@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/platform/github/index.js

@@ -0,0 +1,936 @@
+// GitHub driver (github.com). Implements the Platform port against the GitHub
+// REST API (`/repos/{owner}/{repo}/…`). Unlike GitLab and ForgeJo/Gitea,
+// GitHub addresses repos by `owner/name`; the driver keeps a numeric-id →
+// full_name cache because the port (and MCP/runner) only carry ids.
+//
+// GitHub Enterprise Server is out of scope; GITHUB_API_URL defaults to
+// https://api.github.com. Wiki pages have no REST API (typed UnsupportedError).
+import { z } from "zod";
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+import { config } from "../../config.js";
+import { PlatformHttpError, UnsupportedError, tailFileContent } from "../types.js";
+import { gitExtraHeaderGithub } from "../git-auth.js";
+import { findGithubAttachmentRefs, downloadGithubAttachment } from "./attachments.js";
+import { zipText } from "./zip.js";
+import { GithubActionRunSchema, GithubBranchSchema, GithubCollaboratorSchema, GithubCommentSchema, GithubCommitListSchema, GithubCompareSchema, GithubContentSchema, GithubIssueCommentPayloadSchema, GithubIssuePayloadSchema, GithubIssueSchema, GithubLabelSchema, GithubMilestoneSchema, GithubPermissionSchema, GithubPullRequestPayloadSchema, GithubPullRequestSchema, GithubReleaseSchema, GithubRepositorySchema, GithubReviewCommentSchema, GithubReviewSchema, GithubSearchCodeSchema, GithubTagSchema, GithubUserSchema, GithubWebhookSchema, GithubWorkflowJobsSchema, GithubWorkflowRunPayloadSchema, GithubWorkflowRunsSchema, } from "./schemas.js";
+import { githubFetchRaw, githubRequest, githubRequestArray, githubVoid, pageParams, GithubOversizedError, } from "./http.js";
+const BOT = { kind: "bot" };
+// Safety cap for the raw Actions log ZIP before inflation. The meaningful tail
+// is taken after inflating; this only stops an unbounded archive download.
+const GITHUB_LOG_ARCHIVE_MAX_BYTES = 50_000_000;
+// ---- Mappers ---------------------------------------------------------------
+function splitFullName(fullName) {
+    const idx = fullName.indexOf("/");
+    if (idx === -1)
+        return { owner: "", repo: fullName };
+    return { owner: fullName.slice(0, idx), repo: fullName.slice(idx + 1) };
+}
+function mapRepo(r) {
+    return {
+        id: r.id,
+        path: r.full_name,
+        webUrl: r.html_url ?? "",
+        cloneUrl: r.clone_url || `${config.PLATFORM_URL.replace(/\/$/, "")}/${r.full_name}.git`,
+        defaultBranch: r.default_branch ?? null,
+    };
+}
+function mapUser(u) {
+    if (!u)
+        return undefined;
+    return { id: u.id, username: u.login, name: u.name || u.login };
+}
+// GitHub issue states are already "open"/"closed"; the port uses the same.
+function mapWorkItemState(state) {
+    return state;
+}
+function mapIssue(i) {
+    const assignees = i.assignees && i.assignees.length > 0 ? i.assignees : i.assignee ? [i.assignee] : [];
+    return {
+        id: i.id,
+        number: i.number,
+        title: i.title,
+        description: i.body ?? "",
+        state: mapWorkItemState(i.state),
+        webUrl: i.html_url ?? "",
+        ...(i.user ? { author: { id: i.user.id } } : {}),
+        ...(assignees.length > 0 ? { assignees: assignees.map((a) => ({ id: a.id })) } : {}),
+    };
+}
+function labelName(l) {
+    return typeof l === "string" ? l : l.name;
+}
+function mapIssueSummary(i) {
+    const who = mapUser(i.user);
+    const labels = i.labels?.map(labelName).filter((n) => !!n);
+    return {
+        id: i.id,
+        number: i.number,
+        title: i.title,
+        state: mapWorkItemState(i.state),
+        webUrl: i.html_url ?? "",
+        ...(i.body != null ? { description: i.body } : {}),
+        ...(labels && labels.length > 0 ? { labels } : {}),
+        ...(i.assignees
+            ? { assignees: i.assignees.map((a) => ({ id: a.id, username: a.login, name: a.name || a.login })) }
+            : {}),
+        ...(who ? { author: who } : {}),
+        ...(i.created_at ? { createdAt: i.created_at } : {}),
+        ...(i.due_on !== undefined ? { dueDate: i.due_on } : {}),
+    };
+}
+function mapComment(c) {
+    const who = mapUser(c.user);
+    return {
+        id: c.id,
+        body: c.body ?? "",
+        ...(who ? { author: who } : {}),
+        ...(c.created_at ? { createdAt: c.created_at } : {}),
+    };
+}
+function mapPrState(pr) {
+    if (pr.merged)
