gcb-host 0.0.3 → 0.1.0

package/lib/commands/host-opener.js

@@ -1,44 +1,49 @@
 /**
- * `host-opener` — fulfil the container's requests to open pull requests, as the person running it.
+ * `host-opener` — fulfil the container's requests to open pull requests or issues with the gh account
+ * each request names.
  *
  * This runs on the host, beside the checkout the container also sees, and it does exactly one thing:
- * it turns a request file into a pull request, using the credentials of whoever started it. That is
- * the whole point — a pull request authored by a person is one that automated reviewers will actually
- * review, and the app cannot be that person.
+ * it turns a request file into a pull request or issue, using the gh account the request names. That
+ * is the whole point — content authored by a person is what automated reviewers will actually review,
+ * and the app cannot be that person.
  *
  * It has no other power. It cannot push, merge, close or read anything, and it never runs a shell: the
  * program it calls is configuration, and it is called with an argument list built here.
  */
 import { execFile } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { promisify } from 'node:util';
-import { channelDir, clearOpener, discoverCheckouts, findGitDir, listRequests, readOpener, claimRequest, removeRequest, requestProblems, writeOpener, writeResult, } from 'gcb-core';
+import { channelDir, clearOpener, discoverCheckouts, findGitDir, listRequests, readOpener, claimRequest, removeRequest, requestProblems, writeOpener, writeResult, HOST, } from 'gcb-core';
 import { fail, listFlag, parseArgs, say, warn } from 'gcb-core';
 import { applyProxyChoice, parseProxy } from '../http.js';
+import { loadConfig, resolveConfigPath } from '../config.js';
+import { hostConfig, repoAllowed } from '../policy.js';
 const run = promisify(execFile);
-/** How long one `pr create` may take. */
+/** How long one `pr create` or `issue create` may take. */
 const CREATE_TIMEOUT_MS = 120_000;
 /** Usage text for `host-opener`. */
 export const HOST_OPENER_USAGE = `Usage: gcb host-opener [options]
 
 Run on the host, once, beside the trees the container also sees. It finds the checkouts under the
-roots it is given — ones created later included — and fulfils their requests to open a pull request
-with the credentials of whoever runs it, so the pull request is authored by a person rather than by
+roots it is given — ones created later included — and fulfils their requests to create a pull request, issue
+or fork with the gh account each request names, so the result is authored by a person rather than by
 the app's bot. It does nothing else: it cannot push, merge or close anything.
 
   --root <dir>          A tree to serve, repeatable (default: $HOME)
   --depth <n>           How far below a root to look for checkouts (default: 4)
   --repo <path>         Serve this one checkout instead of discovering any
-  --command <path>      The program that creates a pull request
+  --config <path>       Broker config whose allowlist fork requests are checked against
+                        (default: $GIT_BROKER_CONFIG, else ./broker.config.yml)
+  --command <path>      The program that creates a pull request, issue or fork
                         (default: $GIT_BROKER_PR_COMMAND, else gh)
   --arg <token>         An extra argument for that program, before the subcommand (repeatable)
   --interval <seconds>  How often to look for requests (default: 5)
   --once                Fulfil what is waiting, then exit
   -h, --help            Show this help
 
