actionagent 1.8.0 → 1.9.0

data/app/models/action_agent/recording_event.rb

@@ -0,0 +1,145 @@
+# frozen_string_literal: true
+
+module ActionAgent
+  # A batch of one kind of event that a browser recorded during a session.
+  #
+  # Kinds:
+  #   rrweb        DOM snapshots and mutations from the rrweb recorder
+  #   action       an agent's browser tool call, written by MCPRecordingMiddleware
+  #   console      a console line from the recorded page
+  #   marker       a label a recorder placed on the timeline
+  #   human_input  input a person relayed while taking over a browser
+  #
+  # Each event in a row is a Hash of "at", its server time in epoch
+  # milliseconds, and "data", what the recorder sent. A browser's events are
+  # stored in server time: the client's timestamp plus the clock offset of the
+  # batch they arrived in. Rows are ordered by occurred_from, batch_index, id.
+  #
+  # The payload is the row's events as gzip JSON. A payload up to
+  # INLINE_PAYLOAD_LIMIT compressed bytes is kept in the row. A larger one is
+  # attached through Active Storage when the host has it, and kept in the row
+  # otherwise.
+  class RecordingEvent < ApplicationRecord
+    include Ownable
+    owned_by :account, :user
+
+    KINDS = %w[rrweb action console marker human_input].freeze
+    # The kinds a browser may post. The server writes the others.
+    CLIENT_KINDS = %w[rrweb console marker].freeze
+
+    # See ActionAgent.recording_limits.
+    DEFAULT_LIMITS = {
+      batch_events: 1_000,
+      batch_bytes: 1.megabyte,
+      recording_events: 100_000,
+      recording_bytes: 100.megabytes
+    }.freeze
+
+    INLINE_PAYLOAD_LIMIT = 64.kilobytes
+
+    # How deep a batch's JSON may nest. An rrweb full snapshot nests two
+    # levels per DOM element, so an ordinary page passes the JSON gem's
+    # default of 100.
+    MAX_NESTING = 512
+
+    belongs_to :session_recording
+
+    # Per ActionAgent.active_storage, like RecordingSnapshot: the gem depends
+    # on railties, not rails, so a host may have no Active Storage at all, or
+    # may switch attachments off.
+    has_one_attached :payload_file, **ActionAgent.attachment_options if ActionAgent.active_storage_macros?
+
+    validates :kind, inclusion: { in: KINDS }
+    validates :occurred_from, :occurred_to, presence: true
+
+    before_validation :copy_owner_from_recording, on: :create
+
+    scope :chronological, -> { order(:occurred_from, :batch_index, :id) }
+
+    # The caps in force: DEFAULT_LIMITS with ActionAgent.recording_limits
+    # merged over them.
+    # @return [Hash{Symbol => Integer}]
+    def self.limits
+      DEFAULT_LIMITS.merge((ActionAgent.recording_limits || {}).to_h.symbolize_keys)
+    end
+
+    # Whether payloads can be attached in this host app: Active Storage on
+    # per ActionAgent.active_storage, the macro applied, and its tables
+    # migrated.
+    def self.attachments_available?
+      ActionAgent.active_storage_available? && method_defined?(:payload_file)
+    end
+
+    # Parses JSON text nested up to MAX_NESTING levels.
+    def self.parse_json(text)
+      JSON.parse(text, max_nesting: MAX_NESTING)
+    end
+
+    # Returns +value+ as JSON text at any depth. Responses that carry event
+    # data are generated with it: the default encoder refuses more than 100
+    # levels, and event data was parsed with a limit of MAX_NESTING.
+    def self.generate_json(value)
+      JSON.generate(value.as_json, max_nesting: false)
+    end
+
+    # Converts epoch milliseconds to a Time.
+    def self.time_at(milliseconds)
+      Time.zone.at(milliseconds.to_r / 1000)
+    end
+
+    # Converts a Time to epoch milliseconds.
+    def self.milliseconds(time)
+      (time.to_r * 1000).floor
+    end
+
+    # The row's events, decoded. Empty when the payload cannot be read.
+    # @return [Array<Hash>]
+    def events
+      @events ||= begin
+        compressed = payload.nil? || payload.empty? ? attached_payload : payload
+        compressed ? self.class.parse_json(ActiveSupport::Gzip.decompress(compressed)) : []
+      rescue StandardError => e
+        Rails.logger.warn("[ActionAgent] recording event #{id} payload unreadable: #{e.class}: #{e.message}")
+        []
+      end
+    end
+
+    # Stores +list+ as the payload and sets the counts and the time range
+    # from it. Each entry is a Hash with an "at" in epoch milliseconds.
+    def events=(list)
+      json = self.class.generate_json(list)
+      compressed = ActiveSupport::Gzip.compress(json)
+      times = list.map { |event| event["at"].to_i }
+
+      self.event_count = list.size
+      self.byte_size = json.bytesize
+      self.occurred_from = self.class.time_at(times.min || 0)
+      self.occurred_to = self.class.time_at(times.max || 0)
+
+      if compressed.bytesize > INLINE_PAYLOAD_LIMIT && self.class.attachments_available?
+        self.payload = nil
+        payload_file.attach(io: StringIO.new(compressed), filename: "recording-events.json.gz", content_type: "application/gzip")
+      else
+        self.payload = compressed
+      end
+
+      @events = list
+    end
+
+    private
+
+    def attached_payload
+      return nil unless self.class.attachments_available? && payload_file.attached?
+
+      payload_file.download
+    end
+
+    # Both owner columns, whichever one this install owns through.
+    def copy_owner_from_recording
+      return unless session_recording
+
+      self.user_id = session_recording.user_id
+      self.account_id = session_recording.account_id
+    end
+  end
+end