+        return "merged";
+    if (pr.state === "open")
+        return "open";
+    if (pr.state === "closed")
+        return "closed";
+    return pr.state;
+}
+function mapPr(pr) {
+    return {
+        id: pr.id,
+        number: pr.number,
+        title: pr.title,
+        state: mapPrState(pr),
+        sourceBranch: pr.head?.ref ?? "",
+        targetBranch: pr.base?.ref ?? "",
+        webUrl: pr.html_url ?? "",
+        ...(pr.draft !== undefined ? { draft: pr.draft } : {}),
+    };
+}
+function mapPrSummary(pr) {
+    const who = mapUser(pr.user);
+    return {
+        id: pr.id,
+        number: pr.number,
+        title: pr.title,
+        state: mapPrState(pr),
+        webUrl: pr.html_url ?? "",
+        ...(pr.body != null ? { description: pr.body } : {}),
+        ...(pr.head ? { sourceBranch: pr.head.ref } : {}),
+        ...(pr.base ? { targetBranch: pr.base.ref } : {}),
+        ...(who ? { author: who } : {}),
+        ...(pr.created_at ? { createdAt: pr.created_at } : {}),
+        ...(pr.updated_at ? { updatedAt: pr.updated_at } : {}),
+        ...(pr.merged_at !== undefined ? { mergedAt: pr.merged_at } : {}),
+        ...(pr.draft !== undefined ? { draft: pr.draft } : {}),
+    };
+}
+function mapCommit(c) {
+    const msg = c.commit?.message ?? "";
+    const [title, ...rest] = msg.split("\n");
+    return {
+        id: c.sha,
+        title: (title ?? "").trim(),
+        ...(rest.length ? { message: msg } : {}),
+        ...(c.commit?.author?.name ? { authorName: c.commit.author.name } : {}),
+        ...(c.commit?.author?.date ? { authoredDate: c.commit.author.date } : {}),
+        ...(c.html_url ? { webUrl: c.html_url } : {}),
+    };
+}
+function mapCompare(c) {
+    return {
+        commits: (c.commits ?? []).map((x) => {
+            const title = x.commit?.message ? x.commit.message.split("\n")[0]?.trim() : undefined;
+            return {
+                id: x.sha,
+                ...(title ? { title } : {}),
+                ...(x.commit?.author?.name ? { authorName: x.commit.author.name } : {}),
+                ...(x.commit?.author?.date ? { createdAt: x.commit.author.date } : {}),
+            };
+        }),
+        ...(c.files
+            ? {
+                diffs: c.files.map((f) => ({
+                    oldPath: f.previous_filename ?? f.filename,
+                    newPath: f.filename,
+                    ...(f.patch ? { diff: f.patch } : {}),
+                    ...(typeof f.status === "string"
+                        ? {
+                            newFile: f.status === "added",
+                            deletedFile: f.status === "removed",
+                            renamedFile: f.status === "renamed",
+                        }
+                        : {}),
+                })),
+            }
+            : {}),
+    };
+}
+// GitHub's permission values: admin | maintain | write | triage | read | none.
+function normalizePermission(perm, role) {
+    const p = (perm ?? "").toLowerCase();
+    const r = (role ?? "").toLowerCase();
+    const v = p || r;
+    if (v === "admin")
+        return "admin";
+    if (v === "maintain")
+        return "write";
+    if (v === "write" || v === "push")
+        return "write";
+    if (v === "triage")
+        return "read";
+    if (v === "read" || v === "pull")
+        return "read";
+    if (v === "none")
+        return "none";
+    return undefined;
+}
+function normalizeRoleName(role) {
+    const r = (role ?? "").toLowerCase();
+    if (r === "admin")
+        return "admin";
+    if (r === "maintain" || r === "write")
+        return "write";
+    if (r === "triage" || r === "read")
+        return "read";
+    return undefined;
+}
+// GitHub issue `labels` on collaborators etc. can be objects; map to names.
+function normalizeChangeState(state) {
+    if (!state)
+        return undefined;
+    if (state === "opened")
+        return "open";
+    return state;
+}
+// ---- Driver ----------------------------------------------------------------
+export function createGithubPlatform() {
+    const platform = "github";
+    const apiBase = () => config.GITHUB_API_URL.replace(/\/$/, "");
+    function repoPath(fullName) {
+        const { owner, repo } = splitFullName(fullName);
+        return `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+    }
+    // Numeric repo id -> full_name cache. The MCP + runner only carry ids.