-The container asks for this by passing --via-host to \`pr\`. Requests are files under
+The container asks for this by passing --as-user to \`pr\`. Requests are files under
 <git dir>/gcb/pr-requests, which is shared with the container and untracked by git
 — so the paths on the two sides never have to match: each writes and reads its own view of the same
 directory, and only the roots this process scans are host-side paths.
@@ -59,6 +64,19 @@ export function pullRequestUrl(output) {
         return undefined;
     return { number: Number(digits), url: match[0] };
 }
+/**
+ * Pull the issue number and URL out of the program's output.
+ *
+ * @param output - the program's standard output.
+ * @returns the number and URL, or `undefined`.
+ */
+export function issueUrl(output) {
+    const match = /https:\/\/[^\s]+\/issues\/(\d+)/.exec(output);
+    const digits = match?.[1];
+    if (!match || digits === undefined)
+        return undefined;
+    return { number: Number(digits), url: match[0] };
+}
 /**
  * Run the `host-opener` command.
  *
@@ -77,6 +95,21 @@ export async function runHostOpener(argv) {
     const scanned = roots.length > 0 ? roots.map((root) => resolve(root)) : [homedir()];
     const depth = Number(args.value('depth') ?? '4');
     const command = args.value('command') ?? process.env['GIT_BROKER_PR_COMMAND'] ?? 'gh';
+    const configPath = args.value('config');
+    let config;
+    /** Whether the broker's allowlist permits this host/repository, loaded only for fork requests. */
+    const allowed = (host, repo) => {
+        if (config === undefined) {
+            try {
+                config = loadConfig(resolveConfigPath(configPath));
+            }
+            catch (error) {
+                throw new Error(`a fork needs the broker config allowlist: ${error.message}; pass --config or set GIT_BROKER_CONFIG`);
+            }
+        }
+        const block = hostConfig(config, host);
+        return block !== null && repoAllowed(block.allow, repo);
+    };
     const extra = listFlag(args, 'arg');
     const interval = Number(args.value('interval') ?? '5');
     if (!Number.isFinite(interval) || interval < 1) {
@@ -99,7 +132,12 @@ export async function runHostOpener(argv) {
     const advertise = (dir) => {
         advertised.add(dir);
         if (readOpener(dir)?.pid !== process.pid) {
-            writeOpener(dir, { pid: process.pid, command, startedAt: new Date().toISOString() });
+            writeOpener(dir, {
+                pid: process.pid,
+                command,
+                startedAt: new Date().toISOString(),
+                kinds: ['pull-request', 'issue', 'fork'],
+            });
         }
     };
     // However this process ends — a signal, --once, an exception — its markers go with it. A stale
@@ -120,14 +158,14 @@ export async function runHostOpener(argv) {
     process.on('SIGINT', stop);
     process.on('SIGTERM', stop);
     say(single === undefined ? `serving the checkouts under ${scanned.join(', ')}` : `serving ${single}`);
-    say(`creating pull requests with ${command}${extra.length > 0 ? ` ${extra.join(' ')}` : ''}, as ${process.env['USER'] ?? 'this user'}`);
+    say(`creating pull requests, issues and forks with ${command}${extra.length > 0 ? ` ${extra.join(' ')}` : ''}, as the request's account or this user`);
     for (;;) {
         for (const { repo, dir } of targets()) {
             // One checkout the container has made hostile — its channel directory replaced by a file, say —
             // must not stop the opener serving every other root, under Restart=always least of all.
             try {
                 advertise(dir);
-                await sweep(dir, repo, command, extra);
+                await sweep(dir, repo, command, extra, allowed);
             }
             catch (error) {
                 warn(`could not serve ${repo}: ${error.message}`);
@@ -142,16 +180,16 @@ export async function runHostOpener(argv) {
  * Answer everything waiting in the channel.
  *
  * @param dir - the channel directory.
- * @param repo - the checkout to create pull requests in.
+ * @param repo - the checkout to create pull requests or issues in.
  * @param command - the program to call.
  * @param extra - arguments to pass before the subcommand.
  * @returns how many requests were answered.
  */
-async function sweep(dir, repo, command, extra) {
+async function sweep(dir, repo, command, extra, allowed) {
     let answered = 0;
     for (const id of listRequests(dir)) {
         // Claimed, not read: two openers — a service and a hand-run --once — would otherwise both act on the
-        // same request and each create the pull request, under the person's name.
+        // same request and each create it, under the person's name.
         const request = claimRequest(dir, id);
         if (!request) {
             // Either unreadable or already claimed, and the two are not worth telling apart here: removing
@@ -175,21 +213,49 @@ async function sweep(dir, repo, command, extra) {
             answered += 1;
             continue;
         }
-        const result = await openOne(repo, command, extra, { ...request, proxy });
+        const result = await openOne(repo, command, extra, { ...request, proxy }, allowed);
         writeResult(dir, id, result);
         removeRequest(dir, id);
         if (result.error !== undefined) {
-            warn(`failed to open ${request.head}: ${result.error}`);
+            warn(`failed to open ${request.kind === 'fork' ? 'fork' : request.kind === 'issue' ? 'issue' : request.head}: ${result.error}`);
         }
         else {
-            say(`opened #${result.number}: ${result.url}`);
+            say(request.kind === 'fork'
+                ? `forked ${request.repo} as ${request.account ?? 'this user'}: ${result.url}`
+                : `opened #${result.number} as ${request.account ?? 'this user'}: ${result.url}`);
