terminalhire 0.35.4 → 0.36.1

package/README.md

@@ -212,7 +212,7 @@ GitHub (optional enrichment):
 ## Local profile encryption
 
 - Algorithm: **AES-256-GCM** via Node built-in `crypto` (no external deps).
-- Key: stored at `~/.terminalhire/key` with `0600` permissions. If `keytar` is installed, the OS keychain is preferred and the key file is not written.
+- Key: stored at `~/.terminalhire/key` with `0600` permissions (a plaintext key file). In a compiled build the OS keychain is **not** used for these stores — the cross-platform plugin ships without `node_modules` and can't reach one. See `docs/adr-002` (keychain promotion is tracked as TERM-9).
 - Profile file: `~/.terminalhire/profile.enc` — JSON blob `{ iv, tag, ciphertext }` (all hex-encoded).
 - GitHub token file: `~/.terminalhire/github-token.enc` — same format, same key.
 

package/dist/bin/claim-push-bg.js

@@ -1,52 +1,12 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
 
 // src/claims.ts
 var claims_exports = {};
@@ -259,21 +219,7 @@ var KEY_FILE = join(TERMINALHIRE_DIR, "key");
 var ALGO = "aes-256-gcm";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync(TERMINALHIRE_DIR, { recursive: true, mode: 448 });
   if (existsSync(KEY_FILE)) {
     return Buffer.from(readFileSync(KEY_FILE, "utf8").trim(), "hex");

package/dist/bin/jpi-bounties.js

@@ -1,36 +1,13 @@
 #!/usr/bin/env node
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 function isBounty(job) {
@@ -1748,6 +1725,32 @@ async function openPRClosingRefs(owner, name, token, signal, governor) {
     return null;
   }
 }
+async function issueCrossRefPRAttempts(owner, name, issueNumber, token, signal, governor) {
+  const url = `https://api.github.com/repos/${owner}/${name}/issues/${issueNumber}/timeline?per_page=100`;
+  try {
+    const res = governor ? await governor.get(url, { headers: ghHeaders(token), signal }) : await fetch(url, { headers: ghHeaders(token), signal });
+    if (!res || !res.ok) return null;
+    const link = res.headers?.get("link") ?? null;
+    const hasNextPage = link != null && /\brel="next"/.test(link);
+    const events = await res.json();
+    if (!Array.isArray(events)) return null;
+    if (hasNextPage || events.length >= 100) return null;
+    let hasOpenPR = false;
+    let hasClosedPR = false;
+    const prNumbers = [];
+    for (const ev of events) {
+      if (ev?.event !== "cross-referenced") continue;
+      const src = ev.source?.issue;
+      if (!src || src.pull_request == null) continue;
+      if (typeof src.number === "number") prNumbers.push(src.number);
+      if (src.state === "open") hasOpenPR = true;
+      else if (src.state === "closed") hasClosedPR = true;
+    }
+    return { hasOpenPR, hasClosedPR, prNumbers };
+  } catch {
+    return null;
+  }
+}
 function makeScoringGovernor(governor) {
   return governor ?? makeGitHubGovernor(
     ((url, init) => fetch(url, init)),
@@ -3925,6 +3928,30 @@ var init_feeds = __esm({
 });
 
