managed-deepagents 0.5.0-dev.79 → 0.5.0-dev.80

package/dist/connectors/github/index.js

@@ -1,92 +1,172 @@
 /**
- * GitHub connector — sandbox checkouts, CLI, and credential injection.
+ * GitHub connector — workspace tools, sandbox checkout, and optional webhooks.
  *
- * Declares which repositories MDA should clone into the sandbox, whether to
- * install the GitHub CLI, and whether resolved identity credentials should be
- * available inside the sandbox so the agent can act as the signed-in user.
+ * A [tool server integration](../toolserver) like `connectors.gmail`, so the
+ * workspace's GitHub tools — issues, pull requests, reviews — come from the same
+ * gateway against the same credential. GitHub reaches further than an API
+ * though: an agent works on a repository by having it checked out. So this
+ * connector also provisions the sandbox, declaring which repositories to clone,
+ * whether to install the GitHub CLI, and whether resolved identity credentials
+ * should be available inside the sandbox so the agent can act as the user.
  *
- * Sandbox provisioning runs via the connector's {@link connector}'s `sandbox`
- * hook. Channel ingress lives under `channels/github` (separate plugin).
- * Connect-with-GitHub OAuth lives under `identity/github/`.
+ * Optional `events` merges former `channels.github` authoring: GitHub App
+ * webhook ingress at `POST /connectors/{name}/events`, messaging transport, and
+ * deploy requirements. Connect-with-GitHub OAuth remains `connect.github`.
+ *
+ * The two halves interact in one place: installing the CLI (the default) leaves
+ * the integration's tools off, because `gh` already reaches the same API. Naming
+ * tools, or dropping the CLI, turns them on. See {@link defaultToolsFromCLI}.
  */
+import { z } from "zod";
+import { GITHUB_CHANNEL_REQUIRED_ENV, toGitHubChannelManifest, } from "./define.js";
+import { handleGitHubEventsRequest } from "./http.js";
+import { transportFromEnv } from "./transport.js";
 import { CONNECTOR_BRAND, } from "../../runtime/connector.js";
+import { GITHUB_SLUG, toolServerConnectorSchema, toolServerTools, } from "../toolserver/index.js";
 import { provisionGitHubSandbox } from "./sandbox.js";
-export { connect, credentials, } from "../../identity/github/index.js";
 export { provisionGitHubSandbox, buildGitHubProvisionScript, CLONE_FAILED_MARKDOWN, isBenignCheckoutFailure, GITHUB_TOKEN_REMOTE_PATH, GITHUB_PROVISION_REMOTE_PATH, } from "./sandbox.js";
+export { GITHUB_CHANNEL_REQUIRED_ENV, requiredGitHubPermissions, toGitHubChannelManifest, } from "./define.js";
+/** Sandbox-relative paths may not escape the workspace or be absolute. */
+const relativePath = (message) => z.string(message).refine(isSafeRelativePath, message);
+const repositoryCheckout = z
+    .object({
+    repo: z
+        .string()
+        .refine(isExactRepo, 'repo must look like "owner/repo"')
+        .optional(),
+    from: z.literal("event.repository").optional(),
+    path: relativePath("path must be a safe relative sandbox path"),
+    ref: z.string().optional(),
+    depth: z.int("depth must be >= 1").min(1, "depth must be >= 1").optional(),
+    sparsePaths: z
+        .array(relativePath("sparsePaths must be safe relative paths"))
+        .optional(),
+    submodules: z.boolean().optional(),
+    write: z.boolean().optional(),
+    onReuse: z
+        .enum(["keep", "reset", "fetch"], {
+        error: 'onReuse must be "keep", "reset", or "fetch"',
+    })
+        .optional(),
+})
+    .refine((repo) => repo.repo !== undefined || repo.from === "event.repository", 'requires `repo` or from: "event.repository"');
+const githubEventHandler = z.object({
+    on: z
+        .string('on must be a non-empty string (e.g. "pull_request", "pull_request.opened", or "*")')
+        .trim()
+        .min(1, 'on must be a non-empty string (e.g. "pull_request", "pull_request.opened", or "*")'),
+    repositories: z.array(z.string()).optional(),
+    autoReply: z.boolean().default(true),
+    prompt: z.custom((prompt) => typeof prompt === "function", "requires a `prompt` function"),
+});
 /**
- * Build the branded GitHub connector declaration.