+    const fullNameCache = new Map();
+    async function fullNameOf(repoId) {
+        const hit = fullNameCache.get(repoId);
+        if (hit)
+            return hit;
+        const repo = await githubRequest(`/repositories/${repoId}`, { method: "GET" }, GithubRepositorySchema, BOT);
+        fullNameCache.set(repoId, repo.full_name);
+        return repo.full_name;
+    }
+    // ---- Ingress -------------------------------------------------------------
+    const ingress = {
+        platform,
+        eventName(headers) {
+            const v = headers["x-github-event"];
+            return Array.isArray(v) ? v[0] : v;
+        },
+        projectIdFromBody(body) {
+            const raw = body?.repository?.id;
+            return typeof raw === "number" ? raw : undefined;
+        },
+        deliveryId(headers) {
+            const v = headers["x-github-delivery"];
+            return Array.isArray(v) ? v[0] : v;
+        },
+        verifySignature(secret, headers, rawBody) {
+            const v = headers["x-hub-signature-256"];
+            const sig = Array.isArray(v) ? v[0] : v;
+            if (!sig || !secret)
+                return false;
+            const digest = "sha256=" + createHmac("sha256", secret).update(rawBody).digest("hex");
+            const got = Buffer.from(sig, "utf8");
+            const exp = Buffer.from(digest, "utf8");
+            if (got.length !== exp.length)
+                return false;
+            return timingSafeEqual(got, exp);
+        },
+        generateWebhookSecret() {
+            return randomBytes(32).toString("hex");
+        },
+        parseWebhook(headers, body) {
+            const event = this.eventName(headers);
+            if (event === "issue_comment") {
+                const p = GithubIssueCommentPayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                if (d.action !== "created")
+                    return null;
+                // Issues endpoints consider PRs issues; a PR comment is a review
+                // conversation, not a work-item mention — ignore it here.
+                if (d.issue.pull_request)
+                    return null;
+                return {
+                    kind: "comment",
+                    rawEvent: event,
+                    repo: mapRepo(d.repository),
+                    workItem: mapIssue(d.issue),
+                    actor: mapUser(d.sender),
+                    body: d.comment.body ?? "",
+                    commentId: d.comment.id,
+                };
+            }
+            if (event === "issues") {
+                const p = GithubIssuePayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                if (d.issue.pull_request)
+                    return null;
+                if (d.action === "closed") {
+                    return {
+                        kind: "workitem-close",
+                        rawEvent: event,
+                        repo: mapRepo(d.repository),
+                        workItem: mapIssue(d.issue),
+                        actor: mapUser(d.sender),
+                    };
+                }
+                if (d.action === "opened" || d.action === "reopened") {
+                    return {
+                        kind: "workitem-open",
+                        rawEvent: event,
+                        repo: mapRepo(d.repository),
+                        workItem: mapIssue(d.issue),
+                        actor: mapUser(d.sender),
+                        body: d.issue.body ?? "",
+                    };
+                }
+                return null;
+            }
+            if (event === "pull_request") {
+                const p = GithubPullRequestPayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                return {
+                    kind: "other",
+                    rawEvent: event,
+                    repo: mapRepo(d.repository),
+                    actor: mapUser(d.sender),
+                    ...(d.pull_request.head?.ref ? { sourceBranch: d.pull_request.head.ref } : {}),
+                };
+            }
+            if (event === "workflow_run") {
+                const p = GithubWorkflowRunPayloadSchema.safeParse(body);
+                if (!p.success)
+                    return null;
+                const d = p.data;
+                if (d.action !== "completed" || d.workflow_run.conclusion !== "failure")
+                    return null;
+                const run = d.workflow_run;
+                const prNumber = run.pull_requests?.find((pr) => pr.number !== undefined)?.number;
+                return {
+                    kind: "pipeline-failed",
+                    rawEvent: event,
+                    repo: mapRepo(d.repository),
+                    ...(run.head_branch ? { sourceBranch: run.head_branch } : {}),
+                    pipelineId: run.id,
+                    ...(run.head_sha ? { commitSha: run.head_sha } : {}),
+                    ...(prNumber !== undefined ? { changeRequestNumber: prNumber } : {}),
+                };
+            }
+            return null;
+        },
+    };
+    // ---- Work items ----------------------------------------------------------
+    async function issueComments(repoId, number, o = {}) {
+        const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubCommentSchema, BOT);
+        return rs.map(mapComment);
+    }
+    const workItems = {
+        async postComment(repoId, number, body) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments`, { method: "POST", body: JSON.stringify({ body }) }, GithubCommentSchema, BOT);
+            return mapComment(r);
+        },
+        // GitHub issue comments are flat, so a thread reply degrades to a
+        // top-level comment (still posts in the issue's comment stream).
+        async replyInThread(repoId, number, _commentId, body) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments`, { method: "POST", body: JSON.stringify({ body }) }, GithubCommentSchema, BOT);
+            return mapComment(r);
+        },
+        async postErrorReply(repoId, number, _triggeringCommentId, body) {
+            try {
+                await githubRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}/comments`, { method: "POST", body: JSON.stringify({ body }) }, GithubCommentSchema, BOT);
+            }
+            catch {
+                // Best-effort, matching GitLab's postErrorReply swallow-and-log.
