoSignals, now).slice(0, keepPerRepo)) {
+            ranked.push(c);
+        }
+        candidates.push(...ranked);
+        reposProcessed.push(repoTag);
+    }
+    candidates.sort((a, b) => b.score - a.score || a.number - b.number);
+    const cursor = budgetHit && stoppedAt !== null ? { repoIndex: stoppedAt } : null;
+    if (opts.write) {
+        for (const c of candidates) {
+            const evidence = c.reasons[0] ?? "";
+            const entry = {
+                repo: c.repo,
+                issue: c.number,
+                status: "SCOUTED",
+                pr: null,
+                verdict: c.verdict,
+                evidence: evidence.length > 160 ? evidence.slice(0, 160) + "..." : evidence,
+                scannedAt: now.toISOString(),
+            };
+            appended.push(entry);
+            if (!campaignHas(campaign, c.repo, c.number))
+                campaign.entries.push(entry);
+        }
+        campaign.cursor = cursor;
+        saveCampaignFile(opts.campaignPath, campaign);
+    }
+    const lines = [];
+    lines.push(`**Campaign scout: ${candidates.length} survivors from ${reposProcessed.length} repos**${budgetHit ? ` — budget hit (${opts.budget} calls), stopped at repo ${stoppedAt !== null ? opts.repos[stoppedAt] : "?"}` : ""}`);
+    if (budgetHit)
+        lines.push(`_Resume cursor saved in the campaign file: rerun the same command to continue._`);
+    lines.push("");
+    for (const c of candidates) {
+        lines.push(`- **${c.repo}#${c.number}** "${c.title.slice(0, 70)}" — ${c.verdict} (score ${c.score.toFixed(1)})`);
+        lines.push(`  ${c.url}`);
+    }
+    if (candidates.length === 0)
+        lines.push("_None._");
+    lines.push("");
+    lines.push(`_Scout v0.9.0; budget ${budgetUsed()} calls used of ${opts.budget}._`);
+    return {
+        candidates,
+        appended,
+        budgetHit,
+        cursor,
+        reposProcessed,
+        reposSkipped,
+        apiCallsUsed: budgetUsed(),
+        markdown: lines.join("\n"),
+        json: {
+            candidates: candidates.map((c) => ({
+                repo: c.repo,
+                issue: c.number,
+                title: c.title,
+                url: c.url,
+                verdict: c.verdict,
+                score: c.score,
+                friction: c.friction,
+                outsideMergeShare: c.outsideMergeShare,
+                medianMergeDays: c.medianMergeDays,
+                reasons: c.reasons,
+                flags: c.flags,
+            })),
+            appended: appended.length,
+            budgetHit,
+            cursor,
+            reposProcessed,
+            reposSkipped,
+            apiCallsUsed: budgetUsed(),
+        },
+    };
+}
+//# sourceMappingURL=scout.js.map

