feat(commands): add @gittensory configuration effective-config command (#2168)

src/github/configuration-command.ts

@@ -0,0 +1,30 @@
+import { parseGittensoryMentionCommand } from "./commands";
+import type { GitHubWebhookPayload } from "../types";
+
+/** The validated request for a `@gittensory configuration` command, `null` when the comment is not that command,
+ *  or a skip reason. PURE so every guard (wrong action, bot author, missing repo/issue/installation/actor) is
+ *  exhaustively unit-tested without the webhook harness; the processor then carries a single `ok` branch. Unlike
+ *  the issue-only planner, configuration is repo-level and answers on either a PR or an issue thread. (#2168) */
+export type ConfigurationCommandRequest =
+  | { ok: true; repoFullName: string; installationId: number; actor: string; issueNumber: number }
+  | { ok: false; reason: string; repoFullName: string | null; actor: string | null; targetKey: string | null };
+
+export function classifyConfigurationCommandRequest(
+  payload: GitHubWebhookPayload,
+  installationId: number | null,
+): ConfigurationCommandRequest | null {
+  const comment = payload.comment;
+  const command = parseGittensoryMentionCommand(comment?.body);
+  if (!command || command.name !== "configuration") return null; // not our command — fall through to other handlers
+  const repoFullName = payload.repository?.full_name ?? null;
+  const issue = payload.issue ?? null;
+  const actor = payload.sender?.login ?? comment?.user?.login ?? null;
+  const targetKey = repoFullName && issue ? `${repoFullName}#${issue.number}` : repoFullName;
+  if (payload.action !== "created" || comment?.user?.type === "Bot" || payload.sender?.type === "Bot" || /\[bot\]$/i.test(actor ?? "")) {
+    return { ok: false, reason: "unsupported_comment_action_or_bot", repoFullName, actor, targetKey };
+  }
+  if (!repoFullName || !issue || !installationId || !actor) {
+    return { ok: false, reason: "missing_repo_issue_installation_or_actor", repoFullName, actor, targetKey };
+  }
+  return { ok: true, repoFullName, installationId, actor, issueNumber: issue.number };
+}

src/queue/processors.ts

@@ -419,6 +419,8 @@ import {
   isPlanCommand,
   isPlannerEnabled,
 } from "../review/planner";
+import { classifyConfigurationCommandRequest } from "../github/configuration-command";
+import { summarizeEffectiveConfig } from "../settings/effective-config-summary";
 import {
   buildReviewGroundingText,
   checkSummaryText as checkFailureSummaryText,
@@ -5512,7 +5514,7 @@ async function processGitHubWebhook(
     if (eventName === "issue_comment" && (await maybeProcessResolveCommand(env, deliveryId, payload))) { await recordWebhookEvent(env, { deliveryId, eventName, action: payload.action, installationId: payload.installation?.id, repositoryFullName: payload.repository?.full_name, payloadHash: "processed", status: "processed" }); return; }
     if (
       eventName === "issue_comment" &&
-      (await maybeProcessResolveCommand(env, deliveryId, payload))
+      (await maybeProcessConfigurationCommand(env, deliveryId, payload))
     ) {
       await recordWebhookEvent(env, {
         deliveryId,
@@ -10439,204 +10441,72 @@ async function maybeProcessResolveCommand(env: Env, deliveryId: string, payload:
   await recordAuditEvent(env, { eventType: "github_app.finding_resolved", actor: req.actor, targetKey, outcome: "completed", detail: `Marked ${resolvedLabel} as resolved.`, metadata: { deliveryId, repoFullName: req.repoFullName, scope: findingRef.scope, resolvedWarningCount: selection.findings.length, recordedSuppressionCount, ...(findingRef.scope === "single" ? { findingCode: findingRef.findingCode } : {}) } });
   await recordGithubProductUsage(env, "finding_resolved", { actor: req.actor, repoFullName: req.repoFullName, targetKey, outcome: "completed", metadata: { scope: findingRef.scope, resolvedWarningCount: selection.findings.length, recordedSuppressionCount, ...(findingRef.scope === "single" ? { findingCode: findingRef.findingCode } : {}) } }); return true; }
 /**
- * `@gittensory resolve [<finding-id>]` (#2166 dispatch scaffold). A maintainer records that a posted review
- * finding (or every finding on the PR when no id is supplied) is resolved so it stops re-surfacing in future
- * passes. Contributor scope stops at authorization + `github_app.finding_resolved` audit/usage + a public
- * confirmation — suppression semantics that feed the next review are maintainer-owned (#1964).
