@zhangj1164/dsh-github-issue 0.1.0 → 0.3.0

package/lib/index.js

@@ -1,6 +1,435 @@
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { Service } from "@deepseek-ai/cordis";
 import s from "@deepseek-ai/schemastery";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { z } from "zod";
 import { EMPTY_RESPONSE_CODE, createUserMessage } from "@deepseek-ai/dsh-llm";
+//#region src/github.ts
+/**
+* The GitHub REST API version this client speaks.
+*
+* Pinned rather than configurable: it is the protocol the request shape was
+* written against, and a deployment that changed it would silently receive a
+* different response schema.
+*/
+const GITHUB_API_VERSION = "2022-11-28";
+/** User-Agent GitHub requires on every REST request. */
+const USER_AGENT = "@zhangj1164/dsh-github-issue";
+/** Repository URLs of the form `https://host/owner/repo`, with one optional trailing slash. */
+const REPOSITORY_URL = /^https?:\/\/[^/\s]+\/([^/\s]+)\/([^/\s]+?)\/?$/u;
+/**
+* Split a repository URL into owner and name.
+* @param repoUrl - the configured repository URL.
+* @returns the repository parts, or `undefined` when the URL is not one.
+*/
+function parseRepository(repoUrl) {
+	const match = REPOSITORY_URL.exec(repoUrl.trim());
+	if (match?.[1] === void 0 || match[2] === void 0) return void 0;
+	return {
+		owner: match[1],
+		repo: match[2]
+	};
+}
+/**
+* GitHub issue intake over the REST API.
+*
+* The class owns request construction, authentication, and response
+* classification. It holds no state and caches nothing, so one instance can
+* serve every repository a deployment configures.
+*/
+var GithubIssueClient = class {
+	repoUrl;
+	repository;
+	apiBaseUrl;
+	token;
+	fetchImpl;
+	timeoutMs;
+	/**
+	* @param options - repository, credential, and transport policy.
+	*/
+	constructor(options) {
+		this.repoUrl = options.repoUrl;
+		this.repository = parseRepository(options.repoUrl);
+		this.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/u, "");
+		this.token = options.token;
+		this.fetchImpl = options.fetchImpl ?? fetch;
+		this.timeoutMs = options.timeoutMs;
+	}
+	/**
+	* Create one issue in the configured repository.
+	*
+	* @param report - the optimized issue report; its title becomes the issue
+	*   title and its body the issue body.
+	* @returns the created issue's number and URL, or a stable failure.
+	*/
+	async createIssue(report) {
+		const repository = this.repository;
+		if (repository === void 0) return this.fail("invalid-repo", `"${this.repoUrl}" is not a repository URL`);
+		if (this.token === void 0) return this.fail("auth-missing", "no GitHub token is configured; set the configured token environment variable or token command");
+		const title = report.title.trim();
+		if (title.length === 0) return this.fail("invalid-request", "the issue report has no title");
+		const response = await this.send({
+			method: "POST",
+			path: `/repos/${repository.owner}/${repository.repo}/issues`,
+			body: {
+				title,
+				body: report.body,
+				labels: [...report.labels]
+			}
+		});
+		if (!response.ok) return response;
+		const payload = response.value;
+		const number = readNumber(payload, "number");
+		const url = readString(payload, "html_url");
+		if (number === void 0 || url === void 0) return this.fail("http-failure", "GitHub accepted the issue but the response carried no number or URL");
+		return {
+			ok: true,
+			value: Object.freeze({
+				number,
+				url
+			})
+		};
+	}
+	/**
+	* List open issues carrying one claim label.
+	*
+	* Pull requests are excluded explicitly: GitHub's issue endpoints return
+	* them, and a pull request is never an issue a session should claim.
+	*
+	* @param label - the claim label every returned issue carries.
+	* @param max - the largest number of issues to request.
+	* @returns the matching issues, or a stable failure.
+	*/
+	async listClaimable(label, max) {
+		const repository = this.repository;
+		if (repository === void 0) return this.fail("invalid-repo", `"${this.repoUrl}" is not a repository URL`);
+		if (this.token === void 0) return this.fail("auth-missing", "no GitHub token is configured; set the configured token environment variable or token command");
+		const query = new URLSearchParams({
+			state: "open",
+			labels: label,
+			per_page: String(max)
+		});
+		const response = await this.send({
+			method: "GET",
+			path: `/repos/${repository.owner}/${repository.repo}/issues?${query.toString()}`
+		});
+		if (!response.ok) return response;
+		if (!Array.isArray(response.value)) return this.fail("http-failure", "GitHub returned a list response that is not an array");
+		const tasks = [];
+		for (const entry of response.value) {
+			const task = asTask(entry, label);
+			if (task !== void 0) tasks.push(task);
+		}
+		return {
+			ok: true,
+			value: Object.freeze(tasks)
+		};
+	}
+	/**
+	* Send one request and decode its JSON body.
