spur-board 0.7.0 → 0.8.1

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, B as SLACK_BOT_SCOPES, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as requiredSecretKeys } from "./src-BFgTh55w.mjs";
+import { A as taskKeySchema, B as requiredSecretKeys, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as RESERVED_PROJECT, S as prRefSchema, T as actorIdSchema, V as SLACK_BOT_SCOPES, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as configSchema } from "./src-g7u1onIP.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -7661,18 +7661,92 @@ async function scanTransaction(store, fn) {
 	throw new Error("Gateway secret scan replay limit exceeded");
 }
 //#endregion
+//#region ../core/src/app/board-utils.ts
+function trackerSource(project) {
+	return project.tracker.type === "jira" ? `jira:${project.id}` : `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
+}
+function projectForKey(config, key) {
+	const lowerKey = key.toLowerCase();
+	const matched = config.projects.filter((project) => {
+		const tracker = project.tracker;
+		if (tracker.type === "github-issues") {
+			const prefix = `${tracker.repo.toLowerCase()}#`;
+			const short = tracker.repo.split("/")[1];
+			return lowerKey.startsWith(prefix) || short !== void 0 && lowerKey.startsWith(`${short.toLowerCase()}#`);
+		}
+		const prefix = /^([A-Za-z][A-Za-z0-9_]*)-/.exec(key)?.[1]?.toUpperCase();
+		return prefix !== void 0 && (tracker.projectKeys.length === 0 || tracker.projectKeys.includes(prefix));
+	});
+	return matched.length === 1 ? matched[0] ?? null : null;
+}
+async function emit(trx, kind, project, taskId, at, payload, actor = "system") {
+	const parsed = parseActorId(actor);
+	if (parsed === null) throw new Error("Invalid journal actor");
+	await trx.insertInto("event").values({
+		at,
+		project,
+		task_id: taskId,
+		kind,
+		actor: parsed.actor,
+		actor_ref: parsed.actor === "agent" ? JSON.stringify(parsed.actorRef) : null,
+		payload: toJson(eventPayloadSchemas[kind], payload),
+		v: 1,
+		request_id: null
+	}).execute();
+}
+function taskView(task) {
+	return {
+		key: task.key,
+		project: task.project,
+		column: task.column,
+		membership: task.membership
+	};
+}
+function linkView(link) {
+	return {
+		kind: link.entity,
+		ref: link.entity === "pr" ? `${link.repo ?? ""}#${String(link.number ?? "")}` : link.entity === "session" ? link.session_id ?? "" : link.ticket_key ?? "",
+		role: link.role
+	};
+}
+//#endregion
 //#region ../core/src/app/denied-event.ts
 const actorRefSchema$2 = z.strictObject({
 	project: z.string().min(1),
 	session: z.string().min(1)
 });
+/**
+* The journal project of a denial with no resolved target, in order: the configured project
+* the input's `task` key or `project` names; else the only configured project listing the agent
+* actor's Spur project; else `RESERVED_PROJECT`. Never throws.
+*/
+function deniedProject(config, actor, input) {
+	if (typeof input === "object" && input !== null) {
+		const hints = input;
+		if (typeof hints.task === "string") {
+			const project = projectForKey(config, hints.task);
+			if (project !== null) return project.id;
+		}
+		if (typeof hints.project === "string") {
+			const named = hints.project;
+			if (config.projects.some((project) => project.id === named)) return named;
+		}
+	}
+	const parsed = parseActorId(actor);
+	if (parsed?.actor === "agent") {
+		const owners = config.projects.filter((project) => project.spurProjects.some((spur) => spur.name === parsed.actorRef.project));
+		if (owners.length === 1 && owners[0] !== void 0) return owners[0].id;
+	}
+	return RESERVED_PROJECT;
+}
 /** Persist an authorization refusal through the caller's transaction. */
-async function writeDeniedEvent(trx, actor, operation, target, at) {
+async function writeDeniedEvent(trx, denial) {
+	const { config, actor, operation, input, target, at } = denial;
 	const parsed = parseActorId(actor);
 	if (parsed === null) throw new Error("Invalid actor");
 	await trx.insertInto("event").values({
