rcf-lite 0.27.0 → 0.28.0

package/src/feedback/gh.js

@@ -0,0 +1,376 @@
+// Feedback gh adapter (TAC-4107-feedback-gh, ADR-4105). The one place
+// that shells out to gh. Slice 4 (FBS-183) ships:
+//
+//   - ghAuthStatus({ host })            probe gh auth for a host
+//   - ghLabelList({ repo })             list existing label names
+//   - ghRepoView({ repo })               visibility + viewerPermission + hasIssuesEnabled
+//   - ghIssueSearch({ repo, query, state, limit })   dedupe search
+//   - ghIssueCreate({ repo, title, body, labels })   create one issue
+//   - ghIssueComment({ repo, number, body })         +1 comment
+//   - ghLabelCreate({ repo, name, description, color })  bootstrap only
+//
+// Every function returns a typed result. Errors are classified into
+// { kind: 'network' | 'notFound' | 'ratelimit' | 'client' | 'server' |
+// 'auth' | 'notInstalled' | 'unknown', message, exitCode? }. The
+// tool never spawns `gh auth login`, never reads GH_TOKEN or
+// GITHUB_TOKEN, never mutates process.env.
+//
+// The RCF_FEEDBACK_GH_MODULE env var names an alternative module the
+// caller can import in place of this file; tests use it to record
+// calls without touching gh. This mirrors the verifier launchAgent
+// override in src/verify/engine/launcher.js.
+
+import { spawn } from 'node:child_process';
+import process from 'node:process';
+
+/**
+ * @typedef {object} GhOk
+ * @property {true} ok
+ * @property {any} value
+ */
+
+/**
+ * @typedef {object} GhErr
+ * @property {false} ok
+ * @property {'network' | 'notFound' | 'ratelimit' | 'client' | 'server' | 'auth' | 'notInstalled' | 'search-unavailable' | 'unknown'} kind
+ * @property {string} message
+ * @property {number} [exitCode]
+ */
+
+/** @typedef {GhOk | GhErr} GhResult */
+
+const DEFAULT_HOST = 'github.com';
+
+/**
+ * Load the gh adapter. When RCF_FEEDBACK_GH_MODULE is set, import that
+ * module and return it; otherwise return this module's own default
+ * exports. The consumer (`src/cli/feedback.js:handleSubmit`) calls
+ * this once per invocation.
+ *
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {Promise<GhAdapter>}
+ */
+export async function loadGhAdapter(env = process.env) {
+  const override = env.RCF_FEEDBACK_GH_MODULE;
+  if (typeof override === 'string' && override.length > 0) {
+    const mod = await import(override);
+    return normaliseAdapter(mod);
+  }
+  return DEFAULT_ADAPTER;
+}
+
+/**
+ * Adapter shape (also what a test fake must provide). Every function
+ * takes an options object and returns a Promise<GhResult>.
+ *
+ * @typedef {object} GhAdapter
+ * @property {(opts?: { host?: string }) => Promise<GhResult>} ghAuthStatus
+ * @property {(opts: { repo: string }) => Promise<GhResult>} ghLabelList
+ * @property {(opts: { repo: string }) => Promise<GhResult>} ghRepoView
+ * @property {(opts: { repo: string, query: string, state?: 'open' | 'closed', limit?: number }) => Promise<GhResult>} ghIssueSearch
+ * @property {(opts: { repo: string, title: string, body: string, labels: string[] }) => Promise<GhResult>} ghIssueCreate
+ * @property {(opts: { repo: string, number: number, body: string }) => Promise<GhResult>} ghIssueComment
+ * @property {(opts: { repo: string, name: string, description?: string, color?: string }) => Promise<GhResult>} ghLabelCreate
+ * @property {() => Promise<GhResult>} [ghOnPath]
+ */
+
+/**
+ * Return an { ok: true, value: { present: boolean } } result naming
+ * whether the `gh` binary is on PATH. The default adapter shells out
+ * to `gh --version`; a test fake overrides through the seam.
