lastlight 0.16.0 → 0.16.1

package/dist/engine/github/github.js

@@ -1,357 +0,0 @@
-import { githubAppClient, githubTokenClient, } from "./github-app-client.js";
-/**
- * GitHub client for the harness — uses GitHub App auth.
- * Used by the orchestrator to post comments, not by agent sessions.
- */
-export class GitHubClient {
-    octokit;
-    constructor(config) {
-        this.octokit = githubAppClient(config);
-    }
-    /**
-     * Build a client authed with a raw bearer token (a pre-minted installation
-     * token) instead of App JWT auth. Used by the harness-side `post-review`
-     * action: prod passes the run's scoped review-write token; evals pass the
-     * mock's token + `baseUrl`. Avoids the App installation-token minting
-     * round-trip (which hard-codes api.github.com and the evals mock doesn't
-     * serve).
-     */
-    static withToken(token, baseUrl) {
-        const client = Object.create(GitHubClient.prototype);
-        client.octokit = githubTokenClient(token, baseUrl);
-        return client;
-    }
-    /**
-     * Create a new comment on an issue/PR. Returns the new comment id so callers
-     * that want to edit it later (the in-place status checklist — see
-     * `src/notify/transports/github.ts`) can hold onto a handle. Callers that
-     * just post a one-off comment can ignore the return.
-     */
-    async postComment(owner, repo, issueNumber, body) {
-        const { data } = await this.octokit.rest.issues.createComment({
-            owner,
-            repo,
-            issue_number: issueNumber,
-            body,
-        });
-        return data.id;
-    }
-    /**
-     * List every repository the App installation can access, as `owner/repo`
-     * full names. Used at boot to seed the managed-repo list from the App grant
-     * (see src/managed-repos.ts). The installation id is bound by the App auth
-     * strategy, so no argument is needed. Paginated — handles installs with
-     * hundreds of repos.
-     */
-    async listInstallationRepos() {
-        const repos = await this.octokit.paginate(this.octokit.rest.apps.listReposAccessibleToInstallation, { per_page: 100 });
-        return repos.map((r) => r.full_name);
-    }
-    /**
-     * Edit an existing issue/PR comment in place. Paired with `postComment` to
-     * maintain a single status comment that updates as a workflow progresses,
-     * rather than posting a new comment per phase. GitHub does NOT notify
-     * watchers on edits, which is exactly why this keeps the thread quiet.
-     */
-    async updateComment(owner, repo, commentId, body) {
-        await this.octokit.rest.issues.updateComment({
-            owner,
-            repo,
-            comment_id: commentId,
-            body,
-        });
-    }
-    /**
-     * Add an emoji reaction to a specific issue comment. Used as an immediate
-     * (silent) acknowledgment that the agent has accepted a request, before
-     * any actual work — and any chatty bot comments — start.
-     *
-     * Reaction `content` values: "+1" | "-1" | "laugh" | "confused" | "heart"
-     * | "hooray" | "rocket" | "eyes".
-     */
-    async reactToComment(owner, repo, commentId, content = "rocket") {
-        await this.octokit.rest.reactions.createForIssueComment({
-            owner,
-            repo,
-            comment_id: commentId,
-            content,
-        });
-    }
-    /**
-     * Add an emoji reaction to an issue or PR itself (not a comment) — used to
-     * ack events that aren't comments, e.g. a freshly opened issue/PR. PRs are
-     * issues for the reactions API, so this works for both.
-     */
-    async reactToIssue(owner, repo, issueNumber, content = "eyes") {
-        await this.octokit.rest.reactions.createForIssue({
-            owner,
-            repo,
-            issue_number: issueNumber,
-            content,
-        });
-    }
-    /**
-     * Add an emoji reaction to a pull-request review comment (inline diff
-     * comment). Distinct endpoint from issue comments — review comments live on
-     * the pulls API.
