@shipfox/api-integration-github 12.7.0 → 14.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@shipfox/api-integration-github",
   "license": "MIT",
-  "version": "12.7.0",
+  "version": "14.0.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ShipfoxHQ/shipfox.git",
@@ -28,8 +28,8 @@
     "octokit": "^5.0.3",
     "zod": "^4.4.3",
     "@shipfox/api-auth-context": "12.2.0",
-    "@shipfox/api-integration-spi": "1.1.1",
-    "@shipfox/api-integration-github-dto": "12.2.0",
+    "@shipfox/api-integration-spi": "2.0.0",
+    "@shipfox/api-integration-github-dto": "14.0.0",
     "@shipfox/config": "1.2.4",
     "@shipfox/node-drizzle": "0.3.5",
     "@shipfox/node-fastify": "0.4.2",

package/src/api/client.test.ts

@@ -7,7 +7,15 @@ import {createGithubApiClient, mapGithubError} from './client.js';
 
 const GITHUB_INSTALLATION_TOKEN_PATTERN = /^ghs_[A-Za-z0-9._-]{36,}$/u;
 
-const {createInstallationAccessTokenMock, RequestErrorMock} = vi.hoisted(() => {
+const {
+  authMock,
+  createInstallationAccessTokenMock,
+  getByUsernameMock,
+  listRepositoryCommitsMock,
+  octokitOptionsMock,
+  requestMock,
+  RequestErrorMock,
+} = vi.hoisted(() => {
   class RequestErrorMock extends Error {
     constructor(
       message: string,
@@ -18,26 +26,207 @@ const {createInstallationAccessTokenMock, RequestErrorMock} = vi.hoisted(() => {
     }
   }
 
-  return {createInstallationAccessTokenMock: vi.fn(), RequestErrorMock};
+  return {
+    authMock: vi.fn(),
+    createInstallationAccessTokenMock: vi.fn(),
+    getByUsernameMock: vi.fn(),
+    listRepositoryCommitsMock: vi.fn(),
+    octokitOptionsMock: vi.fn(),
+    requestMock: vi.fn(),
+    RequestErrorMock,
+  };
 });
 
 vi.mock('octokit', () => ({
   App: class App {
     octokit = {
-      rest: {apps: {createInstallationAccessToken: createInstallationAccessTokenMock}},
+      auth: authMock,
+      rest: {
+        apps: {createInstallationAccessToken: createInstallationAccessTokenMock},
+        users: {getByUsername: getByUsernameMock},
+      },
     };
   },
-  Octokit: {
-    plugin() {
-      return this;
-    },
-    defaults(options: unknown) {
+  Octokit: class Octokit {
+    rest = {
+      repos: {listCommits: listRepositoryCommitsMock},
+      users: {getByUsername: getByUsernameMock},
+    };
+    request = requestMock;
+
+    constructor(options: unknown) {
+      octokitOptionsMock(options);
+    }
+
+    static plugin() {
+      return Octokit;
+    }
+
+    static defaults(options: unknown) {
       return {defaults: options};
-    },
+    }
   },
   RequestError: RequestErrorMock,
 }));
 
