madarx 2.17.0 → 2.19.0

package/lib/orchestrator-broadcast.js

@@ -0,0 +1,126 @@
+// Phase 2 of chat live continuity: a process-local broadcaster that decouples a
+// running orchestrator turn from the HTTP request that started it.
+//
+// While a turn streams, the route mirrors every SSE event here via `publish`.
+// A client that navigates away and back (or opens a second tab) reconnects to
+// `/api/orchestrator/stream/attach`, which `subscribe`s with the last sequence
+// it saw: the broadcaster replays the buffered tail, then streams live events
+// until the turn ends. On `endTurn` the entry is retained briefly so a client
+// reconnecting right at the finish still gets the terminal `__end`.
+//
+// Local-first / single-process: state is in-memory, keyed off globalThis so it
+// survives Next.js HMR. If the process restarts mid-turn the buffer is lost —
+// Phase 1's persisted per-turn messages + TTL flag are the durable fallback.
+
+const RETENTION_MS = Number(process.env.MADARX_TURN_BUFFER_RETENTION_MS) || 30000;
+const MAX_BUFFER = Number(process.env.MADARX_TURN_BUFFER_MAX) || 1000;
+// Per-session live-subscriber cap. Single-user local-first app: a handful of
+// tabs is the realistic ceiling. Guards against a client loop opening unbounded
+// attach connections. Mirrors the MAX_SUBSCRIBERS discipline in events/stream.
+const MAX_SUBSCRIBERS = Number(process.env.MADARX_TURN_MAX_SUBSCRIBERS) || 8;
+
+function registry() {
+  if (!globalThis.__madarxTurnBroadcast) {
+    globalThis.__madarxTurnBroadcast = new Map(); // session_id -> turn
+  }
+  return globalThis.__madarxTurnBroadcast;
+}
+
+// Fan a control/event frame out to every subscriber. Subscribers receive
+// { seq, event, data } where event '__end' is the terminal frame.
+function fanout(turn, frame) {
+  for (const cb of turn.subscribers) {
+    try { cb(frame); } catch { /* one bad subscriber can't break the turn */ }
+  }
+}
+
+// Begin (or replace) the live turn for a session. If a prior turn is still
+// live for this session it is ended first so its subscribers detach cleanly.
+export function beginTurn(sessionId, turnId) {
+  if (!sessionId || !turnId) return;
+  const reg = registry();
+  const existing = reg.get(sessionId);
+  if (existing && existing.status === 'live' && existing.turnId !== turnId) {
+    endTurn(sessionId, existing.turnId);
+  }
+  reg.set(sessionId, {
+    turnId,
+    seq: 0,
+    buffer: [],
+    subscribers: new Set(),
+    status: 'live',
+    cleanupTimer: null,
+  });
+}
+
+// Mirror one SSE event into the turn buffer + live subscribers. `data` is kept
+// in its raw form (string or object) exactly as the route's emit() passes it,
+// so attach can re-serialise it identically.
+export function publish(sessionId, turnId, event, data) {
+  const turn = registry().get(sessionId);
+  if (!turn || turn.turnId !== turnId || turn.status !== 'live') return;
+  const frame = { seq: ++turn.seq, event, data };
+  turn.buffer.push(frame);
+  if (turn.buffer.length > MAX_BUFFER) turn.buffer.shift();
+  fanout(turn, frame);
+}
+
+// End the live turn. Emits a terminal `__end` frame, then schedules the entry
+// for deletion after RETENTION_MS (idempotent; a new turn cancels it).
+export function endTurn(sessionId, turnId) {
+  const reg = registry();
+  const turn = reg.get(sessionId);
+  if (!turn || turn.turnId !== turnId) return;
+  if (turn.status === 'live') {
+    turn.status = 'done';
+    const frame = { seq: ++turn.seq, event: '__end', data: {} };
+    turn.buffer.push(frame);
+    fanout(turn, frame);
+    turn.subscribers.clear();
+  }
+  if (turn.cleanupTimer) clearTimeout(turn.cleanupTimer);
+  turn.cleanupTimer = setTimeout(() => {
+    const cur = reg.get(sessionId);
+    if (cur && cur.turnId === turnId) reg.delete(sessionId);
+  }, RETENTION_MS);
+  if (typeof turn.cleanupTimer?.unref === 'function') turn.cleanupTimer.unref();
+}
+
+// Snapshot of the active turn for a session, or null. `lastSeq` lets a caller
+// decide whether it already has everything.
+export function getActiveTurn(sessionId) {
+  const turn = registry().get(sessionId);
+  if (!turn) return null;
+  return { turnId: turn.turnId, status: turn.status, lastSeq: turn.seq };
+}
+
+// Subscribe to a turn, replaying buffered frames with seq > fromSeq first, then
+// streaming live ones. Returns an unsubscribe fn. If the turn is already done,
+// replays the tail (incl. `__end`) and does not register a live listener.
+export function subscribe(sessionId, fromSeq, cb) {
+  const turn = registry().get(sessionId);
+  if (!turn) return () => {};
+  const from = Number.isFinite(fromSeq) ? fromSeq : 0;
+  for (const frame of turn.buffer) {
+    if (frame.seq > from) {
+      try { cb(frame); } catch { /* ignore */ }
+    }
+  }
+  if (turn.status !== 'live') return () => {};
+  if (turn.subscribers.size >= MAX_SUBSCRIBERS) {
+    // At capacity: the caller still got the buffered replay above; it just
+    // won't receive live tail frames. Better than leaking unbounded listeners.
+    return () => {};
+  }
+  turn.subscribers.add(cb);
+  return () => { turn.subscribers.delete(cb); };
+}
+
+// Test helper — wipe all turns.
+export function __resetTurnBroadcast() {
+  const reg = registry();
+  for (const turn of reg.values()) {
+    if (turn.cleanupTimer) clearTimeout(turn.cleanupTimer);
+  }
+  reg.clear();
+}