-     */
-    async reactToReviewComment(owner, repo, commentId, content = "eyes") {
-        await this.octokit.rest.reactions.createForPullRequestReviewComment({
-            owner,
-            repo,
-            comment_id: commentId,
-            content,
-        });
-    }
-    async getIssue(owner, repo, issueNumber) {
-        const { data } = await this.octokit.rest.issues.get({
-            owner,
-            repo,
-            issue_number: issueNumber,
-        });
-        return data;
-    }
-    /**
-     * Fetch the issue body. Used by the dispatch path so build/explore/pr-fix
-     * workflows always see the real issue body, even when triggered from a
-     * comment (where the EventEnvelope.body field is the comment, not the
-     * issue body).
-     */
-    async getIssueBody(owner, repo, issueNumber) {
-        const { data } = await this.octokit.rest.issues.get({
-            owner,
-            repo,
-            issue_number: issueNumber,
-        });
-        return data.body || "";
-    }
-    /**
-     * List all comments on an issue/PR, oldest first. Used by the dispatch path
-     * to inject the full conversation thread into the architect's context — the
-     * spec the bot writes during an `explore` run lives here, and the build
-     * cycle needs to see it to implement the agreed design.
-     */
-    async listIssueComments(owner, repo, issueNumber) {
-        const data = await this.octokit.paginate(this.octokit.rest.issues.listComments, { owner, repo, issue_number: issueNumber, per_page: 100 });
-        return data.map((c) => ({
-            user: c.user?.login || "unknown",
-            body: c.body || "",
-            createdAt: c.created_at,
-        }));
-    }
-    async getPullRequest(owner, repo, pullNumber) {
-        const { data } = await this.octokit.rest.pulls.get({
-            owner,
-            repo,
-            pull_number: pullNumber,
-        });
-        return data;
-    }
-    /**
-     * The repo's default branch (e.g. `main`, `master`, `develop`). Used to
-     * scope build runs to the real base branch instead of assuming `main` — a
-     * `master`-default repo otherwise breaks every `git ... main..HEAD` the
-     * reviewer runs. See the `baseBranch` plumbing in src/index.ts.
-     */
-    async getDefaultBranch(owner, repo) {
-        const { data } = await this.octokit.rest.repos.get({ owner, repo });
-        return data.default_branch;
-    }
-    /** Convenience: fetch only the PR's head commit SHA. Used by check-run code. */
-    async getPullRequestHeadSha(owner, repo, pullNumber) {
-        const { data } = await this.octokit.rest.pulls.get({
-            owner,
-            repo,
-            pull_number: pullNumber,
-        });
-        return data.head.sha;
-    }
-    /**
-     * Create a Check Run on a PR's head commit. Returns the new check_run id so
-     * the caller can later transition it from `in_progress` → `completed` with
-     * a conclusion. Repos that enable "Require status checks to pass" with
-     * `name` in their list will gate merges on the eventual conclusion.
-     *
-     * Requires the GitHub App to have `Checks: Read and write` permission.
-     */
-    async createCheckRun(owner, repo, headSha, name, options = {}) {
-        const { data } = await this.octokit.rest.checks.create({
-            owner,
-            repo,
-            name,
-            head_sha: headSha,
-            status: "in_progress",
-            started_at: new Date().toISOString(),
-            ...(options.detailsUrl ? { details_url: options.detailsUrl } : {}),
-            ...(options.output ? { output: options.output } : {}),
-        });
-        return data.id;
-    }
-    /**
-     * Update an existing Check Run — typically to transition `in_progress` →
-     * `completed` with a conclusion. Conclusion values that branch protection
-     * treats as passing: `success`, `neutral`, `skipped`. Failing: `failure`,
-     * `cancelled`, `timed_out`, `action_required`.
-     */
-    async updateCheckRun(owner, repo, checkRunId, update) {
-        await this.octokit.rest.checks.update({
-            owner,
-            repo,
-            check_run_id: checkRunId,
-            ...(update.status ? { status: update.status } : {}),
-            ...(update.conclusion ? { conclusion: update.conclusion } : {}),
-            ...(update.status === "completed" ? { completed_at: new Date().toISOString() } : {}),
-            ...(update.detailsUrl ? { details_url: update.detailsUrl } : {}),
-            ...(update.output ? { output: update.output } : {}),
-        });
-    }
-    /**
-     * Find the bot's most recent review on this PR's current head commit. Used
-     * after a pr-review workflow finishes to derive the check-run conclusion
-     * from the review the agent actually posted (APPROVE / REQUEST_CHANGES /
-     * COMMENT). Returns null when the bot hasn't reviewed this SHA yet.
