opencara 0.18.5 → 0.18.7

package/dist/index.js

@@ -16,15 +16,24 @@ function isDedupRole(role) {
 function isTriageRole(role) {
   return role === "pr_triage" || role === "issue_triage";
 }
-function isRepoAllowed(repoConfig, targetOwner, targetRepo, agentOwner) {
+function isRepoAllowed(repoConfig, targetOwner, targetRepo, agentOwner, userOrgs) {
   if (!repoConfig)
     return true;
   const fullRepo = `${targetOwner}/${targetRepo}`;
   switch (repoConfig.mode) {
     case "public":
       return true;
-    case "private":
-      return agentOwner === targetOwner;
+    case "private": {
+      const normalizedTarget = targetOwner.toLowerCase();
+      const normalizedOwner = agentOwner?.toLowerCase();
+      const hasAccess = normalizedOwner === normalizedTarget || userOrgs != null && userOrgs.has(normalizedTarget);
+      if (!hasAccess)
+        return false;
+      if (repoConfig.list && repoConfig.list.length > 0) {
+        return repoConfig.list.includes(fullRepo);
+      }
+      return true;
+    }
     case "whitelist":
       return (repoConfig.list ?? []).includes(fullRepo);
     case "blacklist":
@@ -978,6 +987,7 @@ import * as fs5 from "fs";
 import * as path5 from "path";
 import * as os2 from "os";
 import * as crypto from "crypto";
+import { execFileSync as execFileSync3 } from "child_process";
 var AUTH_DIR = path5.join(os2.homedir(), ".opencara");
 function getAuthFilePath() {
   const envPath = process.env.OPENCARA_AUTH_FILE?.trim();
@@ -1189,6 +1199,59 @@ async function resolveUser(token, fetchFn = fetch) {
   }
   return { login: data.login, id: data.id };
 }
+async function fetchUserOrgs(token, fetchFn = fetch, expectedLogin) {
+  const ghOrgs = fetchUserOrgsViaGh(expectedLogin);
+  if (ghOrgs.size > 0) return ghOrgs;
+  try {
+    const res = await fetchFn("https://api.github.com/user/orgs?per_page=100", {
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28"
+      }
+    });
+    if (!res.ok) {
+      return /* @__PURE__ */ new Set();
+    }
+    const data = await res.json();
+    const orgs = /* @__PURE__ */ new Set();
+    for (const org of data) {
+      if (typeof org.login === "string") {
+        orgs.add(org.login.toLowerCase());
+      }
+    }
+    return orgs;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function fetchUserOrgsViaGh(expectedLogin) {
+  try {
+    if (expectedLogin) {
+      const ghUser = execFileSync3("gh", ["api", "/user", "--jq", ".login"], {
+        encoding: "utf-8",
+        timeout: 1e4,
+        stdio: ["ignore", "pipe", "pipe"]
+      }).trim();
+      if (ghUser.toLowerCase() !== expectedLogin.toLowerCase()) {
+        return /* @__PURE__ */ new Set();
+      }
+    }
+    const output = execFileSync3("gh", ["api", "/user/orgs", "--paginate", "--jq", ".[].login"], {
+      encoding: "utf-8",
+      timeout: 15e3,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const orgs = /* @__PURE__ */ new Set();
+    for (const line of output.trim().split("\n")) {
+      const name = line.trim();
+      if (name) orgs.add(name.toLowerCase());
+    }
+    return orgs;
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
 
 // src/http.ts
 var HttpError = class extends Error {
@@ -1396,7 +1459,7 @@ function sleep(ms, signal) {
 }
 