package/lib/pick-folder-authz.js

@@ -0,0 +1,15 @@
+import { requireRole } from './authz.js';
+
+// Authorization for the native folder picker (/api/fs/pick-folder).
+//
+// Plain folder selection is a benign local helper: it opens a native OS dialog
+// and returns the chosen path string, which only fills a form field — it grants
+// no access on its own (project creation and the disk layer enforce allowed
+// roots). So ANY authenticated user may use it; gating it on the org `admin`
+// role wrongly 403s a member/viewer with `insufficient_role`.
+//
+// Registering a Mines import root, by contrast, grants agents access to that
+// root, so that branch stays admin-gated.
+export function assertPickFolderRole(session, registerImportRoot) {
+  if (registerImportRoot) requireRole(session, 'admin', session?.org_id);
+}

package/lib/public-url.js

@@ -0,0 +1,89 @@
+/**
+ * lib/public-url.js — the canonical public base URL of this install.
+ *
+ * Invite links and share links get COPIED and sent to other people, so they must
+ * point at a URL the recipient can actually reach — not `window.location.origin`
+ * of whoever generated them (which is `http://localhost:8787` in dev). This is
+ * the single source of truth for that base URL.
+ *
+ * Precedence:
+ *   config table  `public_base_url`   (UI-settable from Settings → Team)
+ *   → env  MADARX_PUBLIC_URL / MADARX_PUBLIC_SHARE_BASE_URL / NEXT_PUBLIC_SHARE_BASE_URL / NEXT_PUBLIC_SITE_URL
+ *   → ''   (callers fall back to the request origin)
+ *
+ * Server-only (reads the config table via lib/config.js). For client code, the
+ * value is surfaced through GET /api/auth/config.
+ */
+
+import { getConfig, setConfig } from './config.js';
+
+export const PUBLIC_BASE_URL_KEY = 'public_base_url';
+
+const ENV_KEYS = [
+  'MADARX_PUBLIC_URL',
+  'MADARX_PUBLIC_SHARE_BASE_URL',
+  'NEXT_PUBLIC_SHARE_BASE_URL',
+  'NEXT_PUBLIC_SITE_URL',
+];
+
+function clean(raw) {
+  if (!raw || !String(raw).trim()) return '';
+  const value = String(raw).trim().replace(/\/+$/, '');
+  return /^https?:\/\//i.test(value) ? value : '';
+}
+
+/** True for a syntactically valid http(s) URL. */
+export function isValidPublicUrl(raw) {
+  const v = clean(raw);
+  if (!v) return false;
+  try {
+    new URL(v);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** The configured public base URL, or '' when none is set. Never trailing-slashed. */
+export function getPublicBaseUrl() {
+  try {
+    const stored = clean(getConfig(PUBLIC_BASE_URL_KEY, null));
+    if (stored) return stored;
+  } catch {
+    // config table not ready (very early boot) — fall through to env.
+  }
+  for (const key of ENV_KEYS) {
+    const v = clean(process.env[key]);
+    if (v) return v;
+  }
+  return '';
+}
+
+/**
+ * Persists the public base URL (UI-driven). Pass '' to clear it (fall back to
+ * env / request origin). Throws on a non-http(s) value.
+ */
+export function setPublicBaseUrl(raw) {
+  const trimmed = raw == null ? '' : String(raw).trim();
+  if (trimmed === '') {
+    setConfig(PUBLIC_BASE_URL_KEY, '');
+    return '';
+  }
+  if (!isValidPublicUrl(trimmed)) {
+    throw new Error('public app URL must be a valid http(s) URL, e.g. https://madarx.io');
+  }
+  const value = clean(trimmed);
+  setConfig(PUBLIC_BASE_URL_KEY, value);
+  return value;
+}
+
+/**
+ * Joins a path onto the public base URL. Returns the bare path when no base is
+ * configured, so callers can prepend the request origin as a fallback.
+ */
+export function publicUrl(path) {
+  const p = String(path || '');
+  const normalizedPath = p.startsWith('/') ? p : `/${p}`;
+  const base = getPublicBaseUrl();
+  return base ? `${base}${normalizedPath}` : normalizedPath;
+}

