infraweaver 0.1.0

package/src/utils/baseRefConfig.ts

@@ -0,0 +1,254 @@
+/**
+ * Trust boundary for the repo-committed `.infraweaver.yml` on a PULL-REQUEST run.
+ *
+ * THE PROBLEM. `.infraweaver.yml` is read from the checked-out ref, which on a PR
+ * run is the PR's own head. Most of the run's shape is already out of reach —
+ * `push`, `shell`, `allow_replace` and the `*_instructions` are deliberately not
+ * file-readable, because "the run's shape belongs to the workflow that
+ * dispatches it" ([[infraweaverConfig]]). But several keys that ARE file-readable
+ * decide how strictly the run judges the code, and a PR that edits them is
+ * editing the gates that judge that same PR:
+ *
+ *   allowed_paths / protected_paths  → what the fix loop may write
+ *   required_controls                → which controls must be clean to pass
+ *   severity_threshold               → what counts as reportable at all
+ *   autonomy_threshold               → what escalates to a human
+ *   tools_enabled                    → which scanners run
+ *   scan_scope / iac_languages       → how much of the tree is looked at
+ *   suppressions                     → which findings are silenced outright
+ *
+ * None of these is an arbitrary-code-execution hole, and GitHub already defangs
+ * the fork case (read-only token, no secrets on `pull_request`). A workflow
+ * input also always wins over the file. But "the workflow author remembered to
+ * pin it" is not a control, and a same-repo PR silencing the finding that would
+ * have blocked it is a plausible, quiet failure.
+ *
+ * THE RULE. On a PR-triggered run these come from the BASE ref — the reviewed
+ * state of the branch being merged into. Everything else (prose language,
+ * grouping, the advisory module catalogue) still comes from the head, because
+ * none of it can weaken a verdict.
+ *
+ * This is the same principle as the shipped two-person SoD on waivers (§5.3): a
+ * suppression takes effect once someone other than its author has accepted it —
+ * here, by merging it. A PR that adds a waiver still SEES the finding it waives;
+ * the waiver applies from the next run on the merged base.
+ *
+ * HONEST DEGRADE. When the base ref can't be read (a shallow clone with no
+ * `origin/<base>`, a non-PR run, no git at all), the head value is used and the
+ * fact is stated for the run summary. Failing the run would turn a hardening
+ * measure into an outage on every shallow-checkout workflow; silently preferring
+ * the head with no record would be the dishonesty this codebase avoids
+ * everywhere else. So: use it, and say so.
+ *
+ * DIRECTION IS NOT INSPECTED. A PR that *tightens* a gate also defers to the
+ * base value — not because tightening is dangerous, but because "which value
+ * applies" must not depend on a per-key notion of stricter/looser that we would
+ * have to get right for every key forever. The new value takes effect on merge,
+ * which is when the reviewed state actually changes.
+ */
+
+import { CONFIG_FILE } from "#app/brand";
+// the sync, restricted-env, timeout-bounded runner every other git shell-out
+// uses (`resolveBaseRef` in mcp/terraform/paths.ts does the same) — a config
+// read must not inherit the ambient env any more than a scanner does.
+import { run } from "#app/mcp/terraform/subprocess";
+import { log } from "#app/utils/cli";
+import {
+  type InfraweaverConfigKey,
+  type InfraweaverFileValues,
+  INFRAWEAVER_CONFIG_FILENAMES,
+  parseInfraweaverConfig,
+} from "#app/utils/infraweaverConfig";
+
+/**
+ * The file-readable keys that can weaken a verdict. Deliberately enumerated
+ * rather than derived by exclusion, and paired with
+ * {@link PRESENTATIONAL_CONFIG_KEYS} so that every key in
+ * `INFRAWEAVER_CONFIG_KEYS` is classified exactly once — `baseRefConfig.test.ts`
+ * asserts that partition, so a key added later cannot silently default to
+ * "PR-controllable".
+ */
+export const GATE_RELEVANT_CONFIG_KEYS = [
+  "allowed_paths",
+  "protected_paths",
+  "required_controls",
+  "severity_threshold",
+  "autonomy_threshold",
+  "tools_enabled",
+  "scan_scope",
+  "iac_languages",
+] as const satisfies readonly InfraweaverConfigKey[];
+
+/**
+ * Keys a PR may set from its own head: none can hide a finding, relax a
+ * guardrail, or shrink what is scanned. `language` is prose only; `grouping` is
+ * presentation; `module_catalogue` is an advisory list the fixer may prefer
+ * from, never a gate.