+ * The GitHub connector's arguments: the gateway options, plus the sandbox ones.
  *
- * Validates authoring config and implements a `sandbox` hook so checkout / CLI /
- * credential provisioning runs through the public connector protocol.
+ * Checkout paths are the security-relevant part: they land in the sandbox, so
+ * each one must stay inside the workspace and no two may collide.
  */
-export function connector(config = {}) {
-    validateGitHubConnector(config);
-    const instance = {
-        [CONNECTOR_BRAND]: true,
-        kind: "github",
-        repositories: config.repositories ?? [],
-        installCLI: config.installCLI !== false,
-        injectCredentials: config.injectCredentials !== false,
-        async sandbox(ctx) {
-            await provisionGitHubSandbox(ctx.backend, instance, {
-                mode: ctx.mode,
-                config: ctx.config,
-                identity: ctx.identity,
-            });
-        },
-    };
-    return instance;
-}
-/** Validate a GitHub connector config without constructing a connector. */
-export function validateGitHubConnector(config) {
-    if (config === null || typeof config !== "object") {
-        throw new Error("github.connector(...) requires a config object.");
-    }
-    if (config.installCLI !== undefined &&
-        typeof config.installCLI !== "boolean") {
-        throw new Error("github.connector(...) installCLI must be a boolean.");
-    }
-    if (config.injectCredentials !== undefined &&
-        typeof config.injectCredentials !== "boolean") {
-        throw new Error("github.connector(...) injectCredentials must be a boolean.");
-    }
-    const seenPaths = new Set();
-    for (const repo of config.repositories ?? []) {
-        validateRepositoryCheckout(repo);
-        if (seenPaths.has(repo.path)) {
-            throw new Error(`github.connector(...) Duplicate repository checkout path "${repo.path}".`);
+const githubConnectorConfig = toolServerConnectorSchema({
+    repositories: z
+        .array(repositoryCheckout)
+        .check((ctx) => {
+        const seen = new Set();
+        for (const repo of ctx.value) {
+            if (seen.has(repo.path)) {
+                ctx.issues.push({
+                    code: "custom",
+                    input: ctx.value,
+                    message: `duplicate repository checkout path "${repo.path}"`,
+                });
+            }
+            seen.add(repo.path);
         }
-        seenPaths.add(repo.path);
-    }
+    })
+        .prefault([]),
+    installCLI: z.boolean().default(true),
+    injectCredentials: z.boolean().default(true),
+    events: z
+        .array(githubEventHandler)
+        .nonempty("requires a non-empty `events` array")
+        .optional(),
+}).transform(defaultToolsFromCLI);
+const githubTools = toolServerTools(GITHUB_SLUG, "connectors.github");
+function hide(target, key, value) {
+    Object.defineProperty(target, key, { value, enumerable: false });
 }
-function validateRepositoryCheckout(repo) {
-    if (repo === null || typeof repo !== "object") {
-        throw new Error("github.connector(...) repositories entries must be objects.");
-    }
-    if (repo.repo === undefined && repo.from !== "event.repository") {
-        throw new Error('github.connector(...) repository checkout requires `repo` or from: "event.repository".');
-    }
-    if (repo.repo !== undefined && !isExactRepo(repo.repo)) {
-        throw new Error(`github.connector(...) repo "${repo.repo}" must look like "owner/repo".`);
-    }
-    if (typeof repo.path !== "string" || !isSafeRelativePath(repo.path)) {
-        throw new Error(`github.connector(...) repository path "${String(repo.path)}" must be a safe relative sandbox path.`);
+/**
+ * Leave the integration's tools off when the sandbox has `gh`.
+ *
+ * The CLI and the tools are two routes to the same API, and an agent that can run
+ * `gh` does not need the integration's tool definitions in its prompt to reach the
+ * same endpoints. So the CLI — installed by default — implies no tools, and a
+ * project gets them by naming them or by dropping the CLI.
+ *
+ * Any explicit selection wins, including `excludeTools` on its own: asking for a
