limn-review 0.1.123

package/dist/github/client.js

@@ -0,0 +1,454 @@
+import { graphql, GraphqlResponseError } from '@octokit/graphql';
+import { getGithubToken } from './auth.js';
+// True when the partial errors are GitHub's SAML-SSO wall: the token authenticates but isn't
+// authorized for the repo owner's org, so the whole `repository` node is forbidden. GitHub's
+// message is "Resource protected by organization SAML enforcement. You must grant your OAuth
+// token access to this organization." This gates PRs/checks even on PUBLIC repos of a SAML org.
+export function isSamlBlock(errors) {
+    return (Array.isArray(errors) &&
+        errors.some((e) => {
+            // GraphQL exposes a machine-readable flag on the error — the most reliable signal
+            // (docs: FORBIDDEN + extensions.saml_failure === true). Fall back to the message text.
+            if (e.extensions?.saml_failure === true)
+                return true;
+            return /saml enforcement|grant your oauth token access/i.test(e.message ?? '');
+        }));
+}
+// A parenthetical hint appended to a partial-GraphQL log. SAML enforcement gets the actionable
+// re-auth hint; otherwise, ONLY when the forbidden field is a CI-checks field (so a NOT_FOUND —
+// deleted/inaccessible PR — isn't mislabelled). Empty otherwise (the raw errors still get logged).
+export function graphqlChecksHint(errors) {
+    if (isSamlBlock(errors)) {
+        return " — the sign-in token isn't authorized for this org's SAML SSO; re-authorize it inside an active SAML session for the org (see docs/GITHUB-AUTH-SETUP.md)";
+    }
+    const mentionsChecks = Array.isArray(errors) &&
+        errors.some((e) => {
+            const path = e.path;
+            const inPath = Array.isArray(path) && path.some((p) => /statuscheckrollup|check/i.test(String(p)));
+            const inMsg = /check\b|statuscheckrollup/i.test(e.message ?? '');
+            return inPath || inMsg;
+        });
+    return mentionsChecks
+        ? " — the sign-in token can't read CI checks here (GitHub App: install on this org with Checks read; OAuth App: re-authorize; or it's a private repo)"
+        : '';
+}
+// Compact one-line summary of a GraphQL `errors` array for logging.
+export function summarizeGraphqlErrors(errors) {
+    if (!Array.isArray(errors))
+        return String(errors);
+    return errors
+        .slice(0, 5)
+        .map((e) => {
+        const type = e.type ?? 'ERROR';
+        const path = e.path?.join('.') ?? '?';
+        const message = e.message ?? '';
+        return `${type}@${path}: ${message}`;
+    })
+        .join(' | ');
+}
+// Run a GraphQL query, TOLERATING GitHub's *partial* errors. GitHub answers HTTP 200 with a
+// non-empty `errors` array AND partial `data` when the token may read most of a query but is
+// FORBIDDEN one sub-field — e.g. CI check runs (`statusCheckRollup.contexts`) on a private repo
+// the token can't reach, or on a token minted before it was granted the scope to read them. By
+// default `@octokit/graphql` THROWS on any such response, throwing away the usable partial data
+// — so one un-permitted field would wipe the PR body/comments/reviewers. This returns the
+// partial data instead (the forbidden fields arrive as null) and reports the errors via
+// `onPartial`. A response with NO usable data (auth failure, rate limit, network) still throws.
+export async function graphqlTolerant(client, query, variables, onPartial) {
+    try {
+        return await client(query, variables);
+    }
+    catch (err) {
+        if (err instanceof GraphqlResponseError && err.data != null) {
+            onPartial?.(err.errors);
+            return err.data;
+        }
+        throw err;
+    }
+}
+// True for GitHub failures worth RETRYING: transient upstream/gateway faults (a 5xx
+// from GitHub's edge — the fat activity query on a huge repo routinely 502s at nginx)
+// and low-level network faults (reset/timeout/DNS). Deliberately NOT ordinary 4xx
+// (auth / not-found / rate-limit-with-reset) nor GraphQL partial-data errors — those
+// are handled elsewhere (graphqlTolerant) and must not be silently re-attempted. A 502
+// arrives as an HTML error page (not GraphQL JSON), so match BOTH a structured status
+// (octokit RequestError `.status`) AND the message text as a fallback.
