@wardby/cli 0.5.3 → 0.7.0

package/dist/core/related-pull-requests.d.ts

@@ -1,11 +1,20 @@
 /**
  * The pull requests that came from the same request as a run: every pull
  * request opened by a coding run in the same top-level run tree (a lead that
- * fanned out to several repositories), plus any recorded for the same tracker
- * issue (IssuePullRequest). Control-plane rows only.
- * Ordered by when each pull request's coding run was dispatched: the lead's
- * delegation order (for a lead with parallelDelegations, the order its
- * concurrent delegations were admitted, ties broken by repository#number).
+ * fanned out to several repositories), plus any recorded for the same Jira or
+ * GitHub issue (IssuePullRequest). Control-plane rows only.
+ * Ordered by the delegating agent's declared merge order when any entry has
+ * one (CodingRun.mergeOrder; nulls last), then by when each pull request's
+ * coding run was dispatched: the lead's delegation order (for a lead with
+ * parallelDelegations, the order its concurrent delegations were admitted,
+ * ties broken by repository#number). A pull request's mergeOrder is the
+ * newest non-null value set by its opener run or any later continuation
+ * that acted on it, so a lead that re-delegates with a different order
+ * after the fact is reflected here. When mergeOrder is set on any entry,
+ * every truncation cap below this collector (MAX_RELATED_GROUP here,
+ * MAX_SIBLING_HINTS on openSiblingsOf, MAX_RELATED_PULL_REQUESTS on
+ * renderRelatedSection) drops entries with no order first, since they sort
+ * last.
  * A PR opened while siblings were still running lists only the PRs opened
  * before it; updateRelatedPullRequests rewrites every open PR of the set
  * with the full list when the lead run ends. Continuations join
@@ -13,7 +22,7 @@
  * pull requests brings the original request's tree, and the original request
  * brings every later follow-up tree that continued one of its pull requests.
  */
-import { type PrismaClient, type Run } from "#prisma";
+import { type PrismaClient, type Run, type RunStatus } from "#prisma";
 import { type IssueTrackerRegistry } from "../providers/issue-tracker/types.js";
 import type { ReviewHostRegistry } from "../providers/review-host/types.js";
 /** Most pull requests a group holds; the description shows fewer (MAX_RELATED_PULL_REQUESTS). */
@@ -28,15 +37,50 @@ export interface RelatedPullRequest {
     openedByRunId: string;
     /** Only when stored (IssuePullRequest.state, kept current by pr_closed); otherwise unknown. */
     state?: StoredPullRequestState;
+    /**
+     * Step in the delegating agent's merge order (CodingRun.mergeOrder, 1-99):
+     * the newest non-null value among the coding run that opened it and its
+     * continuations. Absent when none of them set one, or when the entry only
+     * came from IssuePullRequest (no CodingRun to read it from).
+     */
+    mergeOrder?: number;
 }
 export interface RelatedPullRequestGroup {
     pullRequests: RelatedPullRequest[];
-    /** The first well-formed issue seen on the group's coding runs. */
+    /** The first well-formed issue (a Jira or GitHub issue) seen on the group's coding runs. */
     issue?: {
         provider: string;
         key: string;
     };
+    /**
+     * The top-level run of every run tree the walk visited (the original
+     * request and each follow-up tree that continued one of its pull
+     * requests), with its status; absent when none was read. `codingRun` is
+     * true when the root is itself a coding run (a top-level follow-up such
+     * as a review fix round or an @mention picked up by a coding link), not a
+     * native lead agent's run.
+     */
+    roots?: Array<{
+        id: string;
+        status: RunStatus;
+        codingRun: boolean;
+    }>;
 }
+/**
+ * The top-level run of the tree a pull request's marker run belongs to,
+ * whatever its status: the marker's coding run (a continuation resolves to
+ * its root coding run first), then up its parents. Null when the marker
+ * names no coding run, or one recorded for a different repository than
+ * `repository` (compared case-insensitively; omit it to skip the check).
