[dezren39]

Fixes #3007 (queue task 4532).

Problem

POST /v1/tasks with issue_number constructed the issue reference from the request with no GitHub lookup: a nonexistent number, a PR number, or a closed issue attached "successfully" (201 with issue_url) and a task was enqueued against a bogus or wrong target.

Fix (per triage task 4345, CONFIRMED)

• github.ts: new GitHubClient.getIssue() — app route with gh api fallback (mirrors createIssue); returns null only on a definitive 404, throws GitHubError otherwise so lookup failures stay distinguishable from invalid targets; exposes the pull_request marker as isPullRequest.
• server.ts: exported verifyAttachTarget() runs before enqueue —
  • not found → 404, PR number → 422, closed → 422; in all cases nothing is enqueued;
  • GitHub lookup failure → 502 (retryable), nothing enqueued;
  • app-not-installed repo → proceed (task is the tracking record) but the response carries attach_verified: false plus an explicit "was NOT verified" warning.
  • Successful attach responses now include attach_verified: true.

Coordination with #2677 / PR #3143 (task 4417, parked for CI)

Same handler, separate defect — not absorbed. This branch is main-based; the attach-verify helpers were deliberately placed by the Routing section so the two branches merge cleanly: verified on the laptop with a trial merge of queue/4417-2677-dispatch-preexisting into this branch ("Automatic merge went well"), aborted after the check.

Tests

• New test/attach_verify.test.ts: verifyAttachTarget with stubbed lookups (nonexistent → 404, PR → 422, closed → 422, open → verified, lookup throw → 502, app-not-installed → explicit unverified + lookup never attempted) and GitHubClient.getIssue with a stubbed GitHub fetch (open, PR marker, 404 → null) — 9/9 pass on laptop.
• Full dispatch suite on laptop: 66/66 pass.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-31T17:14:56.450382Z	291030a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 38 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3652eef3-3a4b-454d-b7aa-5ce50e9249ed

Commits

Reviewing files that changed from the base of the PR and between 9d8e191 and 291030a.

Files selected for processing: 3

• pm-stack/dispatch/src/github.ts
• pm-stack/dispatch/src/server.ts
• pm-stack/dispatch/test/attach_verify.test.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 053b32a2e8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Match the HTTP status without scanning the request endpoint

When a lookup for issue #404 falls back to gh and encounters an authentication, rate-limit, or transient server error, gh() includes /issues/404 in its error-message prefix. This regex therefore returns null even though no HTTP 404 occurred, causing handleTasks() to report an invalid target (404) instead of a retryable lookup failure (502). Reproducing the wrapper message with HTTP 503 Service Unavailable returns null for issue 404 but throws for issue 405. Match the actual response status or restrict matching to the error output rather than the endpoint-containing wrapper.

Useful? React with 👍 / 👎.

[dezren39]

Fixed in 291030a — correct catch. The not-found check now uses an exported isNotFoundError() that matches only the HTTP status text (HTTP 404), never the bare digits, so an issue literally numbered 404 in the echoed request path cannot turn a 403/429/500 into a definitive not-found. Unit tests cover both directions (HTTP 404 → true; /issues/404 path with HTTP 403/429/500 → false). Suite now 11/11 in test/attach_verify.test.ts.