 // src/tool-executor.ts
-import { spawn, execFileSync as execFileSync3 } from "child_process";
+import { spawn, execFileSync as execFileSync4 } from "child_process";
 import * as fs6 from "fs";
 import * as path6 from "path";
 var ToolTimeoutError = class extends Error {
@@ -1421,9 +1484,9 @@ function validateCommandBinary(commandTemplate) {
   try {
     const isWindows = process.platform === "win32";
     if (isWindows) {
-      execFileSync3("where", [command], { stdio: "pipe" });
+      execFileSync4("where", [command], { stdio: "pipe" });
     } else {
-      execFileSync3("sh", ["-c", 'command -v -- "$1"', "_", command], { stdio: "pipe" });
+      execFileSync4("sh", ["-c", 'command -v -- "$1"', "_", command], { stdio: "pipe" });
     }
     return true;
   } catch {
@@ -3207,7 +3270,9 @@ async function pollLoop(client, agentId, reviewDeps, consumptionDeps, agentInfo,
     synthesizeRepos,
     signal,
     cleanupTracker,
-    verbose
+    verbose,
+    agentOwner,
+    userOrgs
   } = options;
   const { log, logError, logWarn } = logger;
   log(`${icons.polling} Polling every ${pollIntervalMs / 1e3}s...`);
@@ -3239,7 +3304,9 @@ async function pollLoop(client, agentId, reviewDeps, consumptionDeps, agentInfo,
       const pollResponse = await client.post("/api/tasks/poll", pollBody);
       consecutiveAuthErrors = 0;
       consecutiveErrors = 0;
-      const eligibleTasks = repoConfig ? pollResponse.tasks.filter((t) => isRepoAllowed(repoConfig, t.owner, t.repo)) : pollResponse.tasks;
+      const eligibleTasks = repoConfig ? pollResponse.tasks.filter(
+        (t) => isRepoAllowed(repoConfig, t.owner, t.repo, agentOwner, userOrgs)
+      ) : pollResponse.tasks;
       const task = eligibleTasks.find(
         (t) => (diffFailCounts.get(t.task_id) ?? 0) < MAX_DIFF_FETCH_ATTEMPTS
       );
@@ -3904,7 +3971,7 @@ function sleep2(ms, signal) {
 async function startAgent(agentId, platformUrl, agentInfo, reviewDeps, consumptionDeps, options) {
   const client = new ApiClient(platformUrl, {
     authToken: options?.authToken,
-    cliVersion: "0.18.5",
+    cliVersion: "0.18.7",
     versionOverride: options?.versionOverride,
     onTokenRefresh: options?.onTokenRefresh
   });
@@ -3972,7 +4039,9 @@ async function startAgent(agentId, platformUrl, agentInfo, reviewDeps, consumpti
     synthesizeRepos: options?.synthesizeRepos,
     signal: abortController.signal,
     cleanupTracker,
-    verbose: options?.verbose
+    verbose: options?.verbose,
+    agentOwner: options?.agentOwner,
+    userOrgs: options?.userOrgs
   });
   if (cleanupTracker && cleanupTracker.size > 0) {
     const finalSwept = await cleanupTracker.sweep(cleanupWorktree);
@@ -4014,9 +4083,12 @@ async function startAgentRouter() {
     throw err;
   }
   const storedAuth = loadAuth();
+  const agentOwner = storedAuth?.github_username;
   if (storedAuth) {
     logger.log(`Authenticated as ${storedAuth.github_username}`);
   }
+  const repoConfig = agentConfig?.repos;
+  const userOrgs = repoConfig?.mode === "private" ? await fetchUserOrgs(oauthToken) : /* @__PURE__ */ new Set();
   const codebaseDir = resolveCodebaseDir(agentConfig?.codebase_dir, config.codebaseDir);
   const reviewDeps = {
     commandTemplate: commandTemplate ?? "",
@@ -4046,12 +4118,14 @@ async function startAgentRouter() {
       maxConsecutiveErrors: config.maxConsecutiveErrors,
       routerRelay: router,
       reviewOnly: agentConfig?.review_only,
-      repoConfig: agentConfig?.repos,
+      repoConfig,
       roles,
       synthesizeRepos: agentConfig?.synthesize_repos,
       label,
       authToken: oauthToken,
       onTokenRefresh: () => getValidToken(config.platformUrl),
+      agentOwner,
+      userOrgs,
       usageLimits: config.usageLimits,
       versionOverride,
       codebaseTtl: config.codebaseTtl
@@ -4059,7 +4133,7 @@ async function startAgentRouter() {
   );
   router.stop();
 }