+export function isRetryableGithubError(err) {
+    const e = err;
+    const status = e.status ?? e.response?.status;
+    if (status === 500 || status === 502 || status === 503 || status === 504)
+        return true;
+    if (/^(ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|ECONNREFUSED|EPIPE)$/.test(e.code ?? '')) {
+        return true;
+    }
+    return /\b(50[0234])\b|bad gateway|gateway time-?out|service unavailable|temporarily unavailable|socket hang up|fetch failed|econnreset|etimedout/i.test(e.message ?? '');
+}
+// Classify a GitHub failure as RATE-LIMITED (primary GraphQL/REST exhaustion, or the
+// secondary "abuse" limiter) and extract a resume time when the response carried one.
+// Deliberately a SEPARATE classifier from isRetryableGithubError: retryable means "try
+// again in milliseconds", limited means "pause until the window resets" — the sync's
+// budget gate (github/rate-budget.ts + sync-repo.ts) owns that wait, and widening the
+// retry predicate would instead hammer a limited token.
+//
+// Shapes recognised:
+//   • GraphQL: `errors[].type === 'RATE_LIMITED'` (GitHub answers HTTP 200, data null —
+//     which is why graphqlTolerant RETHROWS it), or a rate-limit message with no usable
+//     data. GraphqlResponseError exposes the response headers, so a reset time rides in.
+//   • REST: status 429 (Too Many Requests IS the limiter, by definition), or a 403 whose
+//     message carries GitHub's rate-limit/abuse wording (a plain 403 forbidden is NOT
+//     limited). ghRest attaches `status` + the rate-limit headers onto its thrown Error
+//     so this works without re-fetching anything.
+//
+// resumeAt: `retry-after` (relative seconds — the secondary limiter's header) wins, else
+// `x-ratelimit-reset` (epoch seconds), else null (the caller falls back to a default).
+export function isRateLimitError(err) {
+    const e = err;
+    const header = (name) => {
+        const h = e.headers?.[name] ?? e.response?.headers?.[name];
+        if (typeof h === 'string' && h.length > 0)
+            return h;
+        if (typeof h === 'number')
+            return String(h);
+        return null;
+    };
+    const resumeAt = () => {
+        const retryAfter = header('retry-after');
+        if (retryAfter != null) {
+            const secs = Number.parseInt(retryAfter, 10);
+            if (Number.isFinite(secs) && secs >= 0)
+                return new Date(Date.now() + secs * 1000);
+        }
+        const reset = header('x-ratelimit-reset');
+        if (reset != null) {
+            const epoch = Number.parseInt(reset, 10);
+            if (Number.isFinite(epoch) && epoch > 0)
+                return new Date(epoch * 1000);
+        }
+        return null;
+    };
+    if (Array.isArray(e.errors) &&
+        e.errors.some((er) => er.type === 'RATE_LIMITED')) {
+        return { limited: true, resumeAt: resumeAt() };
+    }
+    const status = e.status ?? e.response?.status;
+    if (status === 429)
+        return { limited: true, resumeAt: resumeAt() };
+    if (status === 403 && /rate limit|abuse/i.test(e.message ?? '')) {
+        return { limited: true, resumeAt: resumeAt() };
+    }
+    // Message-only fallback (a GraphQL transport variant with neither structured errors nor
+    // a status). Guarded on "no usable data" + "no status" so a 4xx/5xx that merely MENTIONS
+    // rate limits can't sneak in.
+    if (status == null &&
+        e.errors == null &&
+        e.data == null &&
+        /rate limit/i.test(e.message ?? '')) {
+        return { limited: true, resumeAt: resumeAt() };
+    }
+    return { limited: false, resumeAt: null };
+}
+// Run a GitHub call with bounded exponential-backoff retries on TRANSIENT failures
+// (see isRetryableGithubError). A single 502 on any page must not abort a multi-page
+// backfill of a large repo — without this, adding a big repo (every curated suggestion
+// is one) frequently loads only a partial window before the walk dies. Non-retryable
+// errors (4xx, GraphQL partial) propagate immediately. Backoff: 500ms, 1s, 2s.
+export async function withGithubRetry(fn, opts = {}) {
+    const retries = opts.retries ?? 3;
+    const base = opts.baseDelayMs ?? 500;
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            if (attempt > retries || !isRetryableGithubError(err))
+                throw err;
+            const delayMs = base * 2 ** (attempt - 1);
+            opts.onRetry?.(attempt, delayMs, err);
+            await new Promise((r) => setTimeout(r, delayMs));
+        }
+    }
+}
+// Per-account GitHub clients. There is deliberately NO module-level token /
+// client cache: in a multi-tenant (cloud) process a cached token would leak one
+// account's credentials into another account's request. The token is ALWAYS
+// passed in by the caller (resolved from the owning account), so isolation is
+// structural. See auth/account.ts#getAccessToken for where the token comes from.
