agentwrangler 0.1.0

package/dist/outcomes/findings.js

@@ -0,0 +1,237 @@
+/**
+ * src/outcomes/findings.ts — FindingsExtractor E1/E2/E3.
+ *
+ * All three extractors ship EXPERIMENTAL and are excluded from gated/deferral
+ * denominators (COND-1 conservative — plan §3, §6 Q6).
+ *
+ * E1 UNRESOLVED_THREAD: GraphQL isResolved; unresolved@merge → DEFERRED,
+ *    resolved-pre-merge → ADDRESSED; evidence_ref = thread id.
+ * E2 DEFERRAL_SECTION: regex on in-memory PR body; each item → DEFERRED;
+ *    evidence_ref = keyword-class+index (SEC-101: fixed enum + position, never
+ *    the raw heading text).
+ * E3 DIFF_MARKER: TODO/FIXME on in-memory diff (added lines only), excluding
+ *    vendored/lockfile globs; evidence_ref = file:line@commit.
+ *
+ * Bodies and diffs are parsed in-memory and discarded — never stored (SEC-101).
+ * Findings written: source/extractor_version/evidence_ref/raised_at/status.
+ * Clearance: cleared_at/cleared_by set when a subsequent run finds them resolved.
+ *
+ * Pass bounding (latency): bodies/diffs of TERMINAL work items are immutable,
+ * so E2/E3 fetch them only for items never yet extracted at this synced_at
+ * (per-repo user_config watermark `gh_findings_seen:<owner>/<repo>`, same
+ * pattern as the sync gh_watermark). E1 CAN change post-merge (resolution
+ * clears DEFERRED), so review threads are re-fetched for OPEN items and
+ * newly-synced items every pass, and terminal items at most once per
+ * RECHECK_TTL, deterministically staggered by hash of work_item_id (per-item
+ * last-check marker `gh_e1_check:<work_item_id>` in user_config — no schema
+ * migration). First-ever pass behaves exactly like an unbounded pass.
+ */
+import { EXTRACTOR_VERSIONS, extractDeferralFindings, extractDiffMarkerFindings, projectReviewThreadFindings, } from "./finding-extractors.js";
+import { DEFAULT_CONCURRENCY, mapWithConcurrency } from "./pool.js";
+// ---------------------------------------------------------------------------
+// DB helpers
+// ---------------------------------------------------------------------------
+function insertFinding(db, findingId, workItemId, source, severity, status, evidenceRef, confidence, raisedAt, extractorVersion) {
+    db.prepare(`
+    INSERT OR IGNORE INTO review_findings
+      (finding_id, work_item_id, source, severity, status, evidence_ref,
+       confidence, raised_at, extractor_version)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(findingId, workItemId, source, severity, status, evidenceRef, confidence, raisedAt, extractorVersion);
+}
+function clearFinding(db, findingId, clearedBy) {
+    db.prepare("UPDATE review_findings SET cleared_at = ?, cleared_by = ? WHERE finding_id = ? AND cleared_at IS NULL").run(new Date().toISOString(), clearedBy, findingId);
+}
+// ---------------------------------------------------------------------------
+// Main extractor pass
+// ---------------------------------------------------------------------------
+/** Default terminal-item E1 recheck TTL: 7 days. */
+export const DEFAULT_RECHECK_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/** FNV-1a 32-bit — deterministic stagger phase per work_item_id. */
+function hash32(s) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193);
+    }
+    return h >>> 0;
+}
+/**
+ * Run E1/E2/E3 extractors for all synced work_items in the given workspace.
+ * All finding rows carry extractor_version and evidence_ref; no body/diff content stored.