 		at,
-		project: target.kind === "found" ? target.value.project : "board",
+		project: target.kind === "found" ? target.value.project : deniedProject(config, actor, input),
 		task_id: target.kind === "found" ? target.value.task?.id ?? null : null,
 		kind: "operation_denied",
 		actor: parsed.actor,
@@ -7787,7 +7861,14 @@ function createApply(deps) {
 						...mode === void 0 ? {} : { mode }
 					});
 					if (decision.status === "denied") {
-						await writeDeniedEvent(trx, actor, entry.id, target, at);
+						await writeDeniedEvent(trx, {
+							config,
+							actor,
+							operation: entry.id,
+							input: parsedInput,
+							target,
+							at
+						});
 						deniedHint = decision.hint;
 						return;
 					}
@@ -7849,7 +7930,14 @@ function createQuery(deps) {
 					target
 				});
 				if (decision.status === "denied") {
-					await writeDeniedEvent(trx, actor, entry.id, target, new Date(clock.now()).toISOString());
+					await writeDeniedEvent(trx, {
+						config,
+						actor,
+						operation: entry.id,
+						input: parsedInput,
+						target,
+						at: new Date(clock.now()).toISOString()
+					});
 					return {
 						status: "denied",
 						hint: decision.hint
@@ -8490,11 +8578,13 @@ const NO_FEED = /* @__PURE__ */ new Set([
 	"answer_undelivered",
 	"transport_health"
 ]);
+/** Display label of a feed line with no task; not part of the line's identity. */
+const TASKLESS_FEED_KEY = "spur-board";
 async function journal$2(trx, item, kind, at, rule) {
 	const task = item.task_id === null ? void 0 : await trx.selectFrom("task").select(["project"]).where("id", "=", item.task_id).executeTakeFirstOrThrow();
 	await trx.insertInto("event").values({
 		at: at.toISOString(),
-		project: task?.project ?? "board",
+		project: task?.project ?? "_board",
 		task_id: item.task_id,
 		kind,
 		actor: "system",
@@ -8531,7 +8621,7 @@ async function raiseItem(trx, input) {
 	}).returningAll().executeTakeFirstOrThrow();
 	await journal$2(trx, item, "from_you_raised", input.at, input.rule);
 	if (!NO_FEED.has(item.kind) && !input.suppressFeed) {
-		const key = (item.task_id === null ? null : await trx.selectFrom("task").select("key").where("id", "=", item.task_id).executeTakeFirstOrThrow())?.key ?? "board";
+		const key = (item.task_id === null ? null : await trx.selectFrom("task").select("key").where("id", "=", item.task_id).executeTakeFirstOrThrow())?.key ?? TASKLESS_FEED_KEY;
 		const line = await enqueueFeedLine(trx, {
 			itemId: item.id,
 			itemKey: item.item_key,
@@ -8580,7 +8670,7 @@ async function clearItem(trx, itemId, at) {
 		itemKey: item.item_key,
 		raise: item.raise_no,
 		lineId: item.line_outbox_id,
-		key: task?.key ?? "board",
+		key: task?.key ?? TASKLESS_FEED_KEY,
 		taskId: item.task_id,
 		at
 	});
@@ -8595,7 +8685,7 @@ function effectiveStatus(row, at) {
 async function journalToken(trx, kind, name, at) {
 	await trx.insertInto("event").values({
 		at: at.toISOString(),
-		project: "board",
+		project: RESERVED_PROJECT,
 		task_id: null,
 		kind,
 		actor: kind === "token_approved" || kind === "token_denied" || kind === "token_revoked" ? "operator" : "system",
@@ -8821,12 +8911,15 @@ async function createApiServer(options) {
 		trustProxy: false
 	});
 	const snapshot = await buildCatalogSnapshot(OPERATIONS);
+	/** Lets clients notice a daemon restart and check its catalog again. */
+	const instance = randomUUID();
 	const callers = /* @__PURE__ */ new WeakMap();
 	let doctorInFlight = null;
 	let doctorCached = null;
 	let doctorNextProbeAt = 0;
 	app.addHook("onRequest", async (request, reply) => {
 		reply.header("x-request-id", request.id);
+		reply.header("x-board-instance", instance);
 		if (request.headers.origin !== void 0) throw new CommandError("forbidden", "Browser origins are not accepted.");
 		const address = app.server.address();
 		const port = address !== null && typeof address === "object" ? address.port : options.port;
@@ -8912,7 +9005,7 @@ async function createApiServer(options) {