 // ../../packages/core/src/feeds/contributions.ts
+function readSearchMaxPages() {
+  const raw = process.env["CONTRIB_SEARCH_MAX_PAGES"];
+  if (raw == null) return DEFAULT_SEARCH_MAX_PAGES;
+  const n = Number.parseInt(raw, 10);
+  if (Number.isNaN(n)) return DEFAULT_SEARCH_MAX_PAGES;
+  return Math.min(Math.max(n, MIN_SEARCH_MAX_PAGES), MAX_SEARCH_MAX_PAGES);
+}
+function readMaxContribItems() {
+  const raw = process.env["CONTRIB_MAX_ITEMS"];
+  if (raw == null) return DEFAULT_MAX_CONTRIB_ITEMS;
+  const n = Number.parseInt(raw, 10);
+  if (Number.isNaN(n)) return DEFAULT_MAX_CONTRIB_ITEMS;
+  return Math.min(Math.max(n, MIN_MAX_CONTRIB_ITEMS), MAX_MAX_CONTRIB_ITEMS);
+}
+function readMaxContribIssuesScanned() {
+  const raw = process.env["CONTRIB_MAX_ISSUES_SCANNED"];
+  if (raw == null) return DEFAULT_MAX_CONTRIB_ISSUES_SCANNED;
+  const n = Number.parseInt(raw, 10);
+  if (Number.isNaN(n)) return DEFAULT_MAX_CONTRIB_ISSUES_SCANNED;
+  return Math.min(
+    Math.max(n, MIN_MAX_CONTRIB_ISSUES_SCANNED),
+    MAX_MAX_CONTRIB_ISSUES_SCANNED
+  );
+}
 function authHeaders2() {
   const token = process.env["GITHUB_TOKEN"] ?? process.env["GH_TOKEN"];
   const h = {
@@ -4012,13 +4039,21 @@ async function fetchRateLimit(client) {
 }
 async function searchContribIssues(client, queries) {
   const byUrl = /* @__PURE__ */ new Map();
+  const maxPages = readSearchMaxPages();
   for (const q of queries) {
-    const res = await client.json(
-      `/search/issues?q=${encodeURIComponent(q)}&sort=created&order=desc&per_page=${SEARCH_PER_PAGE2}`
-    );
-    for (const it of res?.items ?? []) {
-      if (it.pull_request) continue;
-      if (!byUrl.has(it.html_url)) byUrl.set(it.html_url, it);
+    for (let page = 1; page <= maxPages; page++) {
+      const res = await client.json(
+        `/search/issues?q=${encodeURIComponent(q)}&sort=created&order=desc&per_page=${SEARCH_PER_PAGE2}&page=${page}`
+      );
+      const items = res?.items;
+      if (items == null) break;
+      for (const it of items) {
+        if (it.pull_request) continue;
+        if (!byUrl.has(it.html_url)) byUrl.set(it.html_url, it);
+      }
+      if (items.length < SEARCH_PER_PAGE2) break;
+      const stats = client.getStats();
+      if (stats.budgetAborted || stats.secondaryAborted) break;
     }
   }
   return [...byUrl.values()].sort(
@@ -4079,10 +4114,14 @@ async function aggregateContributions(opts = {}) {
     probeTimeoutMs: opts.fetchImpl ? null : PROBE_TIMEOUT_MS
   });
   const queries = opts.queries ?? CONTRIB_SEARCH_QUERIES;
+  const maxContribItems = readMaxContribItems();
   const startRl = await fetchRateLimit(client);
   const coreHealthyAtStart = (startRl?.core?.remaining ?? 0) >= 500;
   client.setSecondaryHint(coreHealthyAtStart);
-  const issues = (await searchContribIssues(client, queries)).slice(0, MAX_CONTRIB_ISSUES_SCANNED);
+  const issues = (await searchContribIssues(client, queries)).slice(
+    0,
+    readMaxContribIssuesScanned()
+  );
   const repoCache = /* @__PURE__ */ new Map();
   const contribCache = /* @__PURE__ */ new Map();
   const prRefsCache = /* @__PURE__ */ new Map();
@@ -4172,7 +4211,7 @@ async function aggregateContributions(opts = {}) {
   let contribUndefined = 0;
   let prRefsNull = 0;
   for (const issue of issues) {
-    if (jobs.length >= MAX_CONTRIB_ITEMS) break;
+    if (jobs.length >= maxContribItems) break;
     const fullName = repoFullNameFromApiUrl2(issue.repository_url);