data/app/models/action_agent/recording_snapshot.rb

@@ -5,15 +5,15 @@ module ActionAgent
     belongs_to :session_recording
     belongs_to :recording_action, optional: true
 
-    # Guarded: a host app created with --skip-active-storage (or --minimal)
-    # has no has_one_attached, and the gem depends on railties rather than
-    # rails, so it may not even have the gem to require. Without this the
-    # engine dies during eager load at boot.
-    has_one_attached :file if defined?(ActiveStorage)
+    # Per ActionAgent.active_storage: a host app created with
+    # --skip-active-storage (or --minimal) has no has_one_attached, and the
+    # gem depends on railties rather than rails, so it may not even have the
+    # gem to require; a host may also switch attachments off.
+    has_one_attached :file, **ActionAgent.attachment_options if ActionAgent.active_storage_macros?
 
-    # Whether file attachment is available in this host app.
+    # Whether a snapshot's file can be stored in this host app.
     def self.attachments_available?
-      defined?(ActiveStorage) && method_defined?(:file)
+      ActionAgent.active_storage_available? && method_defined?(:file)
     end
 
     SNAPSHOT_TYPES = %w[screenshot dom full_page].freeze

data/app/models/action_agent/sandbox_session.rb

@@ -6,7 +6,10 @@ module ActionAgent
     owned_by :user, :account
 
     belongs_to :agent_template, optional: true
+    # The project this checkout was booted for, if any.
+    belongs_to :project, class_name: "ActionAgent::Project", optional: true
     has_many :code_sessions, dependent: :destroy
+    has_many :draft_pull_requests, dependent: :destroy
 
     # Session statuses
     enum :status, {
@@ -28,6 +31,23 @@ module ActionAgent
     # mcp_servers lists them: "sandbox:<session_id>".
     RUNTIME_SERVER_PREFIX = "sandbox:"
 
+    # MCP server keys naming a checkout sandbox's browser:
+    # "browser:<session_id>". A run reaches one only through the sandbox it
+    # runs against (MCPToolDispatcher's extra_server_keys), never through an
+    # agent's saved servers.
+    BROWSER_SERVER_PREFIX = "browser:"
+
+    # A browser runs without a window, or with one a person can watch.
+    BROWSER_MODES = %w[headless headed].freeze
+    BROWSER_STATUSES = %w[starting running stopped failed].freeze
+    # Optional Playwright MCP tool groups a browser may be started with.
+    BROWSER_CAPABILITIES = %w[testing vision pdf].freeze
+    # A browser stops on its own this long before its session expires, so the
+    # last events it records are posted while its recording still takes them:
+    # SessionRecording#ingest_token_valid? refuses every post once the session
+    # has expired.
+    BROWSER_STOP_LEAD = 30.seconds
+
     # Free tier limits
     FREE_TIER_LIMITS = {
       max_runs: 10,
@@ -43,6 +63,26 @@ module ActionAgent
     APP_RUNTIME_SESSION_DURATION = 2.hours
 