+	* @param request - verb, path, and optional body.
+	* @returns the decoded payload or a classified failure.
+	*/
+	async send(request) {
+		let response;
+		try {
+			response = await this.fetchImpl(`${this.apiBaseUrl}${request.path}`, {
+				method: request.method,
+				headers: this.headers(),
+				...request.body === void 0 ? {} : { body: JSON.stringify(request.body) },
+				signal: AbortSignal.timeout(this.timeoutMs)
+			});
+		} catch (error) {
+			return this.fail("network-failure", `the request to GitHub failed: ${describeError$1(error)}`);
+		}
+		if (!response.ok) return this.httpFailure(response);
+		try {
+			const text = await response.text();
+			return {
+				ok: true,
+				value: text.trim().length === 0 ? {} : JSON.parse(text)
+			};
+		} catch (error) {
+			return this.fail("http-failure", `GitHub returned a response that could not be read: ${describeError$1(error)}`);
+		}
+	}
+	/**
+	* Classify one non-success HTTP response.
+	* @param response - the failed response.
+	* @returns the stable failure for its status.
+	*/
+	async httpFailure(response) {
+		const detail = await readErrorMessage(response);
+		if (response.status === 401) return this.fail("auth-failure", `GitHub rejected the token (401)${detail}`);
+		if (response.status === 403) {
+			if (response.headers.get("x-ratelimit-remaining") === "0") return this.fail("rate-limited", `GitHub rate limit exhausted (403)${detail}`);
+			return this.fail("auth-failure", `GitHub refused the request (403)${detail}`);
+		}
+		if (response.status === 422) return this.fail("invalid-request", `GitHub rejected the request as invalid (422)${detail}`);
+		return this.fail("http-failure", `GitHub returned HTTP ${response.status}${detail}`);
+	}
+	/**
+	* The headers every request carries.
+	* @returns the header map, including the bearer token when one is configured.
+	*/
+	headers() {
+		const headers = {
+			accept: "application/vnd.github+json",
+			"content-type": "application/json",
+			"user-agent": USER_AGENT,
+			"x-github-api-version": GITHUB_API_VERSION
+		};
+		if (this.token !== void 0) headers.authorization = `Bearer ${this.token}`;
+		return headers;
+	}
+	/**
+	* Build one failure result.
+	* @param code - stable failure code.
+	* @param message - user-facing explanation.
+	* @returns the failure result.
+	*/
+	fail(code, message) {
+		return {
+			ok: false,
+			error: {
+				code,
+				message
+			}
+		};
+	}
+};
+/**
+* Read a string member from an unknown JSON object.
+* @param value - decoded JSON.
+* @param key - member name.
+* @returns the string value, or `undefined`.
+*/
+function readString(value, key) {
+	if (!isRecord(value)) return void 0;
+	const member = value[key];
+	return typeof member === "string" ? member : void 0;
+}
+/**
+* Read a numeric member from an unknown JSON object.
+* @param value - decoded JSON.
+* @param key - member name.
+* @returns the number value, or `undefined`.
+*/
+function readNumber(value, key) {
+	if (!isRecord(value)) return void 0;
+	const member = value[key];
+	return typeof member === "number" && Number.isFinite(member) ? member : void 0;
+}
+/**
+* Narrow one decoded API entry into a claimable task.
+*
+* Malformed entries and pull requests are skipped rather than failing the whole
+* list: one unexpected row must not hide every real task behind it.
+*
+* @param entry - one array member of the issues response.
+* @param label - the claim label the entry must carry.
+* @returns the task, or `undefined` when the entry is not claimable.
+*/
+function asTask(entry, label) {
+	if (!isRecord(entry)) return void 0;
+	if ("pull_request" in entry) return void 0;
+	const number = readNumber(entry, "number");
+	const title = readString(entry, "title");
+	const url = readString(entry, "html_url");
+	if (number === void 0 || title === void 0 || url === void 0) return void 0;
+	const labels = readLabels(entry["labels"]);
+	if (!labels.some((name) => name.toLowerCase() === label.toLowerCase())) return void 0;
+	const body = readString(entry, "body") ?? "";
+	return Object.freeze({
+		number,
+		title,
+		body,
+		url,
+		labels: Object.freeze(labels)
+	});
+}
+/**
+* Read the label names of one issue.
+* @param value - untyped `labels` member.
+* @returns the non-empty names, in response order.
+*/
+function readLabels(value) {
+	if (!Array.isArray(value)) return [];
+	const names = [];
+	for (const entry of value) {
+		const name = isRecord(entry) ? readString(entry, "name") : void 0;
+		if (name !== void 0 && name.length > 0) names.push(name);
+	}
+	return names;
+}
+/**
+* Read the message GitHub attached to a failed response.
+* @param response - the failed response.
+* @returns `: message` for the failure text, or an empty string.