     if (!fullName) continue;
     const id = `contribute:${repoKey(fullName)}#${issue.number}`;
@@ -4230,7 +4269,7 @@ async function aggregateContributions(opts = {}) {
   const doDiscovery = opts.discoverRepos ?? (opts.trendingSlugs != null || opts.vocabTerms != null);
   let discoveredEmitted = 0;
   let discoveryBudgetStopped = false;
-  if (doDiscovery && jobs.length < MAX_CONTRIB_ITEMS) {
+  if (doDiscovery && jobs.length < maxContribItems) {
     const maxRepos = Math.min(
       Math.max(0, opts.maxDiscoveredRepos ?? MAX_DISCOVERED_REPOS),
       MAX_DISCOVERED_REPOS
@@ -4283,7 +4322,7 @@ async function aggregateContributions(opts = {}) {
     }
     const scanned = candidates.slice(0, maxRepos);
     for (const fullName of scanned) {
-      if (jobs.length >= MAX_CONTRIB_ITEMS) break;
+      if (jobs.length >= maxContribItems) break;
       if (client.getStats().budgetAborted || client.getStats().secondaryAborted) {
         discoveryBudgetStopped = true;
         break;
@@ -4308,7 +4347,7 @@ async function aggregateContributions(opts = {}) {
       const repoIssues = (searchRes?.items ?? []).filter((it) => !it.pull_request);
       let perRepoDiscovered = 0;
       for (const issue of repoIssues) {
-        if (jobs.length >= MAX_CONTRIB_ITEMS) break;
+        if (jobs.length >= maxContribItems) break;
         if (perRepoDiscovered >= MAX_ISSUES_PER_DISCOVERED_REPO) break;
         if ((perRepo.get(repoKey(fullName)) ?? 0) >= MAX_BOUNTIES_PER_DISCOVERED_REPO) break;
         const id = `contribute:${repoKey(fullName)}#${issue.number}`;
@@ -4373,7 +4412,7 @@ async function aggregateContributions(opts = {}) {
   }
   return jobs;
 }
-var GITHUB_API2, CONTRIB_LABEL_QUERIES, CONTRIB_LANGUAGE_QUERIES, CONTRIB_SEARCH_QUERIES, SEARCH_PER_PAGE2, MAX_CONTRIB_ITEMS, MAX_CONTRIB_ISSUES_SCANNED, MAX_DISCOVERED_REPOS, MAX_ISSUES_PER_DISCOVERED_REPO, DISCOVERY_REPOS_PER_TERM, DISCOVERY_VOCAB_TERMS, DISCOVERY_ISSUE_LABELS, repoKey;
+var GITHUB_API2, CONTRIB_LABEL_QUERIES, CONTRIB_LANGUAGE_QUERIES, CONTRIB_SEARCH_QUERIES, SEARCH_PER_PAGE2, DEFAULT_SEARCH_MAX_PAGES, MIN_SEARCH_MAX_PAGES, MAX_SEARCH_MAX_PAGES, DEFAULT_MAX_CONTRIB_ITEMS, MIN_MAX_CONTRIB_ITEMS, MAX_MAX_CONTRIB_ITEMS, DEFAULT_MAX_CONTRIB_ISSUES_SCANNED, MIN_MAX_CONTRIB_ISSUES_SCANNED, MAX_MAX_CONTRIB_ISSUES_SCANNED, MAX_DISCOVERED_REPOS, MAX_ISSUES_PER_DISCOVERED_REPO, DISCOVERY_REPOS_PER_TERM, DISCOVERY_VOCAB_TERMS, DISCOVERY_ISSUE_LABELS, repoKey;
 var init_contributions = __esm({
   "../../packages/core/src/feeds/contributions.ts"() {
     "use strict";
@@ -4392,7 +4431,11 @@ var init_contributions = __esm({
       'label:"good-first-issue" type:issue state:open',
       'label:"help wanted" type:issue state:open',
       'label:"help-wanted" type:issue state:open',
-      'label:"up-for-grabs" type:issue state:open'
+      'label:"up-for-grabs" type:issue state:open',
+      // supply-expansion D: two more first-contribution label families widen the
+      // global newest-first slice WITHOUT relaxing the credential gate.
+      'label:"beginner-friendly" type:issue state:open',
+      'label:"first-timers-only" type:issue state:open'
     ];
     CONTRIB_LANGUAGE_QUERIES = [
       ...["rust", "go", "python", "c++", "ruby"].map(
@@ -4400,12 +4443,30 @@ var init_contributions = __esm({
       ),
       ...["rust", "go"].map(
         (lang) => `label:"good first issue" language:${lang} type:issue state:open`