     encrypts :runtime_mcp_token if ActionAgent.encrypt_credentials
+    encrypts :browser_token if ActionAgent.encrypt_credentials
+
+    # What a backend's start_browser needs beyond the session's own columns,
+    # set by SandboxBrowser for that one call and never stored. Carries
+    # secrets, so it goes to the backend and nowhere else:
+    #
+    #   token         the bearer token the browser's MCP endpoint is to expect
+    #   app_url       the sandbox app the browser may open
+    #   capabilities  BROWSER_CAPABILITIES to enable
+    #   stop_at       when the browser stops on its own (browser_stops_at)
+    #   recording     where to post recorded events: { url:, token:,
+    #                 batch_events:, batch_bytes: }, or nil to record nothing
+    #   live          the live view: { session_id:, origins: }, the session
+    #                 its tickets name and the dashboard origins that may
+    #                 open it, or nil for none (BrowserLiveTicket)
+    #   storage_state a Playwright storage state to start signed in with,
+    #                 or absent
+    #
+    # @return [Hash, nil]
+    attr_accessor :browser_launch
 
     # Validations
     validates :session_id, presence: true, uniqueness: true
@@ -51,6 +91,8 @@ module ActionAgent
     validates :repository_ref, length: { maximum: 255 }, format: { without: /\A-|\s|\.\./, message: "is not a valid git ref" },
       allow_blank: true
     validate :repository_available, on: :create, if: :app_runtime?
+    validates :browser_mode, inclusion: { in: BROWSER_MODES }, allow_nil: true
+    validates :browser_status, inclusion: { in: BROWSER_STATUSES }, allow_nil: true
 
     # Callbacks
     before_validation :generate_session_id, on: :create
@@ -74,6 +116,21 @@ module ActionAgent
       key.to_s.start_with?(RUNTIME_SERVER_PREFIX)
     end
 
+    def self.browser_server_key?(key)
+      key.to_s.start_with?(BROWSER_SERVER_PREFIX)
+    end
+
+    # The MCP catalog entry for a sandbox's browser, looked up among +owner+'s
+    # sessions only. Nil unless the session and its browser are running.
+    #
+    # @return [Hash, nil]
+    def self.browser_server_entry(key, owner:)
+      return nil unless browser_server_key?(key)
+
+      session = for_owner(owner).find_by(session_id: key.to_s.delete_prefix(BROWSER_SERVER_PREFIX))
+      session&.browser_server_entry
+    end
+
     # The MCP catalog entry for a checkout sandbox's app runtime, looked up
     # among +owner+'s sessions only. Nil unless the session is live and its
     # backend reported an endpoint.
@@ -122,6 +179,80 @@ module ActionAgent
       }
     end
 
+    def browser_server_key
+      "#{BROWSER_SERVER_PREFIX}#{session_id}"
+    end
+
+    def browser_running?
+      browser_status == "running" && browser_mcp_url.present? && active?
+    end
+
+    # This session's browser as an MCP catalog entry, the shape
+    # MCPToolDispatcher reaches servers through, or nil unless it is running.
+    # Carries the browser's token, so it is for the dispatcher only.
+    #
+    # @return [Hash, nil]
+    def browser_server_entry
+      return nil unless browser_running?
+
+      {
+        key: browser_server_key,
+        name: "Browser (#{repository} sandbox)",
+        description: "The browser of the sandbox booted from #{repository}",
+        transport: "streamable_http",
+        url: browser_mcp_url,
+        headers: browser_token.present? ? { "Authorization" => "Bearer #{browser_token}" } : {}
+      }
+    end
+
+    # When the browser stops on its own: BROWSER_STOP_LEAD before the session
+    # expires.
+    #
+    # @return [Time, nil]
+    def browser_stops_at
+      expires_at && expires_at - BROWSER_STOP_LEAD
+    end
+
+    # The minutes the browser has run, from its start to +at+ or to
+    # browser_stops_at if that is sooner, rounded up to a whole minute and at
+    # least 1; 0 when it never started. Capped so that a reaper running late
+    # does not count time the browser was no longer running.
+    #
+    # @return [Integer]
+    def browser_minutes(at = Time.current)
+      return 0 unless browser_started_at
+
+      stopped_at = [ at, browser_stops_at ].compact.min
+      [ ((stopped_at - browser_started_at) / 60.0).ceil, 1 ].max
+    end
+
+    # Who this session's browser minutes are metered against: the tenant in a
+    # multi-tenant install, the owner ApplicationController#current_owner
+    # resolves and the quota checker is asked about, and the session's owner
+    # otherwise.
+    def metering_owner
+      return owner unless ActionAgent.multi_tenant?
+
+      account_class = ActionAgent.account_class.to_s.safe_constantize
+      account_class.find_by(id: account_id) if account_class && account_id
+    end
+
+    # The browser for an API response: never its token or its MCP endpoint.
+    #
+    # @return [Hash]
+    def browser_summary
+      {
+        mode: browser_mode,
+        status: browser_status,
+        started_at: browser_started_at&.iso8601,
+        # The key an agent run reaches the browser by; nil unless it runs.
+        server_key: browser_running? ? browser_server_key : nil,
+        # The live view's WebSocket, opened with a ticket from
+        # POST .../browser/tickets; nil unless it runs and has one.
+        live_url: browser_running? ? browser_live_url : nil
+      }
+    end
+
     # This runtime as a token-free MCP server listing (see
     # runtime_server_listings), or nil when it is not live.
     def runtime_server_listing
@@ -136,32 +267,109 @@ module ActionAgent
 
