# GitHub Repo Inspector

Public A2A agent + packed React frontend for inspecting GitHub repositories with exact file-level citations.

## Skills

- `check_auth(github_token="")`: validates the supplied GitHub token or consumer secret without logging/returning it.
- `list_repositories(github_token="", visibility="all", affiliation="owner,collaborator,organization_member", per_page=100, max_pages=10)`: lists accessible repositories with owner/name/default branch/private flag.
- `inspect_repository(owner, repo, github_token="", ref="", include_hidden=true, max_files=750, max_bytes=4000000, max_file_bytes=250000)`: fetches a recursive tree, includes hidden files by default, classifies every tree entry, fetches supported text files within explicit limits, reports skipped binary/vendor/build/cache/limited files, analyzes line-level risks, and returns structured JSON plus markdown.
- `create_issue(owner, repo, title, body, github_token="", labels=[])`: creates an issue for a confirmed recommendation/risk.

## GitHub permissions

Provide `github_token` in the UI/skill call or configure a consumer secret named `github_token` / `GITHUB_TOKEN`.

Recommended scopes:

- Public repos: `public_repo` or fine-grained read-only Contents metadata/content access.
- Private repos: `repo` or fine-grained repository Contents read + Metadata read.
- Issue creation: `repo` or fine-grained Issues read/write.

Tokens are never stored, logged, or returned. Snippets redact likely secrets.

## Limits and safety

The scanner inspects all fetched tree metadata. It fetches supported text blobs until `max_files`, `max_bytes`, or `max_file_bytes` limits are reached. Skipped files include an explicit reason such as binary extension, vendor/build/cache folder, too-large file, or aggregate byte limit.

Findings use conservative deterministic heuristics and should be treated as review prompts unless the cited evidence clearly proves the issue.

## Local checks

```bash
pytest tests
```

Packed frontend is served at `/app` after deployment.