-     *
-     * `botLogin` defaults to `last-light[bot]` so the lookup matches App-auth'd
-     * reviews regardless of how the agent identified itself.
-     */
-    async getLatestBotReview(owner, repo, pullNumber, headSha, botLogin = "last-light[bot]") {
-        const reviews = await this.octokit.paginate(this.octokit.rest.pulls.listReviews, {
-            owner,
-            repo,
-            pull_number: pullNumber,
-            per_page: 100,
-        });
-        // Reviews are returned oldest-first; iterate newest-first to pick the most
-        // recent one tied to this SHA. `commit_id` on a review is the head sha at
-        // the time the review was submitted, which is exactly the discriminator
-        // we want — re-pushes invalidate stale reviews here naturally.
-        for (let i = reviews.length - 1; i >= 0; i--) {
-            const r = reviews[i];
-            if (r.user?.login === botLogin && r.commit_id === headSha) {
-                return { state: r.state, body: r.body ?? null, submittedAt: r.submitted_at ?? null };
-            }
-        }
-        return null;
-    }
-    /**
-     * Fetch a PR's unified diff (three-dot, base…head) as a string. Used by the
-     * `post-review` action to anchor findings to changed lines — the harness runs
-     * this in-process (not in the sandbox), so the diff comes from the API rather
-     * than a local `git diff`, with no dependency on checkout/fetch state.
-     */
-    async getPullRequestDiff(owner, repo, pullNumber) {
-        const res = await this.octokit.rest.pulls.get({
-            owner,
-            repo,
-            pull_number: pullNumber,
-            mediaType: { format: "diff" },
-        });
-        // With `format: diff` Octokit returns the raw diff as the response body,
-        // typed as the JSON shape — cast through unknown.
-        return res.data;
-    }
-    /**
-     * Submit one formal PR review with an event (APPROVE / REQUEST_CHANGES /
-     * COMMENT) plus optional line-anchored inline comments. `commitId` pins the
-     * review to the reviewed head SHA. This is the single harness-side write for
-     * PR reviews — the reviewer agent never submits; it writes findings and the
-     * `post-review` action calls this. Throws on a non-2xx so the action can fail
-     * the phase visibly (or retry body-only).
-     */
-    async createPullRequestReview(owner, repo, pullNumber, review) {
-        await this.octokit.rest.pulls.createReview({
-            owner,
-            repo,
-            pull_number: pullNumber,
-            body: review.body,
-            event: review.event,
-            ...(review.comments && review.comments.length ? { comments: review.comments } : {}),
-            ...(review.commitId ? { commit_id: review.commitId } : {}),
-        });
-    }
-    /**
-     * Get failed check runs for a PR's head SHA.
-     * Fetches the actual job logs (not just annotations) to show real errors.