+ * `isOpener` is true when that root is the opening coding run itself (the
+ * pull request was not delegated). The single place this walk and its
+ * repository guard live (requestLeadRunId, the merge order check).
+ */
+export declare function runTreeRoot(db: Pick<PrismaClient, "$queryRaw">, markerRunId: string, repository?: string): Promise<{
+    id: string;
+    status: RunStatus;
+    isOpener: boolean;
+} | null>;
 export declare function collectRelatedPullRequests(db: RelatedPullRequestsDb, runId: string, 
 /**
  * Scopes the issue join (and any tree row explicitly tagged for a
@@ -67,6 +111,14 @@ export interface OpenSibling {
     number: number;
     openedByRunId: string;
 }
+/**
+ * The continuation hint for a ticket (a GitHub or Jira issue) that already has
+ * open wardby pull requests: one sentence per pull request (up to
+ * MAX_SIBLING_HINTS), then SIBLING_GUIDANCE once, as paragraphs. Built from
+ * stored rows only, with the run id, repository and number re-validated and the
+ * link built here, never taken from issue text. Empty when nothing is hintable.
+ */
+export declare function openPullRequestHints(prs: readonly OpenSibling[]): string;
 /**
  * The group's pull requests a follow-up may continue: stored state "open", or
  * no stored state yet (a same-tree sibling not recorded for an issue), minus

package/dist/core/related-pull-requests.js

@@ -1,11 +1,20 @@
 /**
  * The pull requests that came from the same request as a run: every pull
  * request opened by a coding run in the same top-level run tree (a lead that
- * fanned out to several repositories), plus any recorded for the same tracker
- * issue (IssuePullRequest). Control-plane rows only.
- * Ordered by when each pull request's coding run was dispatched: the lead's
- * delegation order (for a lead with parallelDelegations, the order its
- * concurrent delegations were admitted, ties broken by repository#number).
+ * fanned out to several repositories), plus any recorded for the same Jira or
+ * GitHub issue (IssuePullRequest). Control-plane rows only.
+ * Ordered by the delegating agent's declared merge order when any entry has
+ * one (CodingRun.mergeOrder; nulls last), then by when each pull request's
+ * coding run was dispatched: the lead's delegation order (for a lead with
+ * parallelDelegations, the order its concurrent delegations were admitted,
+ * ties broken by repository#number). A pull request's mergeOrder is the
+ * newest non-null value set by its opener run or any later continuation
+ * that acted on it, so a lead that re-delegates with a different order
+ * after the fact is reflected here. When mergeOrder is set on any entry,
+ * every truncation cap below this collector (MAX_RELATED_GROUP here,
+ * MAX_SIBLING_HINTS on openSiblingsOf, MAX_RELATED_PULL_REQUESTS on
+ * renderRelatedSection) drops entries with no order first, since they sort
+ * last.