+ */
+export const PRESENTATIONAL_CONFIG_KEYS = [
+  "language",
+  "grouping",
+  "module_catalogue",
+] as const satisfies readonly InfraweaverConfigKey[];
+
+const GATE_KEY_SET: ReadonlySet<string> = new Set<string>(
+  GATE_RELEVANT_CONFIG_KEYS,
+);
+
+/** What the base ref had to say about `.infraweaver.*`. */
+export type BaseConfigSource =
+  /** the base ref itself could not be resolved (shallow clone, no git, non-PR). */
+  | { kind: "unavailable" }
+  /** the base ref resolved and carries NO config file — so no file-level policy. */
+  | { kind: "absent"; ref: string }
+  | { kind: "file"; ref: string; raw: string; format: "yaml" | "json" };
+
+/** `git show <ref>:<path>`, or null when the ref/path pair doesn't resolve. */
+function showAtRef(cwd: string, ref: string, path: string): string | null {
+  const r = run("git", ["show", `${ref}:${path}`], cwd);
+  return r.status === 0 ? r.stdout : null;
+}
+
+/** Candidate git refs for the PR's base, most-specific first. */
+function baseRefCandidates(baseRef: string): string[] {
+  return [`origin/${baseRef}`, `refs/remotes/origin/${baseRef}`, baseRef];
+}
+
+// One `git show` per (cwd, baseRef) per process. Both the scalar-key resolver
+// and the suppression-policy loader ask the same question, and the answer
+// cannot change mid-run.
+const cache = new Map<string, BaseConfigSource>();
+
+/** Drop the base-ref read cache — tests only. */
+export function resetBaseConfigCache(): void {
+  cache.clear();
+}
+
+/**
+ * Read `.infraweaver.*` as it exists on the PR's base ref.
+ *
+ * The `absent` / `unavailable` distinction is load-bearing: "the base has no
+ * config" legitimately means *no file-level policy applies*, so a PR that ADDS
+ * one is correctly ignored. "We could not look" must never be read that way, or
+ * a shallow clone would silently drop a real policy.
+ */
+export function readConfigAtBaseRef(
+  cwdOrUndefined: string | undefined,
+  baseRef: string | undefined,
+): BaseConfigSource {
+  if (!baseRef) return { kind: "unavailable" };
+  const cwd = cwdOrUndefined ?? process.cwd();
+  const key = `${cwd}::${baseRef}`;
+  const hit = cache.get(key);
+  if (hit) return hit;
+
+  let result: BaseConfigSource = { kind: "unavailable" };
+  for (const ref of baseRefCandidates(baseRef)) {
+    // Prove the ref resolves before concluding anything from a missing file.
+    if (
+      run("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], cwd)
+        .status !== 0
+    ) {
+      continue;
+    }
+    result = { kind: "absent", ref };
+    for (const name of INFRAWEAVER_CONFIG_FILENAMES) {
+      const raw = showAtRef(cwd, ref, name);
+      if (raw === null) continue;
+      result = {
+        kind: "file",
+        ref,
+        raw,
+        format: name.endsWith(".json") ? "json" : "yaml",
+      };
+      break;
+    }
+    break;
+  }
+  cache.set(key, result);
+  return result;
+}
+
+export interface BaseRefConfigResult {
+  /** the config to use, gate keys taken from the base ref where available. */
+  values: InfraweaverFileValues;
+  /** human-readable notes for the run log: what was overridden, or why not. */
+  notes: string[];
+}
+
+/**
+ * Layer the base ref's gate-relevant keys over the head's config. `headValues`
+ * is what `loadInfraweaverConfig` already read from the checked-out tree; on a
+ * non-PR run (or when the base can't be resolved) it comes back unchanged.