+describe('OctokitGithubApiClient.getBotUser', () => {
+  beforeEach(() => {
+    getByUsernameMock.mockReset();
+    octokitOptionsMock.mockReset();
+  });
+
+  it('shares one lookup for concurrent requests with the same token and caches the bot', async () => {
+    getByUsernameMock.mockResolvedValue({
+      data: {id: 307_629_549, login: 'shipfox-ai[bot]', type: 'Bot'},
+    });
+    const client = createGithubApiClient();
+
+    const firstLookup = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_first',
+    });
+    const secondLookup = client.getBotUser({
+      username: 'SHIPFOX-AI[BOT]',
+      installationAccessToken: 'ghs_first',
+    });
+    const [first, second] = await Promise.all([firstLookup, secondLookup]);
+    const cached = await client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_third',
+    });
+
+    expect(first).toEqual({id: 307_629_549, login: 'shipfox-ai[bot]'});
+    expect(second).toEqual(first);
+    expect(cached).toEqual(first);
+    expect(getByUsernameMock).toHaveBeenCalledTimes(1);
+    expect(getByUsernameMock).toHaveBeenCalledWith({
+      username: 'shipfox-ai[bot]',
+      request: {signal: expect.any(AbortSignal)},
+    });
+    expect(octokitOptionsMock).toHaveBeenCalledWith({
+      auth: 'ghs_first',
+      baseUrl: 'https://api.github.com',
+    });
+  });
+
+  it('does not share an in-flight lookup across installation tokens', async () => {
+    getByUsernameMock.mockResolvedValue({
+      data: {id: 307_629_549, login: 'shipfox-ai[bot]', type: 'Bot'},
+    });
+    const client = createGithubApiClient();
+
+    const firstLookup = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_first',
+    });
+    const secondLookup = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_second',
+    });
+
+    await expect(Promise.all([firstLookup, secondLookup])).resolves.toEqual([
+      {id: 307_629_549, login: 'shipfox-ai[bot]'},
+      {id: 307_629_549, login: 'shipfox-ai[bot]'},
+    ]);
+    expect(getByUsernameMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('evicts a failed lookup so a later request can retry', async () => {
+    getByUsernameMock
+      .mockRejectedValueOnce(new RequestErrorMock('GitHub unavailable', 503))
+      .mockResolvedValueOnce({
+        data: {id: 307_629_549, login: 'shipfox-ai[bot]', type: 'Bot'},
+      });
+    const client = createGithubApiClient();
+
+    const failed = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_first',
+    });
+    await expect(failed).rejects.toMatchObject({reason: 'provider-unavailable'});
+    const retried = await client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_second',
+    });
+
+    expect(retried).toEqual({id: 307_629_549, login: 'shipfox-ai[bot]'});
+    expect(getByUsernameMock).toHaveBeenCalledTimes(2);
+  });
+
+  it('maps a missing configured bot and retries after the username becomes available', async () => {
+    getByUsernameMock
+      .mockRejectedValueOnce(new RequestErrorMock('Not Found', 404))
+      .mockResolvedValueOnce({
+        data: {id: 307_629_549, login: 'shipfox-ai[bot]', type: 'Bot'},
+      });
+    const client = createGithubApiClient();
+
+    const missing = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_installationtoken',
+    });
+    await expect(missing).rejects.toMatchObject({
+      reason: 'provider-rejected',
+      message: 'Configured GitHub bot user shipfox-ai[bot] was not found',
+      status: 404,
+    });
+    const corrected = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_installationtoken',
+    });
+
+    await expect(corrected).resolves.toEqual({
+      id: 307_629_549,
+      login: 'shipfox-ai[bot]',
+    });
+    expect(getByUsernameMock).toHaveBeenCalledTimes(2);
+  });
+
+  it.each([
+    ['a null body', null, 'GitHub bot user response is missing required fields'],
+    [
+      'an empty login',
+      {id: 307_629_549, login: '', type: 'Bot'},
+      'GitHub bot user response is missing required fields',
+    ],
+    [
+      'a zero id',
+      {id: 0, login: 'shipfox-ai[bot]', type: 'Bot'},
+      'GitHub bot user response is missing required fields',
+    ],
+    [
+      'a negative id',
+      {id: -1, login: 'shipfox-ai[bot]', type: 'Bot'},
+      'GitHub bot user response is missing required fields',
+    ],
+    [
+      'a fractional id',
+      {id: 1.5, login: 'shipfox-ai[bot]', type: 'Bot'},
+      'GitHub bot user response is missing required fields',
+    ],
+    [
+      'a non-bot account',
+      {id: 307_629_549, login: 'shipfox-ai[bot]', type: 'User'},
+      'Configured GitHub username is not a bot account',
+    ],
+    [
+      'a different bot account',
+      {id: 307_629_549, login: 'another-app[bot]', type: 'Bot'},
+      'GitHub bot user response did not match the configured username',
+    ],
+  ])('rejects %s', async (_label, data, message) => {
+    getByUsernameMock.mockResolvedValue({data});
+    const client = createGithubApiClient();
+
+    const result = client.getBotUser({
+      username: 'shipfox-ai[bot]',
+      installationAccessToken: 'ghs_installationtoken',
+    });
+
+    await expect(result).rejects.toMatchObject({reason: 'malformed-provider-response', message});
+  });
+});
+
 describe('mapGithubError', () => {
   it.each([400, 409, 422])('maps HTTP %i to a terminal provider rejection', async (status) => {
     const error = new RequestErrorMock(`GitHub rejected request with HTTP ${status}`, status);
@@ -62,6 +251,75 @@ describe('mapGithubError', () => {
       status: 503,
     });
   });
+
+  it('maps a request timeout cause to timeout', async () => {
+    const timeout = new Error('The operation was aborted due to timeout');
+    timeout.name = 'TimeoutError';
+    const error = new RequestErrorMock('fetch failed', 500);
+    error.cause = timeout;
+
+    const result = mapGithubError(() => Promise.reject(error));
+
+    await expect(result).rejects.toMatchObject({
+      reason: 'timeout',
+      message: 'GitHub request timed out',
+    });
+  });
+});
+
+describe('OctokitGithubApiClient.listRepositoryCommits', () => {
+  beforeEach(() => {
+    authMock.mockReset();
+    listRepositoryCommitsMock.mockReset();
+    requestMock.mockReset();
+  });
+
+  it.each([
+    [404, 'repository-not-found'],
+    [409, 'ref-not-found'],
+    [422, 'ref-not-found'],
+  ] as const)('maps HTTP %i commit lookup failures to %s', async (status, reason) => {
+    authMock.mockResolvedValue({token: 'ghs_installationtoken'});
+    requestMock.mockResolvedValue({
+      data: {
+        id: 42,
+        owner: {login: 'shipfox'},
+        name: 'platform',
+        full_name: 'shipfox/platform',
+        default_branch: 'main',
+        private: true,
+        clone_url: 'https://github.com/shipfox/platform.git',
+        html_url: 'https://github.com/shipfox/platform',
+      },
+    });
+    listRepositoryCommitsMock.mockRejectedValue(
+      new RequestErrorMock('No commit found for SHA', status),
+    );
+    const client = createGithubApiClient();
+
+    const result = client.listRepositoryCommits({
+      installationId: 1,
+      repositoryId: 42,
+      ref: 'refs/heads/missing',
+    });
+
+    await expect(result).rejects.toMatchObject({
+      reason,
+      status,
+      message: 'No commit found for SHA',
+    });
+    expect(requestMock).toHaveBeenCalledWith('GET /repositories/{repository_id}', {
+      repository_id: 42,
+      request: {signal: expect.any(AbortSignal)},
+    });
+    expect(listRepositoryCommitsMock).toHaveBeenCalledWith({
+      owner: 'shipfox',
+      repo: 'platform',
+      sha: 'refs/heads/missing',
+      per_page: 1,
+      request: {signal: expect.any(AbortSignal)},
+    });
+  });
 });
 