 		const caller = callers.get(request);
 		if (caller === void 0) throw new Error("Operation identity was not resolved.");
 		const operation = OPERATIONS.find((entry) => entry.id === request.params.id);
-		if (operation === void 0) throw new CommandError("usage", "Unknown catalog operation.");
+		if (operation === void 0) throw new CommandError("version_mismatch", "This daemon does not know the operation. Run `board service restart` to update the daemon, then retry.");
 		const body = inputBody(request.body);
 		const parsed = operation.input.safeParse(body.input);
 		if (!parsed.success) throw new CommandError(errorCodeOf(parsed.error), "Fix the operation input.");
@@ -9530,55 +9623,6 @@ function createBlockMutations(config) {
 	};
 }
 //#endregion
-//#region ../core/src/app/board-utils.ts
-function trackerSource(project) {
-	return project.tracker.type === "jira" ? `jira:${project.id}` : `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
-}
-function projectForKey(config, key) {
-	const lowerKey = key.toLowerCase();
-	const matched = config.projects.filter((project) => {
-		const tracker = project.tracker;
-		if (tracker.type === "github-issues") {
-			const prefix = `${tracker.repo.toLowerCase()}#`;
-			const short = tracker.repo.split("/")[1];
-			return lowerKey.startsWith(prefix) || short !== void 0 && lowerKey.startsWith(`${short.toLowerCase()}#`);
-		}
-		const prefix = /^([A-Za-z][A-Za-z0-9_]*)-/.exec(key)?.[1]?.toUpperCase();
-		return prefix !== void 0 && (tracker.projectKeys.length === 0 || tracker.projectKeys.includes(prefix));
-	});
-	return matched.length === 1 ? matched[0] ?? null : null;
-}
-async function emit(trx, kind, project, taskId, at, payload, actor = "system") {
-	const parsed = parseActorId(actor);
-	if (parsed === null) throw new Error("Invalid journal actor");
-	await trx.insertInto("event").values({
-		at,
-		project,
-		task_id: taskId,
-		kind,
-		actor: parsed.actor,
-		actor_ref: parsed.actor === "agent" ? JSON.stringify(parsed.actorRef) : null,
-		payload: toJson(eventPayloadSchemas[kind], payload),
-		v: 1,
-		request_id: null
-	}).execute();
-}
-function taskView(task) {
-	return {
-		key: task.key,
-		project: task.project,
-		column: task.column,
-		membership: task.membership
-	};
-}
-function linkView(link) {
-	return {
-		kind: link.entity,
-		ref: link.entity === "pr" ? `${link.repo ?? ""}#${String(link.number ?? "")}` : link.entity === "session" ? link.session_id ?? "" : link.ticket_key ?? "",
-		role: link.role
-	};
-}
-//#endregion
 //#region ../core/src/app/membership.ts
 function canonicalKey(config, key) {
 	const parsed = parseRef$1(key, "task");
@@ -9988,6 +10032,7 @@ const EVENT_SUMMARIES = {
 	doorbell_read: "Doorbell read",
 	doorbell_undelivered: "Doorbell delivery exhausted",
 	inbound_failed: "Inbound message failed",
+	inbound_skipped: "Inbound message skipped",
 	from_you_raised: "Operator item raised",
 	from_you_cleared: "Operator item cleared",
 	flag_raised: "Flag raised",
@@ -11100,7 +11145,7 @@ function createObservationCore(deps) {
 					key,
 					value: "true"
 				}).execute();
-				await emit(trx, "spur_unknown_state", "board", null, new Date(clock.now()).toISOString(), {
+				await emit(trx, "spur_unknown_state", RESERVED_PROJECT, null, new Date(clock.now()).toISOString(), {
 					kind,
 					value
 				});
@@ -11343,18 +11388,12 @@ async function journal(trx, input) {
 async function taskContext(trx, event, gateway) {
 	if (!("conversation" in event) || event.conversation === void 0) return {
 		taskId: null,
-		project: "board",
-		taskKey: null
+		project: null
 	};
-	const row = await trx.selectFrom("conversation").leftJoin("task", "task.id", "conversation.task_id").select([
-		"conversation.task_id as taskId",
-		"task.project",
-		"task.key"
-	]).where("conversation.gateway", "=", gateway).where("conversation.ref", "=", event.conversation).executeTakeFirst();