  * A PR opened while siblings were still running lists only the PRs opened
  * before it; updateRelatedPullRequests rewrites every open PR of the set
  * with the full list when the lead run ends. Continuations join
@@ -15,7 +24,7 @@
  */
 import { Prisma } from "#prisma";
 import { CODING_CODE_PROVIDER, normalizeGitHubRepository } from "../coding/protocol.js";
-import { ISSUE_KEY, ISSUE_TRACKER_NAMES, } from "../providers/issue-tracker/types.js";
+import { issueReference, } from "../providers/issue-tracker/types.js";
 import { renderRelatedSection } from "../providers/vcs/github.js";
 import { pullRequestOutcome } from "./host-status.js";
 import { logger } from "./logger.js";
@@ -36,17 +45,50 @@ async function treeCodingRuns(db, seeds) {
       UNION
       SELECT p."id", p."parentRunId" FROM "Run" p JOIN up u ON p."id" = u."parentRunId"
     ), down AS (
-      SELECT u."id" FROM up u WHERE u."parentRunId" IS NULL
+      SELECT u."id", u."id" AS "rootId" FROM up u WHERE u."parentRunId" IS NULL
       UNION
-      SELECT c."id" FROM "Run" c JOIN down d ON c."parentRunId" = d."id"
+      SELECT c."id", d."rootId" FROM "Run" c JOIN down d ON c."parentRunId" = d."id"
     )
-    SELECT cr."runId", cr."result", cr."rootCodingRunId", cr."issueProvider", cr."issueKey", r."startedAt"
+    SELECT cr."runId", cr."result", cr."rootCodingRunId", cr."issueProvider", cr."issueKey", cr."mergeOrder", r."startedAt",
+      d."rootId" AS "treeRootId", root."status"::text AS "treeRootStatus",
+      EXISTS (SELECT 1 FROM "CodingRun" rc WHERE rc."runId" = d."rootId") AS "treeRootIsCodingRun"
     FROM "CodingRun" cr
     JOIN down d ON cr."runId" = d."id"
     JOIN "Run" r ON r."id" = cr."runId"
+    JOIN "Run" root ON root."id" = d."rootId"
     ORDER BY r."startedAt" ASC, cr."runId" ASC
     LIMIT ${MAX_TREE_CODING_RUNS}`;
 }
+/**
+ * The top-level run of the tree a pull request's marker run belongs to,
+ * whatever its status: the marker's coding run (a continuation resolves to
+ * its root coding run first), then up its parents. Null when the marker
+ * names no coding run, or one recorded for a different repository than
+ * `repository` (compared case-insensitively; omit it to skip the check).
+ * `isOpener` is true when that root is the opening coding run itself (the
+ * pull request was not delegated). The single place this walk and its
+ * repository guard live (requestLeadRunId, the merge order check).
+ */
+export async function runTreeRoot(db, markerRunId, repository) {
+    const repo = repository ?? null;
+    // UNION, not UNION ALL: a parentRunId cycle (never written, but not a constraint) can't recurse forever.
+    const rows = await db.$queryRaw `
+    WITH RECURSIVE opener AS (
+      SELECT COALESCE(cr."rootCodingRunId", cr."runId") AS "id"
+      FROM "CodingRun" cr
+      WHERE cr."runId" = ${markerRunId}
+        AND (${repo}::text IS NULL OR lower(cr."repository") = lower(${repo}::text))
+    ), up AS (
+      SELECT r."id", r."parentRunId", r."status"::text AS "status" FROM "Run" r JOIN opener o ON r."id" = o."id"
+      UNION
+      SELECT p."id", p."parentRunId", p."status"::text FROM "Run" p JOIN up u ON p."id" = u."parentRunId"
+    )
+    SELECT u."id", u."status", u."id" IN (SELECT "id" FROM opener) AS "isOpener"
+    FROM up u
+    WHERE u."parentRunId" IS NULL
+    LIMIT 1`;
+    return rows[0] ?? null;
+}
 function safeRepository(value) {
     try {
         return normalizeGitHubRepository(value);
@@ -120,7 +162,8 @@ onlyIssueKey) {
     let issue;
     const issues = new Map();
     for (const r of rows) {
-        if (r.issueProvider && r.issueKey && ISSUE_KEY.test(r.issueKey)) {
+        // A Jira issue and a GitHub issue join the same way: by provider and key, each key re-validated.
+        if (r.issueProvider && r.issueKey && issueReference(r.issueProvider, r.issueKey)) {
             const found = { provider: r.issueProvider, key: r.issueKey };
             issue ??= found;
             issues.set(`${found.provider}\0${found.key}`, found);
@@ -139,9 +182,40 @@ onlyIssueKey) {
                 number: pr.pullRequestNumber,
                 openedAt: new Date(r.startedAt),
                 openedByRunId: r.runId,
+                ...(r.mergeOrder != null ? { mergeOrder: r.mergeOrder } : {}),
             });
         }
     }
+    // A continuation dispatched with its own mergeOrder overrides the opener's
+    // (one that omits it stores the value it inherited), and it starts after
+    // the opener; the entry's mergeOrder is the newest non-null
+    // value among the opener row and every continuation row (same PR key,
+    // "pull_request_opened" or "pull_request_updated") found in the tree walk.