+ * `@gittensory configuration` (#2168): post the EFFECTIVE resolved review config (yml>DB>defaults) as a
+ * public-safe comment so a maintainer can see what's actually in force without the dashboard. Read-only — it never
+ * mutates the PR, so unlike gate-override it always answers a maintainer's direct query (the displayed execution
+ * mode still reflects a pause). Honors the repo's per-repo `commandAuthorization` for `configuration` over the REAL
+ * repo permission (never the spoofable comment author_association). Returns true once it owns the event; a
+ * non-configuration comment returns false and falls through to the other command handlers.
  */
-async function maybeProcessResolveCommand(
+async function maybeProcessConfigurationCommand(
   env: Env,
   deliveryId: string,
   payload: GitHubWebhookPayload,
 ): Promise<boolean> {
-  const command = parseGittensoryMentionCommand(payload.comment?.body);
-  if (!command || command.name !== "resolve") return false;
-
-  const req = classifyPrCommandRequest(payload, getInstallationId(payload));
+  const req = classifyConfigurationCommandRequest(payload, getInstallationId(payload));
+  if (!req) return false;
   if (!req.ok) {
-    await recordFindingResolvedSkip(
-      env,
-      deliveryId,
-      req.repoFullName,
-      req.targetKey,
-      req.actor,
-      req.reason,
-    );
-    return true;
-  }
-  const targetKey = `${req.repoFullName}#${req.pr.number}`;
-  const [pr, settings] = await Promise.all([
-    getPullRequest(env, req.repoFullName, req.pr.number),
-    resolveRepositorySettings(env, req.repoFullName),
-  ]);
-  if (!pr) {
-    await recordFindingResolvedSkip(
-      env,
-      deliveryId,
-      req.repoFullName,
-      targetKey,
-      req.actor,
-      "cached_pr_missing",
-    );
+    await recordConfigurationSkip(env, deliveryId, req.repoFullName, req.targetKey, req.actor, req.reason);
     return true;
   }
-
-  const { authorization } = await authorizePrActionActor({
-    env,
-    deliveryId,
-    installationId: req.installationId,
-    repoFullName: req.repoFullName,
-    issue: payload.issue!,
-    actor: req.actor,
-    commandName: "resolve" as GittensoryMentionCommandName,
-    settings,
-    pr,
+  const targetKey = `${req.repoFullName}#${req.issueNumber}`;
+  const settings = await resolveRepositorySettings(env, req.repoFullName);
+  const association = await resolveRealRepoPermissionAssociation(env, req.installationId, req.repoFullName, req.actor);
+  const authorization = evaluateCommandAuthorization({
+    policy: settings.commandAuthorization,
+    commandName: "configuration",
+    commenterLogin: req.actor,
+    commenterAssociation: association,
   });
   if (!authorization.authorized) {
-    await recordAuditEvent(env, {
-      eventType: "github_app.finding_resolved_denied",
-      actor: req.actor,
-      targetKey,
-      outcome: "denied",
-      detail: authorization.reason,
-      metadata: {
-        deliveryId,
-        repoFullName: req.repoFullName,
-        allowedRoles: commandAuthorizationAllowedRoles(
-          settings.commandAuthorization,
-          "resolve",
-        ),
-      },
-    });
-    await recordGithubProductUsage(env, "finding_resolved_denied", {
-      actor: req.actor,
-      repoFullName: req.repoFullName,
-      targetKey,
-      outcome: "denied",
-      metadata: {
-        reason: authorization.reason,
-        actorKind: authorization.actorKind,
-        allowedRoles: commandAuthorizationAllowedRoles(
-          settings.commandAuthorization,
-          "resolve",
-        ),
-      },
-    });
+    await recordConfigurationSkip(env, deliveryId, req.repoFullName, targetKey, req.actor, authorization.reason);