         }
         answered += 1;
     }
     return answered;
 }
+/** Environment for one gh call: the selected account or inherited config, plus the proxy choice. */
+function forkEnv(proxy, account, host) {
+    const env = openerEnv(proxy, account);
+    // gh chooses between GH_TOKEN and GH_ENTERPRISE_TOKEN by host; forcing GH_HOST is what keeps an
+    // inherited token from selecting another instance. Named accounts already had their tokens removed.
+    env['GH_HOST'] = host;
+    return env;
+}
+function openerEnv(proxy, account) {
+    const env = { ...process.env };
+    if (account !== undefined) {
+        const dir = join(homedir(), '.config', `gh-${account}`);
+        if (!existsSync(dir) || !statSync(dir).isDirectory()) {
+            throw new Error(`no gh config for account ${JSON.stringify(account)} at ${dir}`);
+        }
+        // Tokens in the opener's own environment would override the selected account's config.
+        delete env['GH_TOKEN'];
+        delete env['GITHUB_TOKEN'];
+        delete env['GH_ENTERPRISE_TOKEN'];
+        delete env['GITHUB_ENTERPRISE_TOKEN'];
+        delete env['GH_HOST'];
+        env['GH_CONFIG_DIR'] = dir;
+    }
+    applyProxyChoice(env, proxy);
+    return env;
+}
 /**
- * Create one pull request.
+ * Create one pull request, issue or fork.
  *
  * @param repo - the checkout to create it in.
  * @param command - the program to call.
@@ -197,38 +263,71 @@ async function sweep(dir, repo, command, extra) {
  * @param request - what to create.
  * @returns the number and URL, or the reason it did not work.
  */
-function openerEnv(proxy) {
-    const env = { ...process.env };
-    applyProxyChoice(env, proxy);
-    return env;
-}
-async function openOne(repo, command, extra, request) {
+async function openOne(repo, command, extra, request, allowed) {
+    if (request.kind === 'fork') {
+        if (request.host !== undefined && !HOST.test(request.host)) {
+            return { error: `not a host: ${JSON.stringify(request.host)}` };
+        }
+        const host = request.host ?? 'github.com';
+        try {
+            if (!allowed(host, request.repo)) {
+                return { error: `repository ${request.repo} is not in the allowlist for ${host}` };
+            }
+        }
+        catch (error) {
+            return { error: error.message };
+        }
+        try {
+            const { stdout, stderr } = await run(command, [...extra, 'repo', 'fork', request.repo], {
+                cwd: repo,
+                timeout: CREATE_TIMEOUT_MS,
+                maxBuffer: 1 << 20,
+                env: forkEnv(request.proxy, request.account, host),
+            });
+            const match = /https:\/\/[^\s]+\/[^\s/]+\/[^\s/]+/.exec(stdout);
+            if (match?.[0] !== undefined)
+                return { url: match[0] };
+            // With no TTY, gh prints the URL only for a fresh fork; an existing fork older than a minute
+            // is `owner/name already exists` on stderr with empty stdout and exit 0.
+            const existing = /^([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+) already exists$/m.exec(stderr);
+            if (existing?.[1] !== undefined) {
+                return { url: `https://${host}/${existing[1]}` };
+            }
+            return { error: `no fork URL in the output: ${(stdout.trim() || stderr.trim()).slice(0, 300)}` };
+        }
+        catch (error) {
+            const failure = error;
+            const reason = (failure.stderr ?? failure.message ?? 'the command failed').trim();
+            return { error: reason.slice(0, 300) || 'the command failed' };
+        }
+    }
     // The body goes to a private temp file: the program is given a path, never a string to interpret.
     const scratch = mkdtempSync(join(tmpdir(), 'gcb-'));
     const bodyFile = join(scratch, 'body.md');
     writeFileSync(bodyFile, request.body, 'utf8');
+    const issue = request.kind === 'issue';
     try {
         const { stdout, stderr } = await run(command, [
             ...extra,
-            'pr',
+            issue ? 'issue' : 'pr',
             'create',
             // No `--repo`: gh resolves the repository from the checkout it runs in, which is the checkout the
             // request was written in. That is a mechanism, not a boundary — the container can edit that checkout,
-            // its remote included. What a deployment controls is which roots are served and which program runs;
-            // what this reaches is whatever the person running it can reach.
-            ...(request.draft === true ? ['--draft'] : []),
-            '--base',
-            request.base,
-            '--head',
-            request.head,
+            // its remote included. What a deployment controls is which roots are served, which program runs
+            // and which account directories exist; what this reaches is whatever the account the request
+            // names can reach.
+            ...(!issue && request.draft === true ? ['--draft'] : []),
+            ...(issue ? [] : ['--base', request.base, '--head', request.head]),
             '--title',
             request.title,
             '--body-file',
             bodyFile,
-        ], { cwd: repo, timeout: CREATE_TIMEOUT_MS, maxBuffer: 1 << 20, env: openerEnv(request.proxy) });
-        const found = pullRequestUrl(stdout);
+        ], { cwd: repo, timeout: CREATE_TIMEOUT_MS, maxBuffer: 1 << 20, env: openerEnv(request.proxy, request.account) });
+        const found = issue ? issueUrl(stdout) : pullRequestUrl(stdout);
         if (!found) {
-            return { error: `no pull request URL in the output: ${(stdout.trim() || stderr.trim()).slice(0, 300)}` };
+            return {
+                error: `no ${issue ? 'issue' : 'pull request'} URL in the output: ${(stdout.trim() || stderr.trim()).slice(0, 300)}`,
+            };
         }
         return found;
     }