+ * tool is asking for it, whatever else is in the sandbox.
+ */
+function defaultToolsFromCLI(args) {
+    const selected = args.includeTools !== undefined || args.excludeTools !== undefined;
+    if (selected || !args.installCLI) {
+        return args;
     }
-    if (repo.depth !== undefined &&
-        (!Number.isInteger(repo.depth) || repo.depth < 1)) {
-        throw new Error("github.connector(...) repository depth must be >= 1.");
+    return { ...args, includeTools: [] };
+}
+/**
+ * Build the branded GitHub connector declaration.
+ *
+ * Sandbox + tools follow today's defaults. When {@link GitHubConnectorConfig.events}
+ * is set, Events / messaging / requirements hooks are attached as well.
+ *
+ * At least one of repositories, tool selection (`includeTools` /
+ * `excludeTools`), or `events` gives the connector a purpose beyond default
+ * sandbox provisioning — but an empty config remains valid (sandbox-only).
+ */
+export function githubConnector(config) {
+    const validate = githubConnectorConfig["~standard"].validate;
+    const result = validate(config);
+    if (result instanceof Promise) {
+        throw new TypeError("connectors.github(...) needs a schema that validates synchronously");
     }
-    if (repo.sparsePaths !== undefined &&
-        (!Array.isArray(repo.sparsePaths) ||
-            repo.sparsePaths.some((path) => !isSafeRelativePath(path)))) {
-        throw new Error("github.connector(...) sparsePaths must be safe relative paths.");
+    if (result.issues) {
+        const message = result.issues.map((issue) => issue.message).join("; ");
+        throw new Error(`connectors.github(...) ${message}`);
     }
-    if (repo.onReuse !== undefined &&
-        repo.onReuse !== "keep" &&
-        repo.onReuse !== "reset" &&
-        repo.onReuse !== "fetch") {
-        throw new Error('github.connector(...) onReuse must be "keep", "reset", or "fetch".');
+    const args = result.value;
+    // `events` is authoring-only: the Connector.events hook owns that property.
+    const { events: eventHandlers, ...rest } = args;
+    const self = { kind: "github", ...rest };
+    hide(self, CONNECTOR_BRAND, true);
+    hide(self, "tools", (ctx) => githubTools(ctx, self));
+    hide(self, "sandbox", async (ctx) => {
+        await provisionGitHubSandbox(ctx.backend, self, {
+            mode: ctx.mode,
+            config: ctx.config,
+            identity: ctx.identity,
+        });
+    });
+    if (eventHandlers !== undefined && eventHandlers.length > 0) {
+        const webhookConfig = {
+            events: eventHandlers,
+        };
+        hide(self, "events", (ctx) => handleGitHubEventsRequest(ctx.request, {
+            name: ctx.name,
+            config: webhookConfig,
+            definition: { config: webhookConfig },
+            rawBody: ctx.rawBody,
+        }));
+        hide(self, "messaging", (env) => transportFromEnv(env));
+        hide(self, "requirements", (name) => toGitHubRequirements(name, webhookConfig));
     }
+    return self;
+}
+/** Build deploy/runtime requirements for a file-derived connector name. */
+export function toGitHubRequirements(name, config) {
+    return {
+        name,
+        provider: "github",
+        ...toGitHubChannelManifest(config),
+        requiredEnv: [...GITHUB_CHANNEL_REQUIRED_ENV],
+    };
 }
 function isExactRepo(pattern) {
     const [owner, repo, extra] = pattern.split("/");
@@ -103,4 +183,10 @@ function isSafeRelativePath(path) {
     }
     return !path.split("/").some((part) => part === "..");
 }
+export { githubTriggerMatches, matchGitHubHandler } from "./match.js";
+export { verifyGitHubWebhookSignature, normalizeGitHubEvent, extractIssueOrPullNumber, GITHUB_WEBHOOK_SECRET_ENV, } from "./normalize.js";
+export { createGitHubAppTransport, transportFromEnv, GITHUB_APP_ID_ENV, GITHUB_APP_PRIVATE_KEY_ENV, GITHUB_INSTALLATION_ID_ENV, } from "./transport.js";
+export { encodeGitHubSourceThreadKey, decodeGitHubSourceThreadKey, } from "./source-thread.js";
+export { handleGitHubEventsRequest } from "./http.js";
+export { githubChannelAdapter, githubConfigFromManifest, } from "./adapter-core.js";
 //# sourceMappingURL=index.js.map