+export function getGraphqlClientFor(token) {
+    return graphql.defaults({ headers: { authorization: `token ${token}` } });
+}
+async function ghRest(token, method, path, body) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method,
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+            ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        const err = new Error(`GitHub REST ${method} ${path} -> ${res.status}: ${text.slice(0, 300)}`);
+        // Structured status + the rate-limit headers, so isRateLimitError can classify a REST
+        // 403/429 and derive a resume time without message archaeology. Nulls kept as-is —
+        // the classifier's header lookup only honours strings.
+        Object.assign(err, {
+            status: res.status,
+            headers: {
+                'retry-after': res.headers.get('retry-after'),
+                'x-ratelimit-remaining': res.headers.get('x-ratelimit-remaining'),
+                'x-ratelimit-reset': res.headers.get('x-ratelimit-reset'),
+            },
+        });
+        throw err;
+    }
+    return res.json();
+}
+// REST GET (per-commit changed-files etc.) for a specific account's token.
+export function ghRestGetFor(token, path) {
+    return ghRest(token, 'GET', path);
+}
+// Conditional REST GET for the adaptive-sync change probe (Phase 2 — see
+// docs/REALTIME-SYNC.md). Sends `If-None-Match: <etag>` when a prior ETag is known and
+// returns the status + fresh ETag WITHOUT throwing — a 304 (Not Modified) means nothing
+// changed and, crucially, does NOT count against GitHub's primary rate limit. The body is
+// drained and discarded (we only care about changed-or-not + the new ETag). A non-2xx /
+// non-304 (403/404/network) is reported as `notModified: false` so the caller falls back
+// to a full walk rather than silently skipping.
+export async function ghRestGetConditional(token, path, etag) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method: 'GET',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+            ...(etag ? { 'if-none-match': etag } : {}),
+        },
+    });
+    // Drain the body so the socket is freed (we never read it).
+    await res.arrayBuffer().catch(() => { });
+    return {
+        status: res.status,
+        notModified: res.status === 304,
+        etag: res.headers.get('etag'),
+    };
+}
+// REST GET returning the raw response TEXT (not JSON), for endpoints with a plain-text
+// body — notably the Actions job-logs endpoint, which 302-redirects to a signed
+// download URL. fetch follows the redirect automatically AND strips the Authorization
+// header on the cross-origin hop, so our token is never sent to the signed URL. Does
+// NOT throw on a non-2xx status — returns it so the caller can degrade gracefully
+// (logs expire after ~90 days / on a re-run → 404/410; missing actions:read → 403).
+export async function ghRestGetText(token, path) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method: 'GET',
+        headers: {
+            authorization: `token ${token}`,
+            'x-github-api-version': '2022-11-28',
+        },
+    });
+    const text = await res.text().catch(() => '');
+    return { status: res.status, ok: res.ok, text };
+}
+// ADDITIVE (Actions job logs, byte-window viewer): REST GET returning the RAW Response
+// WITHOUT reading the body and WITHOUT following redirects (`redirect: 'manual'`), so
+// the caller can:
+//   (a) read the `location` of the Actions job-logs 302 and issue its OWN byte-`Range`
+//       request against the short-lived signed blob URL (which does honour Range), and
+//   (b) STREAM + cap a potentially multi-MB body instead of buffering the whole thing.
+// The signed URL must NEVER be handed to a client — it is unauthenticated and would
+// bypass our per-account ownership check. Nothing here throws on a non-2xx; the caller
+// branches on `res.status`. The Authorization header is only ever sent to api.github.com
+// because we do not follow the cross-origin hop ourselves.