+ *
+ * @returns {Promise<GhResult>}
+ */
+export async function ghOnPath() {
+  const r = await runGh(['--version']);
+  if (r.ok) return { ok: true, value: { present: true } };
+  if (r.kind === 'notInstalled') return { ok: true, value: { present: false } };
+  return r;
+}
+
+/**
+ * `gh auth status --hostname <host>` exit 0 means logged in on that
+ * host. gh writes the status to stderr; a non-zero exit is the auth
+ * failure the design section 7 fallback keys off.
+ *
+ * @param {{ host?: string }} [opts]
+ * @returns {Promise<GhResult>}
+ */
+export async function ghAuthStatus(opts = {}) {
+  const host = opts.host ?? DEFAULT_HOST;
+  const r = await runGh(['auth', 'status', '--hostname', host]);
+  if (r.ok) return { ok: true, value: { authed: true, host } };
+  if (r.kind === 'notInstalled') return r;
+  return { ok: false, kind: 'auth', message: `not logged in to ${host}`, exitCode: r.exitCode };
+}
+
+/**
+ * `gh label list --repo <repo> --json name` returns [{ name }, ...].
+ * A repo without labels returns []. A repo you cannot see returns
+ * an auth or notFound error; the caller treats either as "labels
+ * unknown" and drops all label requests.
+ *
+ * @param {{ repo: string }} opts
+ * @returns {Promise<GhResult>}
+ */
+export async function ghLabelList(opts) {
+  const r = await runGh(['label', 'list', '--repo', opts.repo, '--json', 'name', '--limit', '100']);
+  if (!r.ok) return r;
+  try {
+    const parsed = JSON.parse(r.value.stdout);
+    const names = Array.isArray(parsed) ? parsed.map((row) => row?.name).filter((n) => typeof n === 'string') : [];
+    return { ok: true, value: { names } };
+  } catch (err) {
+    return { ok: false, kind: 'unknown', message: `label list parse failed: ${err.message}` };
+  }
+}
+
+/**
+ * `gh repo view <repo> --json visibility,viewerPermission,hasIssuesEnabled`.
+ *
+ * @param {{ repo: string }} opts
+ * @returns {Promise<GhResult>}
+ */
+export async function ghRepoView(opts) {
+  const r = await runGh(['repo', 'view', opts.repo, '--json', 'visibility,viewerPermission,hasIssuesEnabled']);
+  if (!r.ok) return r;
+  try {
+    const parsed = JSON.parse(r.value.stdout);
+    return {
+      ok: true,
+      value: {
+        visibility: parsed?.visibility ?? null,
+        viewerPermission: parsed?.viewerPermission ?? null,
+        hasIssuesEnabled: parsed?.hasIssuesEnabled ?? null,
+      },
+    };
+  } catch (err) {
+    return { ok: false, kind: 'unknown', message: `repo view parse failed: ${err.message}` };
+  }
+}
+
+/**
+ * `gh search issues <query> --repo <repo> --state <state> --json
+ * number,url,title --limit <n>`. Slice 4 uses `--match body` via the
+ * query syntax "in:body <query>" so the dedupe search hits the
+ * fingerprint line. Search may be off on GHES and rate-limited on
+ * github.com; both fold to a search-unavailable error the caller
+ * treats as "fall through to create".
+ *
+ * @param {{ repo: string, query: string, state?: 'open' | 'closed', limit?: number }} opts
+ * @returns {Promise<GhResult>}
+ */
+export async function ghIssueSearch(opts) {
+  const state = opts.state ?? 'open';
+  const limit = String(opts.limit ?? 5);
+  const args = [
+    'search', 'issues',
+    `in:body ${opts.query}`,
+    '--repo', opts.repo,
+    '--state', state,
+    '--json', 'number,url,title',
+    '--limit', limit,
+  ];
+  const r = await runGh(args);
+  if (!r.ok) {
+    if (r.kind === 'ratelimit' || r.kind === 'server') {
+      return { ok: false, kind: 'search-unavailable', message: r.message, exitCode: r.exitCode };
+    }
+    return r;
+  }
+  try {
+    const parsed = JSON.parse(r.value.stdout);
+    const matches = Array.isArray(parsed)
+      ? parsed.filter((m) => m && typeof m.number === 'number')
+      : [];
+    return { ok: true, value: { matches } };
+  } catch (err) {
+    return { ok: false, kind: 'search-unavailable', message: `search parse failed: ${err.message}` };
+  }
+}
+
+/**
+ * `gh issue create --repo <repo> --title <t> --body-file - --label
+ * <l1> --label <l2>...` reads the body from stdin so a long body is
+ * safe across every shell. Returns { url, number }.