package/dist/connectors/github/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,eAAe,GAGhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,OAAO,EACP,WAAW,GAMZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAgEtB;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAM,GAA0B,EAAE;IAC1D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAoB;QAChC,CAAC,eAAe,CAAC,EAAE,IAAI;QACvB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,KAAK;QACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,KAAK,KAAK;QACrD,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,OAAO,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,6DAA6D,IAAI,CAAC,IAAI,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAA8B;IAChE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,IAAI,gCAAgC,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAC9C,IAAI,CAAC,IAAI,CACV,yCAAyC,CAC3C,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,SAAS;QAC1B,IAAI,CAAC,OAAO,KAAK,MAAM;QACvB,IAAI,CAAC,OAAO,KAAK,OAAO;QACxB,IAAI,CAAC,OAAO,KAAK,OAAO,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,GAIxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,eAAe,GAKhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,eAAe,GAEhB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAetB,OAAO,EACL,2BAA2B,EAC3B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAsFrB,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,EAAE,CACvC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AAExD,MAAM,kBAAkB,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,MAAM,CAAC,WAAW,EAAE,kCAAkC,CAAC;SACvD,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC,2CAA2C,CAAC;IAC/D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAC1E,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,YAAY,CAAC,yCAAyC,CAAC,CAAC;SAC9D,QAAQ,EAAE;IACb,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC;SACP,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAChC,KAAK,EAAE,6CAA6C;KACrD,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,CACL,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EACrE,6CAA6C,CAC9C,CAAC;AAEJ,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,EAAE,EAAE,CAAC;SACF,MAAM,CACL,oFAAoF,CACrF;SACA,IAAI,EAAE;SACN,GAAG,CACF,CAAC,EACD,oFAAoF,CACrF;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,CACd,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,UAAU,EACxC,8BAA8B,CAC/B;CACF,CAAC,CAAC;AAaH;;;;;GAKG;AACH,MAAM,qBAAqB,GAGvB,yBAAyB,CAG3B;IACA,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,kBAAkB,CAAC;SACzB,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,OAAO,EAAE,uCAAuC,IAAI,CAAC,IAAI,GAAG;iBAC7D,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;SACD,QAAQ,CAAC,EAAE,CAAC;IACf,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACrC,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,kBAAkB,CAAC;SACzB,QAAQ,CAAC,qCAAqC,CAAC;SAC/C,QAAQ,EAAE;CACd,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC;AAE3C,MAAM,WAAW,GAAG,eAAe,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;AAEtE,SAAS,IAAI,CAAC,MAAc,EAAE,GAAoB,EAAE,KAAc;IAChE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,IAAyB;IACpD,MAAM,QAAQ,GACZ,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;IACrE,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA8B;IAE9B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;IAC1B,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,GAAG,IAAI,EAAqB,CAAC;IACrE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;IAElC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAmB,EAAE,EAAE;QAClD,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE;YAC9C,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,aAAa,GAAgC;YACjD,MAAM,EAAE,aAAa;SACtB,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,GAAkB,EAAE,EAAE,CAC1C,yBAAyB,CAAC,GAAG,CAAC,OAAO,EAAE;YACrC,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;YACrC,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC,CACH,CAAC;QACF,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,GAAsB,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,IAAY,EAAE,EAAE,CAC1C,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,MAAmC;IAEnC,OAAO;QACL,IAAI;QACJ,QAAQ,EAAE,QAAQ;QAClB,GAAG,uBAAuB,CAAC,MAAM,CAAC;QAClC,WAAW,EAAE,CAAC,GAAG,2BAA2B,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,wBAAwB,EACxB,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EACL,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC"}