package/lib/realtime-openai.js

@@ -28,6 +28,17 @@ export function realtimeConfigured() {
   return Boolean(getSecret('OPENAI_API_KEY') || process.env.OPENAI_API_KEY);
 }
 
+// Transport-only instruction block. In this mode the Realtime model is a
+// dumb microphone+transcriber: it must NOT reason, answer, or call tools.
+// All cognition runs through the main orchestrator stream (same brain as typed
+// chat); the Realtime model only converts speech → text. Output is suppressed
+// server-side via turn_detection.create_response:false, but we also instruct
+// the model explicitly as a belt-and-suspenders guard.
+const TRANSPORT_INSTRUCTIONS =
+  'You are a transcription microphone only. Do NOT respond, answer, comment, '
+  + 'or call any tool. Never speak. Your sole job is to let the system capture '
+  + 'the user\'s spoken words as text. Stay silent at all times.';
+
 export async function mintOpenAIRealtimeSession(opts = {}) {
   const apiKey = getSecret('OPENAI_API_KEY') || process.env.OPENAI_API_KEY;
   if (!apiKey) throw new Error('OPENAI_API_KEY missing for OpenAI Realtime');
@@ -35,12 +46,24 @@ export async function mintOpenAIRealtimeSession(opts = {}) {
   const model = String(opts.model || getSecret('OPENAI_REALTIME_MODEL') || process.env.OPENAI_REALTIME_MODEL || DEFAULT_REALTIME_MODEL);
   const voice = safeVoice(opts.voice || getSecret('OPENAI_REALTIME_VOICE') || process.env.OPENAI_REALTIME_VOICE);
 
+  // Transport mode: Realtime is STT-only. The orchestrator (Claude) is the
+  // brain; the TTS lane is the mouth. Force no tools + transcribe-only
+  // instructions and suppress the model's auto-response. This is the default
+  // for the unified voice=main-agent path; pass mode:'realtime' to fall back
+  // to the legacy in-browser-brain behaviour.
+  const transport = opts.mode === 'transport';
+
   // Build the durable Madarx instruction block from project + memory + state
   // unless the caller passed an override. Tools default to the curated voice
   // catalog; callers can pass a custom list (e.g. [] to disable tool calling).
   let instructions = String(opts.instructions || '').trim();
   let tools = Array.isArray(opts.tools) ? opts.tools : null;
-  if (!instructions || !tools) {
+  if (transport) {
+    // Transport mode never reasons or acts — ignore any caller-supplied tools
+    // and context, and pin the transcribe-only instruction block.
+    instructions = TRANSPORT_INSTRUCTIONS;
+    tools = [];
+  } else if (!instructions || !tools) {
     const ctx = buildVoiceContext({
       project_id: opts.project_id,
       agent_id: opts.agent_id,
@@ -66,6 +89,31 @@ export async function mintOpenAIRealtimeSession(opts = {}) {
     instructions,
     audio: { output: { voice } },
   };
+  if (transport) {
+    // Enable input transcription so we receive
+    // conversation.item.input_audio_transcription.completed events, and turn
+    // OFF automatic response generation so the Realtime model stays silent —
+    // the orchestrator produces the answer instead.
+    session.audio.input = {
+      transcription: { model: 'gpt-4o-mini-transcribe' },
+      turn_detection: { type: 'server_vad', create_response: false, interrupt_response: false },
+    };
+    session.output_modalities = ['text'];
+  }
+  // Reasoning effort is the biggest latency dial on gpt-realtime-2: lower =
+  // snappier first audio. session.reasoning.effort accepts minimal|low|medium|
+  // high; 'low' is OpenAI's recommended default for production voice agents.
+  // Guard on the model name so older realtime models (which reject the field)
+  // do not fail the mint.
+  if (/realtime-2/.test(model)) {
+    const effort = String(
+      opts.reasoning_effort
+      || getSecret('OPENAI_REALTIME_REASONING')
+      || process.env.OPENAI_REALTIME_REASONING
+      || 'low',
+    );
+    session.reasoning = { effort };
+  }
   if (Array.isArray(tools) && tools.length) session.tools = tools;
   const body = { session };
 