+ */
+export function resolveConfigAcrossRefs(args: {
+  cwd: string | undefined;
+  headValues: InfraweaverFileValues;
+  /** the PR's base branch — `GITHUB_BASE_REF`; empty/undefined on a non-PR run. */
+  baseRef: string | undefined;
+  /** injectable for tests; defaults to the real git read. */
+  readBase?: (
+    cwd: string | undefined,
+    baseRef: string | undefined,
+  ) => BaseConfigSource;
+}): BaseRefConfigResult {
+  const { cwd, headValues, baseRef } = args;
+  const notes: string[] = [];
+  if (!baseRef) return { values: headValues, notes };
+
+  const source = (args.readBase ?? readConfigAtBaseRef)(cwd, baseRef);
+  const headGateKeys = Object.keys(headValues).filter((k) =>
+    GATE_KEY_SET.has(k),
+  );
+
+  if (source.kind === "unavailable") {
+    // Only worth a note when the head actually sets a gate key — otherwise
+    // there was nothing the base could have overridden.
+    if (headGateKeys.length > 0) {
+      notes.push(
+        `could not read the base ref (${baseRef}) to resolve gate-relevant config — using this ` +
+          `ref's values for [${headGateKeys.join(", ")}]. A shallow clone causes this; ` +
+          "`fetch-depth: 0` (or fetching the base branch) restores the check.",
+      );
+    }
+    return { values: headValues, notes };
+  }
+
+  const baseValues =
+    source.kind === "file"
+      ? parseInfraweaverConfig(source.raw, source.format).values
+      : {};
+  const values: InfraweaverFileValues = { ...headValues };
+  const changed: string[] = [];
+  for (const key of GATE_RELEVANT_CONFIG_KEYS) {
+    if (headValues[key] === baseValues[key]) continue;
+    changed.push(key);
+    const base = baseValues[key];
+    if (base === undefined) delete values[key];
+    else values[key] = base;
+  }
+
+  if (changed.length > 0) {
+    notes.push(
+      `gate-relevant config differs from the base ref (${source.ref}); using the BASE value for ` +
+        `[${changed.join(", ")}] so this change cannot relax the gates reviewing it. ` +
+        "It takes effect once merged.",
+    );
+  }
+  return { values, notes };
+}
+
+/**
+ * `resolveConfigAcrossRefs` + logging, for the one call site in `resolvePayload`.
+ * Notes are warnings, not info: a divergence belongs in the run summary rather
+ * than buried in debug output.
+ */
+export function applyBaseRefConfigPolicy(args: {
+  cwd: string | undefined;
+  headValues: InfraweaverFileValues;
+  baseRef: string | undefined;
+}): InfraweaverFileValues {
+  const { values, notes } = resolveConfigAcrossRefs(args);
+  for (const n of notes) log.warning(`» ${CONFIG_FILE}: ${n}`);
+  return values;
+}

package/src/utils/billingErrors.ts

@@ -0,0 +1,210 @@
+/**
+ * Billing-error classification + user-facing copy for `/api/proxy-token`
+ * failures and OpenRouter mid-run exhaustion. Two error classes (Billing vs.
+ * Transient) keep the framing honest: a card decline is *not* the same UX as
+ * a 503 from the proxy service. Both originate in `utils/proxy.ts` (mint
+ * failures) and `utils/runErrorRenderer.ts` (mid-run keylimit reclassify).
+ *
+ * Renderers return markdown bodies that are written into both the GitHub
+ * Actions job summary and the PR progress comment.
+ *
+ * Lives outside `main.ts` so adding a new error `code` branch is a one-file
+ * edit that does not retrigger the full LLM CI matrix (`action/main.ts` is
+ * in `action/test/coverage.ts::ALWAYS_RUN_ALL`).
+ */
+
+import { PRIMARY_DOMAIN, PRODUCT_NAME, STATUS_URL } from "#app/brand";
+
+/**
+ * Billing-layer error surfaced from `/api/proxy-token` as a 402. User-actionable
+ * — distinct from TransientError (503 / transient sync issue) so the job
+ * summary + PR comment can use affirmative "you need to do X" copy rather than
+ * the ambiguous "billing error" label that makes transient outages look like
+ * the user's fault.
+ *
+ * `code` is a server-side discriminator: `router_requires_card` (no card + no
+ * wallet balance on Router), or null for unclassified. `declineCode` is
+ * Stripe's more specific sub-reason on `card_declined` (e.g.
+ * `insufficient_funds`, `lost_card`). `needsReauthentication` is the 3DS case
+ * broken out for convenience.