package/dist/connectors/github/match.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Pure GitHub handler routing — kept out of `define.ts` so normalize/http can
+ * load without pulling the channel authoring module (and its adapter) back in.
+ */
+import type { RequiredGitHubChannelConfig, RequiredGitHubChannelHandler } from "./define.js";
+/**
+ * Whether a handler `on` filter matches a delivery.
+ *
+ * @param on - `"*"`, `"pull_request"`, or `"pull_request.opened"`
+ * @param eventName - `X-GitHub-Event`
+ * @param action - `payload.action` when present
+ */
+export declare function githubTriggerMatches(on: string, eventName: string, action?: string): boolean;
+/**
+ * Find the first handler that matches event/action + repository.
+ *
+ * @returns The handler, or `undefined` when no handler matches (event ignored).
+ */
+export declare function matchGitHubHandler(config: RequiredGitHubChannelConfig, eventName: string, repository: string | undefined, action?: string): RequiredGitHubChannelHandler | undefined;
+//# sourceMappingURL=match.d.ts.map

package/dist/connectors/github/match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/match.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,aAAa,CAAC;AAErB;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,2BAA2B,EACnC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,EAAE,MAAM,GACd,4BAA4B,GAAG,SAAS,CAU1C"}

package/dist/connectors/github/match.js

@@ -0,0 +1,41 @@
+/**
+ * Pure GitHub handler routing — kept out of `define.ts` so normalize/http can
+ * load without pulling the channel authoring module (and its adapter) back in.
+ */
+/**
+ * Whether a handler `on` filter matches a delivery.
+ *
+ * @param on - `"*"`, `"pull_request"`, or `"pull_request.opened"`
+ * @param eventName - `X-GitHub-Event`
+ * @param action - `payload.action` when present
+ */
+export function githubTriggerMatches(on, eventName, action) {
+    if (!on || !eventName)
+        return false;
+    if (on === "*")
+        return true;
+    if (on === eventName)
+        return true;
+    if (action !== undefined && on === `${eventName}.${action}`)
+        return true;
+    return false;
+}
+/**
+ * Find the first handler that matches event/action + repository.
+ *
+ * @returns The handler, or `undefined` when no handler matches (event ignored).
+ */
+export function matchGitHubHandler(config, eventName, repository, action) {
+    for (const handler of config.events) {
+        if (!githubTriggerMatches(handler.on, eventName, action))
+            continue;
+        const repos = handler.repositories;
+        if (repos && repos.length > 0) {
+            if (!repository || !repos.includes(repository))
+                continue;
+        }
+        return handler;
+    }
+    return undefined;
+}
+//# sourceMappingURL=match.js.map

package/dist/connectors/github/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../../src/connectors/github/match.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,EAAU,EACV,SAAiB,EACjB,MAAe;IAEf,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,EAAE,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,EAAE,KAAK,GAAG,SAAS,IAAI,MAAM,EAAE;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmC,EACnC,SAAiB,EACjB,UAA8B,EAC9B,MAAe;IAEf,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC;YAAE,SAAS;QACnE,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;QACnC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,SAAS;QAC3D,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/{channels → connectors}/github/normalize.d.ts

@@ -1,7 +1,7 @@
 /**
  * GitHub App webhook verify + normalize into {@link ChannelEvent}.
  */
-import type { ChannelEvent } from "../types.js";
+import type { ChannelEvent } from "../../channels/types.js";
 import type { GitHubWebhookPromptEvent, RequiredGitHubChannelConfig, RequiredGitHubChannelHandler } from "./define.js";
 export declare const GITHUB_WEBHOOK_SECRET_ENV = "GITHUB_WEBHOOK_SECRET";
 export interface GitHubNormalizeResult {

package/dist/connectors/github/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/normalize.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,aAAa,CAAC;AAIrB,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,YAAY,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,4BAA4B,CAAC;IACvC,sEAAsE;IACtE,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,MAAM,GAAG,UAAU,EAC5B,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,GACb,IAAI,CA0BN;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,OAAO,EACb,OAAO,EAAE;IACP,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB,EACD,MAAM,EAAE,2BAA2B,EACnC,sBAAsB,CAAC,EAAE,MAAM,GAC9B,qBAAqB,CAgGvB;AAED,sEAAsE;AACtE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,MAAM,GAAG,SAAS,CAMpB"}

package/dist/{channels → connectors}/github/normalize.js

@@ -3,8 +3,8 @@
  */
 import { createHmac, timingSafeEqual } from "node:crypto";
 import { randomUUID } from "node:crypto";
-import { ChannelError } from "../errors.js";
-import { matchGitHubHandler } from "./define.js";
+import { ChannelError } from "../../channels/errors.js";
+import { matchGitHubHandler } from "./match.js";
 import { encodeGitHubSourceThreadKey } from "./source-thread.js";
 export const GITHUB_WEBHOOK_SECRET_ENV = "GITHUB_WEBHOOK_SECRET";
 /**