+*/
+async function readErrorMessage(response) {
+	try {
+		const text = await response.text();
+		if (text.length === 0) return "";
+		const parsed = JSON.parse(text);
+		const message = isRecord(parsed) ? readString(parsed, "message") : void 0;
+		return message === void 0 || message.length === 0 ? "" : `: ${message}`;
+	} catch {
+		return "";
+	}
+}
+/**
+* Report whether an unknown value is a plain object.
+* @param value - candidate value.
+* @returns true for a non-null, non-array object.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* Render an unknown thrown value as a message.
+* @param error - the thrown value.
+* @returns a non-empty message.
+*/
+function describeError$1(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
+//#endregion
+//#region src/intake.ts
+/**
+* The dispatch prompt a deployment gets when it configures none.
+*
+* The placeholders are documented on {@link renderDispatchPrompt}; the text
+* tells the receiving Session where the issue is and which workflow to follow,
+* without assuming a repository-specific branch naming scheme.
+*/
+const DEFAULT_DISPATCH_PROMPT = [
+	"你在处理 GitHub issue #{number}：{title}",
+	"",
+	"{url}",
+	"",
+	"请按仓库 AGENTS.md 的工作流完成它：从最新 main 切分支、实现并补测试、跑通门禁、开 PR 并引用 #{number}。不要直接提交到 main。",
+	"",
+	"Issue 正文：",
+	"{body}"
+].join("\n");
+/** Placeholders {@link renderDispatchPrompt} replaces. */
+const PLACEHOLDER = /\{(number|title|url|body|labels)\}/gu;
+/**
+* Strip the leading `## title` line from an optimized report body.
+*
+* The optimizer repeats the title as the body's first heading so the same text
+* can drive the pre-filled URL form. GitHub takes the title as its own field,
+* so filing that body unchanged would show the title twice.
+*
+* @param report - the optimized report.
+* @returns the body without its leading title heading.
+*/
+function issueBody(report) {
+	const lines = report.body.replace(/\r\n/gu, "\n").split("\n");
+	if (/^##\s+/u.test(lines[0] ?? "")) {
+		lines.shift();
+		while (lines.length > 0 && (lines[0] ?? "").trim().length === 0) lines.shift();
+	}
+	return lines.join("\n").trimEnd();
+}
+/**
+* Render the dispatch prompt for one issue.
+*
+* Supported placeholders are `{number}`, `{title}`, `{url}`, `{body}`, and
+* `{labels}`. An unknown `{token}` is left untouched rather than dropped, so a
+* typo in a deployment template stays visible instead of silently disappearing.
+*
+* @param template - the configured prompt template.
+* @param issue - the issue being dispatched.
+* @returns the prompt the receiving Session reads.
+*/
+function renderDispatchPrompt(template, issue) {
+	const values = {
+		number: String(issue.number),
+		title: issue.title,
+		url: issue.url,
+		body: issue.body,
+		labels: issue.labels.join(", ")
+	};
+	return template.replace(PLACEHOLDER, (_match, key) => values[key] ?? "");
+}
+/**
+* Format one instant as a local calendar day.
+*
+* The key is the deployment's local date, not UTC's: "today" for a user in
+* Asia/Shanghai starts eight hours before UTC's, and a UTC key would let a late
+* restart skip the day or run the check twice.
+*
+* @param now - instant in epoch milliseconds.
+* @param timeZone - IANA zone; an empty value follows the host's own zone.
+* @returns the `YYYY-MM-DD` local date.
+*/
+function localDayKey(now, timeZone) {
+	const parts = new Intl.DateTimeFormat("en-US", {
+		...timeZone.length === 0 ? {} : { timeZone },
+		year: "numeric",
+		month: "2-digit",
+		day: "2-digit"
+	}).formatToParts(new Date(now));
+	const read = (type) => parts.find((part) => part.type === type)?.value ?? "";
+	return `${read("year")}-${read("month")}-${read("day")}`;
+}
+/**
+* Verify that one IANA time-zone name is usable.
+*
+* Called while the service configures itself, so a typo fails at load with a
+* named field instead of at the first startup check, hours later.
+*
+* @param timeZone - candidate zone; an empty value is always valid.
+* @returns true when the zone resolves.
+*/
+function isValidTimeZone(timeZone) {
+	if (timeZone.length === 0) return true;
+	try {
+		new Intl.DateTimeFormat("en-US", { timeZone });
+		return true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/spec.ts
+/** Table key of the single intake state row. */
+const INTAKE_STATE_KEY = "intake";
+/** Runtime schema for one dispatched issue. */
+const intakeDispatchedSchema = z.object({
+	number: z.number().int().positive(),
+	day: z.string().min(1),
+	sessionId: z.string().min(1)
+});
+/** Runtime schema for the persisted intake state. */
+const intakeStateSchema = z.object({
+	lastCheckedDay: z.string(),
+	dispatched: z.array(intakeDispatchedSchema)
+});
+/**
+* Build the storage-domain form of the intake state, on demand.