-     */
-    async getFailedChecks(owner, repo, ref) {
-        try {
-            const { data } = await this.octokit.rest.checks.listForRef({
-                owner,
-                repo,
-                ref,
-                filter: "latest",
-            });
-            const failed = data.check_runs.filter((r) => r.conclusion === "failure" || r.conclusion === "timed_out");
-            if (failed.length === 0)
-                return "No failed checks found.";
-            const summaries = await Promise.all(failed.map(async (run) => {
-                let logExcerpt = "";
-                // Try to fetch the actual job log (contains the real errors)
-                if (run.details_url) {
-                    try {
-                        // Extract the job ID from the check run — the run is linked to a workflow job
-                        const jobId = run.id;
-                        const { data: logData } = await this.octokit.rest.actions.downloadJobLogsForWorkflowRun({
-                            owner,
-                            repo,
-                            job_id: jobId,
-                        });
-                        // logData is a string with the full log
-                        const fullLog = typeof logData === "string" ? logData : String(logData);
-                        // Extract the last N lines which typically contain the error
-                        const lines = fullLog.split("\n");
-                        // Find error lines and surrounding context
-                        const errorLines = [];
-                        for (let i = 0; i < lines.length; i++) {
-                            const line = lines[i];
-                            if (line.match(/error|ERR!|FAIL|failed|Error:|npm ERR/i) && !line.match(/^$/)) {
-                                // Include some context before and after
-                                const start = Math.max(0, i - 2);
-                                const end = Math.min(lines.length, i + 5);
-                                for (let j = start; j < end; j++) {
-                                    if (!errorLines.includes(lines[j])) {
-                                        errorLines.push(lines[j]);
-                                    }
-                                }
-                            }
-                        }
-                        if (errorLines.length > 0) {
-                            logExcerpt = errorLines.slice(0, 50).join("\n");
-                        }
-                        else {
-                            // No error lines found — show the last 30 lines
-                            logExcerpt = lines.slice(-30).join("\n");
-                        }
-                    }
-                    catch {
-                        // Job logs may not be available — fall back to annotations
-                    }
-                }
-                // Fall back to annotations if no job logs
-                if (!logExcerpt) {
-                    try {
-                        const { data: annotations } = await this.octokit.rest.checks.listAnnotations({
-                            owner,
-                            repo,
-                            check_run_id: run.id,
-                        });
-                        if (annotations.length > 0) {
-                            logExcerpt = annotations
-                                .filter((a) => a.annotation_level === "failure")
-                                .slice(0, 10)
-                                .map((a) => `${a.path}:${a.start_line} — ${a.message}`)
-                                .join("\n");
-                        }
-                    }
-                    catch { /* annotations may not be available */ }
-                }
-                return `### ${run.name}: ${run.conclusion}\n${logExcerpt || "No log details available."}`;
-            }));
-            return summaries.join("\n\n");
-        }
-        catch (err) {
-            return `Could not fetch check runs: ${err.message}`;
-        }
-    }
-}
-//# sourceMappingURL=github.js.map

package/dist/engine/github/github.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/engine/github/github.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,iBAAiB,GAElB,MAAM,wBAAwB,CAAC;AAchC;;;GAGG;AACH,MAAM,OAAO,YAAY;IACf,OAAO,CAAU;IAEzB,YAAY,MAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,SAAS,CAAC,KAAa,EAAE,OAAgB;QAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAiB,CAAC;QACrE,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB,EAAE,IAAY;QAC9E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5D,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,qBAAqB;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CACvC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,EACxD,EAAE,QAAQ,EAAE,GAAG,EAAE,CAClB,CAAC;QACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,IAAY,EAAE,SAAiB,EAAE,IAAY;QAC9E,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC3C,KAAK;YACL,IAAI;YACJ,UAAU,EAAE,SAAS;YACrB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,UAA2B,QAAQ;QAEnC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;YACtD,KAAK;YACL,IAAI;YACJ,UAAU,EAAE,SAAS;YACrB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,KAAa,EACb,IAAY,EACZ,WAAmB,EACnB,UAA2B,MAAM;QAEjC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;YAC/C,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;YACzB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,IAAY,EACZ,SAAiB,EACjB,UAA2B,MAAM;QAEjC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,iCAAiC,CAAC;YAClE,KAAK;YACL,IAAI;YACJ,UAAU,EAAE,SAAS;YACrB