+	const row = await trx.selectFrom("conversation").leftJoin("task", "task.id", "conversation.task_id").select(["conversation.task_id as taskId", "task.project"]).where("conversation.gateway", "=", gateway).where("conversation.ref", "=", event.conversation).executeTakeFirst();
 	return {
 		taskId: row?.taskId ?? null,
-		project: row?.project ?? "board",
-		taskKey: row?.key ?? null
+		project: row?.project ?? null
 	};
 }
 async function raiseInboundItem(trx, input) {
@@ -11370,6 +11409,10 @@ async function raiseInboundItem(trx, input) {
 	if (input.retry && item.inbound_event_json === null) await trx.updateTable("operator_item").set({ inbound_event_json: toJson(inboundEventSchema, input.event) }).where("id", "=", item.id).execute();
 	return item;
 }
+/** The operation input a parsed query command carries; legacy stored commands carry none. */
+function commandInput(event) {
+	return event.kind === "command" && event.command?.kind === "query" ? event.command.input : void 0;
+}
 async function deny(trx, input) {
 	const context = await taskContext(trx, input.event, input.gateway);
 	await journal(trx, {
@@ -11382,7 +11425,7 @@ async function deny(trx, input) {
 		},
 		actor: input.actor,
 		taskId: context.taskId,
-		project: context.project,
+		project: context.project ?? deniedProject(input.config, input.actor, commandInput(input.event)),
 		at: input.at
 	});
 	return input.privateResponse ? {
@@ -11390,6 +11433,24 @@ async function deny(trx, input) {
 		response: "not allowed"
 	} : { status: "ignored" };
 }
+/** Journal an inbound message the board does not act on; no gateway response. */
+async function skip(trx, input) {
+	const context = await taskContext(trx, input.event, input.gateway);
+	await journal(trx, {
+		kind: "inbound_skipped",
+		payload: {
+			gateway: input.gateway,
+			reason: input.reason,
+			normalizedEvent: input.event,
+			..."author" in input.event ? { platformUser: input.event.author } : {}
+		},
+		actor: input.actor,
+		taskId: context.taskId,
+		project: context.project ?? "_board",
+		at: input.at
+	});
+	return { status: "ignored" };
+}
 async function linkedComment(trx, event) {
 	return trx.selectFrom("comment").selectAll().where("conversation_ref", "=", event.conversation).where("message_ref", "=", event.message).executeTakeFirst();
 }
@@ -11470,7 +11531,7 @@ function createInbound(input) {
 	}
 	async function processMessage(trx, event, at) {
 		const conversation = await sourceContext(trx, event, at);
-		if (conversation?.block_id === null || conversation === void 0) return deny(trx, {
+		if (conversation?.block_id === null || conversation === void 0) return skip(trx, {
 			event,
 			reason: "Unknown board conversation.",
 			actor: "operator",
@@ -11498,7 +11559,7 @@ function createInbound(input) {
 			return { status: "applied" };
 		}
 		const comment = await linkedComment(trx, event);
-		if (comment === void 0 || comment.author !== "operator") return deny(trx, {
+		if (comment === void 0 || comment.author !== "operator") return skip(trx, {
 			event,
 			reason: "Original operator comment not found.",
 			actor: "system",
@@ -11547,6 +11608,7 @@ function createInbound(input) {
 	}
 	async function runUser(trx, event, at) {
 		if (event.kind === "command" && event.name !== void 0 && event.name !== config.slack.command) return deny(trx, {
+			config,
 			event,
 			reason: "Command name does not match the configured command.",
 			actor: "system",
@@ -11554,6 +11616,7 @@ function createInbound(input) {
 			at
 		});
 		if (event.kind !== "message_deleted" && event.author !== config.operator.slack) return deny(trx, {
+			config,
 			event,
 			reason: "Only the configured operator may act.",
 			actor: "system",
@@ -11563,6 +11626,7 @@ function createInbound(input) {
 		});
 		if (event.kind === "action" || event.kind === "command") {
 			if (!(event.kind === "action" ? event.sourceSpace !== null : true)) return deny(trx, {
+				config,
 				event,
 				reason: "Interaction came from outside a board space.",
 				actor: "operator",
@@ -11663,7 +11727,7 @@ function createInbound(input) {