+ */
+export async function extractFindings(db, client, repoOwner, repoName, options = {}) {
+    if (!client.enabled)
+        return;
+    const nowDate = (options.now ?? (() => new Date()))();
+    const recheckTtlMs = options.recheckTtlMs ?? DEFAULT_RECHECK_TTL_MS;
+    const nowMs = nowDate.getTime();
+    const now = nowDate.toISOString();
+    const workItems = db
+        .prepare(`SELECT wi.work_item_id, wi.number, wi.state, wi.final_commit, wi.synced_at
+       FROM work_items wi
+       JOIN workspaces w USING (workspace_id)
+       WHERE w.repo_owner = ? AND w.repo_name = ?`)
+        .all(repoOwner, repoName);
+    // Per-repo "seen" watermark: max work_items.synced_at whose terminal
+    // body/diff extraction completed successfully. Failed fetches must remain
+    // retryable, or transient GitHub errors can permanently hide findings.
+    const seenKey = `gh_findings_seen:${repoOwner}/${repoName}`;
+    const seenRow = db.prepare("SELECT value FROM user_config WHERE key = ?").get(seenKey);
+    const seenWm = seenRow?.value ?? undefined;
+    // Hoist prepared statements outside the per-work-item loop to avoid
+    // re-creating statement handles on every iteration (performance).
+    const selectE1 = db.prepare("SELECT finding_id, status FROM review_findings WHERE finding_id = ?");
+    const selectExists = db.prepare("SELECT 1 FROM review_findings WHERE finding_id = ?");
+    const selectE1Check = db.prepare("SELECT value FROM user_config WHERE key = ?");
+    const ensureConfig = db.prepare(`
+    INSERT OR IGNORE INTO user_config (key, value, updated_at) VALUES (?, ?, ?)
+  `);
+    const updateConfig = db.prepare("UPDATE user_config SET value = ?, updated_at = ? WHERE key = ?");
+    // Per-item due decisions (sync, before any network I/O).
+    const plans = workItems.map((wi) => {
+        const isNew = seenWm === undefined || wi.synced_at === null || wi.synced_at > seenWm;
+        const isOpen = wi.state === "OPEN";
+        // E1: OPEN items and newly-synced items always; terminal items at most
+        // once per recheckTtlMs, staggered deterministically by hash so each pass
+        // re-checks roughly total/TTL worth instead of everything at once.
+        let e1Due = isNew || isOpen;
+        if (!e1Due) {
+            const checkKey = `gh_e1_check:${wi.work_item_id}`;
+            const last = selectE1Check.get(checkKey);
+            if (last?.value === undefined || last.value === null) {
+                e1Due = true;
+            }
+            else {
+                const lastMs = Date.parse(last.value);
+                // Interval is recheckTtlMs * (1 + phase), phase ∈ [0,1): strictly at
+                // least TTL between terminal rechecks, evenly spread across passes.
+                const phase = (hash32(wi.work_item_id) % 1000) / 1000;
+                e1Due = Number.isNaN(lastMs) || nowMs - lastMs >= recheckTtlMs * (1 + phase);
+            }
+        }
+        // E2/E3: terminal bodies/diffs are immutable → fetch only when never yet
+        // extracted at this synced_at (or still OPEN and thus mutable).
+        const e23Due = isNew || isOpen;
+        return { wi, isOpen, e1Due, e23Due };
+    });
+    const extractionResults = await mapWithConcurrency(plans, DEFAULT_CONCURRENCY, async (plan) => {
+        const { wi, isOpen, e1Due, e23Due } = plan;
+        const prNumber = wi.number;
+        let e23Complete = true;
+        // E1: Unresolved review threads (GraphQL)
+        if (e1Due) {
+            const threadsResult = await client.getReviewThreads(repoOwner, repoName, prNumber);
+            if (threadsResult.ok) {
+                for (const finding of projectReviewThreadFindings(wi.work_item_id, threadsResult.data)) {
+                    const findingId = finding.sourceFindingId;
+                    // Merged PRs: unresolved@merge → DEFERRED; resolved → ADDRESSED
+                    const status = finding.status;
+                    // Check if finding already exists
+                    const existing = selectE1.get(findingId);
+                    if (existing === undefined) {
+                        insertFinding(db, findingId, wi.work_item_id, "UNRESOLVED_THREAD", "UNKNOWN", status, finding.evidenceRef, null, now, EXTRACTOR_VERSIONS.E1);
+                    }
+                    else if (existing.status === "DEFERRED" && status === "ADDRESSED") {
+                        // Thread got resolved → clear it
+                        clearFinding(db, findingId, wi.final_commit ?? wi.work_item_id);
+                        db.prepare("UPDATE review_findings SET status = ? WHERE finding_id = ?").run("ADDRESSED", findingId);
+                    }
+                }
+                // Record last E1 check for terminal items only after a successful
+                // GraphQL read. OPEN items are checked every pass, so their marker
+                // would be dead weight.