+ *
+ * @param {{ repo: string, title: string, body: string, labels: string[] }} opts
+ * @returns {Promise<GhResult>}
+ */
+export async function ghIssueCreate(opts) {
+  const args = ['issue', 'create', '--repo', opts.repo, '--title', opts.title, '--body-file', '-'];
+  for (const l of opts.labels ?? []) args.push('--label', l);
+  const r = await runGh(args, { stdin: opts.body });
+  if (!r.ok) return r;
+  const url = extractIssueUrl(r.value.stdout);
+  const number = extractIssueNumber(url);
+  return { ok: true, value: { url, number } };
+}
+
+/**
+ * `gh issue comment <number> --repo <repo> --body-file -`. Returns
+ * { url }.
+ *
+ * @param {{ repo: string, number: number, body: string }} opts
+ * @returns {Promise<GhResult>}
+ */
+export async function ghIssueComment(opts) {
+  const args = ['issue', 'comment', String(opts.number), '--repo', opts.repo, '--body-file', '-'];
+  const r = await runGh(args, { stdin: opts.body });
+  if (!r.ok) return r;
+  const url = (r.value.stdout || '').trim().split(/\s+/).pop() || '';
+  return { ok: true, value: { url } };
+}
+
+/**
+ * `gh label create <name> --repo <repo> --description <d> --color <c>`.
+ * Only used by scripts/bootstrap-feedback-labels.mjs; the tool proper
+ * never creates labels on submit.
+ *
+ * @param {{ repo: string, name: string, description?: string, color?: string }} opts
+ * @returns {Promise<GhResult>}
+ */
+export async function ghLabelCreate(opts) {
+  const args = ['label', 'create', opts.name, '--repo', opts.repo];
+  if (opts.description) args.push('--description', opts.description);
+  if (opts.color) args.push('--color', opts.color);
+  const r = await runGh(args);
+  if (!r.ok) return r;
+  return { ok: true, value: { name: opts.name } };
+}
+
+// -- helpers --------------------------------------------------------------
+
+/**
+ * Spawn gh with the given args, capture stdout/stderr, and classify
+ * failures. We pass a filtered environment (no synthesised TOKEN keys)
+ * so a test can assert the tool never invents credentials.
+ *
+ * @param {string[]} args
+ * @param {{ stdin?: string, env?: NodeJS.ProcessEnv }} [opts]
+ * @returns {Promise<GhResult>}
+ */
+async function runGh(args, opts = {}) {
+  return new Promise((resolvePromise) => {
+    let child;
+    try {
+      child = spawn('gh', args, {
+        env: opts.env ?? process.env,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+    } catch (err) {
+      resolvePromise({ ok: false, kind: classifySpawnError(err), message: err.message });
+      return;
+    }
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (chunk) => { stdout += chunk.toString('utf8'); });
+    child.stderr.on('data', (chunk) => { stderr += chunk.toString('utf8'); });
+    child.on('error', (err) => {
+      resolvePromise({ ok: false, kind: classifySpawnError(err), message: err.message });
+    });
+    child.on('close', (code) => {
+      if (code === 0) {
+        resolvePromise({ ok: true, value: { stdout, stderr } });
+        return;
+      }
+      resolvePromise({
+        ok: false,
+        kind: classifyExit(code, stderr),
+        message: stderr.trim() || `gh exited with code ${code}`,
+        exitCode: code ?? undefined,
+      });
+    });
+    if (typeof opts.stdin === 'string') {
+      child.stdin.end(opts.stdin);
+    } else {
+      child.stdin.end();
+    }
+  });
+}
+
+/**
+ * Classify a spawn-time error. ENOENT means gh is not on PATH.