 describe('OctokitGithubApiClient.createInstallationAccessToken', () => {

package/src/api/client.ts

@@ -1,5 +1,6 @@
 import {Buffer} from 'node:buffer';
-import {MAX_REPOSITORY_FILE_BYTES} from '@shipfox/api-integration-spi';
+import {isRecord, MAX_REPOSITORY_FILE_BYTES} from '@shipfox/api-integration-spi';
+import {logger} from '@shipfox/node-opentelemetry';
 import ky, {HTTPError, TimeoutError} from 'ky';
 import {App, Octokit, RequestError} from 'octokit';
 import {config, normalizedGithubApiBaseUrl, normalizedGithubPrivateKey} from '#config.js';
@@ -13,6 +14,7 @@ import {
 const NEXT_PAGE_RE = /[?&]page=(\d+)/;
 const TRAILING_SLASHES_RE = /\/+$/;
 const MAX_TREE_WALK_DEPTH = 10;
+const GITHUB_API_TIMEOUT_MS = 10_000;
 
 export interface GithubAccount {
   login: string;
@@ -61,12 +63,25 @@ export interface GithubFileContent {
   size: number;
 }
 
+export interface GithubCommit {
+  sha: string;
+}
+
 export interface GithubUserInstallationPage {
   installationIds: number[];
   nextCursor: string | null;
 }
 