+            }
+        },
+        async listComments(repoId, number) {
+            return issueComments(repoId, number);
+        },
+        async getWorkItem(repoId, number) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}`, { method: "GET" }, GithubIssueSchema, BOT);
+            return mapIssue(r);
+        },
+        async getWorkItemStateOrNull(repoId, number) {
+            try {
+                const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}`, { method: "GET" }, GithubIssueSchema, BOT);
+                return mapIssue(r).state === "closed" ? "closed" : "open";
+            }
+            catch (e) {
+                if (e instanceof PlatformHttpError && e.status === 404)
+                    return null;
+                throw e;
+            }
+        },
+        async getMemberPermission(repoId, user) {
+            const full = await fullNameOf(repoId);
+            const { owner, repo } = splitFullName(full);
+            let login = user.username;
+            if (!login) {
+                try {
+                    const u = await githubRequest(`/user/${user.id}`, { method: "GET" }, GithubUserSchema, BOT);
+                    login = u.login;
+                }
+                catch (e) {
+                    if (e instanceof PlatformHttpError && e.status === 404)
+                        return "none";
+                    throw e;
+                }
+            }
+            try {
+                const p = await githubRequest(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/collaborators/${encodeURIComponent(login)}/permission`, { method: "GET" }, GithubPermissionSchema, BOT);
+                return normalizePermission(p.permission, p.role_name) ?? "none";
+            }
+            catch (e) {
+                if (e instanceof PlatformHttpError && e.status === 404)
+                    return "none";
+                throw e;
+            }
+        },
+        async searchUsers(query, opts = {}) {
+            const q = query.trim();
+            if (q === "")
+                return [];
+            const perPage = Math.min(Math.max(opts.perPage ?? 20, 1), 100);
+            const rs = await githubRequestArray(`/search/users?q=${encodeURIComponent(q)}&per_page=${perPage}`, { method: "GET" }, GithubUserSchema, BOT);
+            return rs.slice(0, perPage).map((u) => ({ id: u.id, username: u.login, name: u.name || u.login }));
+        },
+        async resolveUser(username) {
+            // GET /users/{login} is an exact lookup (GitHub logins are
+            // case-insensitive). 404 → null (not-found).
+            const login = username.trim();
+            if (!login)
+                return null;
+            try {
+                const u = await githubRequest(`/users/${encodeURIComponent(login)}`, { method: "GET" }, GithubUserSchema, BOT);
+                return { id: u.id, username: u.login, name: u.name || u.login };
+            }
+            catch (e) {
+                if (e instanceof PlatformHttpError && e.status === 404)
+                    return null;
+                throw e;
+            }
+        },
+        async listWorkItems(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            params.set("state", normalizeChangeState(o.state) ?? "open");
+            if (o.labels)
+                params.set("labels", o.labels);
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/issues?${params.toString()}`, { method: "GET" }, GithubIssueSchema, BOT);
+            const filtered = rs.filter((i) => !i.pull_request);
+            const searched = o.search
+                ? filtered.filter((i) => i.title.toLowerCase().includes(o.search.toLowerCase()))
+                : filtered;
+            return searched.map(mapIssueSummary);
+        },
+        async getWorkItemSummary(repoId, number) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/issues/${number}`, { method: "GET" }, GithubIssueSchema, BOT);
+            return mapIssueSummary(r);
+        },
+        async listCommentsFull(repoId, number, o = {}) {
+            return issueComments(repoId, number, o);
+        },
+        async listLabels(repoId, o = {}) {
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/labels?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubLabelSchema, BOT);
+            const searched = o.search ? rs.filter((l) => l.name.toLowerCase().includes(o.search.toLowerCase())) : rs;
+            return searched.map((l) => ({
+                id: l.id,
+                name: l.name,
+                ...(l.color ? { color: l.color } : {}),
+                ...(l.description !== undefined ? { description: l.description } : {}),
+            }));
+        },
+        async listMilestones(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.state)
+                params.set("state", normalizeChangeState(o.state) ?? "open");
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/milestones?${params.toString()}`, { method: "GET" }, GithubMilestoneSchema, BOT);
+            const titled = o.title ? rs.filter((m) => m.title === o.title) : rs;
+            return titled.map((m) => ({
+                id: m.id,
+                number: m.number,
+                title: m.title,
+                state: m.state,
+                ...(m.description !== undefined ? { description: m.description } : {}),
+                ...(m.due_on !== undefined ? { dueDate: m.due_on } : {}),
+                ...(m.html_url ? { webUrl: m.html_url } : {}),
+            }));
+        },
+    };
+    // ---- Change requests -----------------------------------------------------
+    const changeRequests = {
+        async list(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            // GitHub PR state is open|closed|all; "merged" is a closed PR with a
+            // merged_at timestamp, handled by the client-side filter below.