package/dist/connectors/github/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/connectors/github/normalize.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAOxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAEjE,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAajE;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA4B,EAC5B,eAAuB,EACvB,MAAc;IAEd,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,yCAAyC,CAC1C,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC;IACjC,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,wCAAwC,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GACR,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,YAAY,CACpB,2BAA2B,EAC3B,mCAAmC,CACpC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAa,EACb,OAGC,EACD,MAAmC,EACnC,sBAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,cAAc,GAClB,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QAC/C,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,KAAK,SAAS;YAC5D,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,SAAS,CAAC;QACd,sBAAsB;QACtB,SAAS,CAAC;IAEZ,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,UAAU,GACd,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;QAC9C,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC;IACZ,MAAM,QAAQ,GACZ,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5B,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAChD,SAAS,CAAC;IACZ,MAAM,QAAQ,GACZ,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;QACjC,CAAC,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErE,MAAM,OAAO,GAAG,kBAAkB,CAChC,MAAM,EACN,OAAO,CAAC,SAAS,EACjB,QAAQ,EACR,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GACX,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAE9E,MAAM,WAAW,GAA6B;QAC5C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,EAAE,IAAI;KACd,CAAC;IAEF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,cAAc,GAClB,UAAU,IAAI,QAAQ,IAAI,iBAAiB,KAAK,SAAS;QACvD,CAAC,CAAC,GAAG,UAAU,IAAI,QAAQ,IAAI,iBAAiB,EAAE;QAClD,CAAC,CAAC,CAAC,QAAQ,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvC,MAAM,eAAe,GAAG,2BAA2B,CAAC;QAClD,cAAc,EAAE,cAAc,IAAI,SAAS;QAC3C,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,iBAAiB;QACzB,UAAU,EAAE,OAAO,CAAC,UAAU;KAC/B,CAAC,CAAC;IAEH,OAAO;QACL,OAAO;QACP,eAAe;QACf,OAAO;QACP,WAAW;QACX,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE,OAAO,CAAC,UAAU;YAC3B,IAAI,EAAE,OAAO;YACb,OAAO,EAAE;gBACP,cAAc;gBACd,GAAG,CAAC,iBAAiB,KAAK,SAAS;oBACjC,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE;oBAC9B,CAAC,CAAC,EAAE,CAAC;aACR;YACD,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;YAC1D,MAAM,EAAE;gBACN,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE;oBACP,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,GAAG,CAAC,cAAc,KAAK,SAAS;wBAC9B,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;wBAC1C,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CACtC,OAAgC;IAEhC,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,cAAsB;IAC3C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,SAAS;QAClB,eAAe,EAAE,EAAE;QACnB,KAAK,EAAE;YACL,UAAU,EAAE,UAAU,EAAE;YACxB,OAAO,EAAE,cAAc;YACvB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE;SAChC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAChD,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/connectors/github/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAmB,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,EAAE,SAAS,CAAC,GAC1E,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzD,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACvE,MAAM,CA8CR;AAED,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,QAAQ,GAAG,UAAU,CAAC,GAClE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqD7B;AAsMD,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAiGvD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMjE;AAkCD,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAI/D"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAmB,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AAQjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,EAAE,SAAS,CAAC,GAC1E,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzD,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACvE,MAAM,CAuDR;AAED,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,QAAQ,GAAG,UAAU,CAAC,GAClE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqD7B;AAuMD,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAiGvD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMjE;AAuCD,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAI/D"}

