@reneturcios/greenlight 0.9.0 → 0.9.1

package/dist/proxy.js

@@ -0,0 +1,111 @@
+/**
+ * `greenlight proxy`: a tiny localhost forwarder that attaches the user's
+ * GitHub token server-side. Greenlight's own reads are unauthenticated at
+ * 60/hr on the shared anonymous quota; the proxy lifts a user's setup to
+ * the authenticated 5000/hr budget without their token ever touching a
+ * browser, a log, or a tool's arguments beyond one env var.
+ *
+ *   export GITHUB_TOKEN=<classic-token>
+ *   greenlight proxy &            # default 127.0.0.1:8792
+ *   export GREENLIGHT_GITHUB_BASE_URL=http://127.0.0.1:8792 GITHUB_TOKEN=proxy
+ *
+ * Security model, stated plainly: the token is read once at startup from
+ * GITHUB_TOKEN (or GH_TOKEN) and is never logged, never stored, and never
+ * echoed. Incoming Authorization headers are ignored so a stray value
+ * cannot leak through. The server binds 127.0.0.1 only, and it forwards
+ * to exactly one upstream: https://api.github.com. Absolute-form request
+ * targets (http://...) are rejected so the proxy cannot be aimed at other
+ * hosts.
+ */
+import { createServer, request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+export const PROXY_DEFAULT_PORT = 8792;
+export const PROXY_UPSTREAM = "https://api.github.com";
+/** The exact client env line the command prints on startup. */
+export function proxyClientEnv(port) {
+    return `GREENLIGHT_GITHUB_BASE_URL=http://127.0.0.1:${port} GITHUB_TOKEN=proxy`;
+}
+/**
+ * Read the proxy configuration from the environment. Pure: returns the
+ * config or the human-readable refusal, and never the token on the
+ * refusal path either.
+ */
+export function resolveProxyConfig(env, port = PROXY_DEFAULT_PORT, upstream = PROXY_UPSTREAM) {
+    const tokenVar = env.GITHUB_TOKEN ? "GITHUB_TOKEN" : env.GH_TOKEN ? "GH_TOKEN" : undefined;
+    const token = tokenVar ? env[tokenVar] : undefined;
+    if (!tokenVar || !token) {
+        return {
+            error: "greenlight proxy needs a token: export GITHUB_TOKEN=<your-classic-token> first " +
+                "(a classic personal access token; no scopes needed for public repos). The token is read once at startup and never logged or stored.",
+        };
+    }
+    return { token, tokenVar, port, upstream };
+}
+function forwardRequest(upstream, token, clientReq, clientRes) {
+    const target = clientReq.url ?? "/";
+    // Absolute-form targets would let a client aim the proxy at another
+    // host; refuse them outright.
+    if (/^https?:\/\//i.test(target)) {
+        clientRes.writeHead(400, { "content-type": "text/plain" });
+        clientRes.end("greenlight proxy: absolute-form request targets are rejected");
+        return;
+    }
+    const upstreamUrl = new URL(target, upstream);
+    const useHttps = upstreamUrl.protocol === "https:";
+    const doRequest = useHttps ? httpsRequest : httpRequest;
+    const headers = { ...clientReq.headers };
+    delete headers["authorization"];
+    delete headers["host"];
+    delete headers["connection"];
+    // The whole point: attach the startup token server-side.
+    headers["authorization"] = `Bearer ${token}`;
+    const upstreamReq = doRequest({
+        protocol: upstreamUrl.protocol,
+        hostname: upstreamUrl.hostname,
+        port: upstreamUrl.port || (useHttps ? 443 : 80),
+        path: upstreamUrl.pathname + upstreamUrl.search,
+        method: clientReq.method,
+        headers: headers,
+    }, (upstreamRes) => {
+        const out = {};
+        for (const [k, v] of Object.entries(upstreamRes.headers)) {
+            if (k.toLowerCase() === "transfer-encoding")
+                continue;
+            out[k] = v;
+        }
+        clientRes.writeHead(upstreamRes.statusCode ?? 502, out);
+        upstreamRes.pipe(clientRes);
+    });
+    upstreamReq.on("error", () => {
+        if (!clientRes.headersSent)
+            clientRes.writeHead(502, { "content-type": "text/plain" });
+        clientRes.end("greenlight proxy: upstream unreachable");
+    });
+    upstreamReq.setTimeout(60000, () => upstreamReq.destroy(new Error("upstream timeout")));
+    clientReq.pipe(upstreamReq);
+}
+/**
+ * Start the proxy. Resolves when the socket is bound; the returned stop()
+ * drains it. The token travels only in the Authorization header toward the
+ * fixed upstream.
+ */
+export async function startProxy(config) {
+    const server = createServer((req, res) => forwardRequest(config.upstream, config.token, req, res));
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(config.port, "127.0.0.1", () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    const address = server.address();
+    const port = typeof address === "object" && address ? address.port : config.port;
+    return {
+        server,
+        port,
+        stop: () => new Promise((resolve, reject) => {
+            server.close((err) => (err ? reject(err) : resolve()));
+        }),
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAA0D,MAAM,WAAW,CAAC;AACzH,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEvD,+DAA+D;AAC/D,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,+CAA+C,IAAI,qBAAqB,CAAC;AAClF,CAAC;AASD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAsB,EAAE,IAAI,GAAG,kBAAkB,EAAE,QAAQ,GAAG,cAAc;IAC7G,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,KAAK,EACH,iFAAiF;gBACjF,qIAAqI;SACxI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAQD,SAAS,cAAc,CAAC,QAAgB,EAAE,KAAa,EAAE,SAA0B,EAAE,SAAyB;IAC5G,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,CAAC;IACpC,oEAAoE;IACpE,8BAA8B;IAC9B,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;IACxD,MAAM,OAAO,GAAkD,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;IACxF,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7B,yDAAyD;IACzD,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,KAAK,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,SAAS,CAC3B;QACE,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,QAAQ,EAAE,WAAW,CAAC,QAAQ;QAC9B,IAAI,EAAE,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,IAAI,EAAE,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM;QAC/C,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,OAAO,EAAE,OAA4C;KACtD,EACD,CAAC,WAAW,EAAE,EAAE;QACd,MAAM,GAAG,GAAkD,EAAE,CAAC;QAC9D,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,mBAAmB;gBAAE,SAAS;YACtD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACb,CAAC;QACD,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,IAAI,GAAG,EAAE,GAAwC,CAAC,CAAC;QAC7F,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CACF,CAAC;IACF,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QAC3B,IAAI,CAAC,SAAS,CAAC,WAAW;YAAE,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;QACvF,SAAS,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACxF,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAmB;IAClD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IACjF,OAAO;QACL,MAAM;QACN,IAAI;QACJ,IAAI,EAAE,GAAG,EAAE,CACT,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/integrations/README.md

