opencara 0.18.5 → 0.18.6

package/dist/index.js

@@ -16,15 +16,24 @@ function isDedupRole(role) {
 function isTriageRole(role) {
   return role === "pr_triage" || role === "issue_triage";
 }
-function isRepoAllowed(repoConfig, targetOwner, targetRepo, agentOwner) {
+function isRepoAllowed(repoConfig, targetOwner, targetRepo, agentOwner, userOrgs) {
   if (!repoConfig)
     return true;
   const fullRepo = `${targetOwner}/${targetRepo}`;
   switch (repoConfig.mode) {
     case "public":
       return true;
-    case "private":
-      return agentOwner === targetOwner;
+    case "private": {
+      const normalizedTarget = targetOwner.toLowerCase();
+      const normalizedOwner = agentOwner?.toLowerCase();
+      const hasAccess = normalizedOwner === normalizedTarget || userOrgs != null && userOrgs.has(normalizedTarget);
+      if (!hasAccess)
+        return false;
+      if (repoConfig.list && repoConfig.list.length > 0) {
+        return repoConfig.list.includes(fullRepo);
+      }
+      return true;
+    }
     case "whitelist":
       return (repoConfig.list ?? []).includes(fullRepo);
     case "blacklist":
@@ -1189,6 +1198,30 @@ async function resolveUser(token, fetchFn = fetch) {
   }
   return { login: data.login, id: data.id };
 }
+async function fetchUserOrgs(token, fetchFn = fetch) {
+  try {
+    const res = await fetchFn("https://api.github.com/user/orgs?per_page=100", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28"
+      }
+    });
+    if (!res.ok) {
+      return /* @__PURE__ */ new Set();
+    }
+    const data = await res.json();
+    const orgs = /* @__PURE__ */ new Set();
+    for (const org of data) {
+      if (typeof org.login === "string") {
+        orgs.add(org.login.toLowerCase());
+      }
+    }
+    return orgs;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
 