package/lib/runtime.js

@@ -1483,8 +1483,20 @@ function processesSnapshot(projectId) {
 
 // ── Chat sessions ─────────────────────────────────────────────────────────────
 
+// A live turn older than this is treated as stale (server crashed mid-turn
+// without clearing the flag), so the session reports idle and self-heals.
+const ACTIVE_TURN_TTL_MS = Number(process.env.MADARX_ACTIVE_TURN_TTL_MS) || 900000; // 15min
+
+function isActiveTurnFresh(startedAt) {
+  if (!startedAt) return false;
+  const started = Date.parse(startedAt);
+  if (Number.isNaN(started)) return false;
+  return (Date.now() - started) < ACTIVE_TURN_TTL_MS;
+}
+
 function rowToChatSession(row) {
   if (!row) return null;
+  const fresh = isActiveTurnFresh(row.active_turn_started_at);
   return {
     id: row.id,
     title: row.title,
@@ -1497,6 +1509,10 @@ function rowToChatSession(row) {
     total_cache_read_tokens: row.total_cache_read_tokens,
     total_cache_creation_tokens: row.total_cache_creation_tokens,
     last_context_tokens: row.last_context_tokens,
+    // Only surface the turn id while it is fresh — a stale flag reads as idle.
+    active_turn_id: fresh ? (row.active_turn_id || null) : null,
+    active_turn_started_at: fresh ? (row.active_turn_started_at || null) : null,
+    agent_working: fresh && Boolean(row.active_turn_id),
   };
 }
 
@@ -1613,6 +1629,28 @@ export function appendChatMessage(session_id, {
   return { id, session_id, role, at };
 }
 
+// Mark a chat session as having a live (streaming) turn in flight, or clear it.
+// Pass a turnId to begin, null to end. Idempotent and best-effort: a missing
+// session row is a no-op (it may have been deleted mid-turn).
+export function setSessionActiveTurn(session_id, turnId) {
+  if (!session_id) return { ok: false };
+  const db = getDb();
+  try {
+    if (turnId) {
+      db.prepare(
+        'UPDATE chat_sessions SET active_turn_id = ?, active_turn_started_at = ? WHERE id = ?'
+      ).run(String(turnId), nowIso(), session_id);
+    } else {
+      db.prepare(
+        'UPDATE chat_sessions SET active_turn_id = NULL, active_turn_started_at = NULL WHERE id = ?'
+      ).run(session_id);
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false };
+  }
+}
+
 export function renameChatSession(id, title) {
   const db = getDb();
   const t = String(title || '').slice(0, 200);

package/lib/schema.js

@@ -516,7 +516,12 @@ CREATE TABLE IF NOT EXISTS chat_sessions (
   total_output_tokens INTEGER NOT NULL DEFAULT 0,
   total_cache_read_tokens INTEGER NOT NULL DEFAULT 0,
   total_cache_creation_tokens INTEGER NOT NULL DEFAULT 0,
-  last_context_tokens INTEGER NOT NULL DEFAULT 0
+  last_context_tokens INTEGER NOT NULL DEFAULT 0,
+  -- Live-turn continuity: set while an orchestrator turn is streaming for this
+  -- session, cleared when it finishes. active_turn_started_at gates a TTL so a
+  -- crashed turn self-heals to "idle" instead of pinning the flag forever.
+  active_turn_id TEXT,
+  active_turn_started_at TEXT
 );
 