+ */
+export class BillingError extends Error {
+  code: string | null;
+  declineCode: string | null;
+  needsReauthentication: boolean;
+
+  constructor(
+    message: string,
+    opts: {
+      code?: string | null;
+      declineCode?: string | null;
+      needsReauthentication?: boolean;
+    } = {},
+  ) {
+    super(message);
+    this.name = "BillingError";
+    this.code = opts.code ?? null;
+    this.declineCode = opts.declineCode ?? null;
+    this.needsReauthentication = opts.needsReauthentication ?? false;
+  }
+}
+
+/**
+ * Transient service failures from `/api/proxy-token` (503: partial OpenRouter
+ * usage sync, DB flake, in-flight payment intent). Not the user's fault — the
+ * summary uses "temporarily unavailable" framing, and the non-zero exit lets
+ * GH Actions apply whatever retry policy the workflow has configured.
+ */
+export class TransientError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "TransientError";
+  }
+}
+
+/**
+ * Deep link into the right console section for the failing account. Anchors
+ * are defined in `app/console/[owner]/page.tsx` (`#billing`, `#model-access`).
+ * `owner` is the GitHub login of the repo's account — i.e. the org or user
+ * that pays for this repo's runs, which is the right scope for billing.
+ */
+function billingConsoleUrl(
+  owner: string,
+  anchor: "billing" | "model-access",
+): string {
+  return `https://infraweaver.dev/console/${encodeURIComponent(owner)}#${anchor}`;
+}
+
+/**
+ * Render a BillingError as user-facing markdown (shared between GH job summary
+ * and the PR progress comment). Goals:
+ *
+ *   - quiet, not alarmist — bold first line instead of an `### ❌` H3, since
+ *     the comment already has Infraweaver branding in the footer
+ *   - actionable — every branch ends in a single CTA deep-linked to the
+ *     correct section of the owner's console
+ *   - honest — say what actually went wrong (card declined vs. balance
+ *     empty vs. 3DS required), don't lump them under "billing error"
+ *
+ * Branches:
+ *   - `router_requires_card`: user is on Router mode with no card AND no
+ *     wallet balance (signup credit exhausted or not granted). Frame as
+ *     "add a card to continue", link to `#model-access` where the Add
+ *     Card flow lives.
+ *   - `router_balance_exhausted`: user has a card on file but auto-reload is
+ *     disabled and they've spent past their $5 overdraft buffer. Frame as
+ *     "balance ran out" and surface both remediation paths (top up, or flip
+ *     on auto-reload).
+ *   - `router_keylimit_exhausted`: OpenRouter rejected mid-run because the
+ *     per-run key budget was exhausted while the agent was working. The
+ *     wallet is now negative; same remediation as `router_balance_exhausted`
+ *     but framed for the after-the-fact case ("this run was cut short").
+ *   - `needsReauthentication`: issuer requires 3DS on every off-session
+ *     charge. Re-adding the card won't help — the only escape is a manual
+ *     top-up where 3DS runs interactively in Stripe Checkout.
+ *   - `declineCode` set: Stripe declined a real charge. Show the sub-code
+ *     so support can act on it; tell the user we'll retry on next dispatch.
+ *   - default: balance hit zero with no in-flight charge (auto-reload off
+ *     or amount below threshold). Direct them to top up or enable auto-reload.
