fix(queue): debounce PR-write permission refreshes

[JSONbored]

Motivation

• A hot error path invoked refreshInstallationHealthForInstallation on any PR-write 403, which can be caused by rate limits or operation-specific forbidden errors and creates an availability/cost amplification risk.
• The intent is to preserve self-healing for genuine permission downgrades while avoiding expensive, unthrottled refreshes from non-permission 403s.

Description

• Add a narrow predicate shouldRefreshInstallationHealthAfterPrWriteFailure that returns true only for numeric 403 errors with a permission-looking message and that rejects rate-limit/secondary-limit errors via isGitHubRateLimitedError and githubErrorStatus.
• Introduce a per-installation cooldown (INSTALLATION_HEALTH_REFRESH_COOLDOWN_MS, 5 minutes) with an in-memory Map to debounce repeated refresh attempts for the same installation.
• Replace the previous unconditional catch-path refresh with the new predicate so the expensive refreshInstallationHealthForInstallation is only invoked when appropriate.
• Add unit tests in test/unit/agent-action-executor.test.ts covering: rate-limit/operation-specific 403s do not refresh, permission-looking 403 still triggers a refresh, cooldown debounces repeated refreshes, and the refresh-failure path remains best-effort.

Testing

• Ran git diff --check which produced no issues locally. (passed)
• Ran npm run typecheck which completed with no type errors. (passed)
• Ran the unit tests via npx vitest run test/unit/agent-action-executor.test.ts after adding the new tests; the suite passed (50 tests passed). (passed)
• Attempted npm run test:ci and npm audit --audit-level=moderate but these were blocked in the local environment due to external network/setup issues (actionlint setup could not reach github.com and the npm audit endpoint returned 403). (blocked)

---

Codex Task

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-02 07:18:08 UTC}

2 files · 1 AI reviewer · no blockers · readiness 86/100 · CI green · clean

⏸️ Suggested Action - Manual Review

• Touches a guarded path — held for manual review

Review summary
This change narrows the PR-write 403 self-healing path and adds a per-installation cooldown before calling the expensive installation health refresh. The core wiring is in the right place: it still runs only after a failed live PR-write action, preserves the recorded action error, and filters rate-limit 403s before refreshing. The main remaining concern is maintainability of the process-local cooldown state and the narrowness of the message predicate coverage, not a visible correctness break.

Nits — 6 non-blocking

• nit: src/services/agent-action-executor.ts:28 keeps installation IDs in `installationHealthRefreshAttempts` forever, so a long-lived self-host process can accumulate stale entries; prune expired entries or delete/rewrite on access.
• nit: test/unit/agent-action-executor.test.ts:519 uses unique installation IDs to avoid the module-level cooldown state, but the state has no explicit reset hook, which makes future tests in this module easier to couple accidentally.
• nit: test/unit/agent-action-executor.test.ts:519 covers an operation-specific 403 that says `not allowed`, but the production predicate also accepts `not have permission`; add a negative test for an operation-specific message using that wording or tighten the regex.
• In src/services/agent-action-executor.ts:28, store attempts through a small helper that drops entries older than `INSTALLATION_HEALTH_REFRESH_COOLDOWN_MS` before checking the current installation.
• In test/unit/agent-action-executor.test.ts:519, add a test case for a non-permission 403 whose message contains `not have permission` so the broad predicate cannot silently regress the debounce goal.
• Touches a guarded path — held for manual review — A maintainer must review and merge this change.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (size label size:S; no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 65 registered-repo PR(s), 55 merged, 548 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 65 PR(s), 548 issue(s).
Gate result	⚠️ Not blocking	Advisory; not blocking this PR.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 65 PR(s), 548 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Triage stale or unlinked PRs.
• No action.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.95%. Comparing base (853ec9a) to head (b7f2fe7).
⚠️ Report is 31 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2514      +/-   ##
==========================================
+ Coverage   95.93%   95.95%   +0.01%     
==========================================
  Files         225      226       +1     
  Lines       25336    25396      +60     
  Branches     9217     9237      +20     
==========================================
+ Hits        24306    24368      +62     
  Misses        417      417              
+ Partials      613      611       -2     

Files with missing lines	Coverage Δ
src/services/agent-action-executor.ts	93.33% <100.00%> (+0.54%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.