     return true;
   }
-
-  const findingRef = normalizeResolveFindingRef(command.reason);
-  if (!findingRef.ok) {
-    await recordFindingResolvedSkip(
-      env,
-      deliveryId,
-      req.repoFullName,
-      targetKey,
-      req.actor,
-      findingRef.reason,
-    );
-    return true;
-  }
-
   const mode = resolveAgentActionMode({
-    globalPaused: isGlobalAgentPause(env) || (await isGlobalAgentFrozen(env)),
+    globalPaused: isGlobalAgentPause(env),
     agentPaused: settings.agentPaused,
     agentDryRun: settings.agentDryRun,
   });
-  const resolvedLabel =
-    findingRef.scope === "whole_pr"
-      ? "all review findings on this pull request"
-      : `\`${findingRef.findingCode}\``;
-  const confirmation = sanitizePublicComment(
-    [
-      AGENT_COMMAND_COMMENT_MARKER,
-      "",
-      "> [!NOTE]",
-      `> **Review finding resolved by @${req.actor}**`,
-      `> Marked ${resolvedLabel} as resolved for this PR. The Gate check-run is unchanged.`,
-      "",
-      "---",
-      gittensoryFooter(),
-    ].join("\n"),
+  const body = sanitizePublicComment(
+    [AGENT_COMMAND_COMMENT_MARKER, "", summarizeEffectiveConfig(settings, mode), "", "---", gittensoryFooter()].join("\n"),
   );
-  await createOrUpdateAgentCommandComment(
-    env,
-    req.installationId,
-    req.repoFullName,
-    req.pr.number,
-    confirmation,
-    mode,
-  );
-  if (mode === "live") {
-    await recordAuditEvent(env, {
-      eventType: "github_app.finding_resolved",
-      actor: req.actor,
-      targetKey,
-      outcome: "completed",
-      detail: `Marked ${resolvedLabel} as resolved.`,
-      metadata: {
-        deliveryId,
-        repoFullName: req.repoFullName,
-        scope: findingRef.scope,
-        ...(findingRef.scope === "single"
-          ? { findingCode: findingRef.findingCode }
-          : {}),
-      },
-    });
-    await recordGithubProductUsage(env, "finding_resolved", {
-      actor: req.actor,
-      repoFullName: req.repoFullName,
-      targetKey,
-      outcome: "completed",
-      metadata: {
-        scope: findingRef.scope,
-        ...(findingRef.scope === "single"
-          ? { findingCode: findingRef.findingCode }
-          : {}),
-      },
-    });
-  } else {
-    await recordFindingResolvedSkip(
-      env,
-      deliveryId,
-      req.repoFullName,
-      targetKey,
-      req.actor,
-      mode === "dry_run" ? "dry_run" : "agent_paused",
-      mode,
-    );
-  }
+  await createIssueComment(env, req.installationId, req.repoFullName, req.issueNumber, body);
+  await recordAuditEvent(env, {
+    eventType: "github_app.configuration_posted",
+    actor: req.actor,
+    targetKey,
+    outcome: "completed",
+    detail: `Effective configuration posted for ${targetKey}.`,
+    metadata: { deliveryId, repoFullName: req.repoFullName, mode },
+  });
   return true;
 }
 
-async function recordFindingResolvedSkip(
+async function recordConfigurationSkip(
   env: Env,
   deliveryId: string,
-  repoFullName: string | null | undefined,
-  targetKey: string | null | undefined,
+  repoFullName: string | null,
+  targetKey: string | null,
   actor: string | null,
   reason: string,
-  mode?: "dry_run" | "paused",
 ): Promise<void> {
   await recordAuditEvent(env, {
-    eventType: "github_app.finding_resolved_skipped",
+    eventType: "github_app.configuration_skipped",
     actor,
     targetKey,
     outcome: "completed",
     detail: reason,
-    metadata: {
-      deliveryId,
-      repoFullName: repoFullName ?? null,
-      reason,
-      ...(mode ? { mode } : {}),
-    },
-  });
-  await recordGithubProductUsage(env, "finding_resolved_skipped", {
-    actor,
-    repoFullName,