+                if (!isOpen) {
+                    const checkKey = `gh_e1_check:${wi.work_item_id}`;
+                    ensureConfig.run(checkKey, now, now);
+                    updateConfig.run(now, now, checkKey);
+                }
+            }
+        }
+        if (!e23Due)
+            return { syncedAt: wi.synced_at, isOpen, e23Due, e23Complete };
+        // E2: Deferral sections in body (in-memory only)
+        {
+            const bodyResult = await client.getPRBody(repoOwner, repoName, prNumber);
+            if (bodyResult.ok) {
+                if (bodyResult.data.length > 0) {
+                    const items = extractDeferralFindings(bodyResult.data, wi.work_item_id);
+                    for (let idx = 0; idx < items.length; idx++) {
+                        const item = items[idx];
+                        if (item === undefined)
+                            continue;
+                        const findingId = `e2:${wi.work_item_id}:${idx}`;
+                        const existing = selectExists.get(findingId);
+                        if (existing === undefined) {
+                            insertFinding(db, findingId, wi.work_item_id, "DEFERRAL_SECTION", "UNKNOWN", item.status, item.evidenceRef, null, now, EXTRACTOR_VERSIONS.E2);
+                        }
+                    }
+                }
+                // body variable goes out of scope here — content discarded
+            }
+            else {
+                e23Complete = false;
+            }
+        }
+        // E3: TODO/FIXME in diff (in-memory only)
+        if (wi.state === "MERGED" && wi.final_commit !== null) {
+            const diffResult = await client.getPRDiff(repoOwner, repoName, prNumber);
+            if (diffResult.ok) {
+                if (diffResult.data.length > 0) {
+                    const markers = extractDiffMarkerFindings(diffResult.data, wi.final_commit, wi.work_item_id);
+                    for (let idx = 0; idx < markers.length; idx++) {
+                        const marker = markers[idx];
+                        if (marker === undefined)
+                            continue;
+                        const findingId = `e3:${wi.work_item_id}:${idx}`;
+                        const existing = selectExists.get(findingId);
+                        if (existing === undefined) {
+                            insertFinding(db, findingId, wi.work_item_id, "DIFF_MARKER", "LOW", "UNKNOWN", marker.evidenceRef, null, now, EXTRACTOR_VERSIONS.E3);
+                        }
+                    }
+                }
+                // diff variable goes out of scope here — content discarded
+            }
+            else {
+                e23Complete = false;
+            }
+        }
+        return { syncedAt: wi.synced_at, isOpen, e23Due, e23Complete };
+    });
+    // Advance the seen watermark only through synced_at groups whose terminal
+    // body/diff extraction completed. syncWorkItems writes the same synced_at for
+    // a fetched page, so a single failed item must hold the whole group retryable.
+    let newestSeen = seenWm ?? "1970-01-01T00:00:00Z";
+    const terminalDueBySyncedAt = new Map();
+    for (const result of extractionResults) {
+        if (!result.e23Due || result.isOpen || result.syncedAt === null)
+            continue;
+        const previous = terminalDueBySyncedAt.get(result.syncedAt) ?? true;
+        terminalDueBySyncedAt.set(result.syncedAt, previous && result.e23Complete);
+    }
+    const syncedGroups = Array.from(terminalDueBySyncedAt.entries()).sort(([a], [b]) => a.localeCompare(b));
+    for (const [syncedAt, complete] of syncedGroups) {
+        if (syncedAt <= newestSeen)
+            continue;
+        if (!complete)
+            break;
+        newestSeen = syncedAt;
+    }
+    if (workItems.length > 0) {
+        ensureConfig.run(seenKey, newestSeen, now);
+        updateConfig.run(newestSeen, now, seenKey);
+    }
+}
+/**
+ * Run extractors for all mapped workspaces.