+            const state = o.state === "merged" ? "closed" : normalizeChangeState(o.state) ?? "open";
+            params.set("state", state);
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/pulls?${params.toString()}`, { method: "GET" }, GithubPullRequestSchema, BOT);
+            let filtered = o.sourceBranch ? rs.filter((p) => (p.head?.ref ?? "") === o.sourceBranch) : rs;
+            if (o.state === "merged")
+                filtered = filtered.filter((p) => p.merged === true);
+            const searched = o.search
+                ? filtered.filter((p) => p.title.toLowerCase().includes(o.search.toLowerCase()))
+                : filtered;
+            return searched.map(mapPrSummary);
+        },
+        async create(repoId, input) {
+            const full = await fullNameOf(repoId);
+            const { owner, repo } = splitFullName(full);
+            const r = await githubRequest(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls`, {
+                method: "POST",
+                body: JSON.stringify({
+                    title: input.title,
+                    body: input.description,
+                    head: input.sourceBranch,
+                    base: input.targetBranch,
+                    ...(input.assignee ? { assignees: [input.assignee.username] } : {}),
+                }),
+            }, GithubPullRequestSchema, BOT);
+            return mapPr(r);
+        },
+        async update(repoId, number, input) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/pulls/${number}`, { method: "PATCH", body: JSON.stringify({ title: input.title, body: input.description }) }, GithubPullRequestSchema, BOT);
+            return mapPr(r);
+        },
+        async get(repoId, number) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/pulls/${number}`, { method: "GET" }, GithubPullRequestSchema, BOT);
+            return mapPrSummary(r);
+        },
+        async listReviewDiscussions(repoId, number, o = {}) {
+            const full = await fullNameOf(repoId);
+            const reviews = await githubRequestArray(`${repoPath(full)}/pulls/${number}/reviews?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubReviewSchema, BOT).catch(() => []);
+            const comments = await githubRequestArray(`${repoPath(full)}/pulls/${number}/comments?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubReviewCommentSchema, BOT).catch(() => []);
+            const note = (c) => ({
+                id: c.id,
+                body: c.body ?? "",
+                ...(mapUser(c.user) ? { author: mapUser(c.user) } : {}),
+                ...(c.created_at ? { createdAt: c.created_at } : {}),
+                ...(c.path ? { position: { path: c.path, line: c.line ?? c.original_line ?? null } } : {}),
+            });
+            const byReview = new Map();
+            const orphan = [];
+            for (const c of comments) {
+                if (c.pull_request_review_id != null) {
+                    const list = byReview.get(c.pull_request_review_id) ?? [];
+                    list.push(c);
+                    byReview.set(c.pull_request_review_id, list);
+                }
+                else {
+                    orphan.push(c);
+                }
+            }
+            const out = [];
+            for (const r of reviews) {
+                const cs = byReview.get(r.id);
+                const body = r.body ?? "";
+                const notes = cs && cs.length > 0 ? cs.map(note) : body ? [{ id: r.id, body }] : [];
+                if (notes.length === 0)
+                    continue;
+                out.push({ id: String(r.id), individualNote: true, notes });
+            }
+            if (orphan.length > 0) {
+                out.push({ id: "comments", individualNote: true, notes: orphan.map(note) });
+            }
+            return out;
+        },
+        async listNotes(repoId, number, o = {}) {
+            return issueComments(repoId, number, o);
+        },
+    };
+    // ---- Repository ----------------------------------------------------------
+    async function defaultBranchOf(repoId) {
+        const repo = await githubRequest(`/repositories/${repoId}`, { method: "GET" }, GithubRepositorySchema, BOT);
+        return repo.default_branch ?? "main";
+    }
+    const repository = {
+        async getRepo(repoId) {
+            const repo = await githubRequest(`/repositories/${repoId}`, { method: "GET" }, GithubRepositorySchema, BOT);
+            // Heal the id -> full_name cache so a rename/transfer is picked up here
+            // and every later fullNameOf() call uses the new path.
+            fullNameCache.set(repoId, repo.full_name);
+            return mapRepo(repo);
+        },
+        async branchExists(repoId, branch) {
+            const full = await fullNameOf(repoId);
+            const res = await fetch(`${apiBase()}${repoPath(full)}/branches/${encodeURIComponent(branch)}`, {
+                headers: { Authorization: `Bearer ${config.PLATFORM_TOKEN}`, "User-Agent": "devbot" },
+            });
+            if (res.status === 404)
+                return false;
+            if (!res.ok)
+                throw new PlatformHttpError(res.status, `branchExists ${branch}`, await res.text());
+            return true;
+        },
+        async firstExistingBranch(repoId, branches) {
+            for (const b of branches) {
+                if (await repository.branchExists(repoId, b))
+                    return b;
+            }
+            return null;
+        },
+        async listBranches(repoId, o = {}) {
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/branches?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubBranchSchema, BOT);
+            const searched = o.search ? rs.filter((b) => b.name.includes(o.search)) : rs;
+            return searched.map((b) => ({
+                name: b.name,
+                ...(b.protected !== undefined ? { protected: b.protected } : {}),
+            }));
+        },
+        async listTree(repoId, o = {}) {
+            const full = await fullNameOf(repoId);
+            const ref = o.ref ?? (await defaultBranchOf(repoId));
+            const sub = o.path ? `/${o.path.split("/").map(encodeURIComponent).join("/")}` : "";