+ *
+ * @param {NodeJS.ErrnoException} err
+ * @returns {GhErr['kind']}
+ */
+function classifySpawnError(err) {
+  if (err && err.code === 'ENOENT') return 'notInstalled';
+  return 'unknown';
+}
+
+/**
+ * Classify a non-zero gh exit into one of the error kinds the caller
+ * keys off. Uses stderr substrings because gh does not emit machine
+ * codes; the shapes below are stable across recent gh versions.
+ *
+ * @param {number | null} code
+ * @param {string} stderr
+ * @returns {GhErr['kind']}
+ */
+function classifyExit(code, stderr) {
+  const s = (stderr || '').toLowerCase();
+  if (/(rate limit|abuse|secondary rate)/.test(s)) return 'ratelimit';
+  if (/(not found|could not resolve|http 404)/.test(s)) return 'notFound';
+  if (/(unauthorised|unauthorized|http 401|not logged in|authentication)/.test(s)) return 'auth';
+  if (/(http 5\d\d|internal server error)/.test(s)) return 'server';
+  if (/(http 4\d\d)/.test(s)) return 'client';
+  if (/(network|econnrefused|etimedout|dial tcp|dns)/.test(s)) return 'network';
+  return 'unknown';
+}
+
+/**
+ * Extract the issue url from gh's `issue create` stdout (which is
+ * usually just the URL on its own line, possibly followed by a
+ * trailing newline).
+ *
+ * @param {string} stdout
+ * @returns {string}
+ */
+function extractIssueUrl(stdout) {
+  const m = (stdout || '').match(/https?:\/\/[^\s]+/);
+  return m ? m[0] : '';
+}
+
+/**
+ * Extract the issue number from a gh issue url.
+ *
+ * @param {string} url
+ * @returns {number | null}
+ */
+function extractIssueNumber(url) {
+  const m = (url || '').match(/\/issues\/(\d+)/);
+  return m ? Number(m[1]) : null;
+}
+
+/**
+ * Normalise an override module: allow either a default export or
+ * per-name exports; a partial module falls back to the default
+ * implementations here for anything it does not override.
+ *
+ * @param {any} mod
+ * @returns {GhAdapter}
+ */
+function normaliseAdapter(mod) {
+  const base = { ...DEFAULT_ADAPTER };
+  const src = mod && typeof mod === 'object' && mod.default && typeof mod.default === 'object'
+    ? { ...mod, ...mod.default }
+    : mod;
+  for (const key of Object.keys(base)) {
+    if (typeof src?.[key] === 'function') base[key] = src[key];
+  }
+  return base;
+}
+
+/** Default adapter (this module's own implementations). */
+export const DEFAULT_ADAPTER = Object.freeze({
+  ghOnPath,
+  ghAuthStatus,
+  ghLabelList,
+  ghRepoView,
+  ghIssueSearch,
+  ghIssueCreate,
+  ghIssueComment,
+  ghLabelCreate,
+});

package/src/feedback/hook.js

@@ -0,0 +1,183 @@
+// Feedback harness hook (TAC-4108). Slice 5 (FBS-184): the ask.
+//
+// Two exports are the load-bearing surface:
+//   - `shouldAsk(state)` is a pure function over the design 3.5 inputs
+//     that returns 'ask' or 'silent'; every quiet-rule branch runs
+//     through it and every unit-test truth table drives it directly.
+//   - `emit(harness, decision, message)` writes the per-harness output
+//     shape (Claude Code: exit 2 + stderr; Codex: stdout JSON block)
+//     and returns the exit code the CLI wrapper propagates.