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAClD,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAAY,EAAE,WAAmB;QACjE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;YAClD,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,IAAY,EACZ,WAAmB;QAEnB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CACtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EACrC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAC1D,CAAC;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,SAAS;YAChC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,SAAS,EAAE,CAAC,CAAC,UAAU;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,IAAY,EAAE,UAAkB;QAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACjD,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,IAAY;QAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,qBAAqB,CAAC,KAAa,EAAE,IAAY,EAAE,UAAkB;QACzE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACjD,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,UAAU;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,IAAY,EACZ,OAAe,EACf,IAAY,EACZ,UAAgF,EAAE;QAElF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACrD,KAAK;YACL,IAAI;YACJ,IAAI;YACJ,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,MAaC;QAED,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YACpC,KAAK;YACL,IAAI;YACJ,YAAY,EAAE,UAAU;YACxB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,kBAAkB,CACtB,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,OAAe,EACf,QAAQ,GAAG,iBAAiB;QAE5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAC/E,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,GAAG;SACd,CAAC,CAAC;QACH,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,+DAA+D;QAC/D,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBAC1D,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YACvF,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAE,UAAkB;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YAC5C,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,UAAU;YACvB,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC9B,CAAC,CAAC;QACH,yEAAyE;QACzE,kDAAkD;QAClD,OAAO,GAAG,CAAC,IAAyB,CAAC;IACvC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,uBAAuB,CAC3B,KAAa,EACb,IAAY,EACZ,UAAkB,EAClB,MAA2F;QAE3F,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;YACzC,KAAK;YACL,IAAI;YACJ,WAAW,EAAE,UAAU;YACvB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,IAAY,EAAE,GAAW;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;gBACzD,KAAK;gBACL,IAAI;gBACJ,GAAG;gBACH,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CACnC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW,CAClE,CAAC;YAEF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,yBAAyB,CAAC;YAE1D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC3D,IAAI,UAAU,GAAG,EAAE,CAAC;gBAEpB,6DAA6D;gBAC7D,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,8EAA8E;wBAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;wBACrB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,6BAA6B,CAAC;4BACtF,KAAK;4BACL,IAAI;4BACJ,MAAM,EAAE,KAAK;yBACd,CAAC,CAAC;wBACH,wCAAwC;wBACxC,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;wBACxE,6DAA6D;wBAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;wBAClC,2CAA2C;wBAC3C,MAAM,UAAU,GAAa,EAAE,CAAC;wBAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;4BACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;4BACtB,IAAI,IAAI,CAAC,KAAK,CAAC,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gCAC9E,wCAAwC;gCACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gCACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gCAC1C,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;oCACjC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wCACnC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oCAC5B,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;wBACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAClD,CAAC;6BAAM,CAAC;4BACN,gDAAgD;4BAChD,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;wBAC3C,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,2DAA2D;oBAC7D,CAAC;gBACH,CAAC;gBAED,0CAA0C;gBAC1C,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;4BAC3E,KAAK;4BACL,IAAI;4BACJ,YAAY,EAAE,GAAG,CAAC,EAAE;yBACrB,CAAC,CAAC;wBACH,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC3B,UAAU,GAAG,WAAW;iCACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC;iCAC/C,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;iCACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,UAAU,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;iCACtD,IAAI,CAAC,IAAI,CAAC,CAAC;wBAChB,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;gBACpD,CAAC;gBAED,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,UAAU,KAAK,UAAU,IAAI,2BAA2B,EAAE,CAAC;YAC5F,CAAC,CAAC,CAAC,CAAC;YAEJ,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,+BAA+B,GAAG,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;CACF"}

package/dist/engine/github/profiles.d.ts

@@ -1,279 +0,0 @@
-import type { GitHubTokenPermissions } from "./git-auth.js";
-import type { BuildAssetsLocation, OtelConfig, SandboxBackend } from "../../config/config.js";
-/**
- * Configuration for an agent execution.
- */
-export interface ExecutorConfig {
-    /** Working directory for the agent (used by the no-sandbox path). */
-    cwd?: string;
-    /** Maximum conversation turns. Unused by agentic-pi; kept for API stability. */
-    maxTurns?: number;
-    /** Model id (e.g. "anthropic/claude-sonnet-4-6"). */
-    model?: string;
-    /**
-     * Pi thinking level: `off | minimal | low | medium | high | xhigh`.
-     * Forwarded to agentic-pi as the `thinking` option. When omitted,
-     * agentic-pi uses the model's default.