+*
+* The import is dynamic so this package stays loadable without
+* `@deepseek-ai/dsh-storage-domain`: that package is an optional peer, and a
+* deployment that does not ship it must lose the daily check, not the whole
+* plugin. Every DSH installation includes it, so the failure path is a
+* defence rather than a routine route.
+*
+* @returns the declared domain, ready for `storageDomain.open`.
+*/
+async function createIntakeDomain() {
+	const { defineDomain, domainTable } = await import("@deepseek-ai/dsh-storage-domain");
+	return defineDomain({
+		name: "github_issue_intake",
+		version: 0,
+		tables: { state: domainTable(intakeStateSchema) }
+	});
+}
+//#endregion
 //#region src/llm-text.ts
 /**
 * Model-text helper for this service: ask a model for one block of text and
@@ -152,11 +581,24 @@ var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializ
 };
 /** Schemastery configuration for the GitHub-issue service. */
 const Config = s.object({
-	repoUrl: s.string().default("https://github.com/zhangj1164/dsh-mega-plugins"),
+	repoUrl: s.string().default("https://github.com/zhangj1164/dsh-mega-plugins").volatile(),
 	maxPrefillUrlLength: s.number().default(7e3),
 	prefillTruncationNote: s.string().default("\n\n> （正文过长，已截断以适配 GitHub 的 URL 长度限制。完整正文见备忘面板的「复制完整正文」。）"),
 	provider: s.string(),
-	model: s.string()
+	model: s.string(),
+	tokenEnv: s.string().default("GITHUB_TOKEN"),
+	token: s.string(),
+	tokenCommand: s.string().default("gh auth token"),
+	tokenCommandTimeoutMs: s.number().step(1).min(1e3).max(12e4).default(1e4),
+	apiBaseUrl: s.string().default("https://api.github.com"),
+	requestTimeoutMs: s.number().step(1).min(1e3).max(18e4).default(15e3),
+	claimLabel: s.string().default("ready-for-agent").volatile(),
+	maxIssuesPerRun: s.number().step(1).min(1).max(20).default(3).volatile(),
+	autopilotEnabled: s.boolean().default(false).volatile(),
+	autopilotCwd: s.string().default("").volatile(),
+	autopilotPreset: s.string().default("").volatile(),
+	autopilotTimeZone: s.string().default("").volatile(),
+	autopilotPrompt: s.string().default(DEFAULT_DISPATCH_PROMPT).volatile()
 });
 /** The built-in system prompt that structures a natural-language issue description. */
 const OPTIMIZE_SYSTEM_PROMPT = [
@@ -251,8 +693,35 @@ const REPORT_SYSTEM_PROMPT = [
 	"",
 	"Return only the Markdown body. The first line must be a concise Chinese title."
 ].join("\n");
+/** The empty intake state used before the first pass and without storage. */
+const EMPTY_INTAKE_STATE = Object.freeze({
+	lastCheckedDay: "",
+	dispatched: Object.freeze([])
+});
+/** The failure returned when a report cannot become a GitHub issue at all. */
+const INVALID_ISSUE_REQUEST = {
+	ok: false,
+	error: {
+		code: "invalid-request",
+		message: "the issue report must carry a non-empty title and a body"
+	}
+};
+/** The failure returned when the deployment has no Session router. */
+const SESSION_UNAVAILABLE = {
+	ok: false,
+	error: {
+		code: "session-unavailable",
+		message: "this deployment mounts no Session controller or Agent registry, so no issue can be dispatched"
+	}
+};
+/** Promise-based `exec`, used only for the configured token command. */
+const execAsync = promisify(exec);
 /**
 * GitHub-issue generation and optimization service over the configured model.
+*
+* Beyond the model-backed report methods, the service owns the issue intake
+* loop: it files an optimized report through the GitHub REST API, lists the
+* issues that carry the claim label, and hands one of them to a fresh Session.