+ */
+export function formatBillingErrorSummary(
+  error: BillingError,
+  owner: string,
+): string {
+  if (error.code === "router_requires_card") {
+    return [
+      `**Add a card to start using ${PRODUCT_NAME} Router.**`,
+      "",
+      "Router proxies OpenRouter at raw cost — no platform markup. Add a card and we'll auto-reload your wallet so runs keep flowing.",
+      "",
+      `[Add a card →](${billingConsoleUrl(owner, "model-access")})`,
+    ].join("\n");
+  }
+
+  if (error.code === "router_balance_exhausted") {
+    return [
+      `**Your ${PRODUCT_NAME} Router balance is exhausted.**`,
+      "",
+      "You have a card on file but auto-reload is disabled, so runs paused once your balance went past the overdraft buffer.",
+      "",
+      `[Top up balance →](${billingConsoleUrl(owner, "billing")}) · [Enable auto-reload →](${billingConsoleUrl(owner, "model-access")})`,
+    ].join("\n");
+  }
+
+  if (error.code === "router_keylimit_exhausted") {
+    return [
+      `**This run was cut short — your ${PRODUCT_NAME} Router balance ran out mid-run.**`,
+      "",
+      "OpenRouter stopped the agent because the per-run budget was exhausted. Your wallet is now negative; top up or enable auto-reload to keep runs flowing.",
+      "",
+      `[Top up balance →](${billingConsoleUrl(owner, "billing")}) · [Enable auto-reload →](${billingConsoleUrl(owner, "model-access")})`,
+    ].join("\n");
+  }
+
+  if (error.code === "router_requires_upgrade") {
+    return [
+      "**This managed model needs a higher plan.**",
+      "",
+      "Managed models run through our AWS Bedrock proxy (UK & EU): **Claude Opus 4.8** and **Claude Sonnet 5** run on OSS + Team, and **Claude Fable 5** is on Enterprise. Upgrade to run this model, or pick one your plan includes.",
+      "",
+      `[Upgrade your plan →](${billingConsoleUrl(owner, "billing")})`,
+    ].join("\n");
+  }
+
+  if (error.code === "router_monthly_limit") {
+    return [
+      `**${PRODUCT_NAME} Router hit its monthly spend limit.**`,
+      "",
+      "Auto-reloads are paused for the rest of this UTC month. Ask your admin to raise the cap, or wait for it to reset at 00:00 UTC on the 1st.",
+      "",
+      `[Adjust limit →](${billingConsoleUrl(owner, "model-access")})`,
+    ].join("\n");
+  }
+
+  if (error.needsReauthentication) {
+    const code = error.declineCode ?? "authentication_required";
+    return [
+      `**Your card issuer requires 3D Secure on every charge** (\`${code}\`).`,
+      "",
+      `${PRODUCT_NAME} can't complete a 3DS challenge from inside a workflow. Top up your Router balance once in Stripe Checkout — subsequent runs draw from the prepaid balance without re-triggering 3DS.`,
+      "",
+      `[Top up balance →](${billingConsoleUrl(owner, "billing")})`,
+    ].join("\n");
+  }
+
+  if (error.declineCode) {
+    return [
+      `**Your card was declined** (\`${error.declineCode}\`).`,
+      "",
+      `Update your payment method and ${PRODUCT_NAME} will retry on the next run.`,
+      "",
+      `[Update payment method →](${billingConsoleUrl(owner, "billing")})`,
+    ].join("\n");
+  }
+
+  return [
+    `**Your ${PRODUCT_NAME} balance is empty.**`,
+    "",
+    "Top up your balance or enable auto-reload to keep runs flowing.",
+    "",
+    `[Manage billing →](${billingConsoleUrl(owner, "billing")})`,
+  ].join("\n");
+}
+
+/**
+ * Render a TransientError as user-facing markdown. Distinct framing from
+ * BillingError so the user doesn't read an alarm and assume their card
+ * failed — this branch is "our fault, retry shortly", not theirs.
+ */
+export function formatTransientErrorSummary(
+  error: TransientError,
+  owner: string,
+): string {
+  return [
+    `**${PRODUCT_NAME} billing is temporarily unavailable.**`,
+    "",
+    error.message,
+    "",
+    `Usually transient — the next dispatch should succeed. If it persists, check [status.${PRIMARY_DOMAIN}](${STATUS_URL}) or [your console](${billingConsoleUrl(owner, "billing")}).`,
+  ].join("\n");
+}

package/src/utils/body.ts

@@ -0,0 +1,168 @@
+import TurndownService from "turndown";
+import type { PayloadEvent } from "#app/external";
+import { downloadAssetsInMarkdown } from "#app/utils/assets";
+import type { OctokitWithPlugins } from "#app/utils/github";
+import type { RunContextData } from "#app/utils/runContextData";
+
+const turndown = new TurndownService();
+
+function hasImages(body: string | null | undefined): boolean {
+  if (!body) return false;
+  return body.includes("<img") || body.includes("![");
+}
+
+interface ResolveBodyContext {
+  event: PayloadEvent;
+  octokit: OctokitWithPlugins;
+  repo: RunContextData["repo"];
+  tmpdir: string;
+  githubToken: string;
+}
+
+/**
+ * resolves the body of an event by fetching body_html and converting to markdown.
+ * only fetches body_html if the body contains images (to avoid unnecessary API calls).
+ * this ensures agents receive markdown with working signed image URLs instead of
+ * broken user-attachments URLs.