     # What a sandbox backend clones for an app_runtime session: repository,
     # ref, clone URL and the credentials to fetch it. Nil for any other
-    # sandbox type. Carries the owner's GitHub token, so it goes to the
-    # backend and never into a response.
+    # sandbox type, and when the checkout is no longer available. Carries a
+    # GitHub token, so it goes to the backend and never into a response.
+    #
+    # Reading it never calls GitHub. A checkout through the OAuth connection
+    # carries the connection's stored token. One through a GitHub App
+    # installation carries a token only on the object #mint_checkout_spec!
+    # was called on, and +token+ is nil anywhere else.
     #
     # @return [Hash, nil]
     def checkout_spec
       return nil unless app_runtime?
+      return @minted_checkout_spec if @minted_checkout_spec
+
+      if github_installation_id
+        installation = checkout_installation
+        installation&.repository(repository) && installation.checkout_spec(repository, ref: repository_ref)
+      else
+        github_connection&.checkout_spec(repository, ref: repository_ref)
+      end
+    end
+
+    # Mints the token a GitHub App checkout is fetched with, and keeps the
+    # spec on this object, so #checkout_spec answers with it from here on.
+    # SandboxProvisionJob calls this once per provision, hands this same
+    # object to the backend, and scrubs the same value from what the boot
+    # reports. The token is never stored. A checkout through the OAuth
+    # connection mints nothing and returns #checkout_spec.
+    #
+    # @raise [GithubClient::InstallationUnavailable] when GitHub reports the installation removed or suspended
+    # @return [Hash, nil]
+    def mint_checkout_spec!
+      return checkout_spec unless app_runtime? && github_installation_id
+      return @minted_checkout_spec if @minted_checkout_spec
+
+      installation = checkout_installation
+      return nil unless installation&.repository(repository)
 
-      github_connection&.checkout_spec(repository, ref: repository_ref)
+      @minted_checkout_spec = installation.checkout_spec!(repository, ref: repository_ref)
     end
 
     # The GitHub connection whose selection this session's checkout comes
-    # from.
+    # from, when it does not come from a GitHub App installation.
     def github_connection
       owners_record(GithubConnection)
     end
 
+    # The owner's GitHub App installation this session's checkout comes from,
+    # or nil when it comes from the OAuth connection or the installation was
+    # unlinked.
+    def checkout_installation
+      return nil if github_installation_id.nil?
+
+      owners_record(GithubInstallation.where(id: github_installation_id))
+    end
+
     # Environment the backend passes into an app_runtime checkout, so the
     # booted app can run Claude Code sessions against it with the owner's
     # connected credential (Settings -> Integrations). Empty when none is
     # connected. Secret — for the backend, never a response.
     #
     # @return [Hash{String => String}]
-    def runtime_environment
+    def runtime_environment(runner: "claude_code")
       return {} unless app_runtime?
+      return {} unless ProviderKey::CONNECTION_PROVIDERS.include?(runner)
+
+      owners_record(ProviderKey.where(provider: runner))&.runtime_environment || {}
+    end
 