package/lib/commands/host-opener.js.map

@@ -1 +1 @@
-{"version":3,"file":"host-opener.js","sourceRoot":"","sources":["../../src/commands/host-opener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,GAGZ,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC;AAE5E,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,yCAAyC;AACzC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,oCAAoC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBhC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,iFAAiF;IACjF,MAAM,OAAO,GAAG,GAAoC,EAAE;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,wEAAwE;IACxE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACzC,WAAW,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CAAC;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,UAAU;IACV,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACtG,GAAG,CAAC,+BAA+B,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC;IAExI,SAAS,CAAC;QACR,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;YACtC,gGAAgG;YAChG,wFAAwF;YACxF,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,CAAC,CAAC;gBACf,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,mBAAmB,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,KAAK,CAAC,GAAW,EAAE,IAAY,EAAE,OAAe,EAAE,KAAwB;IACvF,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,qGAAqG;QACrG,0EAA0E;QAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+FAA+F;YAC7F,wFAAwF;YACxF,IAAI,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrD,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACrC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,kBAAkB,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,SAAS,CAAC,KAAkB;IACnC,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,OAAe,EACf,KAAwB,EACxB,OAAwB;IAExB,kGAAkG;IAClG,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAClC,OAAO,EACP;YACE,GAAG,KAAK;YACR,IAAI;YACJ,QAAQ;YACR,kGAAkG;YAClG,sGAAsG;YACtG,oGAAoG;YACpG,iEAAiE;YACjE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,QAAQ;YACR,OAAO,CAAC,IAAI;YACZ,QAAQ;YACR,OAAO,CAAC,IAAI;YACZ,SAAS;YACT,OAAO,CAAC,KAAK;YACb,aAAa;YACb,QAAQ;SACT,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC7F,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,KAAK,EAAE,sCAAsC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3G,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAA8C,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,oBAAoB,EAAE,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}
+{"version":3,"file":"host-opener.js","sourceRoot":"","sources":["../../src/commands/host-opener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EACL,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,UAAU,EACV,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,WAAW,EACX,IAAI,GAIL,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAoB,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEvD,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,oCAAoC;AACpC,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBhC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,KAAK,GAAG,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB;IACzD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC;IACtF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAgC,CAAC;IACrC,kGAAkG;IAClG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE;QACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,6CAA8C,KAAe,CAAC,OAAO,0CAA0C,CAChH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,iDAAiD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,iFAAiF;IACjF,MAAM,OAAO,GAAG,GAAoC,EAAE;QACpD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,wEAAwE;IACxE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAQ,EAAE;QACtC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;YACzC,WAAW,CAAC,GAAG,EAAE;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC;aACzC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACF,+FAA+F;IAC/F,gGAAgG;IAChG,UAAU;IACV,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG;oBAAE,WAAW,CAAC,GAAG,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;IACtG,GAAG,CACD,iDAAiD,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yCAAyC,CAClJ,CAAC;IAEF,SAAS,CAAC;QACR,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC;YACtC,gGAAgG;YAChG,wFAAwF;YACxF,IAAI,CAAC;gBACH,SAAS,CAAC,GAAG,CAAC,CAAC;gBACf,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,mBAAmB,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,KAAK,CAClB,GAAW,EACX,IAAY,EACZ,OAAe,EACf,KAAwB,EACxB,OAAgD;IAEhD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,KAAK,MAAM,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,qGAAqG;QACrG,4DAA4D;QAC5D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+FAA+F;YAC7F,wFAAwF;YACxF,IAAI,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACrD,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC9C,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YACpB,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;YAChE,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACrC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QACnF,WAAW,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC7B,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,CACF,kBACE,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAClF,KAAK,MAAM,CAAC,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CACD,OAAO,CAAC,IAAI,KAAK,MAAM;gBACrB,CAAC,CAAC,UAAU,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,OAAO,IAAI,WAAW,KAAK,MAAM,CAAC,GAAG,EAAE;gBAC9E,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,OAAO,OAAO,CAAC,OAAO,IAAI,WAAW,KAAK,MAAM,CAAC,GAAG,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,QAAQ,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oGAAoG;AACpG,SAAS,OAAO,CAAC,KAAkB,EAAE,OAA2B,EAAE,IAAY;IAC5E,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACtC,gGAAgG;IAChG,oGAAoG;IACpG,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACtB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,KAAkB,EAAE,OAAgB;IACrD,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,OAAO,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,uFAAuF;QACvF,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAClC,OAAO,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAC;QACtB,GAAG,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC;IAC7B,CAAC;IACD,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,OAAe,EACf,KAAwB,EACxB,OAAoB,EACpB,OAAgD;IAEhD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,KAAK,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK,EAAE,cAAc,OAAO,CAAC,IAAI,gCAAgC,IAAI,EAAE,EAAE,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;gBACtF,GAAG,EAAE,IAAI;gBACT,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,CAAC,IAAI,EAAE;gBAClB,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;aACnD,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,6FAA6F;YAC7F,yEAAyE;YACzE,MAAM,QAAQ,GAAG,sDAAsD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrF,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,EAAE,GAAG,EAAE,WAAW,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACnD,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,8BAA8B,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAA8C,CAAC;YAC/D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;YAClF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACjE,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1C,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAClC,OAAO,EACP;YACE,GAAG,KAAK;YACR,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YACtB,QAAQ;YACR,kGAAkG;YAClG,sGAAsG;YACtG,gGAAgG;YAChG,6FAA6F;YAC7F,mBAAmB;YACnB,GAAG,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAClE,SAAS;YACT,OAAO,CAAC,KAAK;YACb,aAAa;YACb,QAAQ;SACT,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAC9G,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,uBAAuB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aACrH,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAA8C,CAAC;QAC/D,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,IAAI,oBAAoB,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,oBAAoB,EAAE,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/lib/index.d.ts