 */
 let GithubIssueService = (() => {
 	let _classSuper = TypertRemoteService;
@@ -260,12 +729,20 @@ let GithubIssueService = (() => {
 	let _generateReport_decorators;
 	let _prefilledIssueUrl_decorators;
 	let _optimizeIssue_decorators;
+	let _createIssue_decorators;
+	let _listClaimableIssues_decorators;
+	let _dispatchIssue_decorators;
+	let _runIntake_decorators;
 	return class GithubIssueService extends _classSuper {
 		static {
 			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
 			_generateReport_decorators = [Remote("generateReport")];
 			_prefilledIssueUrl_decorators = [Remote("prefilledIssueUrl")];
 			_optimizeIssue_decorators = [Remote("optimizeIssue")];
+			_createIssue_decorators = [Remote("createIssue")];
+			_listClaimableIssues_decorators = [Remote("listClaimableIssues")];
+			_dispatchIssue_decorators = [Remote("dispatchIssue")];
+			_runIntake_decorators = [Remote("runIntake")];
 			__esDecorate(this, null, _generateReport_decorators, {
 				kind: "method",
 				name: "generateReport",
@@ -299,6 +776,50 @@ let GithubIssueService = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _createIssue_decorators, {
+				kind: "method",
+				name: "createIssue",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "createIssue" in obj,
+					get: (obj) => obj.createIssue
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _listClaimableIssues_decorators, {
+				kind: "method",
+				name: "listClaimableIssues",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "listClaimableIssues" in obj,
+					get: (obj) => obj.listClaimableIssues
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _dispatchIssue_decorators, {
+				kind: "method",
+				name: "dispatchIssue",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "dispatchIssue" in obj,
+					get: (obj) => obj.dispatchIssue
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _runIntake_decorators, {
+				kind: "method",
+				name: "runIntake",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "runIntake" in obj,
+					get: (obj) => obj.runIntake
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
 				enumerable: true,
 				configurable: true,
@@ -308,24 +829,82 @@ let GithubIssueService = (() => {
 		}
 		static inject = ["llm"];
 		static Config = Config;
-		repoUrl = __runInitializers(this, _instanceExtraInitializers);
-		maxPrefillUrlLength;
+		maxPrefillUrlLength = __runInitializers(this, _instanceExtraInitializers);
 		prefillTruncationNote;
 		/** Configured provider route, or `undefined` to follow `agentDefaultModel`. */
 		provider;
 		/** Configured model id, or `undefined` to follow `agentDefaultModel`. */
 		model;
+		tokenEnv;
+		token;
+		tokenCommand;
+		tokenCommandTimeoutMs;
+		apiBaseUrl;
+		requestTimeoutMs;
+		/** The persisted state, or the empty state when this deployment has no storage. */
+		intakeState = EMPTY_INTAKE_STATE;
+		/** The durable table, absent when this deployment mounts no storage domain. */
+		intakeTable;
+		/** Whether the state is durable; the startup check refuses to run without it. */
+		intakePersistent = false;
+		/** The resolved token, cached so a token command runs at most once. */
+		resolvedToken;
+		/** Whether token resolution finished; a missing credential is a result, not a retry. */
+		tokenResolved = false;
+		/** The last invalid time zone already reported, so a warning is not repeated per call. */
+		warnedTimeZone = "";
 		/**
 		* @param ctx - Host context carrying the llm service.
 		* @param config - Validated deployment configuration.
 		*/
 		constructor(ctx, config) {
 			super(ctx, "githubIssue");
-			this.repoUrl = config.repoUrl;
+			this.config = config;
 			this.maxPrefillUrlLength = config.maxPrefillUrlLength;
 			this.prefillTruncationNote = config.prefillTruncationNote;
 			this.provider = config.provider;
 			this.model = config.model;
+			this.tokenEnv = config.tokenEnv;
+			this.token = config.token;
+			this.tokenCommand = config.tokenCommand;
+			this.tokenCommandTimeoutMs = config.tokenCommandTimeoutMs;
+			this.apiBaseUrl = config.apiBaseUrl;
+			this.requestTimeoutMs = config.requestTimeoutMs;
+		}
+		/**
+		* The IANA zone the intake day is measured in.
+		*
+		* Read per call: a settings surface can rewrite it while the service runs. An
+		* invalid zone must not break the startup check or a dispatch, so it falls
+		* back to the host zone and is reported once per changed value.
+		* @returns the configured zone, or an empty string for the host zone.
+		*/
+		intakeTimeZone() {
+			const zone = this.config.autopilotTimeZone.get();
+			if (zone.length === 0 || isValidTimeZone(zone)) return zone;
+			if (this.warnedTimeZone !== zone) {
+				this.warnedTimeZone = zone;
+				this.warn("autopilotTimeZone \"" + zone + "\" is not an IANA time zone; measuring the day in the host zone");
+			}
+			return "";
+		}
+		/**
+		* Open the durable intake state and, when enabled, run the first-startup
+		* check.
+		*
+		* The check is deliberately not awaited: opening a Session is useful work
+		* but not a prerequisite for the service, and a slow or unreachable GitHub
+		* must not hold up the host's boot. A failure is logged and retried on the
+		* next startup, because the day key is only committed after a completed pass.
+		*/
+		async [Service.init]() {
+			await this.openIntakeState();
+			if (!this.config.autopilotEnabled.get()) return;
+			if (!this.intakePersistent) {
+				this.warn("autopilot is enabled but no durable intake state is available; skipping the startup check so it cannot dispatch the same issue twice");
+				return;
+			}
+			this.startupIntake();
 		}
 		/**
 		* Resolve the model route for one model call.
@@ -389,7 +968,7 @@ let GithubIssueService = (() => {
 		* @returns the prefill URL or an invalid-URL failure.