+    const newestMergeOrder = new Map();
+    for (const r of rows) {
+        if (r.mergeOrder == null)
+            continue;
+        const pr = pullRequestOutcome(r.result);
+        if (pr?.outcome !== "pull_request_opened" && pr?.outcome !== "pull_request_updated")
+            continue;
+        if (onlyIssueKey && r.issueKey && (r.issueProvider !== onlyIssueKey.provider || r.issueKey !== onlyIssueKey.key)) {
+            continue;
+        }
+        const repository = safeRepository(pr.repository);
+        if (!repository)
+            continue;
+        const key = keyOf(repository, pr.pullRequestNumber);
+        const startedAt = new Date(r.startedAt);
+        const current = newestMergeOrder.get(key);
+        if (!current || startedAt.getTime() >= current.startedAt.getTime()) {
+            newestMergeOrder.set(key, { startedAt, mergeOrder: r.mergeOrder });
+        }
+    }
+    for (const [key, entry] of byKey) {
+        const newest = newestMergeOrder.get(key);
+        if (newest)
+            entry.mergeOrder = newest.mergeOrder;
+    }
     const issueFilter = onlyIssueKey
         ? new Map([[`${onlyIssueKey.provider}\0${onlyIssueKey.key}`, onlyIssueKey]])
         : issues;
@@ -177,25 +251,29 @@ onlyIssueKey) {
             });
         }
     }
+    const order = (e) => e.mergeOrder ?? Number.POSITIVE_INFINITY;
     const pullRequests = [...byKey.values()]
-        .sort((a, b) => a.openedAt.getTime() - b.openedAt.getTime() ||
+        .sort((a, b) => order(a) - order(b) ||
+        a.openedAt.getTime() - b.openedAt.getTime() ||
         `${a.repository}#${a.number}`.localeCompare(`${b.repository}#${b.number}`))
         .slice(0, MAX_RELATED_GROUP);
-    return { pullRequests, ...(issue ? { issue } : {}) };
+    const roots = new Map();
+    for (const r of rows) {
+        if (r.treeRootId && r.treeRootStatus) {
+            roots.set(r.treeRootId, { status: r.treeRootStatus, codingRun: r.treeRootIsCodingRun === true });
+        }
+    }
+    return {
+        pullRequests,
+        ...(issue ? { issue } : {}),
+        ...(roots.size > 0 ? { roots: [...roots].map(([id, root]) => ({ id, ...root })) } : {}),
+    };
 }
 function issueFor(group, trackers) {
     if (!group.issue)
         return undefined;
-    const provider = group.issue.provider;
-    let url;
-    try {
-        url = trackers?.[provider]?.issueUrl(group.issue.key);
-    }
-    catch {
-        url = undefined;
-    }
-    const trackerName = Object.hasOwn(ISSUE_TRACKER_NAMES, provider) ? ISSUE_TRACKER_NAMES[provider] : undefined;
-    return { key: group.issue.key, ...(url ? { url } : {}), ...(trackerName ? { trackerName } : {}) };
+    const tracker = trackers?.[group.issue.provider];
+    return issueReference(group.issue.provider, group.issue.key, tracker ? (key) => tracker.issueUrl(key) : undefined);
 }
 /**
  * After a native run ends, rewrites the Related pull requests section on
@@ -219,7 +297,12 @@ export async function updateRelatedPullRequests(db, run, hosts, trackers) {
         for (const pr of group.pullRequests) {
             // A stored merged/closed state is final and such a PR is never edited: no host read.