@@ -5,6 +5,6 @@
  */
 import { type CommandBackend } from 'gcb-core';
 export * from './gh.ts';
-export declare const HOST_HELP = "gcb-host \u2014 host-side gcb broker and administration commands.\n\nUsage: gcb <command> [options]\n\nCommands\n  app          Run the app broker (alias for daemon)\n  host         Run the host operations opener (alias for host-opener)\n  daemon       Run the broker (normally started by the service manager)\n  init         Create or update the broker config, and install the key\n  stage        Export a reviewed commit to where the broker will run\n  compose      Print a Docker sidecar definition for the broker\n  config       Validate the broker configuration\n  diagnose     Ask GitHub what the App can actually see\n  authorize    Authorize this app once for person-authored pull requests\n  host-opener  Watch for the container's pull-request requests and create them\n\nClient commands such as setup/probe/logs/pr are in gcb-client.";
+export declare const HOST_HELP = "gcb-host \u2014 host-side gcb broker and administration commands.\n\nUsage: gcb <command> [options]\n\nCommands\n  app          Run the app broker (alias for daemon)\n  host         Run the host operations opener (alias for host-opener)\n  daemon       Run the broker (normally started by the service manager)\n  init         Create or update the broker config, and install the key\n  stage        Export a reviewed commit to where the broker will run\n  compose      Print a Docker sidecar definition for the broker\n  config       Validate or edit the broker configuration\n  diagnose     Ask GitHub what the App can actually see\n  authorize    Authorize this app once for person-authored pull requests\n  host-opener  Watch for the container's pull-request requests and create them\n\nClient commands such as setup/probe/logs/pr are in gcb-client.";
 export declare const hostBackend: CommandBackend;
 //# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAG9D,cAAc,SAAS,CAAC;AAExB,eAAO,MAAM,SAAS,g1BAgByC,CAAC;AAgChE,eAAO,MAAM,WAAW,EAAE,cAKzB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAG9D,cAAc,SAAS,CAAC;AAExB,eAAO,MAAM,SAAS,w1BAgByC,CAAC;AAgChE,eAAO,MAAM,WAAW,EAAE,cAKzB,CAAC"}