+ */
+export async function extractAllFindings(db, client) {
+    if (!client.enabled)
+        return;
+    const workspaces = db
+        .prepare("SELECT repo_owner, repo_name FROM workspaces WHERE repo_owner IS NOT NULL AND repo_name IS NOT NULL")
+        .all();
+    for (const ws of workspaces) {
+        await extractFindings(db, client, ws.repo_owner, ws.repo_name);
+    }
+}

package/dist/outcomes/github/client.js

@@ -0,0 +1,367 @@
+/**
+ * src/outcomes/github/client.ts — GitHub sync client.
+ *
+ * Uses fetch (REST + GraphQL) — NOT Octokit (plan §6 Q3: no new dep).
+ * Injected token + injected fetch for testability.
+ *
+ * Disabled state: when token is ok:false, ALL methods return {ok:false,reason}
+ * and make ZERO network calls.
+ *
+ * Clean degradation (HARD constraint): never throws; always {ok}|{ok:false,reason}.
+ */
+import { fingerprintBranchRef } from "../branch-key.js";
+import { aggregateCheckConclusion, normalizePRBody } from "../conclusions.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNullableString(value) {
+    return typeof value === "string" || value === null;
+}
+/**
+ * Validate and privacy-project a REST pull-request payload.
+ * The raw head ref is fingerprinted while local to this function and is never
+ * included in either the returned value or an error reason.
+ */
+function projectPR(value) {
+    if (!isRecord(value) || !isRecord(value.head) || typeof value.head.ref !== "string")
+        return null;
+    if (!Number.isInteger(value.number) ||
+        (value.state !== "open" && value.state !== "closed" && value.state !== "merged") ||
+        !isNullableString(value.merged_at) ||
+        !isNullableString(value.closed_at) ||
+        typeof value.created_at !== "string" ||
+        !isNullableString(value.merge_commit_sha) ||
+        typeof value.head.sha !== "string") {
+        return null;
+    }
+    return {
+        number: value.number,
+        state: value.state,
+        merged_at: value.merged_at,
+        closed_at: value.closed_at,
+        created_at: value.created_at,
+        merge_commit_sha: value.merge_commit_sha,
+        head: { sha: value.head.sha, refKey: fingerprintBranchRef(value.head.ref) },
+    };
+}
+/** Validate a complete page before exposing any projected PRs. */
+export function projectPRPage(value) {
+    if (!Array.isArray(value))
+        return { ok: false, reason: "github-pr-payload-invalid" };
+    const projected = [];
+    for (const item of value) {
+        const pr = projectPR(item);
+        if (pr === null)
+            return { ok: false, reason: "github-pr-payload-invalid" };
+        projected.push(pr);
+    }
+    return { ok: true, data: projected };
+}
+/** Validate and project only the privacy-safe branch key from one PR payload. */
+export function projectPRHeadKey(value) {
+    if (!isRecord(value) || !isRecord(value.head) || typeof value.head.ref !== "string") {
+        return { ok: false, reason: "github-pr-payload-invalid" };
+    }
+    return { ok: true, data: fingerprintBranchRef(value.head.ref) };
+}
+const DEFAULT_REQUEST_TIMEOUT_MS = 15_000;
+const DEFAULT_MAX_ATTEMPTS = 3;
+const DEFAULT_RETRY_BACKOFF_MS = 500;
+// ---------------------------------------------------------------------------
+// Client
+// ---------------------------------------------------------------------------
+const GH_REST = "https://api.github.com";
+const GH_GRAPHQL = "https://api.github.com/graphql";
+export class GithubSyncClient {
+    token;
+    fetchFn;
+    etags = new Map();
+    requestTimeoutMs;
+    maxAttempts;
+    retryBackoffMs;
+    constructor(tokenResult, fetchFn = globalThis.fetch, options = {}) {
+        this.token = tokenResult.ok ? tokenResult.data : null;
+        this.fetchFn = fetchFn;
+        this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+        this.maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+        this.retryBackoffMs = options.retryBackoffMs ?? DEFAULT_RETRY_BACKOFF_MS;
+    }
+    get enabled() {
+        return this.token !== null;
+    }
+    disabledResult() {
+        return { ok: false, reason: "github-token-unset" };
+    }
+    headers(extra) {
+        return {
+            Authorization: `Bearer ${this.token ?? ""}`,
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+            ...extra,
+        };
+    }
+    /**
+     * fetch with a bounded per-attempt timeout and retry-with-backoff.