+//
+// The CLI wrapper (`rcf feedback hook stop|session-end|session-start`
+// dispatched from `src/cli/feedback.js`) reads the harness JSON from
+// stdin, gathers the store inputs (settings, pending entries, ask
+// ledger, prior sessionId), calls `shouldAsk` and then `emit`, and
+// (crucially) APPENDS the asked ledger record BEFORE the emit so a
+// crash between emit and reply cannot cause a second ask.
+//
+// Design references: sections 3.5 (quiet rule + per-harness shape),
+// 8 (settings and env vars), 9 (Stop is the ask event ADR), 10.3
+// (quietMinutes default 15).
+
+/**
+ * Reason text the hook feeds Claude Code (stderr) or Codex (JSON
+ * `reason`). Exported so a caller can assemble a locally augmented
+ * variant (e.g. prefixing the outbox path from a carried-over session)
+ * without re-typing the four verb names. Kept STATIC so the managed
+ * block's hash-verified RULE 17 slice 6 text can pin the same verbs
+ * once, in one place.
+ *
+ * @param {number} pendingCount
+ * @returns {string}
+ */
+export function buildAskReason(pendingCount) {
+  const n = Math.max(1, Number(pendingCount) || 1);
+  const noun = n === 1 ? 'entry' : 'entries';
+  return `rcf feedback: ${n} unsubmitted ${noun} on this project. `
+    + "Run 'rcf feedback preview', show the operator the titles, "
+    + 'bodies and destination it prints, ask once whether to send '
+    + "them, then run 'rcf feedback submit --yes', "
+    + "'rcf feedback defer' or 'rcf feedback opt-out'. "
+    + 'Do not ask again this session.';
+}
+
+/**
+ * Reason text the SessionStart hook injects on either harness when
+ * one or more pending entries carried over from a prior session. The
+ * wording mirrors RULE 17's ask contract without prescribing verbs
+ * (SessionStart runs before any operator prompt; the ask itself
+ * arrives on Stop).
+ *
+ * @param {number} pendingCount
+ * @returns {string}
+ */
+export function buildCarryOverLine(pendingCount) {
+  const n = Math.max(1, Number(pendingCount) || 1);
+  const noun = n === 1 ? 'entry' : 'entries';
+  return `rcf feedback: ${n} unsubmitted ${noun} carried over `
+    + 'from an earlier session; ask the operator once at a natural '
+    + 'pause (RULE 17).';
+}
+
+/**
+ * @typedef {object} QuietRuleState
+ * @property {boolean} optedOut         file `ask: false` or env silence
+ * @property {number} pendingCount      pending entries visible to the
+ *                                      hook right now
+ * @property {boolean} askedThisSession `state.json` already recorded
+ *                                      an `asked` entry for the
+ *                                      incoming sessionId
+ * @property {boolean} stopHookActive   Claude Code / Codex loop guard
+ * @property {boolean} anyAskNow        one or more pending entries
+ *                                      carry askNow: true
+ * @property {number | null} newestPendingAgeMs
+ *                                      milliseconds since the newest
+ *                                      pending entry was recorded, or
+ *                                      null when nothing is pending
+ * @property {number} quietMinutes      operator-configurable gate; the
+ *                                      caller resolves the default (15)
+ * @property {boolean} queueComplete    `.rcf/feedback/state.json`
+ *                                      `queueStateAt` cached
+ *                                      complete / nothing-actionable
+ * @property {boolean} anyCarriedOver   one or more pending entries were
+ *                                      recorded under a prior sessionId
+ */
+
+/**
+ * Pure quiet-rule decision (design 3.5, ADR-4107).
+ *
+ * Ask on `stop` when ALL hold:
+ *   - not opted out (per-project file OR per-user env);
+ *   - pending entries exist;
+ *   - no `asked` record for this session_id in `state.json`;
+ *   - `stop_hook_active` is false (Claude Code loop guard; Codex
+ *     sends the same field);
+ *   - AND one of: an entry carries askNow; the newest pending entry
+ *     is older than quietMinutes; queue-state cache reports complete
+ *     or nothing-actionable; the entry was carried over from an
+ *     earlier session.