package/lib/index.js

@@ -17,7 +17,7 @@ Commands
   init         Create or update the broker config, and install the key
   stage        Export a reviewed commit to where the broker will run
   compose      Print a Docker sidecar definition for the broker
-  config       Validate the broker configuration
+  config       Validate or edit the broker configuration
   diagnose     Ask GitHub what the App can actually see
   authorize    Authorize this app once for person-authored pull requests
   host-opener  Watch for the container's pull-request requests and create them

package/lib/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAclE,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CA2BlE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAUjE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAerE;AAED,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAOzF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAclE,kCAAkC;AAClC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CA2BlE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAUjE;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBrE;AAED,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAExE;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAOzF"}

package/lib/policy.js

@@ -79,11 +79,13 @@ export function parseAllowEntry(entry) {
 export function repoAllowed(allowList, full) {
     if (typeof full !== 'string' || !Array.isArray(allowList))
         return false;
-    const slash = full.indexOf('/');
+    // Repository names are case-insensitive on GitHub; the caller may pass the spelling from a remote URL.
+    const normalized = full.toLowerCase();
+    const slash = normalized.indexOf('/');
     if (slash <= 0)
         return false;
-    const owner = full.slice(0, slash);
-    const repo = full.slice(slash + 1);
+    const owner = normalized.slice(0, slash);
+    const repo = normalized.slice(slash + 1);
     for (const raw of allowList) {
         const entry = parseAllowEntry(raw);
         if (!entry)

package/lib/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAgBA,kFAAkF;AAClF,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,4EAA4E;AAC5E,MAAM,YAAY,GAAG,mDAAmD,CAAC;AAEzE,4FAA4F;AAC5F,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC;AAQrB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEjE,wFAAwF;IACxF,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,SAAkB,EAAE,IAAY;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEnC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QACnE,IAAI,YAAY,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB,EAAE,IAAa;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAgBA,kFAAkF;AAClF,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,4EAA4E;AAC5E,MAAM,YAAY,GAAG,mDAAmD,CAAC;AAEzE,4FAA4F;AAC5F,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC;AAQrB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,IAAI,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,IAAI,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEtD,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEjE,wFAAwF;IACxF,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,SAAkB,EAAE,IAAY;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,uGAAuG;IACvG,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEzC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;QACvE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QACnE,IAAI,YAAY,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAKD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB,EAAE,IAAa;IAC5D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,IAAI,cAAc,CAAC,WAAW,EAAE,KAAK,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/providers/github-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/providers/github-app.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAc,SAAS,EAAqB,mBAAmB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBxG,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAuB7D;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,CA+5BnF"}
+{"version":3,"file":"github-app.d.ts","sourceRoot":"","sources":["../../src/providers/github-app.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAc,SAAS,EAAqB,mBAAmB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAmBxG,mDAAmD;AACnD,MAAM,WAAW,wBAAwB;IACvC,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uCAAuC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,mCAAmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6BAA6B;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,sCAAsC;AACtC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAuB7D;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQjE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB,GAAG,QAAQ,CA+8BnF"}