-      owners_record(ProviderKey.where(provider: "claude_code"))&.runtime_environment || {}
+    # The values of the secrets of the project this checkout was booted for,
+    # with their encodings (Project#scrub_values), for scrubbing whatever the
+    # sandbox outputs. Empty for a sandbox no project booted, on an install
+    # that has not run the projects migration, and when the secrets cannot be
+    # read.
+    #
+    # @return [Array<String>]
+    def project_scrub_values
+      return [] unless app_runtime? && has_attribute?(:project_id) && project_id
+
+      project&.scrub_values || []
+    rescue StandardError => e
+      Rails.logger.warn("[ActionAgent] sandbox #{session_id}: could not read its project's secrets: #{e.class}")
+      []
+    end
+
+    # The values this session's sandbox holds that must never leave it: the
+    # checkout token where one is stored, the Claude Code and Codex
+    # credentials it hands its checkout, its runtime's MCP token, and the
+    # secrets of the project it was booted for. Reads without minting.
+    #
+    # @return [Array<String>]
+    def secret_values
+      spec = begin
+        checkout_spec
+      rescue StandardError
+        nil
+      end
+      [
+        spec&.dig(:token),
+        *runtime_environment.values,
+        *runtime_environment(runner: "codex").values,
+        runtime_mcp_token,
+        *project_scrub_values
+      ].compact.map(&:to_s).uniq
     end
 
     # Check if session is still valid
@@ -203,7 +411,11 @@ module ActionAgent
     end
 
     # Provision the Cloud Run sandbox
-    def provision!
+    #
+    # @param boot [Hash, nil] how a checkout boots, as
+    #   SandboxBootSpec.request_options returns it; nil for the default
+    #   ("auto"). Ignored for other sandbox types.
+    def provision!(boot: nil)
       return if provisioning? || ready?
 
       update!(status: :provisioning)
@@ -215,11 +427,32 @@ module ActionAgent
       # synchronously for immediate feedback.
       if !app_runtime? && (Rails.env.development? || Rails.env.test?)
         SandboxProvisionJob.perform_now(id)
+      elsif app_runtime? && boot
+        SandboxProvisionJob.perform_later(id, "boot" => boot)
       else
         SandboxProvisionJob.perform_later(id)
       end
     end
 
+    # Continues a checkout whose boot failed and was kept (see
+    # SandboxOrchestrator#resume_boot), from the step named +from+, or from
+    # the one that failed. False, enqueuing nothing, unless the session is a
+    # failed checkout that has not expired.
+    def resume_boot!(from: nil)
+      resumed = with_lock do
+        next false unless app_runtime? && failed? && !past_expiry?
+
+        update!(status: :provisioning, error_message: nil)
+        true
+      end
+      SandboxProvisionJob.perform_later(id, "resume" => { "from" => from.presence&.to_s }) if resumed
+      resumed
+    end
+
+    def past_expiry?
+      expires_at.present? && expires_at <= Time.current
+    end
+
     # Mark as ready with Cloud Run URL. A checkout sandbox's backend also
     # reports the app runtime's MCP endpoint and the token it expects.
     def mark_ready!(cloud_run_url:, cloud_run_job_id: nil, runtime_mcp_url: nil, runtime_mcp_token: nil)
@@ -239,13 +472,28 @@ module ActionAgent
     # marked it ready since. Acting on the stale copy would neither clear the
     # endpoint it recorded (nil -> nil writes nothing) nor see the handle to
     # terminate, leaving the booted sandbox running.
+    #
+    # Its browser is stopped first while the session is still live, so the
+    # browser's last recorded events are accepted (SandboxBrowser.stop_before_expiry).
+    # When that cannot be done, it stops being reachable the same way as the
+    # runtime, its minutes are counted here (SandboxBrowser.finish!), and the
+    # cleanup job stops it.
     def expire!
+      SandboxBrowser.stop_before_expiry(self)
       with_lock { update!(status: :expired, runtime_mcp_url: nil, runtime_mcp_token: nil) }
+      SandboxBrowser.finish!(self)
       # A checkout with no handle may still have a boot behind it (its job
       # died mid-boot, say); the cleanup job asks the backend for it.
       SandboxCleanupJob.perform_later(id) if cloud_run_job_id.present? || app_runtime?
     end
 