+     * Each attempt arms a fresh AbortSignal.timeout so a request that was aborted
+     * because the loop was momentarily starved gets a clean retry once the loop
+     * drains. Re-throws the last error after maxAttempts so the caller's try/catch
+     * still maps it to {ok:false,reason} (clean degradation — never hangs the pass).
+     * Only thrown errors (abort/network) are retried; an HTTP error response is
+     * returned to the caller unchanged (no retry on 4xx/5xx).
+     */
+    async fetchWithRetry(url, init) {
+        let lastErr;
+        for (let attempt = 1; attempt <= this.maxAttempts; attempt++) {
+            try {
+                return await this.fetchFn(url, {
+                    ...init,
+                    signal: AbortSignal.timeout(this.requestTimeoutMs),
+                });
+            }
+            catch (e) {
+                lastErr = e;
+                if (attempt < this.maxAttempts) {
+                    await new Promise((r) => setTimeout(r, this.retryBackoffMs * attempt));
+                }
+            }
+        }
+        throw lastErr;
+    }
+    /**
+     * List PRs for a repo updated since the watermark ISO-8601 date.
+     * Returns up to 100 PRs per call (no pagination for now — watermark minimises volume).
+     */
+    async listPRs(owner, repo, since) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const qs = new URLSearchParams({
+            state: "all",
+            sort: "updated",
+            direction: "desc",
+            per_page: "100",
+        });
+        if (since !== undefined)
+            qs.set("since", since);
+        const url = `${GH_REST}/repos/${owner}/${repo}/pulls?${qs}`;
+        const hdrs = this.headers();
+        const etag = this.etags.get(url);
+        if (etag !== undefined)
+            hdrs["If-None-Match"] = etag;
+        try {
+            const res = await this.fetchWithRetry(url, { headers: hdrs });
+            if (res.status === 304)
+                return { ok: true, data: [] }; // not modified
+            if (!res.ok)
+                return { ok: false, reason: `github-api-error:${res.status}` };
+            let payload;
+            try {
+                payload = await res.json();
+            }
+            catch {
+                return { ok: false, reason: "github-pr-payload-invalid" };
+            }
+            const projected = projectPRPage(payload);
+            if (!projected.ok)
+                return projected;
+            const newEtag = res.headers.get("ETag");
+            if (newEtag !== null)
+                this.etags.set(url, newEtag);
+            return projected;
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    async getPRHeadKey(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const url = `${GH_REST}/repos/${owner}/${repo}/pulls/${prNumber}`;
+        try {
+            const res = await this.fetchWithRetry(url, { headers: this.headers() });
+            if (!res.ok)
+                return { ok: false, reason: `github-pr-error:${res.status}` };
+            try {
+                return projectPRHeadKey(await res.json());
+            }
+            catch {
+                return { ok: false, reason: "github-pr-payload-invalid" };
+            }
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-pr-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    /**
+     * Get check-run conclusions for the HEAD sha of a PR.
+     * Returns aggregated conclusion: SUCCESS|FAILURE|PENDING|NONE.
+     */
+    async getCheckConclusion(owner, repo, ref) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const url = `${GH_REST}/repos/${owner}/${repo}/commits/${ref}/check-runs?per_page=100`;
+        try {
+            const res = await this.fetchWithRetry(url, { headers: this.headers() });
+            if (!res.ok)
+                return { ok: false, reason: `github-checks-error:${res.status}` };
+            const body = (await res.json());
+            return aggregateCheckConclusion(body);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-checks-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    /**
+     * List commit SHAs for a PR (for SHA_OVERLAP linkage).