-    targetKey,
-    outcome: "skipped",
-    metadata: { reason, ...(mode ? { mode } : {}) },
+    metadata: { deliveryId, repoFullName, reason },
   });
 }
 

src/settings/effective-config-summary.ts

@@ -0,0 +1,42 @@
+import type { AgentActionMode } from "./agent-execution";
+import { AGENT_ACTION_CLASSES, resolveAutonomy } from "./autonomy";
+import { summarizeCommandAuthorizationPolicy } from "./command-authorization";
+import type { RepositorySettings } from "../types";
+
+/**
+ * PURE, public-safe summary of a repo's EFFECTIVE review config (#2168) — the yml>DB>defaults result a maintainer
+ * would otherwise only see in the dashboard, surfaced on demand via `@gittensory configuration`. Renders ONLY
+ * non-sensitive operational config: the agent execution mode, per-action-class autonomy, the slop-gate threshold,
+ * the blacklist label, and the command-authorization overview (reusing {@link summarizeCommandAuthorizationPolicy}).
+ *
+ * Deliberately omits every secret / wallet / hotkey / coldkey / raw-trust-score / reward field (house rule) — none
+ * of the rendered fields derives from a private score, so the output is safe to post publicly. The handler still
+ * wraps it in `sanitizePublicComment` + `gittensoryFooter` as a second belt. `executionMode` is passed in resolved
+ * (the caller applies the global kill-switch via {@link resolveAgentActionMode}) so this stays pure. */
+export function summarizeEffectiveConfig(settings: RepositorySettings, executionMode: AgentActionMode): string {
+  const autonomyLines = AGENT_ACTION_CLASSES.map(
+    (actionClass) => `  - \`${actionClass}\`: ${resolveAutonomy(settings.autonomy, actionClass)}`,
+  );
+  // The command-authorization policy always normalizes to a populated default + per-command overrides (the
+  // maintainer-only command defaults), so both lists are non-empty — no empty-case branch needed.
+  const authorization = summarizeCommandAuthorizationPolicy(settings.commandAuthorization);
+  const overrideLines = authorization.commandOverrides.map(
+    (override) => `  - \`${override.command}\`: ${override.allowedRoles.join(", ")}`,
+  );
+  const slopGate = typeof settings.slopGateMinScore === "number" ? String(settings.slopGateMinScore) : "not set";
+  // Config-as-code allows an explicit `null` to DISABLE the label; an absent value falls back to the "slop" default.
+  const blacklistLabel = settings.blacklistLabel === null ? "(disabled)" : (settings.blacklistLabel ?? "slop");
+  return [
+    "**Effective review configuration**",
+    "",
+    `- Agent execution mode: **${executionMode}**`,
+    "- Autonomy by action class:",
+    ...autonomyLines,
+    `- Slop-gate minimum score: ${slopGate}`,
+    `- Blacklist label: \`${blacklistLabel}\``,
+    "- Command authorization:",
+    `  - default roles: ${authorization.defaultAllowed.join(", ")}`,
+    "  - overrides:",
+    ...overrideLines,
+  ].join("\n");
+}

test/unit/configuration-command.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, it } from "vitest";
+import { classifyConfigurationCommandRequest } from "../../src/github/configuration-command";
+import type { GitHubWebhookPayload } from "../../src/types";
+
+type PayloadParts = {
+  action?: string;
+  body?: string | null;
+  commentUser?: { login?: string; type?: string } | null;
+  sender?: { login?: string; type?: string } | null;
+  repository?: { full_name?: string } | null;
+  issue?: { number: number; pull_request?: unknown } | null;
+};
+
+function payload(parts: PayloadParts = {}): GitHubWebhookPayload {
+  return {
+    action: parts.action ?? "created",
+    repository: parts.repository === null ? undefined : (parts.repository ?? { full_name: "acme/widgets" }),