-     */
-    variant?: string;
-    /** Path to agent context directory. */
-    agentContextDir?: string;
-    /** Directory for persistent state. */
-    stateDir?: string;
-    /** Directory for agent sandboxes (cloned repos). */
-    sandboxDir?: string;
-    /**
-     * Run the agent in a `<workspace>/<repoSubdir>/` SUBDIRECTORY instead of the
-     * workspace root, WITHOUT going through the token-gated `prePopulate`/clone
-     * path. For callers that pre-seed the repo themselves (e.g. the evals harness
-     * in static-token mode): it reproduces production's nested layout — the repo
-     * checkout is a child dir, while `AGENTS.md`/`.lastlight-skills/` stay at the
-     * workspace root, siblings outside the repo's git tree. Ignored when a real
-     * `prePopulate` clone runs (that already nests into `<repo>/`). Use backend
-     * `none` so skills stage at the root rather than under the repo.
-     */
-    repoSubdir?: string;
-    /** Where the shim writes dashboard envelope jsonl. */
-    sessionsDir?: string;
-    /** Workflow sandbox backend (overrides config-level default). */
-    sandbox?: SandboxBackend;
-    /**
-     * Which docker sandbox image this phase runs in: `"qa"` selects the
-     * browser-QA image (Playwright + Chromium), anything else the lean default.
-     * Overlaid per-phase from `sandbox_image:` by `phaseConfigFor`; only acted on
-     * by the docker path.
-     */
-    sandboxImage?: "default" | "qa";
-    /**
-     * Where build handoff docs live for this run:
-     *   - "repo" (default): the agent writes/commits `.lastlight/<issueKey>/`
-     *     into the target repo branch; the stage-in/harvest seam is skipped.
-     *   - "server": docs are staged in from / harvested back to the server store
-     *     under `buildAssetsDir`, never committed. Set from the runtime config.
-     */
-    buildAssets?: BuildAssetsLocation;
-    /** Filesystem root for the server-mode build-assets store (when buildAssets === "server"). */
-    buildAssetsDir?: string;
-    /**
-     * Server-mode artifact identity for this run. Used by the stage-in/harvest
-     * seam to locate the run's docs in the store at
-     * `<buildAssetsDir>/<owner>/<repo>/<issueKey>/`. Set per run from simple.ts.
-     */
-    buildAssetsKey?: {
-        owner: string;
-        repo: string;
-        issueKey: string;
-    };
-    /**
-     * Bypass the HTTP egress allowlist for this phase. When true:
-     *   - gondolin: `allowedHttpHosts: ["*"]` is passed to agentic-pi.
-     *   - docker:   the sandbox container uses the open CoreDNS/nginx
-     *               egress-firewall pair instead of the strict one.
-     *
-     * Default false. Set via the `unrestricted_egress` field on a workflow
-     * phase — used for phases that need broad web access (e.g. an explore
-     * phase that searches third-party documentation).
-     */
-    unrestrictedEgress?: boolean;
-    /**
-     * Enable agentic-pi's web-search extension (`web_search` / `web_fetch`
-     * tools). Default false. agentic-pi auto-enables web search whenever a
-     * provider env var (`TAVILY_API_KEY`, `BRAVE_SEARCH_API_KEY`,
-     * `EXA_API_KEY`) is present, so we pass an explicit `false` downstream
-     * to suppress auto-enable for non-explore workflows.
-     */
-    webSearch?: boolean;
-    /**
-     * Force a specific web-search provider. When unset, agentic-pi picks
-     * one based on which API key env var is present (Tavily > Exa > Brave).
-     */
-    webSearchProvider?: "tavily" | "brave" | "exa";
-    /**
-     * Override the GitHub REST API base URL for agentic-pi's built-in
-     * `github_*` tools (Octokit `baseUrl`). Test/eval escape hatch only:
-     * the eval harness (`evals/`) points this at a local fake GitHub server so
-     * a real workflow runs unchanged with its GitHub calls mocked. Production
-     * leaves it unset → `https://api.github.com`. Only honoured by the
-     * in-process (`none`/`gondolin`) path.