+      ),
+      // supply-expansion D: cover the high-volume web/enterprise ecosystems the
+      // original set omitted. TS/JS were previously left out of "good first issue"
+      // (the global slice over-represented them) but a LANGUAGE-scoped page surfaces
+      // DIFFERENT repos than the global newest-first slice, so re-including them widens
+      // distinct-repo coverage rather than duplicating it.
+      ...["typescript", "javascript", "java", "python"].map(
+        (lang) => `label:"good first issue" language:${lang} type:issue state:open`
+      ),
+      ...["typescript", "javascript", "c#", "php"].map(
+        (lang) => `label:"help wanted" language:${lang} type:issue state:open`
       )
     ];
     CONTRIB_SEARCH_QUERIES = [...CONTRIB_LABEL_QUERIES, ...CONTRIB_LANGUAGE_QUERIES];
     SEARCH_PER_PAGE2 = 100;
-    MAX_CONTRIB_ITEMS = 150;
-    MAX_CONTRIB_ISSUES_SCANNED = 600;
+    DEFAULT_SEARCH_MAX_PAGES = 1;
+    MIN_SEARCH_MAX_PAGES = 1;
+    MAX_SEARCH_MAX_PAGES = 5;
+    DEFAULT_MAX_CONTRIB_ITEMS = 400;
+    MIN_MAX_CONTRIB_ITEMS = 50;
+    MAX_MAX_CONTRIB_ITEMS = 1e3;
+    DEFAULT_MAX_CONTRIB_ISSUES_SCANNED = 1500;
+    MIN_MAX_CONTRIB_ISSUES_SCANNED = 100;
+    MAX_MAX_CONTRIB_ISSUES_SCANNED = 5e3;
     MAX_DISCOVERED_REPOS = 15;
     MAX_ISSUES_PER_DISCOVERED_REPO = 3;
     DISCOVERY_REPOS_PER_TERM = 20;
@@ -8387,6 +8448,7 @@ __export(src_exports, {
   isOverIntroLimit: () => isOverIntroLimit,
   isTrivialPRTitle: () => isTrivialPRTitle,
   isWinnableIssue: () => isWinnableIssue,
+  issueCrossRefPRAttempts: () => issueCrossRefPRAttempts,
   jobShortToken: () => jobShortToken,
   joinLabels: () => joinLabels,
   labelFor: () => labelFor,
@@ -8458,23 +8520,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/crypto-store.ts
 import {
   createCipheriv,
@@ -8519,10 +8564,10 @@ function decrypt(blob, key) {
 function skipKeychain() {
   return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
 }
-async function tryLoadFromKeytar(policy) {
+async function tryLoadFromKeytar() {
   if (forceKeytarUnavailableForTests || skipKeychain()) return null;
   try {
-    const kt = policy === "keychain-required" ? createRequire(import.meta.url)("keytar") : await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+    const kt = createRequire(import.meta.url)("keytar");
     const stored = await kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     if (stored) {
       return Buffer.from(stored, "hex");
@@ -8563,7 +8608,7 @@ async function deleteKey() {
   }
   if (!forceKeytarUnavailableForTests && !skipKeychain()) {
     try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+      const kt = createRequire(import.meta.url)("keytar");
       await kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     } catch {
     }
@@ -8575,15 +8620,13 @@ async function deleteKey() {
 }
 async function resolveKey(filePath, opts) {
   if (opts.keyPolicy === "keychain-required") {
-    const key = await tryLoadFromKeytar("keychain-required");
+    const key = await tryLoadFromKeytar();
     if (!key) {
       warnStderr(`crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`);
       return null;
     }
     return key;
   }
-  const fromKeytar = await tryLoadFromKeytar("keytar-first-file-fallback");
-  if (fromKeytar) return fromKeytar;
   return loadOrCreateFileKey();
 }
 function createEncryptedStore(filePath, opts) {