+     */
+    async listPRCommits(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        // GitHub caps commits per page at 100; PRs with >100 commits truncate the SHA set
+        // (pre-existing limitation, same on both transports).
+        const url = `${GH_REST}/repos/${owner}/${repo}/pulls/${prNumber}/commits?per_page=100`;
+        try {
+            const res = await this.fetchWithRetry(url, { headers: this.headers() });
+            if (!res.ok)
+                return { ok: false, reason: `github-commits-error:${res.status}` };
+            const data = (await res.json());
+            return {
+                ok: true,
+                data: data.map((c) => ({ sha: c.sha, message: c.commit?.message ?? "" })),
+            };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-commits-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    async listPullsForCommit(owner, repo, sha) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const url = `${GH_REST}/repos/${owner}/${repo}/commits/${sha}/pulls`;
+        try {
+            const res = await this.fetchWithRetry(url, {
+                headers: { ...this.headers(), Accept: "application/vnd.github+json" },
+            });
+            if (res.status === 404)
+                return { ok: true, data: [] };
+            if (!res.ok)
+                return { ok: false, reason: `github-commit-pulls-error:${res.status}` };
+            const data = (await res.json());
+            return { ok: true, data: data.map((p) => p.number) };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-commit-pulls-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    /**
+     * Fetch PR body for E2 extraction (in-memory only; body never stored).
+     */
+    async getPRBody(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const url = `${GH_REST}/repos/${owner}/${repo}/pulls/${prNumber}`;
+        try {
+            const res = await this.fetchWithRetry(url, { headers: this.headers() });
+            if (!res.ok)
+                return { ok: false, reason: `github-pr-error:${res.status}` };
+            const data = (await res.json());
+            return { ok: true, data: normalizePRBody(data) };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-pr-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    /**
+     * Fetch diff for E3 extraction (in-memory only; diff never stored).
+     */
+    async getPRDiff(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const url = `${GH_REST}/repos/${owner}/${repo}/pulls/${prNumber}`;
+        const hdrs = { ...this.headers(), Accept: "application/vnd.github.diff" };
+        try {
+            const res = await this.fetchWithRetry(url, { headers: hdrs });
+            if (!res.ok)
+                return { ok: false, reason: `github-diff-error:${res.status}` };
+            const diff = await res.text();
+            return { ok: true, data: diff };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-diff-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    /**
+     * Fetch review thread resolution status via GraphQL (E1 extraction).
+     * Returns list of {id, isResolved} for the PR.
+     * Paginates automatically so PRs with >100 review threads are not truncated.
+     */
+    async getReviewThreads(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const query = `
+      query($owner:String!, $repo:String!, $pr:Int!, $cursor:String) {
+        repository(owner:$owner, name:$repo) {
+          pullRequest(number:$pr) {
+            reviewThreads(first:100, after:$cursor) {
+              pageInfo { hasNextPage endCursor }
+              nodes { id isResolved }
+            }
+          }
+        }
+      }
+    `;
+        try {
+            const allThreads = [];
+            let cursor = null;
+            do {
+                const res = await this.fetchWithRetry(GH_GRAPHQL, {
+                    method: "POST",
+                    headers: { ...this.headers(), "Content-Type": "application/json" },
+                    body: JSON.stringify({ query, variables: { owner, repo, pr: prNumber, cursor } }),
+                });
+                if (!res.ok)
+                    return { ok: false, reason: `github-graphql-error:${res.status}` };
+                const body = (await res.json());
+                if (body.errors !== undefined && body.errors.length > 0) {
+                    return {
+                        ok: false,
+                        reason: `github-graphql-errors: ${body.errors.map((e) => e.message).join("; ")}`,
+                    };
+                }
+                const reviewThreads = body.data?.repository?.pullRequest?.reviewThreads;
+                allThreads.push(...(reviewThreads?.nodes ?? []));
+                const pageInfo = reviewThreads?.pageInfo;
+                if (pageInfo?.hasNextPage !== true)
+                    break;
+                cursor = pageInfo.endCursor ?? null;
+            } while (cursor !== null);
+            return { ok: true, data: allThreads };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-graphql-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+}