+    issue: parts.issue === null ? undefined : (parts.issue ?? { number: 7 }),
+    comment: { body: parts.body === undefined ? "@gittensory configuration" : parts.body, user: parts.commentUser === null ? undefined : (parts.commentUser ?? { login: "maintainer", type: "User" }) },
+    sender: parts.sender === null ? undefined : (parts.sender ?? { login: "maintainer", type: "User" }),
+  } as unknown as GitHubWebhookPayload;
+}
+
+describe("classifyConfigurationCommandRequest", () => {
+  it("returns null for a non-configuration comment (no mention, or a different verb)", () => {
+    expect(classifyConfigurationCommandRequest(payload({ body: "just a comment" }), 123)).toBeNull();
+    expect(classifyConfigurationCommandRequest(payload({ body: "@gittensory plan" }), 123)).toBeNull();
+    expect(classifyConfigurationCommandRequest(payload({ body: null }), 123)).toBeNull();
+  });
+
+  it("returns ok:true with the resolved target for a valid maintainer configuration command", () => {
+    const req = classifyConfigurationCommandRequest(payload(), 123);
+    expect(req).toEqual({ ok: true, repoFullName: "acme/widgets", installationId: 123, actor: "maintainer", issueNumber: 7 });
+  });
+
+  it("works on a PR thread too (repo-level command, not issue-only)", () => {
+    const req = classifyConfigurationCommandRequest(payload({ issue: { number: 9, pull_request: {} } }), 123);
+    expect(req).toEqual({ ok: true, repoFullName: "acme/widgets", installationId: 123, actor: "maintainer", issueNumber: 9 });
+  });
+
+  it("skips a non-created action", () => {
+    expect(classifyConfigurationCommandRequest(payload({ action: "edited" }), 123)).toMatchObject({ ok: false, reason: "unsupported_comment_action_or_bot" });
+  });
+
+  it("skips bot actors (comment user, sender, or a [bot] login suffix)", () => {
+    expect(classifyConfigurationCommandRequest(payload({ commentUser: { login: "x", type: "Bot" } }), 123)).toMatchObject({ ok: false, reason: "unsupported_comment_action_or_bot" });
+    expect(classifyConfigurationCommandRequest(payload({ sender: { login: "x", type: "Bot" } }), 123)).toMatchObject({ ok: false, reason: "unsupported_comment_action_or_bot" });
+    expect(classifyConfigurationCommandRequest(payload({ sender: { login: "renovate[bot]", type: "User" }, commentUser: { login: "renovate[bot]", type: "User" } }), 123)).toMatchObject({ ok: false, reason: "unsupported_comment_action_or_bot" });
+  });
+
+  it("skips when repo, issue, installation, or actor is missing", () => {
+    expect(classifyConfigurationCommandRequest(payload({ repository: null }), 123)).toMatchObject({ ok: false, reason: "missing_repo_issue_installation_or_actor", repoFullName: null });
+    expect(classifyConfigurationCommandRequest(payload({ issue: null }), 123)).toMatchObject({ ok: false, reason: "missing_repo_issue_installation_or_actor" });
+    expect(classifyConfigurationCommandRequest(payload(), null)).toMatchObject({ ok: false, reason: "missing_repo_issue_installation_or_actor" });
+    // actor resolves to null when neither sender.login nor comment.user.login is present (both still non-bot)
+    expect(
+      classifyConfigurationCommandRequest(payload({ sender: { type: "User" }, commentUser: { type: "User" } }), 123),
+    ).toMatchObject({ ok: false, reason: "missing_repo_issue_installation_or_actor", actor: null });
+  });
+
+  it("falls back to the comment author when the sender login is absent", () => {
+    const req = classifyConfigurationCommandRequest(payload({ sender: { type: "User" }, commentUser: { login: "author", type: "User" } }), 123);
+    expect(req).toMatchObject({ ok: true, actor: "author" });
+  });
+});