[meddlin]

What this adds

gitlib dependabot check [--json]: the first slice of the Dependabot watch from docs/dependabot-watch.md. It builds on #36, which has merged and brought that research note to main.

It asks GitHub for the open Dependabot PRs of the repositories you have starred in gitlib (RepoRecord.isFavorite, not GitHub stars) and sorts them into ready / review first / needs work / waiting, with the reasons and suggested actions as text. Report only: no LLM, no schedule, no web page, no storage, nothing written to GitHub or gitlib.db.

• classify (packages/core/src/dependabot/classify.ts) is a pure function over isDraft, mergeable, mergeStateStatus, reviewDecision, the check rollup, labels, branch and the update-type from the commit-message YAML block. It never reads the PR body, so release-note text cannot move a PR between buckets. Suggestions are @dependabot rebase / recreate where the note says so; the merge commands retired on 2026-01-27 are never suggested (a test sweeps ~9,000 input combinations to check that, and that "ready" is only ever returned when nothing stands against it).
• Fetch (github-backend.ts) is behind a DependabotBackend interface with a fake in the tests, injected like SearchBackend / ChatBackend. One GraphQL search per owner (is:pr is:open author:app/dependabot user:OWNER archived:false), filtered to favorites by owner/repo slug; token from GITLIB_GITHUB_TOKEN or GITHUB_TOKEN.
• groupReposByGitHubSlug is core's own equivalent of the web helper (linked worktrees collapse, case-insensitive). Favorites it cannot map are reported with the reason, never dropped.
• CLI: grouped text report, or --json (snake_case). Exit status 1 only if a whole owner could not be checked. Other commands never need GitHub.

The open Checks question is not hidden

GitHub's token guide lists the Checks API as unsupported for fine-grained tokens, and whether GraphQL statusCheckRollup works with one is undocumented. A missing or refused rollup is shown as CI unknown: <reason> (quoting GitHub's own error when there is one) and filed under Review first, never as ready. So with a fine-grained token that cannot read checks you will see CI unknown on every PR rather than a false green. Settling it is item 11 (a) of the note, which has not been run: the fixtures are shaped like the GraphQL response from the docs, not captured from a real one.

Things worth a look in review

• Beyond the note: a second small GraphQL request per owner asks which watched repositories the token can see at all. Without it, a private repo the token cannot reach looks identical to "no open PRs". Those show as NOT CHECKED.
• Not built, and said so in the note's status line: the "Maintainer changes" phrase and Dependabot-alert matching (both need the body or the alerts API; the security label stands in), isRequired per check, a retry for UNKNOWN mergeability, storage, the page, the schedule.
• loadGitRemotes moved from app.ts to remotes.ts (same export from @gitlib/core) so the new module does not import app.ts.
• createApplication / GitLibApp gain an optional dependabotBackend; GitLibApp.checkDependabot() is the function the future web "Check now" button would call.

Verification

• npm run typecheck, npm test (397 tests, 84 new in packages/core/test/dependabot.test.ts and apps/cli/test/dependabot.test.ts) and npm run build pass.
• Mutation-checked: making a missing rollup count as success, or ignoring UNKNOWN mergeability, makes tests fail.
• Run by hand in an isolated GITLIB_HOME through the real fetch against a local stand-in GraphQL server (dummy token); no request went to GitHub and no real token was used.

🤖 Generated with Claude Code