+            const rs = await githubRequestArray(`${repoPath(full)}/contents${sub}?ref=${encodeURIComponent(ref)}&${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubContentSchema, BOT);
+            return rs.map((e) => ({
+                id: e.sha ?? "",
+                name: e.name,
+                type: e.type === "dir" ? "tree" : "blob",
+                path: e.path,
+            }));
+        },
+        async getFile(repoId, filePath, ref, maxBytes) {
+            const full = await fullNameOf(repoId);
+            const params = new URLSearchParams();
+            if (ref)
+                params.set("ref", ref);
+            const path = `${repoPath(full)}/contents/${filePath.split("/").map(encodeURIComponent).join("/")}${params.toString() ? `?${params.toString()}` : ""}`;
+            try {
+                const { bytes, contentType } = await githubFetchRaw(path, BOT, maxBytes, {
+                    headers: { Accept: "application/vnd.github.raw" },
+                });
+                return { content: bytes.toString("utf8"), truncated: false, bytes: bytes.byteLength, contentType };
+            }
+            catch (e) {
+                if (e instanceof GithubOversizedError) {
+                    return { content: "", truncated: true, bytes: maxBytes, contentType: "text/plain" };
+                }
+                throw e;
+            }
+        },
+        async listCommits(repoId, o = {}) {
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.refName)
+                params.set("sha", o.refName);
+            if (o.path)
+                params.set("path", o.path);
+            if (o.since)
+                params.set("since", o.since);
+            if (o.until)
+                params.set("until", o.until);
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/commits?${params.toString()}`, { method: "GET" }, GithubCommitListSchema, BOT);
+            return rs.map(mapCommit);
+        },
+        async getCommit(repoId, sha) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/commits/${encodeURIComponent(sha)}`, { method: "GET" }, GithubCommitListSchema, BOT);
+            return mapCommit(r);
+        },
+        async compare(repoId, from, to) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/compare/${encodeURIComponent(from)}...${encodeURIComponent(to)}`, { method: "GET" }, GithubCompareSchema, BOT);
+            return mapCompare(r);
+        },
+        async listTags(repoId, o = {}) {
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/tags?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubTagSchema, BOT);
+            const searched = o.search ? rs.filter((t) => t.name.includes(o.search)) : rs;
+            return searched.map((t) => ({
+                name: t.name,
+                ...(t.commit?.sha ? { target: t.commit.sha } : {}),
+            }));
+        },
+        async listMembers(repoId, o = {}) {
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/collaborators?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubCollaboratorSchema, BOT);
+            const searched = o.search
+                ? rs.filter((c) => c.login.includes(o.search) || (c.name ?? "").includes(o.search))
+                : rs;
+            return searched.map((c) => {
+                const perm = normalizePermission(c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : c.permissions?.push ? "write" : c.permissions?.triage ? "triage" : c.permissions?.pull ? "read" : undefined, c.role_name) ?? normalizeRoleName(c.role_name);
+                return {
+                    id: c.id,
+                    username: c.login,
+                    name: c.name || c.login,
+                    ...(perm !== undefined ? { permission: perm } : {}),
+                };
+            });
+        },
+        async listReleases(repoId, o = {}) {
+            const rs = await githubRequestArray(`${repoPath(await fullNameOf(repoId))}/releases?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubReleaseSchema, BOT);
+            const searched = o.search
+                ? rs.filter((r) => r.tag_name.includes(o.search) || (r.name ?? "").includes(o.search))
+                : rs;
+            return searched.map((r) => ({
+                tagName: r.tag_name,
+                ...(r.name ? { name: r.name } : {}),
+                ...(r.body != null ? { description: r.body } : {}),
+                ...(r.created_at ? { createdAt: r.created_at } : {}),
+                ...(r.published_at ? { releasedAt: r.published_at } : {}),
+                ...(r.author ? { author: mapUser(r.author) } : {}),
+            }));
+        },
+        // GitHub has no REST API for wikis (they are a separate git repo).
+        async listWikiPages() {
+            throw new UnsupportedError("repository.listWikiPages");
+        },
+        async getWikiPage() {
+            throw new UnsupportedError("repository.getWikiPage");
+        },
+        async searchProject(repoId, search, o = {}) {
+            // GitHub's REST search here is code search only. Any other neutral scope
+            // is a typed unsupported result rather than a silent wrong answer.
+            if (o.scope && o.scope !== "code") {
+                throw new UnsupportedError(`repository.searchProject(scope=${o.scope})`);
+            }
+            const full = await fullNameOf(repoId);
+            const params = new URLSearchParams({
+                q: `repo:${full} ${search}`.trim(),
+                ...(o.page ? { page: String(o.page) } : {}),
+                per_page: String(o.perPage ?? 30),
+            });
+            try {
+                const r = await githubRequest(`/search/code?${params.toString()}`, { method: "GET" }, GithubSearchCodeSchema, BOT);
+                return r.items.map((h) => ({
+                    ...(typeof h.name === "string" ? { title: h.name } : {}),
+                    ...(typeof h.path === "string" ? { path: h.path } : {}),
+                    ...(h.html_url ? { webUrl: h.html_url } : {}),
+                    ...(h.text_matches && h.text_matches[0]?.fragment ? { data: h.text_matches[0].fragment } : {}),
+                }));
+            }
+            catch (e) {
+                // Code search requires the repo scope / indexing and can 403 or 422.
+                // Degrade to an empty result rather than failing the whole MCP call.