-export interface GithubApiClient {
+export interface GithubBotUser {
+  id: number;
+  login: string;
+}
+
+export interface GithubBotUserClient {
+  getBotUser(input: {username: string; installationAccessToken: string}): Promise<GithubBotUser>;
+}
+
+export interface GithubApiClient extends Partial<GithubBotUserClient> {
   exchangeOAuthCode(code: string): Promise<string>;
   listUserInstallations(input: {
     userAccessToken: string;
@@ -93,6 +108,11 @@ export interface GithubApiClient {
     ref: string;
     path: string;
   }): Promise<GithubFileContent>;
+  listRepositoryCommits(input: {
+    installationId: number;
+    repositoryId: number;
+    ref: string;
+  }): Promise<GithubCommit[]>;
   createInstallationAccessToken(input: {
     installationId: number;
     repositoryId: number;
@@ -106,12 +126,17 @@ export interface GithubInstallationAccessToken {
   permissions?: Record<string, 'read' | 'write' | 'admin'> | undefined;
 }
 
-export function createGithubApiClient(): GithubApiClient {
+export function createGithubApiClient(): GithubApiClient & GithubBotUserClient {
   return new OctokitGithubApiClient();
 }
 
-class OctokitGithubApiClient implements GithubApiClient {
+class OctokitGithubApiClient implements GithubApiClient, GithubBotUserClient {
   private app: App | undefined;
+  private readonly botUsers = new Map<string, GithubBotUser>();
+  private readonly botUserLookups = new Map<
+    string,
+    {installationAccessToken: string; promise: Promise<GithubBotUser>}
+  >();
 
   async exchangeOAuthCode(code: string): Promise<string> {
     const body = await mapGithubOAuthError(() =>
@@ -136,6 +161,39 @@ class OctokitGithubApiClient implements GithubApiClient {
     return body.access_token;
   }
 
+  getBotUser(input: {username: string; installationAccessToken: string}): Promise<GithubBotUser> {
+    const cacheKey = input.username.trim().toLowerCase();
+    const cached = this.botUsers.get(cacheKey);
+    if (cached) return Promise.resolve(cached);
+
+    const pending = this.botUserLookups.get(cacheKey);
+    if (pending?.installationAccessToken === input.installationAccessToken) {
+      return pending.promise;
+    }
+
+    const lookup = this.fetchBotUser(input).then((botUser) => {
+      const resolved = this.botUsers.get(cacheKey);
+      if (resolved) return resolved;
+
+      this.botUsers.set(cacheKey, botUser);
+      logger().info(
+        {githubAppBotLogin: botUser.login, githubAppBotUserId: botUser.id},
+        'Resolved GitHub App bot identity',
+      );
+      return botUser;
+    });
+    const trackedLookup = lookup.finally(() => {
+      if (this.botUserLookups.get(cacheKey)?.promise === trackedLookup) {
+        this.botUserLookups.delete(cacheKey);
+      }
+    });
+    this.botUserLookups.set(cacheKey, {
+      installationAccessToken: input.installationAccessToken,
+      promise: trackedLookup,
+    });
+    return trackedLookup;
+  }
+
   async listUserInstallations(input: {
     userAccessToken: string;
     cursor?: string | undefined;
@@ -218,6 +276,7 @@ class OctokitGithubApiClient implements GithubApiClient {
     const response = await mapGithubError(() =>
       octokit.request('GET /repositories/{repository_id}', {
         repository_id: input.repositoryId,
+        request: {signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS)},
       }),
     );
 
@@ -356,6 +415,40 @@ class OctokitGithubApiClient implements GithubApiClient {
     };
   }
 