+export async function ghRestGetRaw(token, path, init) {
+    return fetch(`https://api.github.com${path}`, {
+        method: 'GET',
+        redirect: 'manual',
+        headers: {
+            authorization: `token ${token}`,
+            'x-github-api-version': '2022-11-28',
+        },
+        signal: init?.signal,
+    });
+}
+// REST GET a repo file's RAW contents (Accept: application/vnd.github.raw), NOT throwing
+// on a non-2xx — returns the status + body so the caller can branch. Used to fetch a
+// repo's CODEOWNERS file (404 when absent → degrade to no CODEOWNERS suggestions) and the
+// advisor's bot-config reads. The raw media type returns the file bytes directly (no
+// base64/JSON envelope to decode). `ref` (optional) reads at a specific branch/sha —
+// omitted, GitHub serves the default branch, which is the config that governs FUTURE
+// reviews (the advisor's read point).
+export async function ghRestGetContentRaw(token, path, ref) {
+    const url = ref
+        ? `https://api.github.com${path}?ref=${encodeURIComponent(ref)}`
+        : `https://api.github.com${path}`;
+    const res = await fetch(url, {
+        method: 'GET',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github.raw',
+            'x-github-api-version': '2022-11-28',
+        },
+    });
+    const text = await res.text().catch(() => '');
+    return { status: res.status, ok: res.ok, text };
+}
+// REST GET one directory's contents listing (the JSON contents API — for a FILE it returns
+// an object, for a directory an array). Status-returning like ghRestGetContentRaw: a 404 is
+// the ordinary "that directory doesn't exist" outcome (e.g. a repo with no
+// .github/workflows/). Entries are name/path/type/size only — file BYTES go through
+// ghRestGetContentRaw so there is exactly one place decoding repo-authored content.
+export async function ghRestGetContentDir(token, path, ref) {
+    const url = ref
+        ? `https://api.github.com${path}?ref=${encodeURIComponent(ref)}`
+        : `https://api.github.com${path}`;
+    const res = await fetch(url, {
+        method: 'GET',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+        },
+    });
+    if (!res.ok) {
+        await res.text().catch(() => '');
+        return { status: res.status, ok: false, entries: [] };
+    }
+    const body = await res.json().catch(() => null);
+    if (!Array.isArray(body)) {
+        // A file path (object body) or an unreadable payload — not a directory listing.
+        return { status: res.status, ok: false, entries: [] };
+    }
+    const entries = body
+        .map((e) => {
+        const it = e;
+        if (typeof it.name !== 'string' || typeof it.path !== 'string')
+            return null;
+        const type = it.type === 'dir' ? 'dir' : it.type === 'file' ? 'file' : null;
+        if (!type)
+            return null;
+        return {
+            name: it.name,
+            path: it.path,
+            type,
+            size: typeof it.size === 'number' ? it.size : 0,
+        };
+    })
+        .filter((e) => Boolean(e));
+    return { status: res.status, ok: true, entries };
+}
+// REST GET in GitHub's raw `diff` media type (Accept: application/vnd.github.diff),
+// NOT throwing on a non-2xx — returns the status + body so the caller can branch. GitHub
+// caps this media type at 20,000 lines and 406s past it (a huge PR), which the caller
+// handles by falling back to the per-file endpoint. Mirrors ghRestGetText's non-throwing
+// contract.
+export async function ghRestGetDiffStatus(token, path) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method: 'GET',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github.diff',
+            'x-github-api-version': '2022-11-28',
+        },
+    });
+    const text = await res.text().catch(() => '');
+    return { status: res.status, ok: res.ok, text };
+}
+// Throwing variant of the above — the per-account, cloud-ready way to fetch a PR's
+// unified diff (vs the local-only `gh pr diff`). Throws on a non-2xx status.
+export async function ghRestGetDiff(token, path) {
+    const res = await ghRestGetDiffStatus(token, path);
+    if (!res.ok) {
+        throw new Error(`GitHub REST GET(diff) ${path} -> ${res.status}: ${res.text.slice(0, 300)}`);
+    }
+    return res.text;
+}
+// REST PUT returning the parsed STATUS + body WITHOUT throwing on a non-2xx, so the caller can
+// map GitHub's meaningful merge / update-branch statuses to structured results (405 not
+// mergeable, 409 head-sha mismatch, 422 method disallowed / can't update). Per-account token.
+export async function ghRestPutStatus(token, path, body) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method: 'PUT',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+            ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    const text = await res.text().catch(() => '');
+    let json = null;
+    try {
+        json = text ? JSON.parse(text) : null;
+    }
+    catch {
+        /* non-JSON body (rare on these endpoints) */
+    }
+    return { status: res.status, ok: res.ok, json, text };
+}
+// REST PATCH returning status (updating a pull request — e.g. closing it via
+// `{ state: 'closed' }`). Mirrors ghRestPutStatus: never throws on a non-2xx, returns the
+// status + parsed body so the caller can map GitHub's error to an HTTP response.