+                if (e instanceof PlatformHttpError && (e.status === 403 || e.status === 422 || e.status === 404))
+                    return [];
+                throw e;
+            }
+        },
+    };
+    // ---- CI (Actions) --------------------------------------------------------
+    const ci = {
+        async listPipelines(repoId, o = {}) {
+            if (o.scope)
+                throw new UnsupportedError(`ci.listPipelines(scope=${o.scope})`);
+            const params = new URLSearchParams(pageParams(o.page, o.perPage ?? 100));
+            if (o.ref)
+                params.set("branch", o.ref);
+            if (o.status)
+                params.set("status", o.status);
+            if (o.username)
+                params.set("actor", o.username);
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/actions/runs?${params.toString()}`, { method: "GET" }, GithubWorkflowRunsSchema, BOT);
+            return r.workflow_runs.map(mapRun);
+        },
+        async getPipeline(repoId, pipelineId) {
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/actions/runs/${pipelineId}`, { method: "GET" }, GithubActionRunSchema, BOT);
+            return mapRun(r);
+        },
+        async listPipelineJobs(repoId, pipelineId, o = {}) {
+            if (o.scope)
+                throw new UnsupportedError(`ci.listPipelineJobs(scope=${o.scope})`);
+            const r = await githubRequest(`${repoPath(await fullNameOf(repoId))}/actions/runs/${pipelineId}/jobs?${pageParams(o.page, o.perPage ?? 100)}`, { method: "GET" }, GithubWorkflowJobsSchema, BOT);
+            const jobs = r.jobs.map((j) => ({
+                id: j.id,
+                name: j.name,
+                status: j.conclusion ?? j.status,
+                ...(j.html_url ? { webUrl: j.html_url } : {}),
+                ...(j.started_at !== undefined ? { startedAt: j.started_at } : {}),
+                ...(j.completed_at !== undefined ? { finishedAt: j.completed_at } : {}),
+            }));
+            // Neutral `outcome: "failed"` filters client-side: the Actions jobs
+            // endpoint has no failure scope (unlike GitLab).
+            return o.outcome === "failed" ? jobs.filter((j) => j.status === "failure") : jobs;
+        },
+        async getJobLog(repoId, jobId, maxBytes) {
+            const path = `${repoPath(await fullNameOf(repoId))}/actions/jobs/${jobId}/logs`;
+            // GitHub serves the log as a ZIP, so we must fetch and inflate the whole
+            // archive before we can slice its text. The archive is bounded by a
+            // safety cap; the tail is taken on the inflated text.
+            const { bytes } = await githubFetchRaw(path, BOT, GITHUB_LOG_ARCHIVE_MAX_BYTES);
+            const text = Buffer.from(zipText(bytes), "utf8");
+            return tailFileContent(text, text.byteLength, "text/plain", maxBytes);
+        },
+    };
+    // ---- Git auth ------------------------------------------------------------
+    const gitAuth = {
+        gitExtraHeader: () => gitExtraHeaderGithub(config.PLATFORM_TOKEN),
+        cloneUrl: (path) => `${config.PLATFORM_URL.replace(/\/$/, "")}/${path}.git`,
+    };
+    // ---- Attachments ---------------------------------------------------------
+    // GitHub uploads appear as absolute URLs on github.com/user-attachments or
+    // user-images.githubusercontent.com. The fetcher pulls the asset URL with the
+    // bot token (needed for private repos).
+    const attachments = {
+        findRefs: (body) => findGithubAttachmentRefs(body),
+        download: (_repoId, ref) => downloadGithubAttachment(ref),
+        // GitHub has no public REST API to attach a file to an issue or comment
+        // (the web UI uses a private endpoint). Typed gap, per the parity rules.
+        upload: async () => {
+            throw new UnsupportedError("attachments.upload");
+        },
+    };
+    // ---- Onboarding ----------------------------------------------------------
+    const onboarding = {
+        authorizeUrl(state) {
+            const params = new URLSearchParams({
+                client_id: config.PLATFORM_OAUTH_CLIENT_ID,
+                redirect_uri: `${config.PUBLIC_URL}/oauth/callback`,
+                // `repo` covers private repos, webhooks and collaborator management.
+                scope: "repo read:user",
+                state,
+            });
+            return `https://github.com/login/oauth/authorize?${params.toString()}`;
+        },
+        async exchangeCode(code) {
+            const res = await fetch("https://github.com/login/oauth/access_token", {
+                method: "POST",
+                headers: { "Content-Type": "application/json", Accept: "application/json" },
+                body: JSON.stringify({
+                    client_id: config.PLATFORM_OAUTH_CLIENT_ID,
+                    client_secret: config.PLATFORM_OAUTH_CLIENT_SECRET,
+                    code,
+                    redirect_uri: `${config.PUBLIC_URL}/oauth/callback`,
+                }),
+            });
+            if (!res.ok)
+                throw new PlatformHttpError(res.status, "oauth token", await res.text());
+            const parsed = z.object({ access_token: z.string().min(1) }).safeParse(await res.json());
+            if (!parsed.success)
+                throw new Error("oauth token schema mismatch");
+            return { accessToken: parsed.data.access_token };
+        },
+        async currentUser(accessToken) {
+            const u = await githubRequest("/user", { method: "GET" }, GithubUserSchema, { kind: "bearer", token: accessToken });
+            // Authorization (allowlist) is enforced platform-neutrally in
+            // oauth-routes; the driver only reports identity.