+ *
+ * Otherwise, exit silent. The function is total, deterministic, and
+ * has no side effects; unit tests drive it directly from a truth
+ * table and the wrapper only calls it once per invocation.
+ *
+ * @param {QuietRuleState} state
+ * @returns {'ask' | 'silent'}
+ */
+export function shouldAsk(state) {
+  if (!state) return 'silent';
+  if (state.optedOut) return 'silent';
+  if (!Number.isFinite(state.pendingCount) || state.pendingCount <= 0) return 'silent';
+  if (state.askedThisSession) return 'silent';
+  if (state.stopHookActive) return 'silent';
+
+  const quietMinutes = Number.isFinite(state.quietMinutes) && state.quietMinutes >= 0
+    ? state.quietMinutes
+    : 15;
+  const ageMs = typeof state.newestPendingAgeMs === 'number'
+    ? state.newestPendingAgeMs
+    : null;
+  const olderThanQuiet = ageMs !== null && ageMs >= quietMinutes * 60_000;
+
+  const triggerAny = Boolean(state.anyAskNow)
+    || olderThanQuiet
+    || Boolean(state.queueComplete)
+    || Boolean(state.anyCarriedOver);
+  return triggerAny ? 'ask' : 'silent';
+}
+
+/**
+ * Per-harness emit shape. Writes to the passed streams and returns
+ * the exit code the wrapper should propagate. The reason is written
+ * VERBATIM; callers pass the text `buildAskReason` (or their own
+ * augmented variant) produced. On `silent` no bytes are written on
+ * either stream and the exit code is 0 on both harnesses.
+ *
+ * @param {'claude-code' | 'codex'} harness
+ * @param {'ask' | 'silent'} decision
+ * @param {string} reason
+ * @param {{ stdout: NodeJS.WritableStream, stderr: NodeJS.WritableStream }} streams
+ * @returns {number} exit code the wrapper propagates
+ */
+export function emit(harness, decision, reason, streams) {
+  if (decision !== 'ask') return 0;
+  const stdout = streams?.stdout;
+  const stderr = streams?.stderr;
+  if (harness === 'codex') {
+    // Codex requires JSON on stdout with { decision: 'block', reason };
+    // plain text is invalid. The wrapper still exits 0 (Codex reads
+    // the decision, not the exit code, on Stop).
+    const payload = { decision: 'block', reason };
+    stdout?.write(`${JSON.stringify(payload)}\n`);
+    return 0;
+  }
+  // Claude Code default: exit 2 with the reason on stderr. Claude
+  // Code feeds the reason back to Claude, which speaks to the user.
+  stderr?.write(`${reason}\n`);
+  return 2;
+}
+
+/**
+ * SessionStart emit: one plain line for Claude Code (harness picks it
+ * up as context), a JSON `additionalContext` shape for Codex. Both
+ * return exit 0; the ledger is NOT touched on SessionStart (ask still
+ * runs on Stop). If the Codex build in use does not accept a
+ * SessionStart additionalContext, the RULE 17 fallback ("check
+ * `rcf feedback status` at session start") carries the same posture;
+ * the wrapper falls back gracefully.
+ *
+ * @param {'claude-code' | 'codex'} harness
+ * @param {string} line
+ * @param {{ stdout: NodeJS.WritableStream }} streams
+ * @returns {number} exit code the wrapper propagates
+ */
+export function emitSessionStart(harness, line, streams) {
+  const stdout = streams?.stdout;
+  if (!line) return 0;
+  if (harness === 'codex') {
+    stdout?.write(`${JSON.stringify({ additionalContext: line })}\n`);
+    return 0;
+  }
+  stdout?.write(`${line}\n`);
+  return 0;
+}

package/src/feedback/labels.js

@@ -0,0 +1,87 @@
+// Feedback label catalogue (TAC-4105-feedback-render, AC-15902-4). The
+// six labels the tool asks GitHub to apply on create, and the same
+// six the maintainer bootstrap script creates on a destination repo.