 				},
 				actor: "system",
 				taskId: context.taskId,
-				project: context.project,
+				project: context.project ?? "_board",
 				at
 			});
 			await raiseInboundItem(trx, {
@@ -13250,7 +13314,7 @@ var GithubIssuesHttpError = class extends AdapterError {
 		this.status = status;
 	}
 };
-function object$2(value) {
+function object$3(value) {
 	if (value !== null && typeof value === "object" && !Array.isArray(value)) return value;
 	throw new AdapterError("transient", "Malformed GitHub issue response");
 }
@@ -13268,14 +13332,14 @@ function issueNumber(ref, repo) {
 	return number(Number(match[2]));
 }
 function normalize(value, trackerId, repo, inFilter) {
-	const issue = object$2(value);
+	const issue = object$3(value);
 	if (issue["pull_request"] !== void 0) throw new AdapterError("transient", "A pull request cannot be a tracker ticket");
 	const updatedAt = new Date(string$3(issue["updated_at"]));
 	if (Number.isNaN(updatedAt.getTime())) throw new AdapterError("transient", "Malformed GitHub issue timestamp");
 	const labels = issue["labels"];
 	if (!Array.isArray(labels)) throw new AdapterError("transient", "Malformed GitHub issue labels");
-	const assignee = issue["assignee"] == null ? null : string$3(object$2(issue["assignee"])["login"]);
-	const milestone = issue["milestone"] == null ? null : string$3(object$2(issue["milestone"])["title"]);
+	const assignee = issue["assignee"] == null ? null : string$3(object$3(issue["assignee"])["login"]);
+	const milestone = issue["milestone"] == null ? null : string$3(object$3(issue["milestone"])["title"]);
 	return {
 		trackerId,
 		id: string$3(issue["node_id"]),
@@ -13284,7 +13348,7 @@ function normalize(value, trackerId, repo, inFilter) {
 		status: string$3(issue["state"]),
 		assignee,
 		sprint: milestone,
-		labels: labels.map((label) => string$3(object$2(label)["name"])),
+		labels: labels.map((label) => string$3(object$3(label)["name"])),
 		inFilter,
 		url: string$3(issue["html_url"]),
 		updatedAt: updatedAt.toISOString()
@@ -13293,9 +13357,9 @@ function normalize(value, trackerId, repo, inFilter) {
 function matchesFilter(issue, tracker) {
 	if (tracker.label !== void 0) {
 		const labels = issue["labels"];
-		return Array.isArray(labels) && labels.some((label) => object$2(label)["name"] === tracker.label);
+		return Array.isArray(labels) && labels.some((label) => object$3(label)["name"] === tracker.label);
 	}
-	return issue["milestone"] != null && object$2(issue["milestone"])["title"] === tracker.milestone;
+	return issue["milestone"] != null && object$3(issue["milestone"])["title"] === tracker.milestone;
 }
 /** Lists tracker issues and resolves manually included keys outside the filter. */
 function createGithubIssuesAdapter(options) {
@@ -13383,7 +13447,7 @@ function createGithubIssuesAdapter(options) {
 			if (error instanceof GithubIssuesHttpError && error.status === 404) throw new AdapterError("config", "GitHub Issues repository is unavailable");
 			throw error;
 		}
-		const match = milestones.map(object$2).find((entry) => entry["title"] === options.tracker.milestone);
+		const match = milestones.map(object$3).find((entry) => entry["title"] === options.tracker.milestone);
 		if (match === void 0) throw new AdapterError("config", "Configured GitHub milestone is missing");
 		return number(match["number"]);
 	}
@@ -13411,7 +13475,7 @@ function createGithubIssuesAdapter(options) {
 			}
 			const facts = /* @__PURE__ */ new Map();
 			for (const value of listed) {
-				const issue = object$2(value);
+				const issue = object$3(value);
 				if (issue["pull_request"] !== void 0) continue;
 				const fact = normalize(issue, options.id, options.tracker.repo, true);
 				facts.set(number(issue["number"]), fact);
@@ -13422,7 +13486,7 @@ function createGithubIssuesAdapter(options) {
 				const issueNo = issueNumber(ref, options.tracker.repo);
 				let fact = facts.get(issueNo);
 				if (fact === void 0) try {