+export async function ghRestPatchStatus(token, path, body) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method: 'PATCH',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+            ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    const text = await res.text().catch(() => '');
+    let json = null;
+    try {
+        json = text ? JSON.parse(text) : null;
+    }
+    catch {
+        /* non-JSON body (rare on these endpoints) */
+    }
+    return { status: res.status, ok: res.ok, json, text };
+}
+// REST POST (submitting a PR review — inline line comments require the REST
+// reviews endpoint) for a specific account's token.
+export function ghRestPostFor(token, path, body) {
+    return ghRest(token, 'POST', path, body);
+}
+// REST POST to an endpoint that returns NO body (201/204 No Content) — e.g. the Actions
+// "rerun" / "rerun-failed-jobs" endpoints. Same auth + fail-loud-on-non-2xx as ghRest,
+// but does NOT call res.json() (which would throw `Unexpected end of JSON input` on the
+// empty success body). Returns nothing.
+export async function ghRestPostNoContent(token, path, body) {
+    const res = await fetch(`https://api.github.com${path}`, {
+        method: 'POST',
+        headers: {
+            authorization: `token ${token}`,
+            accept: 'application/vnd.github+json',
+            'x-github-api-version': '2022-11-28',
+            ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    if (!res.ok) {
+        const text = await res.text().catch(() => '');
+        throw new Error(`GitHub REST POST ${path} -> ${res.status}: ${text.slice(0, 300)}`);
+    }
+}
+// ---- Local-only convenience wrappers ----
+// Use the gh CLI token. ONLY for code paths that run in local mode — the Claude
+// Review posting path (post-review.ts) and clone-manager.ts, both force-disabled
+// in cloud. Caching the gh token is safe because local mode is single-account.
+let localToken = null;
+function localGhToken() {
+    return (localToken ??= getGithubToken());
+}
+export function ghRestGet(path) {
+    return ghRestGetFor(localGhToken(), path);
+}
+export function ghRestPost(path, body) {
+    return ghRestPostFor(localGhToken(), path, body);
+}
+//# sourceMappingURL=client.js.map

package/dist/github/codeowners.js

@@ -0,0 +1,221 @@
+// CODEOWNERS-based reviewer suggestions (CORE). Fetches a repo's CODEOWNERS file via the
+// contents API, parses it, and — given a PR's changed paths — returns the owning users +
+// teams. Best-effort throughout: any failure (no file, token can't read the repo, a parse
+// hiccup) degrades to "no CODEOWNERS suggestions", NEVER an error on the PR-detail path.
+//
+// Why CODEOWNERS and not the org/teams API: the contents API is reachable in every auth
+// mode (local gh token, cloud OAuth `public_repo`, GitHub App with contents:read), and a
+// `@org/team` owner is directly requestable as a review via `team_reviewers` — no need to
+// expand team membership (which needs `read:org` + org membership and is unreliable under
+// the cloud GitHub App). Individual `@user` owners become user suggestions directly.
+import { ghRestGetContentRaw } from './client.js';
+// The candidate file locations GitHub honours, in the order it resolves them.
+const CODEOWNERS_PATHS = ['.github/CODEOWNERS', 'CODEOWNERS', 'docs/CODEOWNERS'];
+// Per-(account, repo) cache. CODEOWNERS changes rarely, so a short TTL keeps the extra
+// contents-API call off the hot path while staying reasonably fresh. A `null` rules value
+// is cached too (the common "repo has no CODEOWNERS" case) so we don't refetch a 404 on
+// every PR open. Keyed by account so one tenant's token result never leaks to another.
+const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+const cache = new Map();
+// ---- Hard limits on attacker-supplied input ----
+// A CODEOWNERS file is fetched from a repository, which means its contents are chosen by
+// whoever controls that repository — in cloud, anyone who can sign up and add their own
+// repo. Every one of these rules is then regex-matched against every changed path of every
+// PR on the request thread of a SINGLE-threaded server, so unbounded input here is a
+// denial-of-service on the whole deployment, not just on the caller.
+//
+// A real CODEOWNERS file is a few dozen lines; GitHub itself stops honouring one past 3 MB
+// and only applies the first 1000 rules. These caps sit comfortably above any legitimate
+// file and turn a hostile one into a truncated, harmless one.
