patchrelay 0.12.1 → 0.12.2

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
   "service": "patchrelay",
-  "version": "0.12.1",
-  "commit": "dfda2eb5c3db",
-  "builtAt": "2026-03-24T13:11:33.565Z"
+  "version": "0.12.2",
+  "commit": "a39d9226ae29",
+  "builtAt": "2026-03-24T13:32:47.905Z"
 }

package/dist/config.js

@@ -3,7 +3,7 @@ import { isIP } from "node:net";
 import path from "node:path";
 import { z } from "zod";
 import { getDefaultConfigPath, getDefaultDatabasePath, getDefaultLogPath, getDefaultRuntimeEnvPath, getDefaultServiceEnvPath, getPatchRelayDataDir, } from "./runtime-paths.js";
-import { resolveSecret } from "./resolve-secret.js";
+import { resolveSecretWithSource } from "./resolve-secret.js";
 import { ensureAbsolutePath } from "./utils.js";
 const LINEAR_OAUTH_CALLBACK_PATH = "/oauth/linear/callback";
 const REPO_SETTINGS_DIRNAME = ".patchrelay";
@@ -286,13 +286,18 @@ export function loadConfig(configPath = process.env.PATCHRELAY_CONFIG ?? getDefa
     const parsedFile = parseJsonFile(requestedPath, "config file");
     const parsed = configSchema.parse(withSectionDefaults(expandEnv(parsedFile, env)));
     const requirements = getLoadProfileRequirements(profile);
-    const webhookSecret = resolveSecret("linear-webhook-secret", parsed.linear.webhook_secret_env, env);
-    const tokenEncryptionKey = resolveSecret("token-encryption-key", parsed.linear.token_encryption_key_env, env);
-    const oauthClientId = resolveSecret("linear-oauth-client-id", parsed.linear.oauth.client_id_env, env);
-    const oauthClientSecret = resolveSecret("linear-oauth-client-secret", parsed.linear.oauth.client_secret_env, env);
-    const operatorApiToken = parsed.operator_api.bearer_token_env
-        ? resolveSecret("operator-api-token", parsed.operator_api.bearer_token_env, env)
+    const rWebhookSecret = resolveSecretWithSource("linear-webhook-secret", parsed.linear.webhook_secret_env, env);
+    const rTokenEncryptionKey = resolveSecretWithSource("token-encryption-key", parsed.linear.token_encryption_key_env, env);
+    const rOAuthClientId = resolveSecretWithSource("linear-oauth-client-id", parsed.linear.oauth.client_id_env, env);
+    const rOAuthClientSecret = resolveSecretWithSource("linear-oauth-client-secret", parsed.linear.oauth.client_secret_env, env);
+    const rOperatorApiToken = parsed.operator_api.bearer_token_env
+        ? resolveSecretWithSource("operator-api-token", parsed.operator_api.bearer_token_env, env)
         : undefined;
+    const webhookSecret = rWebhookSecret.value;
+    const tokenEncryptionKey = rTokenEncryptionKey.value;
+    const oauthClientId = rOAuthClientId.value;
+    const oauthClientSecret = rOAuthClientSecret.value;
+    const operatorApiToken = rOperatorApiToken?.value;
     if (requirements.requireWebhookSecret && !webhookSecret) {
         throw new Error(`Missing env var ${parsed.linear.webhook_secret_env}`);
     }
@@ -400,6 +405,13 @@ export function loadConfig(configPath = process.env.PATCHRELAY_CONFIG ?? getDefa
                 } : {}),
             };
         }),
+        secretSources: {
+            "linear-webhook-secret": rWebhookSecret.source,
+            "token-encryption-key": rTokenEncryptionKey.source,
+            "linear-oauth-client-id": rOAuthClientId.source,
+            "linear-oauth-client-secret": rOAuthClientSecret.source,
+            ...(rOperatorApiToken ? { "operator-api-token": rOperatorApiToken.source } : {}),
+        },
     };
     validateConfigSemantics(config, {
         allowMissingOperatorApiToken: requirements.allowMissingOperatorApiToken,

package/dist/github-app-token.js

@@ -1,7 +1,7 @@
 import { createSign } from "node:crypto";
 import { writeFile, mkdir } from "node:fs/promises";
 import path from "node:path";
-import { resolveSecret } from "./resolve-secret.js";
+import { resolveSecretWithSource } from "./resolve-secret.js";
 import { getPatchRelayDataDir } from "./runtime-paths.js";
 const TOKEN_REFRESH_MS = 30 * 60_000; // 30 minutes (tokens last 1 hour)
 /**
@@ -14,14 +14,19 @@ const TOKEN_REFRESH_MS = 30 * 60_000; // 30 minutes (tokens last 1 hour)
  */
 export function resolveGitHubAppCredentials() {
     const appId = process.env.PATCHRELAY_GITHUB_APP_ID;
-    const privateKey = resolveSecret("github-app-pem", "PATCHRELAY_GITHUB_APP_PRIVATE_KEY");
-    if (!appId || !privateKey)
+    const rPrivateKey = resolveSecretWithSource("github-app-pem", "PATCHRELAY_GITHUB_APP_PRIVATE_KEY");
+    const rWebhookSecret = resolveSecretWithSource("github-app-webhook-secret", "GITHUB_APP_WEBHOOK_SECRET");
+    if (!appId || !rPrivateKey.value)
         return undefined;
     const installationId = process.env.PATCHRELAY_GITHUB_APP_INSTALLATION_ID;
     return {
         appId,
-        privateKey,
+        privateKey: rPrivateKey.value,
         ...(installationId ? { installationId } : {}),
+        secretSources: {
+            "github-app-pem": rPrivateKey.source,
+            ...(rWebhookSecret.value ? { "github-app-webhook-secret": rWebhookSecret.source } : {}),
+        },
     };
 }
 /**