package/lib/providers/github-app.js

@@ -558,11 +558,36 @@ export function createGithubAppProvider(options) {
          * @returns the number and the URL GitHub answered with.
          */
         async pullRequest(request) {
+            if (request.action === 'fork') {
+                let token = await personalToken();
+                const userToken = cfg.userTokens?.[request.owner];
+                if (token === undefined && userToken !== undefined) {
+                    token = readFileSync(userToken, 'utf8').trim();
+                }
+                if (token === undefined) {
+                    throw new ProviderConfigError('no user token for fork; run gcb authorize or configure userTokens');
+                }
+                const { text } = await callWithToken('POST', `${api}/repos/${request.owner}/${request.repo}/forks`, token);
+                let payload = null;
+                try {
+                    payload = JSON.parse(text);
+                }
+                catch {
+                    payload = null;
+                }
+                const forked = (payload ?? {});
+                if (typeof forked.full_name !== 'string' || typeof forked.html_url !== 'string') {
+                    throw new ProviderConfigError('GitHub did not answer with a fork');
+                }
+                return { number: 0, url: forked.html_url };
+            }
             // The two actions a person may perform are decided first: when somebody has authorized this
             // deployment, their token is the whole authority for them, and requiring an installation as well
             // would refuse a repository the app was never installed on — the fork-to-upstream case the allowlist
             // exists to permit. Everything else still acts as the app, and only ever could.
-            const personalForThis = request.action === 'open' || request.action === 'resolve';
+            const wantsApp = request.identity === 'app';
+            const wantsUser = request.identity === 'user';
+            const personalForThis = !wantsApp && (request.action === 'open' || request.action === 'resolve');
             const personToken = personalForThis ? await personalToken() : undefined;
             // `--status` also reads /actions/runs, which is checked against actions: read. Pre-flighting
             // pull_requests alone passed a grant that could not make that call, which is the opposite of what a
@@ -573,10 +598,11 @@ export function createGithubAppProvider(options) {
             // A token per owner is the other way a person acts. It counts exactly as the authorized token does:
             // whoever is acting, requiring an installation as well would refuse a repository the app was never
             // installed on — the fork-to-upstream case the allowlist exists to permit.
-            const fileToken = request.action === 'open' || request.action === 'resolve'
-                ? cfg.userTokens?.[request.owner]
-                : undefined;
+            const fileToken = personalForThis ? cfg.userTokens?.[request.owner] : undefined;
             const actingToken = personToken ?? (fileToken === undefined ? undefined : readFileSync(fileToken, 'utf8').trim());
+            if (wantsUser && actingToken === undefined) {
+                throw new ProviderConfigError('no authorized user token for this request; run gcb authorize or configure userTokens');
+            }
             if (actingToken === undefined) {
                 await ensurePermissions(request.owner, wanted);
                 const installationId = await resolveInstallationId(request.owner);
@@ -747,66 +773,86 @@ export function createGithubAppProvider(options) {
                     query: 'query($owner:String!,$name:String!,$number:Int!){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:50){totalCount nodes{id isResolved path line comments(first:10){nodes{databaseId author{login} body}}}}}}}',
                     variables: { owner: request.owner, name: request.repo, number: request.number },
                 });
-                let listed = null;
+                let listed;
                 try {
                     listed = JSON.parse(raw);
                 }
                 catch {
-                    listed = null;
+                    throw new Error('GitHub did not answer with review-thread JSON');
                 }
-                // Nothing from a response body reaches the container — the broker answers with a generic
-                // message for an ordinary Error — but the host log is where a reason belongs, and a refusal
-                // that reads as "no threads" is worse than one that reads as a refusal.
-                const refused = (listed ?? {});
+                // A refusal that reads as "no threads" is worse than one that reads as a refusal: malformed
+                // JSON, a GraphQL error, and a missing reviewThreads shape are all failures, not an empty list.
+                if (listed === null || typeof listed !== 'object') {
+                    throw new Error('GitHub did not answer with review-thread JSON');
+                }
+                const refused = listed;
                 if (Array.isArray(refused.errors) && refused.errors.length > 0) {
                     throw new Error(`GitHub refused to list the review threads: ${JSON.stringify(refused.errors).slice(0, 300)}`);
                 }
-                const data = (listed ?? {});
-                const nodes = data.data?.repository?.pullRequest?.reviewThreads?.nodes;
+                const data = listed;
+                const threads = data.data?.repository?.pullRequest?.reviewThreads;
+                if (threads === undefined || threads === null) {
+                    throw new Error('GitHub did not answer with reviewThreads');
+                }
+                if (!Array.isArray(threads.nodes)) {
+                    throw new Error('GitHub did not answer with reviewThreads.nodes');
+                }
+                if (typeof threads.totalCount !== 'number' || !Number.isInteger(threads.totalCount) || threads.totalCount < 0) {
+                    throw new Error('GitHub did not answer with reviewThreads.totalCount');
+                }
+                if (threads.totalCount > 0 && threads.nodes.length === 0) {
+                    throw new Error('GitHub answered with a thread count but no threads');
+                }
+                const nodes = threads.nodes;
                 const report = [];
-                if (Array.isArray(nodes)) {