package/dist/connectors/github/sandbox.js

@@ -5,10 +5,11 @@
  * declared repositories. When a thread starts against a reused sandbox, refresh
  * credentials and apply each checkout's `onReuse` policy (default `fetch`).
  */
-import { defaultResolveActorToken } from "../../identity/github/credentials.js";
+import { defaultResolveUserToken } from "../../identity/github/credentials.js";
 import { createCredentialsProvider } from "../../runtime/credentials.js";
 import { buildRuntimeIdentity, resolveRuntimeConfigurable, } from "../../runtime/identity-runtime.js";
 import { assertSetupSucceeded } from "../../runtime/setup-script.js";
+import { executeWithStreamRetry } from "../../runtime/sandbox-stream-retry.js";
 /** Absolute paths used for GitHub provisioning artifacts inside the sandbox. */
 export const GITHUB_TOKEN_REMOTE_PATH = "/tmp/mda-gh-token";
 export const GITHUB_PROVISION_REMOTE_PATH = "/tmp/mda-github-provision.sh";
@@ -50,11 +51,11 @@ export async function provisionGitHubSandbox(backend, connector, options) {
         const configurable = resolveRuntimeConfigurable({
             configurable: options.config?.configurable,
         });
-        const actorId = buildRuntimeIdentity(configurable)?.actor.id;
+        const actorId = buildRuntimeIdentity(configurable)?.user.id;
         const slackHint = typeof actorId === "string" && actorId.startsWith("slack:")
             ? " Slack is running as an unlinked Slack actor — Connect Slack in the app UI while signed in, then Connect GitHub on that same account."
             : " Connect GitHub for this actor in the app UI (same account Slack is linked to), or set GITHUB_TOKEN.";
-        throw new Error("github.connector(...): cannot clone repositories without GitHub credentials" +
+        throw new Error("connectors.github(...): cannot clone repositories without GitHub credentials" +
             ` (actor=${actorId ?? "none"}).${slackHint}`);
     }
     const script = buildGitHubProvisionScript(connector, {
@@ -79,11 +80,10 @@ export function buildGitHubProvisionScript(connector, options) {
         // Same-thread refresh: rewrite token + gh wrapper only. Skip apt/git
         // install and `gh api user` identity probes so we don't add latency (or
         // another sandbox round-trip that can 502) on every message.
-        if (connector.injectCredentials && options.hasToken) {
-            lines.push(...injectCredentialsScriptLines({ light: true }));
-        }
-        else if (connector.injectCredentials) {
-            lines.push(...clearInjectedCredentialsScriptLines());
+        if (connector.injectCredentials) {
+            lines.push(...(options.hasToken
+                ? injectCredentialsScriptLines({ light: true })
+                : clearInjectedCredentialsScriptLines()));
         }
         return `${lines.join("\n")}\n`;
     }
@@ -95,8 +95,13 @@ export function buildGitHubProvisionScript(connector, options) {
     if (needsGit) {
         lines.push(...ensureGitScriptLines());
     }
-    if (connector.injectCredentials && options.hasToken) {
-        lines.push(...injectCredentialsScriptLines());
+    // Fail closed on every mode: a sandbox reused by a new thread can still hold
+    // the previous actor's token, so an actor without one must clear it before
+    // any checkout sync runs.
+    if (connector.injectCredentials) {
+        lines.push(...(options.hasToken
+            ? injectCredentialsScriptLines()
+            : clearInjectedCredentialsScriptLines()));
     }
     for (const repo of connector.repositories) {
         if (!repo.repo) {
@@ -122,14 +127,14 @@ export async function resolveSandboxGitHubToken(connector, options) {
     });
     const runtimeIdentity = buildRuntimeIdentity(configurable);
     const repoHint = firstStaticRepo(connector);
-    if (identityConfig?.scoping.credentials === "custom" &&
+    if (identityConfig?.scope.credentials === "custom" &&
         identityConfig.credentials &&
         runtimeIdentity) {
         // Connect-with-GitHub vault first — same path tools use for write: ["actor"].
         // Do this before provider.for so a missing PAT / installation source cannot
         // mask a vault hit, and vault/store errors surface instead of being swallowed.
         try {
-            const vaultToken = await defaultResolveActorToken({
+            const vaultToken = await defaultResolveUserToken({
                 identity: runtimeIdentity,
                 scopes: ["repo"],
             });
@@ -138,8 +143,8 @@ export async function resolveSandboxGitHubToken(connector, options) {
         }
         catch (err) {
             const detail = err instanceof Error ? err.message : String(err);
-            throw new Error(`github.connector(...): failed to read Connect-with-GitHub credentials` +
-                ` (actor=${runtimeIdentity.actor.id}): ${detail}`);
+            throw new Error(`connectors.github(...): failed to read Connect-with-GitHub credentials` +
+                ` (actor=${runtimeIdentity.user.id}): ${detail}`);
         }
