@capybara-hq/kernel 0.1.0-rc.27 → 0.1.0-rc.28

package/dist/orgs/settings.service.d.ts

@@ -29,6 +29,8 @@ import { OrgLock } from "./org-lock.js";
  *   absent (or an invalid stored value) = follow the platform, personal picks allowed.
  * - `uiArrangement`: per slot, the extension contributions the org hides and their order (UI slots
  *   spec §5); a slot with no entry follows the platform's; an invalid stored value reads as absent.
+ * - `gitGateway`: the org's git gateway switch and host sources (sandbox git credentials spec §9);
+ *   not in the PATCH yet; an invalid stored value reads as `{ enabled: false }` (fails closed).
  */
 /** 组织沙箱出站白名单的主机数上限。 */
 export declare const ORG_SANDBOX_ALLOW_HOSTS_MAX = 200;
@@ -117,6 +119,21 @@ export declare const ScheduledTasksPatchSchema: z.ZodObject<{
     pauseAfterFailures: z.ZodOptional<z.ZodNumber>;
     forbiddenTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
+/**
+ * The org's git gateway setting (sandbox git credentials spec §9): `enabled: false` switches the
+ * gateway off for the org (absent = on); `hostSources` names, per git host, the connector whose
+ * credential the gateway uses there. Reads fail closed: an invalid stored value (not an object, or
+ * a field of the wrong type) reads as {@link GIT_GATEWAY_INVALID} (off), never wider than stored.
+ */
+export declare const GitGatewaySettingSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    hostSources: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+/** What an invalid stored `gitGateway` reads as: the gateway off for the org. */
+export declare const GIT_GATEWAY_INVALID: {
+    readonly enabled: false;
+};
+export type GitGatewaySetting = z.infer<typeof GitGatewaySettingSchema>;
 export declare const OrgSettingsSchema: z.ZodObject<{
     toolSearch: z.ZodCatch<z.ZodDefault<z.ZodEnum<{
         off: "off";
@@ -165,6 +182,10 @@ export declare const OrgSettingsSchema: z.ZodObject<{
         }>;
     }, z.core.$strict>>>;
     uiArrangement: z.ZodCatch<z.ZodOptional<z.ZodType<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown, z.core.$ZodTypeInternals<Partial<Record<"agent.detail.section" | "conversation.composer.frame" | "conversation.empty" | "conversation.panel" | "conversation.properties.section" | "conversation.tool-result.card" | "file.preview" | "org.page" | "org.settings.section" | "platform.page" | "shell.brand" | "shell.overlay", import("../ui/arrangement.js").UiArrangementEntry>>, unknown>>>>;
+    gitGateway: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        hostSources: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>>;
     scheduledTasks: z.ZodCatch<z.ZodPrefault<z.ZodObject<{
         enabled: z.ZodCatch<z.ZodDefault<z.ZodBoolean>>;
         minIntervalMinutes: z.ZodCatch<z.ZodDefault<z.ZodNumber>>;