@@ -41,7 +41,7 @@ without it the tools still work but share the small anonymous budget.
 ## Verify it worked
 
 Ask the agent: "list your MCP tools." You should see the `greenlight`
-server with all 15 tools:
+server with all 17 tools:
 
 - `check_issue` — verdict on whether an issue is landable (GO / RISKY / TAKEN / GATED / STALE)
 - `scan_repo` — find starter issues worth working in a repo
@@ -58,6 +58,8 @@ server with all 15 tools:
 - `verify_comment` — draft the verified-finding comment for maintainer-only repos (draft only, never posts)
 - `babysit_prs` — watch your open PRs: one prioritized action list (needs you now, waiting on them, quiet), diffed against stored watermarks
 - `evidence_pack` — the Verified PR evidence pack for one PR: guard verdict, CI triage, review triage, protocol status of linked issues, every claim citing its source
+- `scout_campaign` — campaign mode: scan repos, rank survivors, append SCOUTED rows to a campaign file, budget-aware
+- `my_claims` — bucket your my-claims registry by live protocol status (linked, healthy-active, heartbeat-due, expiring, unlinked-stale, queue-lost)
 
 ## Format notes
 

package/integrations/claude-code/CLAUDE.snippet.md

@@ -7,9 +7,10 @@ your project's CLAUDE.md (or keep the file and reference it from CLAUDE.md).
 ## Greenlight: check before you open a PR
 
 You have the Greenlight MCP server connected (server name: greenlight,
-15 tools: check_issue, scan_repo, repo_friction, claim_issue, prep_issue,
+17 tools: check_issue, scan_repo, repo_friction, claim_issue, prep_issue,
 open_pr, ci_triage, review_triage, guard_pr, repo_digest, claim_status,
-preflight, verify_comment, babysit_prs, evidence_pack). It answers one
+preflight, verify_comment, babysit_prs, evidence_pack, scout_campaign,
+my_claims). It answers one
 question at every step: is this contribution worth doing, and is the
 problem mine?
 

package/integrations/cline/README.md

@@ -7,7 +7,7 @@ file form is:
 
 Copy the `cline_mcp_settings.json` file in this folder there (merging with
 any servers you already have), then check the Cline "MCP Servers" panel:
-the `greenlight` server should list 15 tools. The `disabled: false` field is
+the `greenlight` server should list 17 tools. The `disabled: false` field is
 Cline's way of keeping the server enabled without deleting it.
 
 Workflow: see the integrations README — your agent checks Greenlight

package/integrations/windsurf/README.md

@@ -6,7 +6,7 @@ Windsurf's global MCP config lives at:
 
 Copy the `mcp_config.json` file in this folder there (merging with any
 servers you already have), then restart Windsurf and check its MCP panel:
-the `greenlight` server should list 15 tools. Newer Windsurf versions also
+the `greenlight` server should list 17 tools. Newer Windsurf versions also
 accept a project-level `.windsurf/mcp.json` file using the same
 `mcpServers` format.
 

package/package.json

@@ -25,7 +25,7 @@
     "test": "tsx --test test/*.test.ts"
   },
   "type": "module",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "mcpName": "io.github.CloudCorpRecords/greenlight",
   "publishConfig": {
     "access": "public"

package/server.json

@@ -6,13 +6,13 @@
     "url": "https://github.com/CloudCorpRecords/greenlight",
     "source": "github"
   },
-  "version": "0.9.0",
+  "version": "0.9.1",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@reneturcios/greenlight",
-      "version": "0.9.0",
+      "version": "0.9.1",
       "runtimeHint": "npx",
       "packageArguments": [
         {