package/dist/scout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scout.js","sourceRoot":"","sources":["../src/scout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAA2B,MAAM,qBAAqB,CAAC;AAElF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BpC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC;QAC/E,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,OAA0B;gBAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;aAC9B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kCAAkC;IACpC,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,QAAsB;IACnE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,QAAsB,EAAE,IAAY,EAAE,KAAa;IAC7E,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CACxE,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AAExE,MAAM,cAAc,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAkBnE;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,UASE,EACF,WAAqF,EACrF,GAAS;IAET,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAC/B,CAAC,EACD,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,QAAQ,CAC7D,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,GACT,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,GAAG,WAAW,CAAC,QAAQ;YAC3B,EAAE,GAAG,WAAW,CAAC,iBAAiB;YAClC,EAAE,GAAG,CAAC,CAAC,GAAG,WAAW,CAAC,eAAe,GAAG,EAAE,CAAC;YAC3C,CAAC,GAAG,SAAS,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,CAAC;YACJ,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,iBAAiB,EAAE,WAAW,CAAC,iBAAiB;YAChD,eAAe,EAAE,WAAW,CAAC,eAAe;YAC5C,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAkED,KAAK,UAAU,iBAAiB,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa;IACzE,MAAM,CAAC,GAAG,kBAAkB,CAAC,QAAQ,KAAK,IAAI,IAAI,0CAA0C,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,aAAa,KAAK,EAAE,CAAC,CAAkC,CAAC;IACxG,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QACxB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,sBAAsB,KAAK,IAAI,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;QACnF,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;KAC7D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,IAAY,EAAE,MAAc;IACzE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO;QACL,MAAM;QACN,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,GAAG,EAAE,QAAQ,CAAC,SAAS;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AACxC,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,2BAA2B,CAAC;IACpE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IAErD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,SAAS,GAAkB,IAAI,CAAC;IAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YACjB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,IAAI,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS,GAAG,CAAC,CAAC;YACd,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM;QACR,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,sEAAsE;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,CAAC,cAAc,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACxD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;SAChD,CAAC,CAAC;QACH,MAAM,WAAW,GAAG;YAClB,QAAQ,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE;YACrC,iBAAiB,EAAE,aAAa,EAAE,aAAa,IAAI,CAAC;YACpD,eAAe,EAAE,aAAa,EAAE,eAAe,IAAI,EAAE;SACtD,CAAC;QAEF,MAAM,MAAM,GAAmB,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChC,SAAS,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,GAAG,CAAC,CAAC;YACd,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9C,mEAAmE;YACnE,kEAAkE;YAClE,8DAA8D;QAChE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;YAC7C,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;YACzC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC,CAChG,CAAC;QACF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAyB,EAAE,CAAC,CAAC,CAAC;QACvG,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;QAC3B,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpE,MAAM,MAAM,GAAuB,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrG,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,KAAK,GAAkB;gBAC3B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,MAAM;gBACf,MAAM,EAAE,SAAS;gBACjB,EAAE,EAAE,IAAI;gBACR,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAC3E,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;aAC7B,CAAC;YACF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;QACzB,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,MAAM,mBAAmB,cAAc,CAAC,MAAM,WAAW,SAAS,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,MAAM,4BAA4B,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpO,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IAC7G,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACjH,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,yBAAyB,UAAU,EAAE,kBAAkB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;IAEnF,OAAO;QACL,UAAU;QACV,QAAQ;QACR,SAAS;QACT,MAAM;QACN,cAAc;QACd,YAAY;QACZ,YAAY,EAAE,UAAU,EAAE;QAC1B,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,IAAI,EAAE;YACJ,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACjC,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,KAAK,EAAE,CAAC,CAAC,MAAM;gBACf,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;gBACtC,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,KAAK,EAAE,CAAC,CAAC,KAAK;aACf,CAAC,CAAC;YACH,QAAQ,EAAE,QAAQ,CAAC,MAAM;YACzB,SAAS;YACT,MAAM;YACN,cAAc;YACd,YAAY;YACZ,YAAY,EAAE,UAAU,EAAE;SAC3B;KACF,CAAC;AACJ,CAAC"}

package/dist/triage.d.ts

@@ -0,0 +1,23 @@
+export interface TriageHold {
+    held: boolean;
+    /** What caused the hold: the matched label, or the quoted bot notice. */
+    evidence: string;
+}
+export declare function hasTriageLabel(labels: string[] | undefined): string | undefined;
+export interface TriageComment {
+    author: string;
+    body: string;
+}
+export declare function hasTriageNoticeComment(comments: TriageComment[] | undefined): {
+    author: string;
+    quote: string;
+} | undefined;
+/**
+ * Detect a triage hold from an issue's labels and comments. Labels alone
+ * are enough (the cheap digest path); the bot-notice variant covers the
+ * comment case the verdict engine sees (mastra's dane-ai-mastra notice).
+ */
+export declare function detectTriageHold(args: {
+    labels?: string[];
+    comments?: TriageComment[];
+}): TriageHold;