-function startAgentByIndex(config, agentIndex, pollIntervalMs, oauthToken, versionOverride, verbose, instancesOverride) {
+function startAgentByIndex(config, agentIndex, pollIntervalMs, oauthToken, versionOverride, verbose, instancesOverride, agentOwner, userOrgs) {
   let commandTemplate;
   let agentConfig;
   if (config.agents && config.agents.length > agentIndex) {
@@ -4122,7 +4196,9 @@ function startAgentByIndex(config, agentIndex, pollIntervalMs, oauthToken, versi
         usageLimits: config.usageLimits,
         versionOverride,
         codebaseTtl: config.codebaseTtl,
-        verbose
+        verbose,
+        agentOwner,
+        userOrgs
       }
     ).finally(() => {
       routerRelay?.stop();
@@ -4161,9 +4237,40 @@ agentCommand.command("start").description("Start agents in polling mode").option
       throw err;
     }
     const storedAuth = loadAuth();
+    const agentOwner = storedAuth?.github_username;
     if (storedAuth) {
       console.log(`Authenticated as ${storedAuth.github_username}`);
     }
+    const needsOrgs = config.agents?.some((a) => a.repos?.mode === "private") ?? false;
+    let userOrgs = needsOrgs ? await fetchUserOrgs(oauthToken, fetch, agentOwner) : /* @__PURE__ */ new Set();
+    if (needsOrgs && userOrgs.size === 0 && config.agents) {
+      const currentLogin = agentOwner?.toLowerCase();
+      const fallbackOrgs = /* @__PURE__ */ new Set();
+      for (const a of config.agents) {
+        if (a.repos?.list) {
+          for (const repo of a.repos.list) {
+            const owner = repo.split("/")[0]?.toLowerCase();
+            if (owner && owner !== currentLogin) fallbackOrgs.add(owner);
+          }
+        }
+        if (a.synthesize_repos?.list) {
+          for (const repo of a.synthesize_repos.list) {
+            const owner = repo.split("/")[0]?.toLowerCase();
+            if (owner && owner !== currentLogin) fallbackOrgs.add(owner);
+          }
+        }
+      }
+      if (fallbackOrgs.size > 0) {
+        userOrgs = fallbackOrgs;
+        console.log(`Org memberships (from config): ${[...userOrgs].join(", ")}`);
+      } else {
+        console.warn(
+          "\u26A0 Failed to fetch org memberships \u2014 private mode agents may not see org repos"
+        );
+      }
+    } else if (needsOrgs && userOrgs.size > 0) {
+      console.log(`Org memberships: ${[...userOrgs].join(", ")}`);
+    }
     if (opts.all) {
       if (!config.agents || config.agents.length === 0) {
         console.error("No agents configured in ~/.opencara/config.toml");
@@ -4181,7 +4288,9 @@ agentCommand.command("start").description("Start agents in polling mode").option
           oauthToken,
           versionOverride,
           opts.verbose,
-          instancesOverride
+          instancesOverride,
+          agentOwner,
+          userOrgs
         );
         if (agentPromises) {
           promises.push(...agentPromises);
@@ -4226,7 +4335,9 @@ agentCommand.command("start").description("Start agents in polling mode").option
         oauthToken,
         versionOverride,
         opts.verbose,
-        instancesOverride
+        instancesOverride,
+        agentOwner,
+        userOrgs
       );
       if (!agentPromises) {
         process.exit(1);
@@ -4942,7 +5053,7 @@ var statusCommand = new Command4("status").description("Show agent config, conne
 });
 
 // src/index.ts
-var program = new Command5().name("opencara").description("OpenCara \u2014 distributed AI code review agent").version("0.18.5");
+var program = new Command5().name("opencara").description("OpenCara \u2014 distributed AI code review agent").version("0.18.7");
 program.addCommand(agentCommand);
 program.addCommand(authCommand());
 program.addCommand(dedupCommand());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencara",
-  "version": "0.18.5",
+  "version": "0.18.7",
   "description": "Distributed AI code review agent — poll, review, and submit PR reviews using your own AI tools",
   "type": "module",
   "license": "MIT",