package/dist/bin/jpi-chat-read.js

@@ -1,32 +1,8 @@
 #!/usr/bin/env node
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 var init_types = __esm({
@@ -892,7 +868,11 @@ var init_contributions = __esm({
       'label:"good-first-issue" type:issue state:open',
       'label:"help wanted" type:issue state:open',
       'label:"help-wanted" type:issue state:open',
-      'label:"up-for-grabs" type:issue state:open'
+      'label:"up-for-grabs" type:issue state:open',
+      // supply-expansion D: two more first-contribution label families widen the
+      // global newest-first slice WITHOUT relaxing the credential gate.
+      'label:"beginner-friendly" type:issue state:open',
+      'label:"first-timers-only" type:issue state:open'
     ];
     CONTRIB_LANGUAGE_QUERIES = [
       ...["rust", "go", "python", "c++", "ruby"].map(
@@ -900,6 +880,17 @@ var init_contributions = __esm({
       ),
       ...["rust", "go"].map(
         (lang) => `label:"good first issue" language:${lang} type:issue state:open`
+      ),
+      // supply-expansion D: cover the high-volume web/enterprise ecosystems the
+      // original set omitted. TS/JS were previously left out of "good first issue"
+      // (the global slice over-represented them) but a LANGUAGE-scoped page surfaces
+      // DIFFERENT repos than the global newest-first slice, so re-including them widens
+      // distinct-repo coverage rather than duplicating it.
+      ...["typescript", "javascript", "java", "python"].map(
+        (lang) => `label:"good first issue" language:${lang} type:issue state:open`
+      ),
+      ...["typescript", "javascript", "c#", "php"].map(
+        (lang) => `label:"help wanted" language:${lang} type:issue state:open`
       )
     ];
     CONTRIB_SEARCH_QUERIES = [...CONTRIB_LABEL_QUERIES, ...CONTRIB_LANGUAGE_QUERIES];
@@ -4107,23 +4098,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/github-auth.ts
 import {
   createCipheriv,
@@ -4140,21 +4114,7 @@ import {
 } from "fs";
 import { join as join2 } from "path";
 import { homedir } from "os";
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes3(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync(TERMINALHIRE_DIR, { recursive: true, mode: 448 });
   if (existsSync(KEY_FILE)) {
     return Buffer.from(readFileSync2(KEY_FILE, "utf8").trim(), "hex");

package/dist/bin/jpi-chat.js

@@ -1,36 +1,13 @@
 #!/usr/bin/env node
-var __create = Object.create;
 var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __commonJS = (cb, mod2) => function __require() {
-  return mod2 || (0, cb[__getOwnPropNames(cb)[0]])((mod2 = { exports: {} }).exports, mod2), mod2.exports;
-};
 var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__getProtoOf(mod2)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod2 || !mod2.__esModule ? __defProp(target, "default", { value: mod2, enumerable: true }) : target,
-  mod2
-));
 
 // ../../packages/core/src/types.ts
 var init_types = __esm({
@@ -909,7 +886,11 @@ var init_contributions = __esm({
       'label:"good-first-issue" type:issue state:open',
       'label:"help wanted" type:issue state:open',
       'label:"help-wanted" type:issue state:open',
-      'label:"up-for-grabs" type:issue state:open'
+      'label:"up-for-grabs" type:issue state:open',
+      // supply-expansion D: two more first-contribution label families widen the
+      // global newest-first slice WITHOUT relaxing the credential gate.
+      'label:"beginner-friendly" type:issue state:open',
+      'label:"first-timers-only" type:issue state:open'
     ];
     CONTRIB_LANGUAGE_QUERIES = [
       ...["rust", "go", "python", "c++", "ruby"].map(
@@ -917,6 +898,17 @@ var init_contributions = __esm({
       ),
       ...["rust", "go"].map(
         (lang) => `label:"good first issue" language:${lang} type:issue state:open`
+      ),
+      // supply-expansion D: cover the high-volume web/enterprise ecosystems the
+      // original set omitted. TS/JS were previously left out of "good first issue"
+      // (the global slice over-represented them) but a LANGUAGE-scoped page surfaces
+      // DIFFERENT repos than the global newest-first slice, so re-including them widens
+      // distinct-repo coverage rather than duplicating it.
+      ...["typescript", "javascript", "java", "python"].map(
+        (lang) => `label:"good first issue" language:${lang} type:issue state:open`
+      ),
+      ...["typescript", "javascript", "c#", "php"].map(
+        (lang) => `label:"help wanted" language:${lang} type:issue state:open`
       )
     ];
     CONTRIB_SEARCH_QUERIES = [...CONTRIB_LABEL_QUERIES, ...CONTRIB_LANGUAGE_QUERIES];
@@ -4135,23 +4127,6 @@ var init_src = __esm({
   }
 });
 