package/dist/index.js

@@ -59,6 +59,7 @@ async function main() {
         port: config.server.port,
         webhookPath: config.ingress.linearWebhookPath,
         configPath: process.env.PATCHRELAY_CONFIG,
+        secrets: config.secretSources,
     }, "PatchRelay started");
     const shutdown = async () => {
         service.stop();

package/dist/preflight.js

@@ -2,8 +2,10 @@ import { accessSync, constants, existsSync, mkdirSync, statSync } from "node:fs"
 import path from "node:path";
 import { runPatchRelayMigrations } from "./db/migrations.js";
 import { SqliteConnection } from "./db/shared.js";
+import { resolveSecret } from "./resolve-secret.js";
 import { execCommand } from "./utils.js";
-export async function runPreflight(config) {
+export async function runPreflight(config, options) {
+    const connectivity = options?.connectivity ?? true;
     const checks = [];
     if (!config.linear.webhookSecret) {
         checks.push(fail("linear", "LINEAR_WEBHOOK_SECRET is missing"));
@@ -82,11 +84,79 @@ export async function runPreflight(config) {
     }
     checks.push(await checkExecutable("git", config.runner.gitBin));
     checks.push(await checkExecutable("codex", config.runner.codex.bin));
+    // Connectivity checks — verify secrets actually work against live APIs.
+    // Skipped when graphqlUrl uses a non-routable domain (.example, .test, .invalid).
+    const skipConnectivity = !connectivity || isNonRoutableDomain(config.linear.graphqlUrl);
+    if (!skipConnectivity) {
+        if (config.linear.oauth.clientId && config.linear.oauth.clientSecret) {
+            checks.push(await checkLinearApi(config.linear.graphqlUrl));
+        }
+        const ghAppId = process.env.PATCHRELAY_GITHUB_APP_ID;
+        const ghAppKey = resolveSecret("github-app-pem", "PATCHRELAY_GITHUB_APP_PRIVATE_KEY");
+        if (ghAppId && ghAppKey) {
+            checks.push(await checkGitHubApp(ghAppId, ghAppKey));
+        }
+    }
     return {
         checks,
         ok: checks.every((check) => check.status !== "fail"),
     };
 }
+async function checkLinearApi(graphqlUrl) {
+    try {
+        const response = await fetch(graphqlUrl, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ query: "{ __typename }" }),
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            return pass("linear_api", `Linear GraphQL API is reachable at ${graphqlUrl}`);
+        }
+        return warn("linear_api", `Linear GraphQL API returned ${response.status} — may be unreachable or rate-limited`);
+    }
+    catch (error) {
+        return fail("linear_api", `Linear GraphQL API is unreachable at ${graphqlUrl}: ${formatError(error)}`);
+    }
+}
+async function checkGitHubApp(appId, privateKey) {
+    try {
+        const { createSign } = await import("node:crypto");
+        const now = Math.floor(Date.now() / 1000);
+        const header = Buffer.from(JSON.stringify({ alg: "RS256", typ: "JWT" })).toString("base64url");
+        const payload = Buffer.from(JSON.stringify({ iat: now - 60, exp: now + 120, iss: appId })).toString("base64url");
+        const signer = createSign("RSA-SHA256");
+        signer.update(`${header}.${payload}`);
+        let signature;
+        try {
+            signature = signer.sign(privateKey, "base64url");
+        }
+        catch (error) {
+            return fail("github_app", `GitHub App private key is invalid: ${formatError(error)}`);
+        }
+        const jwt = `${header}.${payload}.${signature}`;
+        const response = await fetch("https://api.github.com/app", {
+            headers: {
+                Authorization: `Bearer ${jwt}`,
+                Accept: "application/vnd.github+json",
+                "X-GitHub-Api-Version": "2022-11-28",
+            },
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.ok) {
+            const app = await response.json();
+            const label = app.slug ?? app.name ?? appId;
+            return pass("github_app", `GitHub App authenticated as "${label}"`);
+        }
+        if (response.status === 401) {
+            return fail("github_app", "GitHub App authentication failed — check APP_ID and private key");
+        }
+        return warn("github_app", `GitHub App API returned ${response.status}`);
+    }
+    catch (error) {
+        return fail("github_app", `GitHub API is unreachable: ${formatError(error)}`);
+    }
+}
 function checkDatabaseHealth(config) {
     const checks = [];
     let connection;
@@ -242,6 +312,15 @@ function checkOAuthRedirectUri(config) {
 function isLoopbackHost(host) {
     return host === "127.0.0.1" || host === "::1" || host === "localhost";
 }
+function isNonRoutableDomain(url) {
+    try {
+        const hostname = new URL(url).hostname;
+        return /\.(example|test|invalid|localhost)$/i.test(hostname);
+    }
+    catch {
+        return false;
+    }
+}
 function formatError(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/resolve-secret.js