+const MAX_CODEOWNERS_BYTES = 256 * 1024;
+const MAX_RULES = 500;
+const MAX_PATTERN_LENGTH = 512;
+/** Cap the paths matched per PR. A PR touching more files than this is already an outlier,
+ *  and suggestions from the first N are as useful as suggestions from all of them. */
+const MAX_PATHS_MATCHED = 300;
+// Convert a CODEOWNERS (gitignore-style) path pattern into a regex over POSIX file paths.
+// A best-effort subset matching GitHub's documented CODEOWNERS semantics: `*` matches
+// within a single segment (NOT across `/`), `**` across segments, `?` one non-slash char;
+// a leading `/` or any internal `/` anchors to the repo root, otherwise the pattern may
+// match at any directory depth; a trailing `/` (or a bare directory name) owns everything
+// under that directory. Exported for the unit test that locks these semantics.
+export function globToRegExp(raw) {
+    let p = raw.trim();
+    if (p.length > MAX_PATTERN_LENGTH) {
+        throw new Error('codeowners pattern too long');
+    }
+    // ---- ReDoS guard: collapse repeated globs BEFORE compiling ----
+    // Each segment-aligned `**/` compiles to `(?:.*/)?` below. Two of those in a row give the
+    // regex engine two nullable, overlapping ways to consume the same directory prefix, and
+    // N in a row make that 2^N — so `**/**/**/…/zzz.txt` against a deep path backtracks
+    // effectively forever, freezing the event loop for every tenant.
+    //
+    // Collapsing is not merely a mitigation, it is SEMANTICALLY EXACT: "any number of leading
+    // directories, then any number of leading directories" is the same language as "any
+    // number of leading directories". Same for a run of bare `**`, and for `**` adjacent to
+    // `*`. After this, at most one `(?:.*/)?` can come from each distinct run, so the compiled
+    // pattern is linear to match.
+    p = p
+        // `**/**/` … → `**/`
+        .replace(/(?:\*\*\/)+/g, '**/')
+        // `****…` (a run of 3+ stars, or `**` next to `*`) → `**`
+        .replace(/\*{3,}/g, '**')
+        // `**/**` (trailing, not slash-terminated) → `**`
+        .replace(/\*\*(?:\/\*\*)+/g, '**');
+    const dirOnly = p.endsWith('/');
+    if (dirOnly)
+        p = p.slice(0, -1);
+    const startSlash = p.startsWith('/');
+    if (startSlash)
+        p = p.slice(1);
+    // Git: a pattern with a slash anywhere but the end is relative to the root (anchored);
+    // a pattern with no internal slash matches by name at any level.
+    const anchored = startSlash || p.includes('/');
+    let re = '';
+    for (let i = 0; i < p.length; i++) {
+        const c = p[i];
+        if (c === '*') {
+            if (p[i + 1] === '*') {
+                // `**` spans path segments. A segment-aligned `**/` becomes OPTIONAL leading
+                // directories that preserve the `/` boundary (so `**/logs` matches `a/logs` but
+                // NOT `mylogs`); a trailing/standalone `**` matches anything.
+                if (p[i + 2] === '/') {
+                    re += '(?:.*/)?';
+                    i += 2; // consume the second '*' and the '/'
+                }
+                else {
+                    re += '.*';
+                    i += 1; // consume the second '*'
+                }
+            }
+            else {
+                re += '[^/]*';
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+        }
+        else if ('.+^${}()|[]\\'.includes(c)) {
+            re += `\\${c}`;
+        }
+        else {
+            re += c;
+        }
+    }
+    // A trailing-slash directory (or a bare literal path) OWNS everything under it, so it
+    // gets a "…/.*" / "(?:/.*)?" tail. A wildcard-TERMINATED pattern (e.g. `docs/*`) is
+    // single-level per GitHub — it must NOT gain that tail, or it would over-match nested
+    // files (`docs/*` matches `docs/a.md` but not `docs/sub/a.md`).
+    const endsWithWildcard = /[*?]$/.test(p);
+    const body = dirOnly ? `${re}/.*` : endsWithWildcard ? re : `${re}(?:/.*)?`;
+    const full = anchored ? `^${body}$` : `^(?:.*/)?${body}$`;
+    // Last line of defence: refuse a compiled source that still contains several nullable
+    // `(?:.*/)?` groups. The collapse above should make this unreachable for any input, so
+    // reaching it means a pattern shape we did not anticipate — drop the rule (parseCodeowners
+    // catches this) rather than hand the engine something that might backtrack.