             if (pr.state === "merged" || pr.state === "closed") {
-                live.push({ repository: pr.repository, number: pr.number, state: pr.state });
+                live.push({
+                    repository: pr.repository,
+                    number: pr.number,
+                    state: pr.state,
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
+                });
                 continue;
             }
             try {
@@ -240,12 +323,23 @@ export async function updateRelatedPullRequests(db, run, hosts, trackers) {
                     if (opener && opener.repository.toLowerCase() === pr.repository)
                         markerRunId = origin.markerRunId;
                 }
-                live.push({ repository: pr.repository, number: pr.number, state, ...(markerRunId ? { markerRunId } : {}) });
+                live.push({
+                    repository: pr.repository,
+                    number: pr.number,
+                    state,
+                    ...(markerRunId ? { markerRunId } : {}),
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
+                });
             }
             catch (err) {
                 log.warn({ err, runId: run.id, repository: pr.repository, number: pr.number }, "could not read a related pull request");
                 // The stored state (issue-recorded PRs) is better than none; never edited without a live read.
-                live.push({ repository: pr.repository, number: pr.number, ...(pr.state ? { state: pr.state } : {}) });
+                live.push({
+                    repository: pr.repository,
+                    number: pr.number,
+                    ...(pr.state ? { state: pr.state } : {}),
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
+                });
             }
         }
         const issue = issueFor(group, trackers);
@@ -258,6 +352,7 @@ export async function updateRelatedPullRequests(db, run, hosts, trackers) {
                     number: pr.number,
                     ...(pr.state ? { state: pr.state } : {}),
                     ...(pr === target ? { self: true } : {}),
+                    ...(pr.mergeOrder !== undefined ? { mergeOrder: pr.mergeOrder } : {}),
                 })),
                 ...(issue ? { issue } : {}),
             });
@@ -286,6 +381,26 @@ const SAFE_RUN_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
 export const SIBLING_GUIDANCE = "Continue the pull request you were asked about, and a listed open one only when the change requires it. " +
     "Never open a new pull request in a repository that already has an open pull request listed here. Merged or " +
     "closed pull requests are not listed: a change there needs a new pull request.";
+const HINT_REPOSITORY = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+/**
+ * The continuation hint for a ticket (a GitHub or Jira issue) that already has
+ * open wardby pull requests: one sentence per pull request (up to
+ * MAX_SIBLING_HINTS), then SIBLING_GUIDANCE once, as paragraphs. Built from
+ * stored rows only, with the run id, repository and number re-validated and the
+ * link built here, never taken from issue text. Empty when nothing is hintable.
+ */
+export function openPullRequestHints(prs) {
+    const lines = prs
+        .filter((p) => SAFE_RUN_ID.test(p.openedByRunId) &&
+        HINT_REPOSITORY.test(p.repository) &&
+        Number.isSafeInteger(p.number) &&
+        p.number > 0)
+        .slice(0, MAX_SIBLING_HINTS)
+        .map((p) => `This issue already has an open pull request wardby opened: ${p.repository}#${p.number} ` +
+        `(https://github.com/${p.repository}/pull/${p.number}). ` +
+        `To revise it, delegate with continuePriorRun set to exactly "${p.openedByRunId}".`);
+    return lines.length > 0 ? [...lines, SIBLING_GUIDANCE].join("\n\n") : "";
+}
 /**
  * The group's pull requests a follow-up may continue: stored state "open", or
  * no stored state yet (a same-tree sibling not recorded for an issue), minus

package/dist/core/reply-parts.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Splits an agent's reply into comment-sized parts, so a long reply (a plan
+ * posted to an issue, say) can go out in full as numbered follow-up comments
+ * instead of being cut. Pure: numbering, headers and the cut note are the
+ * caller's job; each part is a raw slice of the defused text.
+ */
+export interface ReplyParts {
+    parts: string[];
+    truncated: boolean;
+}
+/** "@" + U+200B before a word character, so a quoted reply pings nobody. */
+export declare function defuseMentions(text: string): string;
+/**
+ * Splits `text` into at most `maxParts` parts of at most `maxChars` each, preferring Markdown heading
+ * boundaries, then blank lines (paragraphs), then single newlines, then a hard cut. Defuses @-mentions.
