feat(issues): add multi-provider issue tracking

apps/server/src/atomicWrite.test.ts

@@ -0,0 +1,34 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { assert, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Exit from "effect/Exit";
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+
+import { writeFileStringAtomically } from "./atomicWrite.ts";
+
+it.effect("does not fail after the target file is committed", () =>
+  Effect.scoped(
+    Effect.gen(function* () {
+      const fileSystem = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+      const root = yield* fileSystem.makeTempDirectoryScoped({ prefix: "t3-atomic-write-" });
+      const target = path.join(root, "settings.json");
+      const cleanupFailureFileSystem = {
+        ...fileSystem,
+        makeTempDirectoryScoped: (options) =>
+          Effect.acquireRelease(fileSystem.makeTempDirectory(options), () =>
+            Effect.die(new Error("temporary directory cleanup failed")),
+          ),
+      } satisfies FileSystem.FileSystem;
+
+      const exit = yield* writeFileStringAtomically({
+        filePath: target,
+        contents: "committed",
+      }).pipe(Effect.provideService(FileSystem.FileSystem, cleanupFailureFileSystem), Effect.exit);
+
+      assert.isTrue(Exit.isSuccess(exit));
+      assert.strictEqual(yield* fileSystem.readFileString(target), "committed");
+    }),
+  ).pipe(Effect.provide(NodeServices.layer)),
+);

apps/server/src/atomicWrite.ts

@@ -6,20 +6,24 @@ export const writeFileStringAtomically = (input: {
   readonly filePath: string;
   readonly contents: string;
 }) =>
-  Effect.scoped(
-    Effect.gen(function* () {
-      const fs = yield* FileSystem.FileSystem;
-      const path = yield* Path.Path;
-      const targetDirectory = path.dirname(input.filePath);
+  Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const path = yield* Path.Path;
+    const targetDirectory = path.dirname(input.filePath);
 
-      yield* fs.makeDirectory(targetDirectory, { recursive: true });
-      const tempDirectory = yield* fs.makeTempDirectoryScoped({
-        directory: targetDirectory,
-        prefix: `${path.basename(input.filePath)}.`,
-      });
-      const tempPath = path.join(tempDirectory, "contents.tmp");
+    yield* fs.makeDirectory(targetDirectory, { recursive: true });
+    const tempDirectory = yield* fs.makeTempDirectory({
+      directory: targetDirectory,
+      prefix: `${path.basename(input.filePath)}.`,
+    });
+    const tempPath = path.join(tempDirectory, "contents.tmp");
 
+    yield* Effect.gen(function* () {
       yield* fs.writeFileString(tempPath, input.contents);
       yield* fs.rename(tempPath, input.filePath);
-    }),
-  );
+    }).pipe(
+      Effect.ensuring(
+        fs.remove(tempDirectory, { recursive: true, force: true }).pipe(Effect.ignore),
+      ),
+    );
+  });

apps/server/src/auth/RpcAuthorization.ts

@@ -73,6 +73,28 @@ export const RPC_REQUIRED_SCOPES = {
   // write like every other one.
   [WS_METHODS.pullRequestsReviewerCandidates]: AuthOrchestrationReadScope,
   [WS_METHODS.pullRequestsRequestReviewers]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesList]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesDetail]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesActivity]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesCommentsPage]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesRunAction]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesComment]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesUpdateComment]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesSetReaction]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesCreate]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesUpdate]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesSetLabels]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesSetAssignees]: AuthOrchestrationOperateScope,
+  [WS_METHODS.issuesLabelCandidates]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesAssigneeCandidates]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesTemplates]: AuthOrchestrationReadScope,
+  [WS_METHODS.issuesInvalidate]: AuthOrchestrationReadScope,
+  [WS_METHODS.linearConnectionStatus]: AuthOrchestrationReadScope,
+  [WS_METHODS.linearConnect]: AuthOrchestrationOperateScope,
+  [WS_METHODS.linearDisconnect]: AuthOrchestrationOperateScope,
+  [WS_METHODS.linearSetProjectBinding]: AuthOrchestrationOperateScope,
+  [WS_METHODS.workItemsGenerateTask]: AuthOrchestrationOperateScope,
+  [WS_METHODS.workItemsFindMatches]: AuthOrchestrationOperateScope,
   [WS_METHODS.sourceControlLookupRepository]: AuthOrchestrationReadScope,
   [WS_METHODS.sourceControlCloneRepository]: AuthOrchestrationOperateScope,
   [WS_METHODS.sourceControlPublishRepository]: AuthOrchestrationOperateScope,

apps/server/src/auth/ServerSecretStore.test.ts

@@ -221,7 +221,7 @@ it.layer(NodeServices.layer)("ServerSecretStore.layer", (it) => {
       assert.isTrue(
         chmodCalls.some((call) => call.mode === 0o700 && call.path.endsWith("/secrets")),
       );
-      assert.isAtLeast(chmodCalls.filter((call) => call.mode === 0o600).length, 2);
+      assert.strictEqual(chmodCalls.filter((call) => call.mode === 0o600).length, 1);
     }).pipe(Effect.provide(NodeServices.layer)),
   );
 

apps/server/src/auth/ServerSecretStore.ts

@@ -200,7 +200,6 @@ export const make = Effect.gen(function* () {
           yield* fileSystem.writeFile(tempPath, value);
           yield* fileSystem.chmod(tempPath, 0o600);
           yield* fileSystem.rename(tempPath, secretPath);
-          yield* fileSystem.chmod(secretPath, 0o600);
         }).pipe(
           Effect.catch((cause) =>
             fileSystem.remove(tempPath).pipe(

apps/server/src/environment/ServerEnvironment.ts

@@ -153,6 +153,7 @@ export const make = Effect.gen(function* () {
       attachmentUploads: true,
       fileAttachments: { maxUploadBytes: PROVIDER_SEND_TURN_MAX_FILE_BYTES },
       pullRequests: true,
+      issues: true,
       threadSettlement: true,
       threadSnooze: true,
       threadPinning: true,

apps/server/src/git/GitManager.test.ts

@@ -295,6 +295,8 @@ function createTextGeneration(
       Effect.succeed({
         title: "Update workflow",
       }),
+    generateWorkItemTask: () => Effect.succeed({ prompt: "Update workflow" }),
+    findWorkItemMatches: () => Effect.succeed({ matches: [] }),
     ...overrides,
   };
 
@@ -343,6 +345,28 @@ function createTextGeneration(
             }),
         ),
       ),
+    generateWorkItemTask: (input) =>
+      implementation.generateWorkItemTask(input).pipe(
+        Effect.mapError(
+          (cause) =>
+            new TextGenerationError({
+              operation: "generateWorkItemTask",
+              detail: "fake text generation failed",
+              ...(cause !== undefined ? { cause } : {}),
+            }),
+        ),
+      ),
+    findWorkItemMatches: (input) =>
+      implementation.findWorkItemMatches(input).pipe(
+        Effect.mapError(
+          (cause) =>
+            new TextGenerationError({
+              operation: "findWorkItemMatches",
+              detail: "fake text generation failed",
+              ...(cause !== undefined ? { cause } : {}),
+            }),
+        ),
+      ),
   };
 }