-// ../../node_modules/keytar/lib/keytar.js
-var require_keytar = __commonJS({
-  "../../node_modules/keytar/lib/keytar.js"(exports, module) {
-    "use strict";
-    function disabled() {
-      throw new Error("keytar disabled in this dev checkout (keychain popup guard) \u2014 key-file fallback expected");
-    }
-    module.exports = {
-      getPassword: disabled,
-      setPassword: disabled,
-      deletePassword: disabled,
-      findPassword: disabled,
-      findCredentials: disabled
-    };
-  }
-});
-
 // src/github-auth.ts
 import {
   createCipheriv,
@@ -4168,21 +4143,7 @@ import {
 } from "fs";
 import { join as join2 } from "path";
 import { homedir } from "os";
-function skipKeychain() {
-  return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
-}
 async function loadKey() {
-  if (!skipKeychain()) {
-    try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
-      const stored = await kt.getPassword("terminalhire", "profile-key");
-      if (stored) return Buffer.from(stored, "hex");
-      const key2 = randomBytes3(KEY_BYTES);
-      await kt.setPassword("terminalhire", "profile-key", key2.toString("hex"));
-      return key2;
-    } catch {
-    }
-  }
   mkdirSync(TERMINALHIRE_DIR, { recursive: true, mode: 448 });
   if (existsSync(KEY_FILE)) {
     return Buffer.from(readFileSync2(KEY_FILE, "utf8").trim(), "hex");
@@ -5072,13 +5033,13 @@ function decrypt2(blob, key) {
   ]);
   return plain.toString("utf8");
 }
-function skipKeychain2() {
+function skipKeychain() {
   return process.env.TERMINALHIRE_NO_KEYCHAIN !== void 0 || process.env.CI !== void 0 || process.env.VITEST !== void 0 || process.env.NODE_ENV === "test";
 }
-async function tryLoadFromKeytar(policy) {
-  if (forceKeytarUnavailableForTests || skipKeychain2()) return null;
+async function tryLoadFromKeytar() {
+  if (forceKeytarUnavailableForTests || skipKeychain()) return null;
   try {
-    const kt = policy === "keychain-required" ? createRequire(import.meta.url)("keytar") : await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+    const kt = createRequire(import.meta.url)("keytar");
     const stored = await kt.getPassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     if (stored) {
       return Buffer.from(stored, "hex");
@@ -5117,9 +5078,9 @@ async function deleteKey() {
     } catch {
     }
   }
-  if (!forceKeytarUnavailableForTests && !skipKeychain2()) {
+  if (!forceKeytarUnavailableForTests && !skipKeychain()) {
     try {
-      const kt = await Promise.resolve().then(() => __toESM(require_keytar(), 1));
+      const kt = createRequire(import.meta.url)("keytar");
       await kt.deletePassword(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
     } catch {
     }
@@ -5131,15 +5092,13 @@ async function deleteKey() {
 }
 async function resolveKey(filePath, opts) {
   if (opts.keyPolicy === "keychain-required") {
-    const key = await tryLoadFromKeytar("keychain-required");
+    const key = await tryLoadFromKeytar();
     if (!key) {
       warnStderr(`crypto-store: OS keychain unavailable \u2014 store at ${filePath} is disabled (no plaintext key file will be written)`);
       return null;
     }
     return key;
   }
-  const fromKeytar = await tryLoadFromKeytar("keytar-first-file-fallback");
-  if (fromKeytar) return fromKeytar;
   return loadOrCreateFileKey();
 }
 function createEncryptedStore(filePath, opts) {