+ * Never splits inside a fenced code block unless one block alone exceeds maxChars (then hard-cut it).
+ */
+export declare function splitReply(text: string, opts: {
+    maxChars: number;
+    maxParts: number;
+}): ReplyParts;

package/dist/core/reply-parts.js

@@ -0,0 +1,73 @@
+/**
+ * Splits an agent's reply into comment-sized parts, so a long reply (a plan
+ * posted to an issue, say) can go out in full as numbered follow-up comments
+ * instead of being cut. Pure: numbering, headers and the cut note are the
+ * caller's job; each part is a raw slice of the defused text.
+ */
+/** "@" + U+200B before a word character, so a quoted reply pings nobody. */
+export function defuseMentions(text) {
+    return text.replace(/@(?=[\w-])/g, "@\u200b");
+}
+const FENCE_LINE = /^\s{0,3}(```|~~~)/;
+const HEADING_LINE = /^#{1,6}\s/;
+/** [open, close) offsets of each fenced code block; a cut strictly inside one would break it. */
+function fenceSpans(text) {
+    const spans = [];
+    let open = -1;
+    let offset = 0;
+    for (const line of text.split("\n")) {
+        const end = offset + line.length + 1;
+        if (FENCE_LINE.test(line)) {
+            if (open < 0)
+                open = offset;
+            else {
+                spans.push([open, Math.min(end, text.length)]);
+                open = -1;
+            }
+        }
+        offset = end;
+    }
+    if (open >= 0)
+        spans.push([open, text.length]);
+    return spans;
+}
+/**
+ * Splits `text` into at most `maxParts` parts of at most `maxChars` each, preferring Markdown heading
+ * boundaries, then blank lines (paragraphs), then single newlines, then a hard cut. Defuses @-mentions.
+ * Never splits inside a fenced code block unless one block alone exceeds maxChars (then hard-cut it).
+ */
+export function splitReply(text, opts) {
+    const maxChars = Math.max(1, Math.floor(opts.maxChars));
+    const maxParts = Math.max(1, Math.floor(opts.maxParts));
+    const defused = defuseMentions(text);
+    if (defused.length <= maxChars)
+        return { parts: [defused], truncated: false };
+    const spans = fenceSpans(defused);
+    const inFence = (at) => spans.some(([open, close]) => at > open && at < close);
+    const lineStart = (at) => defused[at - 1] === "\n";
+    const tiers = [
+        (at) => lineStart(at) && HEADING_LINE.test(defused.slice(at, at + 7)),
+        (at) => lineStart(at) && defused[at - 2] === "\n",
+        lineStart,
+    ];
+    /** The furthest cut in (start, start + maxChars]: the best tier wins, then a hard cut. */
+    const cutAfter = (start) => {
+        const limit = start + maxChars;
+        for (const tier of tiers) {
+            for (let at = limit; at > start; at--)
+                if (!inFence(at) && tier(at))
+                    return at;
+        }
+        // A surrogate pair is one character to a reader; keep it whole when we can.