+            return {
+                id: u.id,
+                username: u.login,
+            };
+        },
+        async listProjects(accessToken, q) {
+            const out = [];
+            for (let page = 1;; page++) {
+                const rs = await githubRequestArray(`/user/repos?${pageParams(page, 100)}&affiliation=owner,collaborator,organization_member&sort=full_name`, { method: "GET" }, GithubRepositorySchema, { kind: "bearer", token: accessToken });
+                if (rs.length === 0)
+                    break;
+                for (const r of rs)
+                    out.push({ id: r.id, path: r.full_name, webUrl: r.html_url ?? "" });
+                if (rs.length < 100)
+                    break;
+            }
+            const query = q?.trim().toLowerCase();
+            return query ? out.filter((p) => p.path.toLowerCase().includes(query)) : out;
+        },
+        async addBot(accessToken, project) {
+            const { owner, repo } = splitFullName(project.path);
+            await githubVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/collaborators/${encodeURIComponent(config.BOT_USERNAME)}`, { method: "PUT", body: JSON.stringify({ permission: "push" }) }, { kind: "bearer", token: accessToken }, { okStatuses: [201, 204, 404, 422] });
+        },
+        async removeBot(accessToken, project) {
+            const { owner, repo } = splitFullName(project.path);
+            await githubVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/collaborators/${encodeURIComponent(config.BOT_USERNAME)}`, { method: "DELETE" }, { kind: "bearer", token: accessToken }, { okStatuses: [204, 404] });
+        },
+        async findOrCreateWebhook(accessToken, project, url, secret) {
+            const { owner, repo } = splitFullName(project.path);
+            const base = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks`;
+            const hooks = await githubRequestArray(base, { method: "GET" }, GithubWebhookSchema, { kind: "bearer", token: accessToken });
+            const existing = hooks.find((h) => h.config?.url === url);
+            if (existing)
+                return { id: existing.id, created: false };
+            const created = await githubRequest(base, {
+                method: "POST",
+                body: JSON.stringify({
+                    name: "web",
+                    active: true,
+                    events: ["issues", "issue_comment", "pull_request", "workflow_run"],
+                    config: { url, content_type: "json", secret },
+                }),
+            }, GithubWebhookSchema, { kind: "bearer", token: accessToken });
+            return { id: created.id, created: true };
+        },
+        async setWebhookSecret(accessToken, project, webhookId, secret) {
+            const { owner, repo } = splitFullName(project.path);
+            await githubVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks/${webhookId}`, {
+                method: "PATCH",
+                body: JSON.stringify({
+                    config: { url: `${config.PUBLIC_URL}/webhook`, content_type: "json", secret },
+                }),
+            }, { kind: "bearer", token: accessToken });
+        },
+        async ensureCiFailureEvents(accessToken, project, webhookId) {
+            const { owner, repo } = splitFullName(project.path);
+            const base = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks`;
+            const hooks = await githubRequestArray(base, { method: "GET" }, GithubWebhookSchema, { kind: "bearer", token: accessToken });
+            const existing = hooks.find((h) => h.id === webhookId);
+            const current = existing?.events ?? ["issues", "issue_comment", "pull_request"];
+            if (current.includes("workflow_run"))
+                return;
+            await githubVoid(`${base}/${webhookId}`, {
+                method: "PATCH",
+                body: JSON.stringify({ events: [...new Set([...current, "workflow_run"])] }),
+            }, { kind: "bearer", token: accessToken });
+        },
+        async deleteWebhook(accessToken, project, webhookId) {
+            const { owner, repo } = splitFullName(project.path);
+            await githubVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks/${webhookId}`, { method: "DELETE" }, { kind: "bearer", token: accessToken }, { okStatuses: [204, 404] });
+        },
+        async testWebhook(accessToken, project, webhookId) {
+            const { owner, repo } = splitFullName(project.path);
+            try {
+                await githubVoid(`/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/hooks/${webhookId}/pings`, { method: "POST" }, { kind: "bearer", token: accessToken }, { okStatuses: [204] });
+            }
+            catch {
+                // Test delivery is best-effort, matching GitLab's swallow.
+            }
+        },
+    };
+    // ---- Links -------------------------------------------------------------
+    const links = {
+        workItemUrl(projectPath, number) {
+            if (!projectPath || !Number.isInteger(number) || number <= 0)
+                return "";
+            return `${config.PLATFORM_URL.replace(/\/$/, "")}/${projectPath}/issues/${number}`;
+        },
+    };
+    return {
+        name: platform,
+        ingress,
+        workItems,
+        changeRequests,
+        repository,
+        ci,
+        gitAuth,
+        attachments,
+        onboarding,
+        links,
+    };
+}
+function mapRun(r) {
+    const name = r.display_title ?? r.name;
+    return {
+        id: r.id,
+        status: r.conclusion ?? r.status ?? "unknown",
+        ...(r.head_branch ? { ref: r.head_branch } : {}),
+        ...(r.head_sha ? { sha: r.head_sha } : {}),
+        ...(name ? { name } : {}),
+        ...(r.html_url ? { webUrl: r.html_url } : {}),
+        ...(r.created_at ? { createdAt: r.created_at } : {}),
+        ...(r.updated_at ? { updatedAt: r.updated_at } : {}),
+    };
+}
+//# sourceMappingURL=index.js.map