 CREATE TABLE IF NOT EXISTS whatsapp_messages (

package/lib/share-url.js

@@ -1,21 +1,13 @@
-const SHARE_BASE_ENV_KEYS = [
-  'MADARX_PUBLIC_SHARE_BASE_URL',
-  'NEXT_PUBLIC_SHARE_BASE_URL',
-  'NEXT_PUBLIC_SITE_URL',
-];
+/**
+ * lib/share-url.js — share-link URL builder.
+ *
+ * Thin back-compat wrapper over lib/public-url.js (the single source of truth
+ * for this install's public base URL, now UI-settable from Settings → Team).
+ * Kept so existing imports of `publicShareUrl` keep working.
+ */
 
-function normalizedBaseUrl() {
-  for (const key of SHARE_BASE_ENV_KEYS) {
-    const raw = process.env[key];
-    if (!raw || !String(raw).trim()) continue;
-    const value = String(raw).trim().replace(/\/+$/, '');
-    if (/^https?:\/\//i.test(value)) return value;
-  }
-  return '';
-}
+import { publicUrl } from './public-url.js';
 
 export function publicShareUrl(path) {
-  const normalizedPath = String(path || '').startsWith('/') ? String(path || '') : `/${path || ''}`;
-  const base = normalizedBaseUrl();
-  return base ? `${base}${normalizedPath}` : normalizedPath;
+  return publicUrl(path);
 }

package/lib/tools/adapters/browser-session.js

@@ -1,10 +1,15 @@
 /**
  * browser-session.js — native Playwright browser-interaction adapter.
  *
- * Drives a real headless Chromium so the main agent can navigate, click, type,
- * read, and screenshot pages that need JavaScript (unlike browser_navigate,
- * which is fetch + regex only). One managed persistent context is shared across
- * calls and auto-closed after an idle window so we never leak browser processes.
+ * Drives a real Chromium so the main agent can navigate, click, type, read, and
+ * screenshot pages that need JavaScript (unlike browser_navigate, which is
+ * fetch + regex only). One managed persistent context is shared across calls and
+ * auto-closed after an idle window so we never leak browser processes.
+ *
+ * Headless by default. Set MADARX_BROWSER_HEADED=1 (or true/yes/on) to open a
+ * VISIBLE window the operator can watch — it prefers the installed Chrome
+ * (channel:'chrome'), falling back to bundled Chromium. The idle auto-close
+ * (90s) still applies, so a visible window left untouched closes on its own.
  *
  * Safety posture:
  *  - Dedicated profile under DATA_DIR/browser-profile — NOT the user's personal
@@ -45,6 +50,33 @@ function cap(text) {
   return redactToolOutput(String(text ?? '').slice(0, MAX_TEXT_CHARS));
 }
 
+// Headed mode lets the operator watch the agent drive a real, visible browser.
+// Off by default so headless servers and CI stay unattended. When on, prefer the
+// operator's installed Chrome (channel:'chrome') so it looks/behaves like a real
+// browser; we transparently fall back to bundled Chromium if that channel is
+// unavailable. The persistent profile (PROFILE_DIR) is still the dedicated
+// madarX profile, never the user's personal Chrome data.
+function isHeaded() {
+  const v = String(process.env.MADARX_BROWSER_HEADED || '').trim().toLowerCase();
+  return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+
+async function launchContext(chromium) {
+  const headed = isHeaded();
+  const base = {
+    headless: !headed,
+    args: ['--no-sandbox', '--disable-dev-shm-usage'],
+  };
+  if (headed) {
+    try {
+      return await chromium.launchPersistentContext(PROFILE_DIR, { ...base, channel: 'chrome' });
+    } catch {
+      // Installed Chrome not found — fall back to bundled Chromium, still headed.
+    }
+  }
+  return await chromium.launchPersistentContext(PROFILE_DIR, base);
+}
+
 function touchIdleTimer() {
   if (_idleTimer) clearTimeout(_idleTimer);
   _idleTimer = setTimeout(() => { closeBrowser().catch(() => {}); }, IDLE_CLOSE_MS);
@@ -75,10 +107,7 @@ async function ensurePage() {
   }
   fs.mkdirSync(PROFILE_DIR, { recursive: true });
   try {
-    _context = await chromium.launchPersistentContext(PROFILE_DIR, {
-      headless: true,
-      args: ['--no-sandbox', '--disable-dev-shm-usage'],
-    });
+    _context = await launchContext(chromium);
   } catch (err) {
     _context = null;
     throw new Error(