+        const code = defused.charCodeAt(limit - 1);
+        return code >= 0xd800 && code <= 0xdbff && limit - 1 > start ? limit - 1 : limit;
+    };
+    const parts = [];
+    let start = 0;
+    while (start < defused.length && parts.length < maxParts) {
+        const end = defused.length - start <= maxChars ? defused.length : cutAfter(start);
+        parts.push(defused.slice(start, end));
+        start = end;
+    }
+    return { parts, truncated: start < defused.length };
+}

package/dist/core/repo-access.d.ts

@@ -23,6 +23,8 @@ export declare const AUTHORIZED_VIA: readonly AuthorizedVia[];
 export type RepoAccessDenial = "owner_required" | "not_authorized" | "identity_not_linked" | "insufficient_permission" | "check_failed"
 /** A `local:` repository that is not inside the current trusted roots (LOCAL_REPO_ROOTS). */
  | "local_repo_not_allowed"
+/** A GitHub repository whose owner is neither the App's owner nor in WARDBY_GITHUB_ALLOWED_ACCOUNTS. */
+ | "github_account_not_allowed"
 /** In-flight use only: the host was unreachable or rate-limited, even after one retry. */
  | "check_unavailable";
 export type RepoAccessDecision = {
@@ -78,6 +80,8 @@ export interface RepoAccessGate {
         required: HostPermission;
         fresh?: boolean;
     }): Promise<RepoAccessDecision>;
+    /** Is this repository's account served by the GitHub App? undefined = yes (or not a GitHub repository). */
+    checkAccount?(provider: string, repository: string): Promise<RepoAccessDecision | undefined>;
 }
 export interface RepoAccessGateOptions {
     db: Pick<PrismaClient, "hostIdentity">;
@@ -92,9 +96,20 @@ export interface RepoAccessGateOptions {
     /** Delay before the one retry of a transient error (default 1s). */
     retryDelayMs?: number;
     sleep?: (ms: number) => Promise<void>;
+    /**
+     * The served GitHub accounts (default: the App owner from hosts.github plus
+     * WARDBY_GITHUB_ALLOWED_ACCOUNTS). undefined = no GitHub App, nothing to guard.
+     * Throwing = fail closed.
+     */
+    trustedAccounts?: () => Promise<ReadonlySet<string> | undefined>;
 }
 /** 5xx, rate limits (403/429), and transport failures: worth one retry for a run already under way. */
 export declare function isTransientHostError(err: unknown): boolean;
+/**
+ * Why the trusted GitHub accounts could not be read, as a fixed string: every
+ * branch returns a literal, so nothing from the error itself reaches a log.
+ */
+export declare function trustedAccountsFailure(err: unknown): string;
 export declare const DEFAULT_REPO_ACCESS_TTL_MS: number;
 export declare function createRepoAccessGate(options: RepoAccessGateOptions): RepoAccessGate;
 /** Actionable, non-leaking text for a denial, for tool results and run errors. */

package/dist/core/repo-access.js

@@ -1,5 +1,6 @@
 import { HOST_PERMISSION_RANK, ReviewHostError, } from "../providers/review-host/types.js";
 import { LocalRepoError, isLocalRepository, loadLocalRepoRoots, resolveLocalRepository } from "../coding/local-repo.js";
+import { githubAccountOf, isGitHubAccountAllowed, loadGitHubAllowedAccounts, trustedAccounts as trustedAccountSet, } from "../config/github-allowed-accounts.js";
 import { logger } from "./logger.js";
 const log = logger.child({ module: "repo-access" });
 export const AUTHORIZED_VIA = ["host_permission", "admin", "grandfathered", "local_root"];
@@ -20,6 +21,24 @@ export function isTransientHostError(err) {
         return false;
     return err.message === "github_api_unavailable" || /^github_api_error:(5\d\d|429|403)(:|$)/.test(err.message);
 }
+/**
+ * Why the trusted GitHub accounts could not be read, as a fixed string: every
+ * branch returns a literal, so nothing from the error itself reaches a log.
+ */
+export function trustedAccountsFailure(err) {
+    const message = err instanceof Error ? err.message : "";
+    if (message === "github_allowed_accounts_invalid")
+        return "github_allowed_accounts_invalid";
+    if (message === "github_api_unavailable")
+        return "github_api_unavailable";
+    if (message === "github_api_invalid_response")
+        return "github_api_invalid_response";
+    if (message === "github_app_private_key_invalid")
+        return "github_app_private_key_invalid";
+    if (message.startsWith("github_api_error:"))
+        return "github_api_error";
+    return "unexpected_error";
+}
 const defaultLocalRoots = () => loadLocalRepoRoots(process.env).roots;
 export const DEFAULT_REPO_ACCESS_TTL_MS = 5 * 60_000;
 export function createRepoAccessGate(options) {
@@ -29,6 +48,41 @@ export function createRepoAccessGate(options) {
     const retryDelayMs = options.retryDelayMs ?? 1000;
     const sleep = options.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const cache = new Map();
+    const readTrusted = options.trustedAccounts ??