 		*/
 		prefilledIssueUrl(request) {
-			const repoUrl = request.repoUrl.length > 0 ? request.repoUrl : this.repoUrl;
+			const repoUrl = request.repoUrl.length > 0 ? request.repoUrl : this.config.repoUrl.get();
 			if (!/^https:\/\/github\.com\/[^/]+\/[^/]+$/u.test(repoUrl)) return {
 				ok: false,
 				error: {
@@ -432,6 +1011,346 @@ let GithubIssueService = (() => {
 			};
 		}
 		/**
+		* File one issue in the configured repository.
+		*
+		* The body is filed without its leading title heading: the optimizer repeats
+		* the title there so one text can drive both the pre-filled URL form and a
+		* direct filing, and GitHub takes the title as its own field.
+		*
+		* @param request - repository override and the report to file.
+		* @returns the created issue, or a stable failure.
+		*/
+		async createIssue(request) {
+			const report = request.report;
+			if (typeof report?.title !== "string" || typeof report.body !== "string") return INVALID_ISSUE_REQUEST;
+			const title = report.title.trim();
+			if (title.length === 0) return INVALID_ISSUE_REQUEST;
+			const labels = [...report.labels ?? []].map((label) => label.trim()).filter((label) => label.length > 0);
+			const normalized = {
+				title,
+				body: issueBody(report),
+				labels
+			};
+			const result = await (await this.createClient(request.repoUrl)).createIssue(normalized);
+			if (!result.ok) {
+				this.trackError("createIssue", {
+					code: result.error.code,
+					message: result.error.message,
+					featureCodeRef: this.featureCode("createIssue")
+				});
+				return result;
+			}
+			this.track("createIssue", "success", { issue: result.value.number });
+			return result;
+		}
+		/**
+		* List the open issues that carry the claim label.
+		* @param request - repository, label, and count overrides.
+		* @returns the claimable issues, or a stable failure.
+		*/
+		async listClaimableIssues(request = {}) {
+			const claimLabel = firstNonBlank(request.claimLabel, this.config.claimLabel.get()) ?? this.config.claimLabel.get();
+			const max = clampCount(request.max ?? this.config.maxIssuesPerRun.get());
+			const result = await (await this.createClient(request.repoUrl)).listClaimable(claimLabel, max);
+			if (!result.ok) this.trackError("listClaimableIssues", {
+				code: result.error.code,
+				message: result.error.message,
+				featureCodeRef: this.featureCode("listClaimableIssues")
+			});
+			return result;
+		}
+		/**
+		* Hand one issue to a fresh Session.
+		* @param request - the issue and optional Session placement.
+		* @returns the created Session, or a stable failure.
+		*/
+		async dispatchIssue(request) {
+			return this.dispatch(request);
+		}
+		/**
+		* Run one intake pass: list the claimable issues, skip the ones an earlier
+		* pass already dispatched, and hand the rest to a fresh Session.
+		*
+		* The local day is committed only after the listing succeeded, so a pass that
+		* could not reach GitHub is retried on the next startup instead of being
+		* remembered as done. An issue that was already dispatched is never
+		* dispatched again, even on a later day: its Session exists, and a second one
+		* would duplicate the work.
+		*
+		* @param request - repository, label, count, and Session placement overrides.
+		* @returns what the pass read and did.
+		*/
+		async runIntake(request = {}) {
+			const repoUrl = firstNonBlank(request.repoUrl, this.config.repoUrl.get()) ?? this.config.repoUrl.get();
+			const claimLabel = firstNonBlank(request.claimLabel, this.config.claimLabel.get()) ?? this.config.claimLabel.get();
+			const max = clampCount(request.max ?? this.config.maxIssuesPerRun.get());
+			const listed = await this.listClaimableIssues({
+				repoUrl,
+				claimLabel,
+				max
+			});
+			if (!listed.ok) return listed;
+			const claimed = new Set(this.intakeState.dispatched.map((row) => row.number));
+			const skipped = [];
+			const fresh = [];
+			for (const issue of listed.value) if (claimed.has(issue.number)) skipped.push(issue.number);
+			else fresh.push(issue);
+			const selected = fresh.slice(0, max);
+			const dispatched = [];
+			const failures = [];
+			for (const issue of selected) {
+				const result = await this.dispatch({
+					issue,
+					...request.cwd === void 0 ? {} : { cwd: request.cwd },
+					...request.agentPreset === void 0 ? {} : { agentPreset: request.agentPreset }
+				});
+				if (result.ok) {
+					dispatched.push({
+						number: issue.number,
+						sessionId: result.value.sessionId
+					});
+					continue;
+				}
+				failures.push({
+					number: issue.number,
+					code: result.error.code,
+					message: result.error.message
+				});
+			}
+			const checkedAt = Date.now();
+			await this.commitIntakeState(localDayKey(checkedAt, this.intakeTimeZone()), dispatched);
+			return {
+				ok: true,
+				value: Object.freeze({
+					checkedAt,
+					repoUrl,
+					claimable: listed.value,
+					dispatched: Object.freeze(dispatched),
+					skipped: Object.freeze(skipped),
+					failures: Object.freeze(failures)
+				})
+			};
+		}
+		/**
+		* Create one Session, queue the issue prompt, and name the Session.