+ */
+export async function resolveBody(ctx: ResolveBodyContext): Promise<string | null> {
+  const body = ctx.event.body;
+  const bodyHtml = hasImages(body) ? await fetchBodyHtml(ctx) : undefined;
+  return resolveBodyAssets({
+    body,
+    bodyHtml,
+    tmpdir: ctx.tmpdir,
+    githubToken: ctx.githubToken,
+  });
+}
+
+interface ResolveBodyAssetsContext {
+  body: string | null | undefined;
+  bodyHtml: string | null | undefined;
+  tmpdir: string;
+  githubToken: string;
+}
+
+/**
+ * downloads github-hosted image assets in a body to disk and rewrites the urls to local
+ * paths so the agent can read them. when the body has images and a rendered `bodyHtml`
+ * is supplied, the html is turndowned first: github only exposes attachments as signed,
+ * self-authenticating `*.githubusercontent.com` urls through body_html — the raw
+ * `github.com/user-attachments/...` urls in unrendered markdown 404 for the installation
+ * token. callers that fetch a body should request it with the `application/vnd.github.full+json`
+ * media type and pass `body_html` here.
+ */
+export async function resolveBodyAssets(ctx: ResolveBodyAssetsContext): Promise<string | null> {
+  let body = ctx.body ?? null;
+  if (body && hasImages(body) && ctx.bodyHtml) {
+    body = turndown.turndown(ctx.bodyHtml);
+  }
+  if (!body) return ctx.body ?? null;
+  return downloadAssetsInMarkdown(body, ctx.tmpdir, ctx.githubToken);
+}
+
+async function fetchBodyHtml(ctx: ResolveBodyContext): Promise<string | undefined> {
+  const event = ctx.event;
+  const headers = { accept: "application/vnd.github.full+json" };
+  const owner = ctx.repo.owner;
+  const repo = ctx.repo.name;
+
+  switch (event.trigger) {
+    case "issue_comment_created":
+      if (!event.comment_id) return;
+      return (
+        await ctx.octokit.rest.issues.getComment({
+          owner,
+          repo,
+          comment_id: event.comment_id,
+          headers,
+        })
+      ).data.body_html;
+
+    case "issues_opened":
+    case "issues_assigned":
+    case "issues_labeled":
+      if (!event.issue_number) return;
+      return (
+        await ctx.octokit.rest.issues.get({
+          owner,
+          repo,
+          issue_number: event.issue_number,
+          headers,
+        })
+      ).data.body_html;
+
+    case "pull_request_opened":
+    case "pull_request_ready_for_review":
+    case "pull_request_synchronize":
+    case "pull_request_review_requested":
+      // PRs are also issues - use issues.get which returns body_html
+      if (!event.issue_number) return;
+      return (
+        await ctx.octokit.rest.issues.get({
+          owner,
+          repo,
+          issue_number: event.issue_number,
+          headers,
+        })
+      ).data.body_html;
+
+    case "pull_request_review_submitted":
+      if (!event.issue_number || !event.review_id) return;
+      return (
+        await ctx.octokit.rest.pulls.getReview({
+          owner,
+          repo,
+          pull_number: event.issue_number,
+          review_id: event.review_id,
+          headers,
+        })
+      ).data.body_html;
+
+    case "pull_request_review_comment_created":
+      if (!event.comment_id) return;
+      return (
+        await ctx.octokit.rest.pulls.getReviewComment({
+          owner,
+          repo,
+          comment_id: event.comment_id,
+          headers,
+        })
+      ).data.body_html;
+
+    case "check_suite_completed":
+      // body is the PR body
+      if (!event.issue_number) return;
+      return (
+        await ctx.octokit.rest.issues.get({
+          owner,
+          repo,
+          issue_number: event.issue_number,
+          headers,
+        })
+      ).data.body_html;
+
+    case "implement_plan":
+      // body is the plan content from an issue comment
+      if (!event.plan_comment_id) return;
+      return (
+        await ctx.octokit.rest.issues.getComment({
+          owner,
+          repo,
+          comment_id: event.plan_comment_id,
+          headers,
+        })
+      ).data.body_html;
+
+    // triggers without a body field that needs resolution
+    case "workflow_dispatch":
+    case "fix_review":
+    case "unknown":
+      return undefined;
+
+    default:
+      // exhaustiveness check - TypeScript will error if a trigger is missing
+      event satisfies never;
+      return undefined;
+  }
+}