+//
+// F-6 gate finding: keep the catalogue as a single exported constant
+// so the label pre-check on submit, the render.js default-labels
+// helper, and the bootstrap script all consume one source of truth.
+// A grep test (test/feedback/labels-catalogue.test.js) refuses bare
+// literals for these names anywhere else under src/ or scripts/.
+
+/**
+ * The six bootstrap labels (ADR-4102). Frozen so a downstream mutation
+ * would throw rather than silently drift.
+ *
+ * @type {readonly [string, string, string, string, string, string]}
+ */
+export const FEEDBACK_LABELS = Object.freeze([
+  'rcf-feedback',
+  'severity:blocker',
+  'severity:major',
+  'severity:minor',
+  'area:blueprint',
+  'area:core',
+]);
+
+/**
+ * Machine-readable description of each label (for the bootstrap
+ * script's `gh label create` call, which wants a `--description` and
+ * a `--color`). Same order as `FEEDBACK_LABELS`.
+ */
+export const FEEDBACK_LABEL_DEFINITIONS = Object.freeze([
+  { name: 'rcf-feedback', description: 'Filed by rcf-lite feedback verb', color: '5319E7' },
+  { name: 'severity:blocker', description: 'Blocks a workflow with no workaround', color: 'B60205' },
+  { name: 'severity:major', description: 'Significant impact, workaround exists', color: 'D93F0B' },
+  { name: 'severity:minor', description: 'Small friction or cosmetic', color: 'FBCA04' },
+  { name: 'area:blueprint', description: 'About a blueprint (shelf or library)', color: '0E8A16' },
+  { name: 'area:core', description: 'About the rcf-lite core CLI or docs', color: '1D76DB' },
+]);
+
+/**
+ * The three labels the tool asks for on a given entry (subset of the
+ * six above). `severity:<sev>` and `area:<blueprint|core>` are picked
+ * per entry; `rcf-feedback` is always requested.
+ *
+ * Callers pass the severity and the kind; the returned array is the
+ * request, before the label pre-check narrows it to what exists on
+ * the destination repo.
+ *
+ * @param {'blocker' | 'major' | 'minor'} severity
+ * @param {'blueprint' | 'core'} kind
+ * @returns {string[]}
+ */
+export function labelsForEntry(severity, kind) {
+  const out = [FEEDBACK_LABELS[0]];
+  const sevLabel = severityLabel(severity);
+  if (sevLabel) out.push(sevLabel);
+  const areaLabel = areaLabelForKind(kind);
+  if (areaLabel) out.push(areaLabel);
+  return out;
+}
+
+/**
+ * `severity:<blocker|major|minor>` from the entry's severity, or null
+ * if it is not one of the three (defensive; the enum is fixed).
+ *
+ * @param {string | undefined | null} severity
+ * @returns {string | null}
+ */
+export function severityLabel(severity) {
+  if (severity === 'blocker') return FEEDBACK_LABELS[1];
+  if (severity === 'major') return FEEDBACK_LABELS[2];
+  if (severity === 'minor') return FEEDBACK_LABELS[3];
+  return null;
+}
+
+/**
+ * `area:blueprint` or `area:core` from the entry's kind, or null on
+ * anything else.
+ *
+ * @param {string | undefined | null} kind
+ * @returns {string | null}
+ */
+export function areaLabelForKind(kind) {
+  if (kind === 'blueprint') return FEEDBACK_LABELS[4];
+  if (kind === 'core') return FEEDBACK_LABELS[5];
+  return null;
+}

package/src/feedback/redact-allowlist.json

@@ -0,0 +1,14 @@
+{
+  "hosts": [
+    "github.com",
+    "npmjs.com",
+    "nodejs.org",
+    "stravica.ai",
+    "developers.cloudflare.com",
+    "cloudflare.com",
+    "docs.github.com",
+    "developer.mozilla.org",
+    "localhost",
+    "127.0.0.1"
+  ]
+}