+		*
+		* The Session is created through the Session controller rather than the Agent
+		* registry directly: the controller applies the deployment's preset and
+		* workspace policy, so the dispatched Session behaves like one the user
+		* opened from the Web. The prompt is queued with the Agent's followup, which
+		* wakes the driver without waiting for a turn to be open elsewhere.
+		*
+		* @param request - the issue and optional Session placement.
+		* @returns the created Session, or a stable failure.
+		*/
+		async dispatch(request) {
+			const controller = optionalService(this.ctx, "sessionController");
+			const agents = optionalService(this.ctx, "agents");
+			if (controller === void 0 || agents === void 0) return SESSION_UNAVAILABLE;
+			const cwd = firstNonBlank(request.cwd, this.config.autopilotCwd.get());
+			const agentPreset = firstNonBlank(request.agentPreset, this.config.autopilotPreset.get());
+			let sessionId;
+			try {
+				sessionId = (await controller.create({
+					...cwd === void 0 ? {} : { cwd },
+					...agentPreset === void 0 ? {} : { agentPreset }
+				})).sessionId;
+			} catch (error) {
+				return {
+					ok: false,
+					error: {
+						code: "dispatch-failed",
+						message: "the Session could not be created: " + describeError(error)
+					}
+				};
+			}
+			const handle = agents.get(sessionId);
+			if (handle === void 0) return {
+				ok: false,
+				error: {
+					code: "dispatch-failed",
+					message: "Session \"" + sessionId + "\" was created but no live Agent was published for it"
+				}
+			};
+			try {
+				handle.agent.followup({
+					content: [{
+						type: "text",
+						text: renderDispatchPrompt(this.config.autopilotPrompt.get(), request.issue)
+					}],
+					source: { kind: "github-issue" }
+				});
+			} catch (error) {
+				return {
+					ok: false,
+					error: {
+						code: "dispatch-failed",
+						message: "Session \"" + sessionId + "\" was created but the issue prompt was refused: " + describeError(error)
+					}
+				};
+			}
+			this.renameSession(controller, sessionId, "Issue #" + request.issue.number + ": " + request.issue.title);
+			this.track("dispatchIssue", "success", {
+				issue: request.issue.number,
+				sessionId
+			});
+			return {
+				ok: true,
+				value: Object.freeze({ sessionId })
+			};
+		}
+		/**
+		* Name a dispatched Session so the user can recognise it in the sidebar.
+		*
+		* A title is presentation, not part of the dispatch contract: a deployment
+		* that mounts no title service still gets a working Session, so a failure
+		* here is logged and never fails the dispatch.
+		*
+		* @param controller - the Session controller.
+		* @param sessionId - the Session to name.
+		* @param title - the proposed title.
+		*/
+		async renameSession(controller, sessionId, title) {
+			try {
+				await controller.rename?.({
+					sessionId,
+					title: title.slice(0, 120)
+				});
+			} catch (error) {
+				this.warn("Session \"" + sessionId + "\" was created without a title: " + describeError(error));
+			}
+		}
+		/**
+		* Run the first-startup check once per local day.
+		*
+		* The day is read from durable state, so a restart later the same day does
+		* nothing; the check is skipped until the local calendar moves on.
+		*/
+		async startupIntake() {
+			try {
+				const today = localDayKey(Date.now(), this.intakeTimeZone());
+				if (this.intakeState.lastCheckedDay === today) return;
+				const result = await this.runIntake({});
+				if (!result.ok) {
+					this.warn("issue intake did not complete: " + result.error.code + ": " + result.error.message);
+					return;
+				}
+				this.track("startupIntake", "success", { dispatched: result.value.dispatched.length });
+			} catch (error) {
+				this.warn("issue intake failed: " + describeError(error));
+			}
+		}
+		/**
+		* Open the durable intake state when this deployment mounts storage.
+		*
+		* Storage is optional so the service still installs on its own bundle; the
+		* startup check then stays off rather than running without a memory of what
+		* it already dispatched.
+		*/
+		async openIntakeState() {
+			const storage = optionalService(this.ctx, "storageDomain");
+			if (storage === void 0) return;
+			try {
+				const domain = await storage.open(await createIntakeDomain());
+				this.ctx.effect(() => async () => {
+					await domain.close();
+				}, "github-issue.intakeStateClose");
+				const table = domain.table("state");
+				this.intakeTable = table;
+				this.intakeState = table.get("intake") ?? EMPTY_INTAKE_STATE;
+				this.intakePersistent = true;
+			} catch (error) {
+				this.warn("intake state is unavailable: " + describeError(error));
+			}
+		}
+		/**
+		* Commit one completed pass to durable state.