-					const detail = object$2((await request(`${root}/issues/${String(issueNo)}`, ctx.signal)).value);
+					const detail = object$3((await request(`${root}/issues/${String(issueNo)}`, ctx.signal)).value);
 					if (detail["pull_request"] !== void 0) {
 						entities.push({
 							ref,
@@ -13483,7 +13547,7 @@ var JiraHttpError = class extends AdapterError {
 		this.status = status;
 	}
 };
-function object$1(value) {
+function object$2(value) {
 	if (value !== null && typeof value === "object" && !Array.isArray(value)) return value;
 	throw new AdapterError("transient", "Invalid Jira response");
 }
@@ -13543,10 +13607,10 @@ function sprintName(value) {
 	return null;
 }
 function issueFacts(value, trackerId, baseUrl, sprintField, inFilter) {
-	const issue = object$1(value);
-	const fields = object$1(issue["fields"]);
-	const status = object$1(fields["status"]);
-	const assignee = fields["assignee"] == null ? null : object$1(fields["assignee"]);
+	const issue = object$2(value);
+	const fields = object$2(issue["fields"]);
+	const status = object$2(fields["status"]);
+	const assignee = fields["assignee"] == null ? null : object$2(fields["assignee"]);
 	const key = string$2(issue["key"]);
 	const updated = string$2(fields["updated"]);
 	const updatedAt = new Date(updated);
@@ -13608,14 +13672,14 @@ function createJiraAdapter(options) {
 				if (error instanceof JiraHttpError && error.status === 404) throw new AdapterError("config", `Unknown Jira project key ${key}`);
 				throw error;
 			}
-			const names = new Set(array(result).flatMap((entry) => array(object$1(entry)["statuses"]).map((status) => string$2(object$1(status)["name"]))));
+			const names = new Set(array(result).flatMap((entry) => array(object$2(entry)["statuses"]).map((status) => string$2(object$2(status)["name"]))));
 			for (const name of [...tracker.doneStatuses, ...tracker.readyStatuses]) if (!names.has(name)) throw new AdapterError("config", `Unknown Jira status ${name} in project ${key}`);
 		}
 	}
 	async function findSprintField(tracker, signal) {
 		const fields = array(await request(tracker.baseUrl, "/rest/api/3/field", signal));
 		for (const field of fields) {
-			const entry = object$1(field);
+			const entry = object$2(field);
 			const schema = entry["schema"];
 			if (schema !== null && typeof schema === "object" && !Array.isArray(schema)) {
 				if (schema["custom"] === SPRINT_SCHEMA) return string$2(entry["id"]);
@@ -13650,7 +13714,7 @@ function createJiraAdapter(options) {
 				...token === void 0 ? {} : { nextPageToken: token }
 			}).toString()}` : "/rest/api/3/search/jql";
 			if (options.searchMethod === "GET" && new URL(path, tracker.baseUrl).href.length > MAX_GET_SEARCH_URL_LENGTH) throw new AdapterError("config", `Jira GET search URL is too long (over ${String(MAX_GET_SEARCH_URL_LENGTH)} characters)`);
-			const result = object$1(await request(tracker.baseUrl, path, signal, options.searchMethod === "GET" ? void 0 : body));
+			const result = object$2(await request(tracker.baseUrl, path, signal, options.searchMethod === "GET" ? void 0 : body));
 			issues.push(...array(result["issues"]));
 			const next = result["nextPageToken"];
 			if (next == null || next === "") {
@@ -13672,7 +13736,7 @@ function createJiraAdapter(options) {
 	async function fetchById(tracker, ref, signal, beforeRequest) {
 		try {
 			beforeRequest();
-			const issue = object$1(await request(tracker.baseUrl, `/rest/api/3/issue/${encodeURIComponent(ref.id)}`, signal));
+			const issue = object$2(await request(tracker.baseUrl, `/rest/api/3/issue/${encodeURIComponent(ref.id)}`, signal));
 			if (string$2(issue["id"]) !== ref.id) throw new AdapterError("transient", "Jira returned a different ticket id");
 			return issue;
 		} catch (error) {
@@ -13698,7 +13762,7 @@ function createJiraAdapter(options) {
 	}
 	async function fetchPending(tracker, ref, signal) {
 		try {
-			const issue = object$1(await request(tracker.baseUrl, `/rest/api/3/issue/${encodeURIComponent(ref.key)}`, signal));