package/dist/triage.js

@@ -0,0 +1,83 @@
+/**
+ * Triage-hold detection (Greenlight v0.9.0).
+ *
+ * Field case 2026-10-17: mastra-ai/mastra issues all carried a bot
+ * notice telling contributors to wait until maintainers remove the
+ * triage or approval label before opening a PR, and every one of them
+ * scored GO because the verdict engine had no gate kind for it. nuxt/nuxt
+ * uses a standing "pending triage" label with the same practical effect.
+ *
+ * A triage hold is not a claim and never produces TAKEN. It is a
+ * downgrade signal: the issue is real work that nobody is allowed to
+ * build yet, so GO caps at RISKY with the hold named, and scan/digest
+ * treat held issues as future pipeline rather than current targets.
+ */
+import { isBotAuthor } from "./claims.js";
+/** Label texts that mean "do not build yet" (compared case-insensitively). */
+const TRIAGE_LABELS = new Set([
+    "needs triage",
+    "pending triage",
+    "status: needs triage",
+    "needs-triage",
+    "triage needed",
+    "awaiting triage",
+    "triage",
+]);
+/**
+ * Bot triage notices: a comment telling contributors to wait for triage
+ * before opening a PR. Anchored on the "wait ... before opening a pull
+ * request" shape mastra's bot uses, plus the label-clearance variant.
+ */
+const TRIAGE_NOTICE_RES = [
+    /wait until.{0,120}(triage|approval).{0,60}label.{0,60}before (opening|submitting)/i,
+    /before (opening|submitting) (a )?pull request.{0,80}(until|unless).{0,80}triag/i,
+    /do not open.{0,60}pull request.{0,60}(until|before).{0,60}triag/i,
+];
+export function hasTriageLabel(labels) {
+    if (!labels)
+        return undefined;
+    for (const label of labels) {
+        const norm = label.trim().toLowerCase();
+        if (TRIAGE_LABELS.has(norm))
+            return label;
+    }
+    return undefined;
+}
+export function hasTriageNoticeComment(comments) {
+    if (!comments)
+        return undefined;
+    for (const c of comments) {
+        // Triage notices come from bots (mastra's dane-ai-mastra[bot]) or from
+        // maintainer-named accounts. A random human matching the notice shape
+        // is almost always quoting the bot, not issuing a hold.
+        if (!isBotAuthor(c.author) && !/maintainer|owner/i.test(c.author))
+            continue;
+        const re = TRIAGE_NOTICE_RES.find((r) => r.test(c.body));
+        if (!re)
+            continue;
+        const match = re.exec(c.body);
+        const quote = match ? match[0].replace(/\s+/g, " ").trim().slice(0, 140) : "";
+        return { author: c.author, quote };
+    }
+    return undefined;
+}
+/**
+ * Detect a triage hold from an issue's labels and comments. Labels alone
+ * are enough (the cheap digest path); the bot-notice variant covers the
+ * comment case the verdict engine sees (mastra's dane-ai-mastra notice).
+ */
+export function detectTriageHold(args) {
+    const label = hasTriageLabel(args.labels);
+    if (label) {
+        return { held: true, evidence: `label "${label}" means the issue is still in triage; do not build until it clears` };
+    }
+    const notice = hasTriageNoticeComment(args.comments);
+    if (notice) {
+        return {
+            held: true,
+            evidence: `triage notice from @${notice.author}: "${notice.quote}"`,
+        };
+    }
+    return { held: false, evidence: "" };
+}
+//# sourceMappingURL=triage.js.map

package/dist/triage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../src/triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,cAAc;IACd,gBAAgB;IAChB,sBAAsB;IACtB,cAAc;IACd,eAAe;IACf,iBAAiB;IACjB,QAAQ;CACT,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG;IACxB,oFAAoF;IACpF,iFAAiF;IACjF,kEAAkE;CACnE,CAAC;AAQF,MAAM,UAAU,cAAc,CAAC,MAA4B;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD,MAAM,UAAU,sBAAsB,CAAC,QAAqC;IAC1E,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,uEAAuE;QACvE,sEAAsE;QACtE,wDAAwD;QACxD,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QAC5E,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAGhC;IACC,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,KAAK,oEAAoE,EAAE,CAAC;IACvH,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,IAAI;YACV,QAAQ,EAAE,uBAAuB,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,KAAK,GAAG;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC"}

package/dist/types.d.ts

@@ -143,7 +143,23 @@ export type GateKind = "assignment_required" | "claim_first" | "vouch_required"
  * A repo workflow closes external PRs automatically ("Close external
  * PRs" style), the sharp end of the paused-PR policy above.
  */
- | "external_prs_closed";
+ | "external_prs_closed"
+/**
+ * The repo bans autonomous-agent contributions outright, usually in
+ * AGENTS.md or CLAUDE.md rather than CONTRIBUTING (nuxt/nuxt's
+ * AGENTS.md: "Contributions may only be submitted by a human who
+ * fully understands them... autonomous agents are not allowed"). This
+ * is a hard block for anyone working through an agent: only a human
+ * may submit. Never satisfied by tooling; claim refuses.
+ */
+ | "agents_banned"
+/**
+ * The repo permits agent-assisted work but requires disclosure, often
+ * plus an [AI] prefix on PR titles and commits (actualbudget/actual's
+ * AI Usage Policy + AGENTS.md). A flag, never a verdict change: prep
+ * turns it into concrete required actions.
+ */
+ | "agents_disclosure";
 /** Another issue this one is marked a duplicate of, with its live state. */
 export interface DuplicateTarget {
     number: number;