+    const nullableGroups = (full.match(/\(\?:\.\*\/\)\?/g) ?? []).length;
+    if (nullableGroups > 2) {
+        throw new Error('codeowners pattern too ambiguous to match safely');
+    }
+    return new RegExp(full);
+}
+// Parse CODEOWNERS text into ordered rules (order matters: the LAST matching rule wins).
+function parseCodeowners(text) {
+    const rules = [];
+    for (const line of text.split('\n')) {
+        // Stop at MAX_RULES rather than compiling a hostile 100k-line file. GitHub itself only
+        // honours the first 1000 rules, so truncating is consistent with the real semantics.
+        if (rules.length >= MAX_RULES)
+            break;
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        // Strip an inline comment, then split on whitespace: first token = pattern, rest = owners.
+        const noComment = trimmed.split('#')[0].trim();
+        if (!noComment)
+            continue;
+        const parts = noComment.split(/\s+/);
+        const pattern = parts[0];
+        // Owners are the @-prefixed tokens (drop bare emails — not requestable as reviewers).
+        const owners = parts.slice(1).filter((o) => o.startsWith('@'));
+        if (owners.length === 0)
+            continue;
+        try {
+            rules.push({ re: globToRegExp(pattern), owners });
+        }
+        catch {
+            /* skip an un-compilable pattern rather than fail the whole file */
+        }
+    }
+    return rules;
+}
+// Fetch + parse a repo's CODEOWNERS (cached). Returns null when there's no file / it can't
+// be read. Never throws.
+async function loadRules(token, owner, name, accountId) {
+    const key = `${accountId}:${owner}/${name}`;
+    const hit = cache.get(key);
+    if (hit && Date.now() - hit.at < CACHE_TTL_MS)
+        return hit.rules;
+    let rules = null;
+    try {
+        for (const path of CODEOWNERS_PATHS) {
+            const res = await ghRestGetContentRaw(token, `/repos/${owner}/${name}/contents/${path}`);
+            if (res.ok && res.text) {
+                // Truncate before parsing: the body length is chosen by whoever owns the repo.
+                rules = parseCodeowners(res.text.length > MAX_CODEOWNERS_BYTES
+                    ? res.text.slice(0, MAX_CODEOWNERS_BYTES)
+                    : res.text);
+                break;
+            }
+            // Any non-404 (403 org wall / 401) also means "give up on CODEOWNERS" — stop trying.
+            if (res.status !== 404)
+                break;
+        }
+    }
+    catch {
+        rules = null;
+    }
+    cache.set(key, { rules, at: Date.now() });
+    return rules;
+}
+// Given a PR's changed paths, return the CODEOWNERS-derived owners (users + teams). The
+// LAST matching rule for each file wins (git semantics); owners are unioned across files.
+export async function getCodeownersMatch(token, owner, name, accountId, changedPaths) {
+    const empty = { logins: [], teams: [] };
+    if (changedPaths.length === 0)
+        return empty;
+    const rules = await loadRules(token, owner, name, accountId);
+    if (!rules || rules.length === 0)
+        return empty;
+    // Bound the total match work to MAX_PATHS_MATCHED × MAX_RULES regex tests. Both factors
+    // are attacker-influenceable (the PR's file count and the repo's CODEOWNERS), and this runs
+    // synchronously on the request thread of a single-threaded server.
+    const paths = changedPaths.length > MAX_PATHS_MATCHED
+        ? changedPaths.slice(0, MAX_PATHS_MATCHED)
+        : changedPaths;
+    const ownerTokens = new Set();
+    for (const path of paths) {
+        let last = null;
+        for (const r of rules)
+            if (r.re.test(path))
+                last = r; // last match wins
+        if (last)
+            for (const o of last.owners)
+                ownerTokens.add(o);
+    }
+    const logins = [];
+    const teams = [];
+    for (const tok of ownerTokens) {
+        const handle = tok.slice(1); // drop '@'
+        if (handle.includes('/')) {
+            const slug = handle.slice(handle.indexOf('/') + 1);
+            if (slug)
+                teams.push({ slug, name: handle });
+        }
+        else if (handle) {
+            logins.push(handle);
+        }
+    }
+    return { logins, teams };
+}
+//# sourceMappingURL=codeowners.js.map