+			const issue = object$2(await request(tracker.baseUrl, `/rest/api/3/issue/${encodeURIComponent(ref.key)}`, signal));
 			if (string$2(issue["key"]) !== ref.key) throw new AdapterError("transient", "Jira returned a different ticket key");
 			return {
 				status: "ok",
@@ -15254,7 +15318,7 @@ async function* recoverThreads(client, request, botIdentity) {
 }
 //#endregion
 //#region ../gateway-slack/src/socket.ts
-function object(value) {
+function object$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function value(value) {
@@ -15287,11 +15351,11 @@ function createSocket(api, config, botIdentity) {
 	async function handle(envelope) {
 		if (stopping || sink === void 0) return;
 		const type = value(envelope.type);
-		const body = object(envelope.body);
+		const body = object$1(envelope.body);
 		if (type === void 0 || body === null) return;
 		let events = [];
 		if (type === "events_api") {
-			const event = object(body.event);
+			const event = object$1(body.event);
 			const eventType = value(event?.type);
 			const channel = value(event?.channel);
 			if (event !== null && channel !== void 0 && (eventType === "message" || eventType === "app_mention")) {
@@ -15300,8 +15364,8 @@ function createSocket(api, config, botIdentity) {
 					...event,
 					type: "message"
 				} : event;
-				const nested = object(message.message);
-				const previous = object(message.previous_message);
+				const nested = object$1(message.message);
+				const previous = object$1(message.previous_message);
 				const threadTs = value(message.thread_ts) ?? value(nested?.thread_ts) ?? value(previous?.thread_ts);
 				const messageTs = value(message.ts) ?? value(nested?.ts);
 				const deletedRoot = message.subtype === "message_deleted" && threadTs === value(message.deleted_ts);
@@ -15312,8 +15376,8 @@ function createSocket(api, config, botIdentity) {
 				});
 			}
 		} else if (type === "interactive" || type === "block_actions") {
-			const actionMessage = object(body.message);
-			const channel = value(object(body.channel)?.id);
+			const actionMessage = object$1(body.message);
+			const channel = value(object$1(body.channel)?.id);
 			const ts = value(actionMessage?.ts);
 			const threadTs = value(actionMessage?.thread_ts) ?? ts;
 			const root = channel !== void 0 && threadTs !== void 0 && threadTs !== ts ? await rootFor(api, channel, threadTs) : actionMessage;
@@ -15509,6 +15573,86 @@ function createBoardModules(ctxFor, options = {}) {
 //#endregion
 //#region ../daemon/src/doctor.ts
 const TIMEOUT_MS = 5e3;
+const GITHUB_FIX = "Check the GitHub token and repository access.";
+const GITHUB_CHECKS_FIX = "Use a classic GitHub personal access token with the repo scope, authorized for organization SSO where required, to read check runs.";
+const GITHUB_TEAMS_FIX = "Use a classic GitHub personal access token with the repo and read:org scopes to read requested review teams.";
+const GITHUB_ORG_READ_SCOPES = /* @__PURE__ */ new Set([
+	"read:org",
+	"write:org",
+	"admin:org"
+]);
+const GITHUB_PROBE = `query DoctorGithubPermissions($owner: String!, $repo: String!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequests(first: 10, states: [OPEN], orderBy: {field: UPDATED_AT, direction: DESC}) {
+      nodes {
+        statusCheckRollup { contexts(first: 100) { nodes { ... on CheckRun { name } } } }
+        reviewRequests(first: 100) { nodes { requestedReviewer { ... on Team { name } } } }
+      }
+    }
+    defaultBranchRef { target { ... on Commit {
+      statusCheckRollup { contexts(first: 100) { nodes { ... on CheckRun { name } } } }
+    } } }
+  }
+}`;
+function object(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function scopedGithubError(value) {
+	const error = object(value);
+	const path = error?.["path"];
+	if (!Array.isArray(path)) return null;
+	const fields = path.filter((part) => typeof part === "string");
+	if (error?.["type"] === "FORBIDDEN" && fields.includes("statusCheckRollup") && fields.includes("contexts")) return GITHUB_CHECKS_FIX;