-                    for (const node of nodes) {
-                        report.push(`${node.isResolved === true ? 'resolved' : 'open    '} ${String(node.id ?? '')}  ${String(node.path ?? '')}:${String(node.line ?? '')}`);
-                        const comments = node.comments?.nodes;
-                        if (!Array.isArray(comments))
-                            continue;
-                        for (const comment of comments) {
-                            // The whole comment, not its first line and not 120 characters of it: a review bot puts the finding
-                            // in the lines below the header, and a report that drops them sends the reader to the web UI for the
-                            // one thing this command exists to show.
-                            const body = String(comment.body ?? '');
-                            // The prose, not the first twelve lines of the comment: a review bot prefixes its finding with the
-                            // commands it ran and a fence of their output, so counting raw lines reads the preamble and never
-                            // reaches the claim. Fences and the bot's own metadata lines are dropped, and the cap then applies to
-                            // what is left, which is what the reader wants and what the writer meant.
-                            const bodyLines = body.split('\n');
-                            const kept = [];
-                            let inFence = false;
-                            for (const raw of bodyLines) {
-                                const line = raw.trim();
-                                if (line.startsWith('```')) {
-                                    inFence = !inFence;
-                                    continue;
-                                }
-                                if (inFence)
-                                    continue;
-                                if (/^(🏁|🔎|⚙️|🌐|💡|💬|🔗|Repository:|Length of output:|Proposed fix$|---$|_?\s*[🔒📐🎯🩺🟡🟠])/u.test(line))
-                                    continue;
-                                kept.push(line.replace(/<\/?[a-z][^>]*>/gi, '').trim());
+                for (const node of nodes) {
+                    if (typeof node.id !== 'string' || node.id === '') {
+                        throw new Error('GitHub did not answer with a review-thread id');
+                    }
+                    // The id is the handle `--resolve` needs; the body is the finding. Both are required.
+                    report.push(`${node.isResolved === true ? 'resolved' : 'open    '} ${node.id}  ${String(node.path ?? '')}:${String(node.line ?? '')}`);
+                    const comments = node.comments?.nodes;
+                    if (!Array.isArray(comments)) {
+                        throw new Error('GitHub did not answer with review-thread comments');
+                    }
+                    for (const comment of comments) {
+                        // The whole comment, not its first line and not 120 characters of it: a review bot puts the finding
+                        // in the lines below the header, and a report that drops them sends the reader to the web UI for the
+                        // one thing this command exists to show.
+                        if (typeof comment.body !== 'string') {
+                            throw new Error('GitHub did not answer with a review-comment body');
+                        }
+                        const body = comment.body;
+                        // The prose, not the first twelve lines of the comment: a review bot prefixes its finding with the
+                        // commands it ran and a fence of their output, so counting raw lines reads the preamble and never
+                        // reaches the claim. Fences and the bot's own metadata lines are dropped, and the cap then applies to
+                        // what is left, which is what the reader wants and what the writer meant.
+                        const bodyLines = body.split('\n');
+                        const kept = [];
+                        let inFence = false;
+                        for (const raw of bodyLines) {
+                            const line = raw.trim();
+                            if (line.startsWith('```')) {
+                                inFence = !inFence;
+                                continue;
                             }
-                            const shown = kept.filter((line) => line !== '').slice(0, 14);
-                            const more = kept.length > shown.length ? ` (+${kept.length - shown.length} more lines)` : '';
-                            report.push(`    ${String(comment.databaseId ?? '')} @${String(comment.author?.login ?? '?')}:${more}`);
-                            for (const line of shown)
-                                report.push(`      ${line.slice(0, 300)}`);
+                            if (inFence)
+                                continue;
+                            if (/^(🏁|🔎|⚙️|🌐|💡|💬|🔗|Repository:|Length of output:|Proposed fix$|---$|_?\s*[🔒📐🎯🩺🟡🟠])/u.test(line))
+                                continue;
+                            kept.push(line.replace(/<\/?[a-z][^>]*>/gi, '').trim());
                         }
+                        const visible = kept.filter((line) => line !== '');
+                        const shown = visible.slice(0, 14);
+                        const more = visible.length > shown.length ? ` (+${visible.length - shown.length} more lines)` : '';
+                        report.push(`    ${String(comment.databaseId ?? '')} @${String(comment.author?.login ?? '?')}:${more}`);
+                        for (const line of shown)
+                            report.push(`      ${line.slice(0, 300)}`);
                     }
                 }
                 // A page is not the whole list. Saying which it is is the difference between a report and a guess.
-                const shown = Array.isArray(nodes) ? nodes.length : 0;
-                const counted = data.data?.repository?.pullRequest?.reviewThreads
-                    ?.totalCount;
-                const total = typeof counted === 'number' ? counted : shown;
+                const shown = nodes.length;
+                const total = threads.totalCount;
                 if (total > shown) {
                     report.push(`... and ${total - shown} more: this asks for the first 50 threads, and the first 10 comments of each`);
                 }