+  async listRepositoryCommits(input: {
+    installationId: number;
+    repositoryId: number;
+    ref: string;
+  }): Promise<GithubCommit[]> {
+    const octokit = await mapGithubError(() =>
+      getGithubInstallationOctokit(this.getApp(), input.installationId),
+    );
+    const repository = await this.getRepository({
+      installationId: input.installationId,
+      repositoryId: input.repositoryId,
+    });
+    const response = await mapGithubError(
+      () =>
+        octokit.rest.repos.listCommits({
+          owner: repository.ownerLogin,
+          repo: repository.name,
+          sha: input.ref,
+          per_page: 1,
+          request: {signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS)},
+        }),
+      'ref-not-found',
+    );
+    return response.data.map((commit) => {
+      if (typeof commit.sha !== 'string') {
+        throw new GithubIntegrationProviderError(
+          'malformed-provider-response',
+          'GitHub commit response is missing the commit sha',
+        );
+      }
+      return {sha: commit.sha};
+    });
+  }
+
   async createInstallationAccessToken(input: {
     installationId: number;
     repositoryId: number;
@@ -405,6 +498,72 @@ class OctokitGithubApiClient implements GithubApiClient {
     }
     return this.app;
   }
+
+  private async fetchBotUser(input: {
+    username: string;
+    installationAccessToken: string;
+  }): Promise<GithubBotUser> {
+    const octokit = new Octokit({
+      auth: input.installationAccessToken,
+      baseUrl: normalizedGithubApiBaseUrl(),
+    });
+    let response: Awaited<ReturnType<typeof octokit.rest.users.getByUsername>>;
+    try {
+      response = await mapGithubError(
+        () =>
+          octokit.rest.users.getByUsername({
+            username: input.username,
+            request: {signal: AbortSignal.timeout(GITHUB_API_TIMEOUT_MS)},
+          }),
+        'provider-rejected',
+      );
+    } catch (error) {
+      if (error instanceof GithubIntegrationProviderError && error.status === 404) {
+        throw new GithubIntegrationProviderError(
+          'provider-rejected',
+          `Configured GitHub bot user ${input.username} was not found`,
+          undefined,
+          error.status,
+        );
+      }
+      throw error;
+    }
+
+    const data: unknown = response.data;
+    if (!isRecord(data)) {
+      throw new GithubIntegrationProviderError(
+        'malformed-provider-response',
+        'GitHub bot user response is missing required fields',
+      );
+    }
+    const {id, login, type} = data;
+    if (
+      typeof id !== 'number' ||
+      !Number.isSafeInteger(id) ||
+      id <= 0 ||
+      typeof login !== 'string' ||
+      login.trim().length === 0
+    ) {
+      throw new GithubIntegrationProviderError(
+        'malformed-provider-response',
+        'GitHub bot user response is missing required fields',
+      );
+    }
+    if (type !== 'Bot') {
+      throw new GithubIntegrationProviderError(
+        'malformed-provider-response',
+        'Configured GitHub username is not a bot account',
+      );
+    }
+    const canonicalLogin = login.trim();
+    if (canonicalLogin.toLowerCase() !== input.username.trim().toLowerCase()) {
+      throw new GithubIntegrationProviderError(
+        'malformed-provider-response',
+        'GitHub bot user response did not match the configured username',
+      );
+    }
+    return {id, login: canonicalLogin};
+  }
 }
 
 async function mapGithubOAuthError<T>(operation: () => Promise<T>): Promise<T> {
@@ -442,16 +601,29 @@ export async function mapGithubError<T>(
   notFoundReason:
     | 'repository-not-found'
     | 'installation-not-found'
-    | 'file-not-found' = 'repository-not-found',
+    | 'file-not-found'
+    | 'ref-not-found'
+    | 'provider-rejected' = 'repository-not-found',
 ): Promise<T> {
   try {
     return await operation();
   } catch (error) {
     if (error instanceof GithubIntegrationProviderError) throw error;
+    if (isGithubTimeoutError(error)) {
+      throw new GithubIntegrationProviderError('timeout', 'GitHub request timed out');
+    }
     if (error instanceof RequestError) {
       if (error.status === 404) {
         throw new GithubIntegrationProviderError(
-          notFoundReason,
+          notFoundReason === 'ref-not-found' ? 'repository-not-found' : notFoundReason,
+          error.message,
+          undefined,
+          error.status,
+        );
+      }
+      if (notFoundReason === 'ref-not-found' && (error.status === 409 || error.status === 422)) {
+        throw new GithubIntegrationProviderError(
+          'ref-not-found',
           error.message,
           undefined,
           error.status,
@@ -490,13 +662,16 @@ export async function mapGithubError<T>(
         );
       }
     }
-    if (error instanceof Error && error.name === 'AbortError') {
-      throw new GithubIntegrationProviderError('timeout', 'GitHub request timed out');
-    }
     throw error;
   }
 }
 
+function isGithubTimeoutError(error: unknown): boolean {
+  if (!(error instanceof Error)) return false;
+  if (error.name === 'AbortError' || error.name === 'TimeoutError') return true;
+  return error.cause instanceof Error && isGithubTimeoutError(error.cause);
+}
+
 function isGithubRateLimitError(error: RequestError): boolean {
   return error.status === 403 && error.response?.headers['x-ratelimit-remaining'] === '0';
 }

package/src/api/installation-token-envelope.ts

@@ -37,9 +37,11 @@ const terminalMintErrorReasons = new Set<IntegrationProviderErrorReason>([
   'malformed-provider-response',
 ]);
 