+		*
+		* The in-memory state is updated first so the next pass in this process sees
+		* the dispatch even when the durable write fails; the warning then names the
+		* consequence instead of pretending the write succeeded.
+		*
+		* @param day - local day the pass completed.
+		* @param dispatched - issues handed to a Session in this pass.
+		*/
+		async commitIntakeState(day, dispatched) {
+			const appended = dispatched.map((entry) => ({
+				number: entry.number,
+				day,
+				sessionId: entry.sessionId
+			}));
+			const next = Object.freeze({
+				lastCheckedDay: day,
+				dispatched: Object.freeze([...this.intakeState.dispatched, ...appended].slice(-500))
+			});
+			this.intakeState = next;
+			const table = this.intakeTable;
+			if (table === void 0) return;
+			try {
+				await table.put(INTAKE_STATE_KEY, next);
+			} catch (error) {
+				this.warn("intake state could not be saved, so a later pass may dispatch the same issue again: " + describeError(error));
+			}
+		}
+		/**
+		* Build one GitHub client for a call.
+		* @param repoUrl - repository override, or the configured repository.
+		* @returns the client, carrying the resolved credential.
+		*/
+		async createClient(repoUrl) {
+			return new GithubIssueClient({
+				repoUrl: firstNonBlank(repoUrl, this.config.repoUrl.get()) ?? this.config.repoUrl.get(),
+				apiBaseUrl: this.apiBaseUrl,
+				token: await this.resolveToken(),
+				timeoutMs: this.requestTimeoutMs
+			});
+		}
+		/**
+		* Resolve the GitHub credential once.
+		*
+		* The order is explicit config, then the configured environment variable,
+		* then the configured command. The command runs at most once per process so
+		* a keyring-backed credential is not fetched on every request, and its output
+		* is never logged.
+		*
+		* @returns the token, or undefined when the deployment has none.
+		*/
+		async resolveToken() {
+			if (this.tokenResolved) return this.resolvedToken;
+			this.tokenResolved = true;
+			const direct = firstNonBlank(this.token);
+			if (direct !== void 0) return this.resolvedToken = direct;
+			const fromEnv = this.tokenEnv.length === 0 ? void 0 : firstNonBlank(process.env[this.tokenEnv]);
+			if (fromEnv !== void 0) return this.resolvedToken = fromEnv;
+			if (this.tokenCommand.trim().length === 0) return void 0;
+			try {
+				const { stdout } = await execAsync(this.tokenCommand, {
+					timeout: this.tokenCommandTimeoutMs,
+					windowsHide: true,
+					maxBuffer: 65536
+				});
+				const fromCommand = firstNonBlank(stdout);
+				if (fromCommand !== void 0) return this.resolvedToken = fromCommand;
+			} catch (error) {
+				this.warn("token command failed: " + describeError(error));
+			}
+		}
+		/**
+		* The telemetry feature anchor for one intake action.
+		* @param action - the method the event belongs to.
+		* @returns the stable feature-code reference.
+		*/
+		featureCode(action) {
+			return "github-issue:" + action;
+		}
+		/**
+		* Log one non-fatal intake problem.
+		* @param message - what went wrong and what it costs.
+		*/
+		warn(message) {
+			this.ctx.logger?.warn("github-issue: " + message);
+		}
+		/**
 		* Report one model failure and return the business failure.
 		*
 		* The preserved DSH code goes into both the message and the telemetry event:
@@ -623,5 +1542,38 @@ function buildPrefillUrl(repoUrl, report, maxLength, note) {
 	}
 	return candidate.length <= maxLength ? candidate : compose(note);
 }
+/**
+* Read one optional host service by its Cordis key.
+*
+* The intake loop works with services this package does not depend on: a
+* deployment may mount no storage, no Session controller, or no Agent registry.
+* Reading them by key keeps those features optional without turning the plugin
+* into a hard dependency of the whole Web composition.
+*
+* @param ctx - the host context.
+* @param name - the service key.
+* @returns the service, or undefined when this deployment mounts none.
+*/
+function optionalService(ctx, name) {
+	return ctx.get.call(ctx, name);
+}
+/**
+* Bound one requested issue count to the accepted range.
+* @param value - the requested count.
+* @returns an integer from 1 through 100.
+*/
+function clampCount(value) {
+	if (!Number.isFinite(value)) return 1;
+	return Math.min(100, Math.max(1, Math.trunc(value)));
+}
+/**
+* Render an unknown thrown value as a message.
+* @param error - the thrown value.
+* @returns a non-empty message.
+*/
+function describeError(error) {
+	if (error instanceof Error) return error.message;
+	return String(error);
+}
 //#endregion
 export { Config, GithubIssueService, GithubIssueService as default };