package/lib/tools/adapters/github.js

@@ -65,12 +65,30 @@ function parseOwnerRepo(repo_full_name) {
 // ── Error extraction ──────────────────────────────────────────────────────────
 
 async function extractGitHubError(res) {
+  let message = `GitHub API error: ${res.status}`;
   try {
     const data = await res.json();
-    return data?.message || `GitHub API error: ${res.status}`;
+    if (data?.message) message = data.message;
   } catch {
-    return `GitHub API error: ${res.status}`;
+    // non-JSON body — keep the status-based message
   }
+
+  // Actionable guidance for the two access failures users actually hit.
+  // SAML SSO: the org requires the token to be explicitly authorized. GitHub
+  // signals this via the x-github-sso response header.
+  const sso = res.headers?.get?.('x-github-sso');
+  if (res.status === 403 && sso) {
+    const urlMatch = /url=([^;,\s]+)/i.exec(sso);
+    const where = urlMatch ? ` Authorize it here: ${urlMatch[1]}` : '';
+    return `${message} — this org requires SAML SSO authorization for your token.${where}`;
+  }
+  if (res.status === 403) {
+    return `${message} — the token is valid but lacks permission for this resource (check the fine-grained PAT's repository access / scopes, and authorize SSO if the org uses it).`;
+  }
+  if (res.status === 404) {
+    return `${message} — not found, OR your token cannot see it. A fine-grained PAT only sees repos it was explicitly granted; a classic PAT needs the 'repo' scope. Grant access to this repo/org and retry.`;
+  }
+  return message;
 }
 
 // ── Response shapers ──────────────────────────────────────────────────────────
@@ -146,12 +164,36 @@ export async function ghRepoList(input = {}, options = {}) {
   const token = requireCredential('GITHUB_TOKEN', options);
   const agentId = options.agent_id ?? null;
 
-  const url = new URL(`${GH_API}/user/repos`);
-  if (input.visibility) url.searchParams.set('visibility', String(input.visibility));
-  if (input.type) url.searchParams.set('type', String(input.type));
+  // Two listing modes:
+  //  - `org` set → GET /orgs/{org}/repos (repos owned by that org the token can
+  //    see). This is how you reach org repos you were granted access to.
+  //  - otherwise → GET /user/repos across every affiliation the token has, so
+  //    collaborator + organization_member repos show up, not just owned ones.
+  const org = input.org ? String(input.org).trim() : '';
+  let url;
+  if (org) {
+    if (!/^[A-Za-z0-9_.-]+$/.test(org)) {
+      throw new Error(`org must be a valid GitHub org/owner name, got: ${org}`);
+    }
+    url = new URL(`${GH_API}/orgs/${org}/repos`);
+    if (input.type) url.searchParams.set('type', String(input.type)); // all|public|private|forks|sources|member
+  } else {
+    url = new URL(`${GH_API}/user/repos`);
+    // Default to the full affiliation set so org/collaborator repos are listed.
+    url.searchParams.set('affiliation', String(input.affiliation || 'owner,collaborator,organization_member'));
+    if (input.visibility) url.searchParams.set('visibility', String(input.visibility));
+    // `type` and `affiliation` are mutually exclusive on /user/repos — only send
+    // `type` when the caller did not narrow by affiliation themselves.
+    if (input.type && !input.affiliation) {
+      url.searchParams.delete('affiliation');
+      url.searchParams.set('type', String(input.type));
+    }
+  }
   if (input.sort) url.searchParams.set('sort', String(input.sort));
   const perPage = Math.min(Math.max(Number(input.per_page || 30), 1), 100);
   url.searchParams.set('per_page', String(perPage));
+  const page = Math.max(Number(input.page || 1), 1);
+  if (page > 1) url.searchParams.set('page', String(page));
 
   const res = await wrapFetch('gh_repo_list', agentId)(url, {
     headers: githubHeaders(token),