+	if (error?.["type"] === "INSUFFICIENT_SCOPES" && fields.includes("reviewRequests") && fields.includes("requestedReviewer") && fields.includes("name")) return GITHUB_TEAMS_FIX;
+	return null;
+}
+async function githubGraphql(ctx, fetcher, token, repo) {
+	const [owner, name] = repo.split("/");
+	if (!owner || !name) return null;
+	const controller = new AbortController();
+	const deadline = setTimeout(() => {
+		controller.abort();
+	}, TIMEOUT_MS);
+	const aborted = new Promise((_resolve, reject) => {
+		controller.signal.addEventListener("abort", () => {
+			reject(/* @__PURE__ */ new Error("GitHub doctor probe timed out"));
+		}, { once: true });
+	});
+	try {
+		return await ctx.logCall("doctor.github", async () => {
+			try {
+				return await Promise.race([(async () => {
+					const response = await fetcher("https://api.github.com/graphql", {
+						method: "POST",
+						headers: {
+							Authorization: `Bearer ${token}`,
+							Accept: "application/vnd.github+json",
+							"Content-Type": "application/json"
+						},
+						body: JSON.stringify({
+							query: GITHUB_PROBE,
+							variables: {
+								owner,
+								repo: name
+							}
+						}),
+						signal: controller.signal
+					});
+					return {
+						response,
+						body: response.ok ? await response.json() : null
+					};
+				})(), aborted]);
+			} catch {
+				throw new Error("GitHub doctor probe failed");
+			}
+		});
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(deadline);
+	}
+}
 function check(id, ok, fix) {
 	return {
 		id,
@@ -15578,13 +15722,29 @@ async function runDaemonDoctor(ctx, productVersion, fetcher = fetch) {
 	checks.push(check("jira.credentials", jiraOk, "Check the Jira account, API token, and project access."));
 	const githubToken = secrets["GITHUB_TOKEN"];
 	const githubRepos = new Set(config.projects.flatMap((project) => project.repos));
-	const githubOk = githubToken !== void 0 && (await Promise.all([...githubRepos].map(async (repo) => {
-		return (await request(ctx, fetcher, "github", `https://api.github.com/repos/${repo}`, { headers: {
+	const githubFailure = (githubToken === void 0 ? [GITHUB_FIX] : await Promise.all([...githubRepos].map(async (repo) => {
+		const response = await request(ctx, fetcher, "github", `https://api.github.com/repos/${repo}`, { headers: {
 			Authorization: `Bearer ${githubToken}`,
 			Accept: "application/vnd.github+json"
-		} }))?.ok === true;
-	}))).every(Boolean);
-	checks.push(check("github.credentials", githubOk, "Check the GitHub token and repository access."));
+		} });
+		if (response?.ok !== true) return GITHUB_FIX;
+		const probe = await githubGraphql(ctx, fetcher, githubToken, repo);
+		if (probe?.response.ok !== true) return GITHUB_FIX;
+		const payload = object(probe.body);
+		const errors = payload?.["errors"];
+		if (errors !== void 0) {
+			if (!Array.isArray(errors)) return GITHUB_FIX;
+			const scoped = errors.map(scopedGithubError).find((fix) => fix !== null);
+			if (scoped) return scoped;
+			if (errors.length > 0) return GITHUB_FIX;
+		}
+		const pullRequests = object(object(object(payload?.["data"])?.["repository"])?.["pullRequests"]);
+		if (!Array.isArray(pullRequests?.["nodes"])) return GITHUB_FIX;
+		const scopes = response.headers.get("x-oauth-scopes");
+		if (scopes !== null && !scopes.split(",").some((scope) => GITHUB_ORG_READ_SCOPES.has(scope.trim()))) return GITHUB_TEAMS_FIX;
+		return null;
+	}))).find((failure) => failure !== null) ?? null;
+	checks.push(check("github.credentials", githubFailure === null, githubFailure ?? GITHUB_FIX));
 	const spur = await request(ctx, fetcher, "spur", new URL("sessions", `${config.adapters.spur.baseUrl.replace(/\/$/, "")}/`));
 	checks.push(check("spur.api", spur?.ok === true, "Start or correct the configured Spur API."));
 	if (!slackConfigured) checks.push(warning("slack.configured", "Slack is not configured: questions addressed to you are only visible through board inbox. Run the spur-board-setup skill to configure slack.channels."));