+// Ref reasons describe ref-resolution failures, which a token mint never
+// observes; keep them out of the envelope schema and acknowledge them here.
 type MissingProviderErrorReason = Exclude<
   IntegrationProviderErrorReason,
-  (typeof providerErrorReasons)[number]
+  (typeof providerErrorReasons)[number] | 'ref-not-found' | 'ref-invalid'
 >;
 const providerErrorReasonSchemaCoversUnion: Record<MissingProviderErrorReason, never> = {};
 void providerErrorReasonSchemaCoversUnion;

package/src/core/agent-tools.test.ts

@@ -1734,6 +1734,7 @@ function githubClient(): GithubApiClient {
     getRepository: vi.fn(() => Promise.reject(new Error('not used'))),
     listRepositoryFiles: vi.fn(() => Promise.reject(new Error('not used'))),
     fetchRepositoryFile: vi.fn(() => Promise.reject(new Error('not used'))),
+    listRepositoryCommits: vi.fn(() => Promise.reject(new Error('not used'))),
     createInstallationAccessToken: vi.fn(() => Promise.reject(new Error('not used'))),
   };
 }

package/src/core/agent-tools.ts

@@ -13,8 +13,9 @@ import {
   createGithubInstallationTokenProvider,
   type GithubInstallationTokenProvider,
 } from '#api/installation-token-provider.js';
-import {config, normalizedGithubApiBaseUrl} from '#config.js';
+import {normalizedGithubApiBaseUrl} from '#config.js';
 import type {GithubInstallation} from '#db/installations.js';
+import {githubAppBotLogin} from './bot-identity.js';
 import {GithubIntegrationProviderError} from './errors.js';
 import {
   type GithubAgentToolCatalogEntry,
@@ -59,7 +60,6 @@ const GITHUB_GRAPHQL_ROUTE = 'POST /graphql';
 const GITHUB_ARTIFACT_ARCHIVE_FORMAT = 'zip';
 const GITHUB_ARTIFACT_DOWNLOAD_ROUTE = `GET /repos/{owner}/{repo}/actions/artifacts/{resource_id}/${GITHUB_ARTIFACT_ARCHIVE_FORMAT}`;
 const GITHUB_ARTIFACT_DOWNLOAD_TIMEOUT_MS = 30_000;
-const GITHUB_APP_BOT_SUFFIX = '[bot]';
 const PENDING_REVIEW_PAGE_SIZE = 100;
 const PENDING_REVIEW_MAX_PAGE_REQUESTS = 5;
 const PENDING_REVIEW_LOOKUP_TIMEOUT_MS = 15_000;
@@ -725,13 +725,6 @@ function latestPendingReviewOnPage(
   return {malformed};
 }
 
-function githubAppBotLogin(): string {
-  const configuredUsername = config.GITHUB_APP_USERNAME?.trim() || config.GITHUB_APP_SLUG.trim();
-  return configuredUsername.toLowerCase().endsWith(GITHUB_APP_BOT_SUFFIX)
-    ? configuredUsername
-    : `${configuredUsername}${GITHUB_APP_BOT_SUFFIX}`;
-}
-
 function githubToolResult(
   toolId: GithubAgentToolId,
   data: unknown,

package/src/core/bot-identity.test.ts

@@ -0,0 +1,19 @@
+import {configuredGithubAppBotLogin, githubAppBotLogin, githubBotLogin} from './bot-identity.js';
+
+describe('GitHub App bot identity', () => {
+  it.each([
+    ['shipfox-ai', 'shipfox-ai[bot]'],
+    ['shipfox-ai[bot]', 'shipfox-ai[bot]'],
+    ['Shipfox-AI[Bot]', 'Shipfox-AI[Bot]'],
+  ])('normalizes %s to %s', (username, expected) => {
+    expect(githubBotLogin(username)).toBe(expected);
+  });
+
+  it('uses the configured username for commit attribution', () => {
+    expect(configuredGithubAppBotLogin()).toBe('shipfox-test[bot]');
+  });
+
+  it('uses the configured username for App review identity', () => {
+    expect(githubAppBotLogin()).toBe('shipfox-test[bot]');
+  });
+});