         const provider = createCredentialsProvider(identityConfig, runtimeIdentity);
         if (provider) {
@@ -229,7 +234,7 @@ function installCLIScriptLines() {
         "  elif command -v brew >/dev/null 2>&1; then",
         "    brew install gh",
         "  else",
-        '    echo "github.connector(...): unable to install gh CLI" >&2',
+        '    echo "connectors.github(...): unable to install gh CLI" >&2',
         "    exit 1",
         "  fi",
         "fi",
@@ -248,7 +253,7 @@ function ensureGitScriptLines() {
         "  elif command -v brew >/dev/null 2>&1; then",
         "    brew install git",
         "  else",
-        '    echo "github.connector(...): git is required to checkout repositories" >&2',
+        '    echo "connectors.github(...): git is required to checkout repositories" >&2',
         "    exit 1",
         "  fi",
         "fi",
@@ -257,9 +262,10 @@ function ensureGitScriptLines() {
 /**
  * Remove previously injected GitHub credentials from a reused sandbox.
  *
- * Thread-scoped sandboxes are shared across Slack users in the same thread; when
- * the current actor has no token we must clear any prior actor's token file /
- * gh auth / git helpers before returning.
+ * Thread-scoped sandboxes are shared across Slack users in the same thread, and
+ * agent-scoped sandboxes are shared across every thread and actor; when the
+ * current actor has no token we must clear any prior actor's token file / gh
+ * auth / git helpers before returning.
  */
 function clearInjectedCredentialsScriptLines() {
     return [
@@ -380,7 +386,7 @@ function cloneRepositoryScriptLines(repo) {
     // Use `if ! clone; then …; else …; fi` so the failure branch is valid even
     // when there is no post-clone work (empty `then` before `else` is a syntax error).
     lines.push(`  if ! git clone "\${CLONE_ARGS[@]}" ${remote} ${path}; then`);
-    lines.push(`    rm -rf ${path}`, `    mkdir -p ${path}`, `    cat > ${noticePath} <<'MDA_CLONE_FAILED_EOF'`, "# Repository clone failed", "", `MDA could not clone ${repoLabel} into this directory.`, "", "Common causes:", "- the branch/ref does not exist on the remote (omit ref to use the default branch)", "- the repository is private and Connect-with-GitHub / GITHUB_TOKEN cannot access it", "- the repository name is wrong or was renamed", "- network / GitHub availability issues", "", "The agent run continued without this checkout. Fix access (or set", "MDA_GITHUB_CHECKOUT_REPO to a repo you can read), then start a new thread", "so the sandbox is reprovisioned.", "MDA_CLONE_FAILED_EOF", `    echo "github.connector(...): clone failed for ${repoLabel}; wrote ${CLONE_FAILED_MARKDOWN}" >&2`);
+    lines.push(`    rm -rf ${path}`, `    mkdir -p ${path}`, `    cat > ${noticePath} <<'MDA_CLONE_FAILED_EOF'`, "# Repository clone failed", "", `MDA could not clone ${repoLabel} into this directory.`, "", "Common causes:", "- the branch/ref does not exist on the remote (omit ref to use the default branch)", "- the repository is private and Connect-with-GitHub / GITHUB_TOKEN cannot access it", "- the repository name is wrong or was renamed", "- network / GitHub availability issues", "", "The agent run continued without this checkout. Fix access (or set", "MDA_GITHUB_CHECKOUT_REPO to a repo you can read), then start a new thread", "so the sandbox is reprovisioned.", "MDA_CLONE_FAILED_EOF", `    echo "connectors.github(...): clone failed for ${repoLabel}; wrote ${CLONE_FAILED_MARKDOWN}" >&2`);
     if ((repo.sparsePaths && repo.sparsePaths.length > 0) || repo.submodules) {
         lines.push("  else");
         if (repo.sparsePaths && repo.sparsePaths.length > 0) {
@@ -406,7 +412,7 @@ function reuseRepositoryScriptLines(repo) {
     const lines = [
         `if [ -d ${path}/.git ]; then`,
         // Soft-fail refresh so a stale remote cannot abort the run.
-        `  git -C ${path} fetch --prune origin ${quotedRef} || echo "github.connector(...): fetch failed for ${path}" >&2`,
+        `  git -C ${path} fetch --prune origin ${quotedRef} || echo "connectors.github(...): fetch failed for ${path}" >&2`,
     ];
     if (onReuse === "reset") {
         lines.push(`  git -C ${path} checkout -f ${quotedRef} || true`, `  git -C ${path} reset --hard FETCH_HEAD || true`);
@@ -441,10 +447,11 @@ async function uploadAndRun(backend, connector, script, extraFiles = []) {
     let result;
     if (typeof backend.uploadFiles === "function") {
         await backend.uploadFiles(files);
-        result = (await backend.execute(`bash ${GITHUB_PROVISION_REMOTE_PATH}`));
+        // Fresh sandboxes often reject the first websocket execute; retry in place.
+        result = (await executeWithStreamRetry((command) => backend.execute(command), `bash ${GITHUB_PROVISION_REMOTE_PATH}`));
     }
     else {
-        result = (await backend.execute(script));
+        result = (await executeWithStreamRetry((command) => backend.execute(command), script));
     }
     if (typeof result.exitCode === "number" && result.exitCode !== 0) {
         // Clone/ref failures must not abort the agent run. Leave notice files and