-     */
-    githubApiBaseUrl?: string;
-    /** Controls OTEL env forwarding and PI event redaction for workflow phase runs. */
-    otel?: OtelConfig;
-    telemetry?: {
-        workflowName?: string;
-        phaseName?: string;
-        triggerId?: string;
-        workflowRunId?: string;
-    };
-    /**
-     * Absolute host paths to skill directories (each containing SKILL.md
-     * plus optional scripts/, references/, assets/). Staged into a per-phase
-     * bundle at `.lastlight-skills/<phaseName>/<basename>/` before the agent
-     * runs — gondolin/none via symlink, docker via copy — and passed to pi
-     * explicitly (`--skill` in docker, `skillPaths` in-process). cwd stays the
-     * repo; the bundle is a workspace-root sibling of the repo (never committed)
-     * on docker/none, and under the repo + local `.git/info/exclude` on gondolin
-     * (which mounts only cwd). Keyed per phase so parallel phases stay isolated.
-     * Resolved by `phaseConfigFor` in the workflow runner from the phase's
-     * `skill:`/`skills:` field.
-     */
-    skillPaths?: string[];
-}
-/**
- * Normalized status of one agentic-pi extension for a single run.
- * Keyed by extension name ("file-search" | "github" | "web-search") in
- * an {@link ExtensionStatusMap}. agentic-pi emits these as `extension_status`
- * events at run start and on `RunResult.{fileSearch,github,webSearch}`;
- * lastlight captures them so the dashboard and logs show which extensions
- * (e.g. FFF file-search) were actually active.
- */
-export interface ExtensionStatus {
-    /** "configured" when the extension loaded, "skipped" otherwise. */
-    status: string;
-    /** file-search only: "override" | "tools-only" | "tools-and-ui". */
-    mode?: string;
-    /** web-search only: the resolved search provider. */
-    provider?: string;
-    /** Number of tools the extension registered. */
-    toolCount?: number;
-    /** Why it was skipped (e.g. "no-credentials", "resolve-failed"). */
-    reason?: string;
-}
-export type ExtensionStatusMap = Record<string, ExtensionStatus>;
-/**
- * One skill agentic-pi discovered for a run, flattened from the
- * `skills_status` event's `skills[]`. Mirrors agentic-pi's `SkillSummary`.
- */
-export interface SkillSummary {
-    /** Skill name (from SKILL.md frontmatter). */
-    name: string;
-    /** Absolute path to the skill's SKILL.md. */
-    source: string;
-    /**
-     * Whether the model can auto-invoke it. False when the skill set
-     * `disable-model-invocation: true` — present but not surfaced in the
-     * system prompt, so worth flagging in the dashboard.
-     */
-    modelInvocable: boolean;
-}
-/**
- * Normalized status of agentic-pi's skill discovery for a single run — the
- * skill-loading counterpart to {@link ExtensionStatus} (tool loading).
- * agentic-pi (≥0.2.6) emits this as a single, gated `skills_status` event at
- * run start: present only when skills were configured (`skillPaths`/`noSkills`)
- * or at least one was discovered, absent on a default run with no skills.
- * lastlight captures it so the dashboard's phase-detail panel can show which
- * skills the agent had available.
- */
-export interface SkillsStatus {
-    /**
-     * "default" (rely on auto-discovery), "configured" (explicit `skillPaths`
-     * resolved), or "disabled" (`noSkills` with no explicit paths).
-     */
-    status: string;
-    /** Number of skills the resource loader actually discovered. */
-    discovered: number;
-    /** The discovered skills, flattened. */
-    skills: SkillSummary[];
-    /** Operator-mapped skill paths that resolved (echoed for observability). */
-    mappedPaths: string[];
-    /** Whether agentic-pi's default skill discovery was disabled. */
-    noSkills: boolean;
-}
-/**
- * Result from an agent execution.
- */
-export interface ExecutionResult {
-    success: boolean;
-    output: string;
-    turns: number;
-    error?: string;
-    durationMs: number;
-    /** Session id captured from the runtime's stream. */
-    sessionId?: string;
-    /** Total USD cost reported by the runtime. Zero under OAuth/subscription auth. */
-    costUsd?: number;
-    /** Tokens billed as fresh input (no cache hit). */
-    inputTokens?: number;
-    /** Tokens that triggered a cache write. */
-    cacheCreationInputTokens?: number;
-    /** Tokens served from prompt cache (heavily discounted). */
-    cacheReadInputTokens?: number;
-    /** Output tokens generated by the model. */
-    outputTokens?: number;
-    /** API-side duration (excludes orchestrator overhead). */
-    apiDurationMs?: number;
-    /** Mapped stop reason ("success" / "error_*" / etc.). */
-    stopReason?: string;
-    /**
-     * Which agentic-pi extensions were active for this run, keyed by name.