 // src/http.ts
 var HttpError = class extends Error {
@@ -3207,7 +3240,9 @@ async function pollLoop(client, agentId, reviewDeps, consumptionDeps, agentInfo,
     synthesizeRepos,
     signal,
     cleanupTracker,
-    verbose
+    verbose,
+    agentOwner,
+    userOrgs
   } = options;
   const { log, logError, logWarn } = logger;
   log(`${icons.polling} Polling every ${pollIntervalMs / 1e3}s...`);
@@ -3239,7 +3274,9 @@ async function pollLoop(client, agentId, reviewDeps, consumptionDeps, agentInfo,
       const pollResponse = await client.post("/api/tasks/poll", pollBody);
       consecutiveAuthErrors = 0;
       consecutiveErrors = 0;
-      const eligibleTasks = repoConfig ? pollResponse.tasks.filter((t) => isRepoAllowed(repoConfig, t.owner, t.repo)) : pollResponse.tasks;
+      const eligibleTasks = repoConfig ? pollResponse.tasks.filter(
+        (t) => isRepoAllowed(repoConfig, t.owner, t.repo, agentOwner, userOrgs)
+      ) : pollResponse.tasks;
       const task = eligibleTasks.find(
         (t) => (diffFailCounts.get(t.task_id) ?? 0) < MAX_DIFF_FETCH_ATTEMPTS
       );
@@ -3904,7 +3941,7 @@ function sleep2(ms, signal) {
 async function startAgent(agentId, platformUrl, agentInfo, reviewDeps, consumptionDeps, options) {
   const client = new ApiClient(platformUrl, {
     authToken: options?.authToken,
-    cliVersion: "0.18.5",
+    cliVersion: "0.18.6",
     versionOverride: options?.versionOverride,
     onTokenRefresh: options?.onTokenRefresh
   });
@@ -3972,7 +4009,9 @@ async function startAgent(agentId, platformUrl, agentInfo, reviewDeps, consumpti
     synthesizeRepos: options?.synthesizeRepos,
     signal: abortController.signal,
     cleanupTracker,
-    verbose: options?.verbose
+    verbose: options?.verbose,
+    agentOwner: options?.agentOwner,
+    userOrgs: options?.userOrgs
   });
   if (cleanupTracker && cleanupTracker.size > 0) {
     const finalSwept = await cleanupTracker.sweep(cleanupWorktree);
@@ -4014,9 +4053,12 @@ async function startAgentRouter() {
     throw err;
   }
   const storedAuth = loadAuth();
+  const agentOwner = storedAuth?.github_username;
   if (storedAuth) {
     logger.log(`Authenticated as ${storedAuth.github_username}`);
   }
+  const repoConfig = agentConfig?.repos;
+  const userOrgs = repoConfig?.mode === "private" ? await fetchUserOrgs(oauthToken) : /* @__PURE__ */ new Set();
   const codebaseDir = resolveCodebaseDir(agentConfig?.codebase_dir, config.codebaseDir);
   const reviewDeps = {
     commandTemplate: commandTemplate ?? "",
@@ -4046,12 +4088,14 @@ async function startAgentRouter() {
       maxConsecutiveErrors: config.maxConsecutiveErrors,
       routerRelay: router,
       reviewOnly: agentConfig?.review_only,
-      repoConfig: agentConfig?.repos,
+      repoConfig,
       roles,
       synthesizeRepos: agentConfig?.synthesize_repos,
       label,
       authToken: oauthToken,
       onTokenRefresh: () => getValidToken(config.platformUrl),
+      agentOwner,
+      userOrgs,
       usageLimits: config.usageLimits,
       versionOverride,
       codebaseTtl: config.codebaseTtl
@@ -4059,7 +4103,7 @@ async function startAgentRouter() {
   );
   router.stop();
 }
-function startAgentByIndex(config, agentIndex, pollIntervalMs, oauthToken, versionOverride, verbose, instancesOverride) {
+function startAgentByIndex(config, agentIndex, pollIntervalMs, oauthToken, versionOverride, verbose, instancesOverride, agentOwner, userOrgs) {
   let commandTemplate;
   let agentConfig;
   if (config.agents && config.agents.length > agentIndex) {
@@ -4122,7 +4166,9 @@ function startAgentByIndex(config, agentIndex, pollIntervalMs, oauthToken, versi
         usageLimits: config.usageLimits,
         versionOverride,
         codebaseTtl: config.codebaseTtl,
-        verbose
+        verbose,
+        agentOwner,
+        userOrgs
       }
     ).finally(() => {
       routerRelay?.stop();
@@ -4161,9 +4207,12 @@ agentCommand.command("start").description("Start agents in polling mode").option
       throw err;
     }
     const storedAuth = loadAuth();
+    const agentOwner = storedAuth?.github_username;
     if (storedAuth) {
       console.log(`Authenticated as ${storedAuth.github_username}`);
     }
+    const needsOrgs = config.agents?.some((a) => a.repos?.mode === "private") ?? false;
+    const userOrgs = needsOrgs ? await fetchUserOrgs(oauthToken) : /* @__PURE__ */ new Set();
     if (opts.all) {
       if (!config.agents || config.agents.length === 0) {
         console.error("No agents configured in ~/.opencara/config.toml");
@@ -4181,7 +4230,9 @@ agentCommand.command("start").description("Start agents in polling mode").option
           oauthToken,
           versionOverride,
           opts.verbose,
-          instancesOverride
+          instancesOverride,
+          agentOwner,
+          userOrgs
         );
         if (agentPromises) {
           promises.push(...agentPromises);
@@ -4226,7 +4277,9 @@ agentCommand.command("start").description("Start agents in polling mode").option
         oauthToken,
         versionOverride,
         opts.verbose,
-        instancesOverride
+        instancesOverride,
+        agentOwner,
+        userOrgs
       );
       if (!agentPromises) {
         process.exit(1);
@@ -4942,7 +4995,7 @@ var statusCommand = new Command4("status").description("Show agent config, conne
 });
 
 // src/index.ts
-var program = new Command5().name("opencara").description("OpenCara \u2014 distributed AI code review agent").version("0.18.5");
+var program = new Command5().name("opencara").description("OpenCara \u2014 distributed AI code review agent").version("0.18.6");
 program.addCommand(agentCommand);
 program.addCommand(authCommand());
 program.addCommand(dedupCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencara",
-  "version": "0.18.5",
+  "version": "0.18.6",
   "description": "Distributed AI code review agent — poll, review, and submit PR reviews using your own AI tools",
   "type": "module",
   "license": "MIT",