+    # The browser token never leaves the model, whatever serializes it.
+    def serializable_hash(options = nil)
+      options = (options || {}).dup
+      options[:except] = Array(options[:except]).map(&:to_s) | %w[browser_token]
+      super(options)
+    end
+
     # Summary for API responses
     def summary
       {
@@ -262,15 +510,30 @@ module ActionAgent
         mcp_servers: Array(mcp_servers),
         repository: repository,
         repository_ref: repository_ref,
+        # How a checkout reaches GitHub: "app" (a GitHub App installation) or
+        # "oauth" (the OAuth connection).
+        checkout_source: app_runtime? ? (github_installation_id ? "app" : "oauth") : nil,
         # The key an agent adds to its mcp_servers to use this runtime's
         # tools; nil until the backend has reported the endpoint.
         runtime_server_key: runtime_mcp_url.present? ? runtime_server_key : nil,
         # Why provisioning failed. Scrubbed of the session's secrets when
         # SandboxProvisionJob stored it.
-        error_message: error_summary
+        error_message: error_summary,
+        browser: browser_summary,
+        # The project this checkout was booted for, so a listing can link to
+        # its page; nil for a sandbox started on its own.
+        project: project_link
       }
     end
 
+    # { id:, name: } of the project this checkout was booted for, or nil. An
+    # install that has not run the projects migration has no column for it.
+    def project_link
+      return nil unless has_attribute?(:project_id) && project_id
+
+      project && { id: project.id, name: project.name }
+    end
+
     # A failed boot's message is a one-line reason followed by the tail of
     # the failing step's log, and the log's last lines usually hold the
     # actual error — so a long message keeps its head and its end.
@@ -297,26 +560,47 @@ module ActionAgent
     # The owner's record in +scope+, found through that model's own owner
     # column. GitHub connections and provider keys are account-owned before
     # user-owned, the opposite of a session, so the session's #owner is not
-    # necessarily theirs.
+    # necessarily theirs. Only the rows the model's .owned_rows admits are
+    # read, so a member's personal provider key never reaches a sandbox,
+    # which every member of the account shares.
     def owners_record(scope)
+      owners_records(scope).first
+    end
+
+    # Every record of the owner's in +scope+, found the same way.
+    def owners_records(scope)
       scope = scope.all
+      scope = scope.merge(scope.klass.owned_rows)
       case scope.klass.owner_association
-      when :account then account_id && scope.find_by(account_id: account_id)
-      when :user then user_id && scope.find_by(user_id: user_id)
-      else scope.first
+      when :account then account_id ? scope.where(account_id: account_id) : scope.none
+      when :user then user_id ? scope.where(user_id: user_id) : scope.none
+      else scope
       end
     end
 
+    # A repository selected on one of the owner's GitHub App installations is
+    # checked out through that installation, ahead of the OAuth connection,
+    # so the checkout gets a short-lived token limited to that repository.
+    # Installations count only while a GitHub App is configured, since
+    # nothing else can mint their tokens.
     def repository_available
       return if repository.blank?
 
-      connection = github_connection
-      if connection.nil?
-        errors.add(:repository, "needs a GitHub connection (Settings -> Integrations)")
-      elsif (repo = connection.repository(repository))
+      installations = ActionAgent.github_app_configured? ? owners_records(GithubInstallation).order(:id).to_a : []
+      installation = installations.find { |candidate| candidate.usable? && candidate.repository(repository) }
+      connection = github_connection unless installation
+      repo = installation&.repository(repository) || connection&.repository(repository)
+
+      if repo
+        self.github_installation_id = installation&.id
         # Canonical spelling, and the default branch unless a ref was asked for.
         self.repository = repo["full_name"]
         self.repository_ref = repository_ref.presence || repo["default_branch"]
+      elsif installations.any? { |candidate| candidate.repository(repository) }
+        errors.add(:repository, "is selected on a GitHub App installation that was removed or suspended: " \
+          "reinstall the GitHub App, or Check again once it is unsuspended, in Settings -> Integrations")
+      elsif connection.nil? && installations.empty?
+        errors.add(:repository, "needs a GitHub connection (Settings -> Integrations)")
       else
         errors.add(:repository, "is not one of the repositories selected in Settings -> Integrations")
       end