-     * Surfaced in the dashboard's phase-detail panel and persisted to the
-     * `executions.extension_status` column.
-     */
-    extensions?: ExtensionStatusMap;
-    /**
-     * Skill-loading status captured from agentic-pi's `skills_status` event.
-     * Surfaced alongside {@link extensions} in the dashboard's phase-detail
-     * panel and persisted to the `executions.skills_status` column. Undefined
-     * when the run reported no skills (the event is gated on the agentic-pi side).
-     */
-    skills?: SkillsStatus;
-}
-export type GitAccessProfile = "read" | "issues-write" | "review-write" | "repo-write";
-/**
- * agentic-pi's GitHub extension uses the same four profile names — they
- * pass through unchanged. Kept as an explicit map so renames on either
- * side surface as a type error rather than a silent runtime mismatch.
- */
-export declare const AGENTIC_PROFILE_FOR: Record<GitAccessProfile, string>;
-export interface GitSandboxAccess {
-    owner: string;
-    repo: string;
-    profile: GitAccessProfile;
-    /**
-     * When true, sandbox MCP can mint/refresh tokens using the app PEM.
-     * Leave false for lower-trust runs to keep private key material inaccessible.
-     */
-    allowMcpAppAuth?: boolean;
-    /**
-     * When set, the harness pre-clones the repo at this branch into the
-     * task's workspace before the sandbox container starts. The agent then
-     * sees the workspace already checked out — no `clone_repo` call needed
-     * inside the session. Used by read-only workflows (pr-review, pr-fix)
-     * that operate on an existing branch, and by branch-synthesizing
-     * workflows (`build`, `verify`, `qa-test`, `demo` — see
-     * `PREPOPULATE_SYNTH_WORKFLOWS`) whose `lastlight/N-slug` branch doesn't
-     * exist on the remote yet: the missing-branch fallback in
-     * `prePopulateWorkspace` clones the default branch and creates it locally.
-     */
-    prePopulateBranch?: string;
-    /**
-     * The owning workflow run id. Stamped into a `<workDir>/.lastlight-run`
-     * marker by the pre-clone so a reused per-PR workspace (see
-     * `workflowScopedTaskId` for pr-review / pr-fix) can tell "next phase of
-     * the same run" (preserve the checkout — build's plan.md lives here) from
-     * "a fresh run reusing an old PR dir" (fetch + hard-reset + clean, keeping
-     * node_modules warm). Unset for non-workflow callers, which keep the old
-     * skip-if-`.git`-exists behaviour.
-     */
-    runId?: string;
-    /**
-     * Clone shallowly (`--depth 1 --single-branch`). Set for read-only
-     * workflows that never need history; repo-write workflows (build, pr-fix,
-     * security-feedback) keep the deeper `--depth 50` clone so rebases / amends
-     * have headroom.
-     */
-    shallow?: boolean;
-    /**
-     * Recreate the workspace from the **default branch** on a fresh run instead
-     * of reusing/refreshing an existing feature-branch checkout. Set for the
-     * `PER_TARGET_RECREATE_WORKFLOWS` (build): a re-triggered build discards any
-     * leftover from an earlier incomplete run and starts again off current
-     * `main`, and its feature branch is always cut from the latest default —
-     * never inheriting a stale pushed branch (issue #153). A same-run resume
-     * (approval gate) still preserves the checkout via the run marker.
-     */
-    recreateFromBase?: boolean;
-}
-export declare const GITHUB_PERMISSION_PROFILES: Record<GitAccessProfile, GitHubTokenPermissions>;
-export declare function loadAgentContext(_dir?: string): string;