feat(agent-actions): auto-close a contributor's issue over the open-issue cap (#2270)

[JSONbored]

Summary

• Stacked on feat(agent-actions): auto-close a contributor's PR over the open-PR cap (#2270) #2479 (base branch is that PR's branch — this PR's diff is only the issue-side delta; it will retarget to main once feat(settings): add contributorOpenPrCap/contributorOpenIssueCap config (#2270) #2467 → feat(agent-actions): auto-close a contributor's PR over the open-PR cap (#2270) #2479 → this merge in order).
• Adds the first eventName === "issues" actuation branch in processGitHubWebhook — issues previously had zero auto-close path at all. maybeCloseIssueOverContributorCap mirrors the PR-path cap exactly: same oldest-stays/newest-closes ranking by item number, same owner/admin/automation-bot exemption, and it reuses planAgentMaintenanceActions's contributor_cap short-circuit to build the label+close plan — so the label/message/closeKind construction is identical between the PR and issue paths, not a parallel reimplementation.
• Fixes a bug this reuse exposed: the close-comment message was hardcoded to say "pull requests" even when closing an issue (caught by my own local integration test, not by the gate this time). contributorCapMatch now carries an explicit itemKind: "pull requests" | "issues" so each caller states its own noun — no default, so a future caller can't silently mislabel the other kind.
• New executeIssueMaintenanceActions is deliberately narrower than the PR executor: no freshness/live-CI-re-verification/pull_requests:write gates (none of those PR concepts apply to a plain issue — no head SHA, no CI, and a close needs issues: write, a different permission). auto_with_approval is denied, not staged — the pending-action queue is PR-shaped (pullNumber-typed staging + a /pull/{n} notification deeplink); extending it to issues is a documented follow-up, not silently bypassed.
• closeIssue is a new GitHub REST primitive (PATCH /issues/{n}) — closePullRequest hits the Pulls API, which a plain issue number is not valid against.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue (feat(agent-actions): configurable per-contributor open PR/issue cap with auto-close over the limit #2270).

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally — 100% line coverage and full branch coverage on every changed line (verified via the v8/lcov report against the exact diff, including the "at cap, not over" and "matched but no acting autonomy" branches for the issue path).
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries — direct executor tests in test/unit/agent-action-executor.test.ts (label/close, paused, autonomy-denied, dry-run, auto_with_approval denial, unsupported-class defensive denial, error path), a closeIssue primitive test in test/unit/github-pr-actions.test.ts, planner itemKind regression test in test/unit/agent-actions.test.ts, and full webhook-pipeline integration tests in test/unit/queue.test.ts (over-cap close, at-cap no-close, disabled-by-default no-op, no-acting-autonomy no-op, owner exemption).

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics — same sanitized close-comment construction as the PR path.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no auth/session/CORS surface touched.
• API/OpenAPI/MCP behavior is updated and tested where needed — no new request/response fields (all config already shipped in feat(settings): add contributorOpenPrCap/contributorOpenIssueCap config (#2270) #2467).
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI change.
• Visible UI changes include a UI Evidence section. — N/A, no visible UI change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs — no doc changes needed (already covered in feat(settings): add contributorOpenPrCap/contributorOpenIssueCap config (#2270) #2467); CHANGELOG.md untouched.

Notes

• Next in the feat(agent-actions): configurable per-contributor open PR/issue cap with auto-close over the limit #2270 sequence: the global env-var default (CONTRIBUTOR_OPEN_PR_CAP_DEFAULT / CONTRIBUTOR_OPEN_ISSUE_CAP_DEFAULT) and the named-contributor whitelist noted in the comment on feat(agent-actions): configurable per-contributor open PR/issue cap with auto-close over the limit #2270.
• Known, documented scope limit (same as feat(agent-actions): auto-close a contributor's PR over the open-PR cap (#2270) #2479): live webhook-time enforcement only — a maintainer lowering the cap after a contributor already has more issues open than the new cap allows is not retroactively enforced by a sweep in this PR.

[gittensory-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (feat/contributor-cap-enforcement@a39c458). Learn more about missing BASE report.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@                         Coverage Diff                         @@
##             feat/contributor-cap-enforcement    #2493   +/-   ##
===================================================================
  Coverage                                    ?   95.97%           
===================================================================
  Files                                       ?      226           
  Lines                                       ?    25521           
  Branches                                    ?     9272           
===================================================================
  Hits                                        ?    24493           
  Misses                                      ?      417           
  Partials                                    ?      611           

Files with missing lines	Coverage Δ
src/github/pr-actions.ts	100.00% <100.00%> (ø)
src/queue/processors.ts	91.97% <100.00%> (ø)
src/services/agent-action-executor.ts	94.36% <100.00%> (ø)
src/settings/agent-actions.ts	93.38% <100.00%> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.