+        (async () => {
+            const host = options.hosts.github;
+            if (!host?.appOwnerLogin)
+                return undefined;
+            let extra;
+            try {
+                extra = loadGitHubAllowedAccounts();
+            }
+            catch {
+                // A fixed code: the parse error quotes the raw value, which must not reach the log.
+                throw new Error("github_allowed_accounts_invalid");
+            }
+            return trustedAccountSet(await host.appOwnerLogin(), extra);
+        });
+    /** A server-wide boundary, checked before any stamp, owner, or host call. Local repositories are exempt. */
+    async function checkAccount(provider, repository) {
+        if (provider !== "github" || isLocalRepository(repository))
+            return undefined;
+        let trusted;
+        try {
+            trusted = await readTrusted();
+        }
+        catch (err) {
+            // Only a fixed code is logged, never the error: its message may carry
+            // WARDBY_GITHUB_ALLOWED_ACCOUNTS's value (CodeQL js/clear-text-logging).
+            log.warn({ code: trustedAccountsFailure(err) }, "could not read the GitHub App's trusted accounts; denying");
+            return { ok: false, reason: "check_failed" };
+        }
+        if (trusted === undefined)
+            return undefined;
+        return isGitHubAccountAllowed(trusted, githubAccountOf(repository))
+            ? undefined
+            : { ok: false, reason: "github_account_not_allowed" };
+    }
     /** The user's level, or why it could not be determined (host missing or failing). */
     async function levelOf(provider, repository, user, fresh, retryTransient) {
         const key = `${provider}\u0000${repository}\u0000${user.id}`;
@@ -69,6 +123,9 @@ export function createRepoAccessGate(options) {
         return atLeast(level, required) ? { ok: true, level } : { ok: false, reason: "insufficient_permission", level };
     }
     async function authorizePrincipal(input) {
+        const denied = await checkAccount(input.provider, input.repository);
+        if (denied)
+            return denied;
         let identity;
         try {
             identity = await options.db.hostIdentity.findUnique({
@@ -108,6 +165,9 @@ export function createRepoAccessGate(options) {
                     return { ok: false, reason: "local_repo_not_allowed" };
                 }
             }
+            const denied = await checkAccount(input.provider, input.repository);
+            if (denied)
+                return denied;
             if (!input.ownerId)
                 return { ok: false, reason: "owner_required" };
             if (input.authorizedVia === "admin" || input.authorizedVia === "grandfathered")
@@ -124,11 +184,15 @@ export function createRepoAccessGate(options) {
         },
         authorizePrincipal,
         async authorizeHostUser(input) {
+            const denied = await checkAccount(input.provider, input.repository);
+            if (denied)
+                return denied;
             const answer = await levelOf(input.provider, input.repository, input.user, input.fresh === true, false);
             if (!answer.ok)
                 return unavailable(answer);
             return decide(answer.level, input.required);
         },
+        checkAccount,
     };
 }
 /** Actionable, non-leaking text for a denial, for tool results and run errors. */
@@ -144,6 +208,8 @@ export function describeDenial(decision, repository) {
             return `The agent owner's GitHub account has ${decision.level ?? "no"} access to ${repository}, which is not enough.`;
         case "local_repo_not_allowed":
             return `local_repo_not_allowed: ${repository} is not a git repository inside the configured local roots (LOCAL_REPO_ROOTS).`;
+        case "github_account_not_allowed":
+            return `github_account_not_allowed: ${repository} belongs to a GitHub account this server does not serve (the App's owner and WARDBY_GITHUB_ALLOWED_ACCOUNTS).`;
         case "check_failed":
             return `Could not verify access to ${repository} right now; try again later.`;
         case "check_unavailable":