@@ -13,11 +13,19 @@ import path from "node:path";
  * Returns `undefined` when the secret is not found at any level.
  */
 export function resolveSecret(credentialName, envKey, env = process.env) {
+    return resolveSecretWithSource(credentialName, envKey, env).value;
+}
+/**
+ * Same as `resolveSecret` but also returns which layer provided the value.
+ */
+export function resolveSecretWithSource(credentialName, envKey, env = process.env) {
     // 1. systemd credentials directory (private mount, highest trust)
     const credDir = process.env.CREDENTIALS_DIRECTORY;
     if (credDir) {
         try {
-            return readFileSync(path.join(credDir, credentialName), "utf8").trim();
+            const value = readFileSync(path.join(credDir, credentialName), "utf8").trim();
+            if (value)
+                return { value, source: "creddir" };
         }
         catch {
             // credential not in this directory — fall through
@@ -27,12 +35,17 @@ export function resolveSecret(credentialName, envKey, env = process.env) {
     const filePath = env[`${envKey}_FILE`];
     if (filePath) {
         try {
-            return readFileSync(filePath, "utf8").trim();
+            const value = readFileSync(filePath, "utf8").trim();
+            if (value)
+                return { value, source: "file" };
         }
         catch {
             // file not readable — fall through
         }
     }
     // 3. Direct env var
-    return env[envKey] || undefined;
+    const value = env[envKey] || undefined;
+    if (value)
+        return { value, source: "env" };
+    return { value: undefined, source: "missing" };
 }

package/dist/run-orchestrator.js

@@ -171,26 +171,33 @@ export class RunOrchestrator {
             }
             // Reuse the existing thread only for review_fix (reviewer context matters).
             // Implementation, ci_repair, and queue_repair get fresh threads.
-            // Fall back to a fresh thread if the stored one is stale (e.g. after app-server restart).
             if (issue.threadId && runType === "review_fix") {
-                try {
-                    await this.codex.readThread(issue.threadId, false);
-                    threadId = issue.threadId;
-                }
-                catch {
-                    this.logger.info({ issueKey: issue.issueKey, staleThreadId: issue.threadId }, "Stored thread is stale, starting fresh for review_fix");
-                    const thread = await this.codex.startThread({ cwd: worktreePath });
-                    threadId = thread.id;
-                    this.db.upsertIssue({ projectId: item.projectId, linearIssueId: item.issueId, threadId });
-                }
+                threadId = issue.threadId;
             }
             else {
                 const thread = await this.codex.startThread({ cwd: worktreePath });
                 threadId = thread.id;
                 this.db.upsertIssue({ projectId: item.projectId, linearIssueId: item.issueId, threadId });
             }
-            const turn = await this.codex.startTurn({ threadId, cwd: worktreePath, input: prompt });
-            turnId = turn.turnId;
+            try {
+                const turn = await this.codex.startTurn({ threadId, cwd: worktreePath, input: prompt });
+                turnId = turn.turnId;
+            }
+            catch (turnError) {
+                // If the thread is stale (e.g. after app-server restart), start fresh and retry once.
+                const msg = turnError instanceof Error ? turnError.message : String(turnError);
+                if (msg.includes("thread not found") || msg.includes("not materialized")) {
+                    this.logger.info({ issueKey: issue.issueKey, staleThreadId: threadId }, "Thread is stale, retrying with fresh thread");
+                    const thread = await this.codex.startThread({ cwd: worktreePath });
+                    threadId = thread.id;
+                    this.db.upsertIssue({ projectId: item.projectId, linearIssueId: item.issueId, threadId });
+                    const turn = await this.codex.startTurn({ threadId, cwd: worktreePath, input: prompt });
+                    turnId = turn.turnId;
+                }
+                else {
+                    throw turnError;
+                }
+            }
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);

package/dist/service.js

@@ -69,6 +69,7 @@ export class PatchRelayService {
         // Optional GitHub App token management for bot identity
         const ghAppCredentials = resolveGitHubAppCredentials();
         if (ghAppCredentials) {
+            Object.assign(config.secretSources, ghAppCredentials.secretSources);
             this.githubAppTokenManager = createGitHubAppTokenManager(ghAppCredentials, logger);
         }
         this.codex.on("notification", (notification) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "patchrelay",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "license": "MIT",
   "type": "module",
   "repository": {