package/dist/orgs/settings.service.js

@@ -45,6 +45,8 @@ import { OrgLock, OrgLockModule } from "./org-lock.js";
  *   absent (or an invalid stored value) = follow the platform, personal picks allowed.
  * - `uiArrangement`: per slot, the extension contributions the org hides and their order (UI slots
  *   spec §5); a slot with no entry follows the platform's; an invalid stored value reads as absent.
+ * - `gitGateway`: the org's git gateway switch and host sources (sandbox git credentials spec §9);
+ *   not in the PATCH yet; an invalid stored value reads as `{ enabled: false }` (fails closed).
  */
 /** 组织沙箱出站白名单的主机数上限。 */
 export const ORG_SANDBOX_ALLOW_HOSTS_MAX = 200;
@@ -139,6 +141,18 @@ export const ScheduledTasksPatchSchema = z
 })
     .partial()
     .strict();
+/**
+ * The org's git gateway setting (sandbox git credentials spec §9): `enabled: false` switches the
+ * gateway off for the org (absent = on); `hostSources` names, per git host, the connector whose
+ * credential the gateway uses there. Reads fail closed: an invalid stored value (not an object, or
+ * a field of the wrong type) reads as {@link GIT_GATEWAY_INVALID} (off), never wider than stored.
+ */
+export const GitGatewaySettingSchema = z.object({
+    enabled: z.boolean().optional(),
+    hostSources: z.record(z.string(), z.string()).optional(),
+});
+/** What an invalid stored `gitGateway` reads as: the gateway off for the org. */
+export const GIT_GATEWAY_INVALID = { enabled: false };
 export const OrgSettingsSchema = z.object({
     toolSearch: z.enum(["on", "off"]).default("on").catch("on"),
     locale: z.enum(["zh", "en"]).default("en").catch("en"),
@@ -155,6 +169,8 @@ export const OrgSettingsSchema = z.object({
     theme: OrgThemeSettingSchema.optional().catch(undefined),
     /** Hidden and ordered extension contributions per slot; absent = follow the platform. */
     uiArrangement: UiArrangementSchema.optional().catch(undefined),
+    /** The org's git gateway switch and host sources; absent = on, sources chosen by default. */
+    gitGateway: GitGatewaySettingSchema.optional().catch({ ...GIT_GATEWAY_INVALID }),
     /** Scheduled tasks (spec §9); the platform bounds clamp it, see `effectiveScheduleSettings`. */
     scheduledTasks: ScheduledTasksSettingsSchema.prefault({}).catch(ScheduledTasksSettingsSchema.parse({})),
 });
@@ -434,6 +450,8 @@ let OrgSettingsService = class OrgSettingsService {
             delete after.theme;
         if (after.uiArrangement === undefined)
             delete after.uiArrangement;
+        if (after.gitGateway === undefined)
+            delete after.gitGateway;
         if (sameSettings(before, after))
             return before;
         // Lock order: the org row (orgLock above), then the theme's catalog item and its row FOR

package/dist/overrides.d.ts

@@ -8,6 +8,8 @@ import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
 import { USAGE_SUBSCRIBERS_CLOCK } from "./extensions/usage-subscribers.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { GIT_UPSTREAM_ORIGIN, type GitUpstreamOrigin } from "./git/gateway.js";
+import { GIT_IDENTITY_API_BASE, type GitIdentityApiBase } from "./git/identity.js";
 import { OUTBOX_DISPATCH_FAILS } from "./infra/outbox/outbox.dispatcher.js";
 import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
 import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
@@ -40,6 +42,8 @@ import { EMBED_TOKEN_CLOCK } from "./ui/embed-token.js";
  * - `EMBED_TOKEN_CLOCK`: the clock embed tokens are issued and checked with;
  * - `RUN_CONTEXT_CLOCK`: the clock run start reads the run context's date from, and the
  *   `CurrentTime` builtin the time;
+ * - `GIT_IDENTITY_API_BASE`: the API base of a git host for the commit identity (a loopback fake);
+ * - `GIT_UPSTREAM_ORIGIN`: the origin the git gateway relays a git host to (a loopback fake);
  * - `OUTBOX_STRICT_CONFLICTS`: a reused outbox job id with different data throws (tests) instead
  *   of logging an error;
  * - `OUTBOX_DISPATCH_FAILS`: returns true to make the outbox dispatcher's adds to the given queue
@@ -69,6 +73,8 @@ interface KernelSeams {
     [ADMIN_USAGE_TIMINGS]: Partial<AdminUsageTimings>;
     [EMBED_TOKEN_CLOCK]: () => number;
     [RUN_CONTEXT_CLOCK]: () => number;
+    [GIT_IDENTITY_API_BASE]: GitIdentityApiBase;
+    [GIT_UPSTREAM_ORIGIN]: GitUpstreamOrigin;
     [OUTBOX_STRICT_CONFLICTS]: boolean;
     [OUTBOX_DISPATCH_FAILS]: (queue: KernelQueueName) => boolean;
     [USAGE_SUBSCRIBERS_CLOCK]: () => number;

package/dist/overrides.js

@@ -6,6 +6,8 @@ import { EVAL_REPLAY_HOOKS } from "./evals/worker.js";
 import { BOOTSTRAP_LOCK_TTL } from "./extensions/bootstrap.js";
 import { USAGE_SUBSCRIBERS_CLOCK } from "./extensions/usage-subscribers.js";
 import { FILE_PREVIEW_TIMEOUT } from "./files/previewers.js";
+import { GIT_UPSTREAM_ORIGIN } from "./git/gateway.js";
+import { GIT_IDENTITY_API_BASE } from "./git/identity.js";
 import { OUTBOX_DISPATCH_FAILS } from "./infra/outbox/outbox.dispatcher.js";
 import { OUTBOX_FAST_PATH_SETTLED } from "./infra/outbox/outbox.module.js";
 import { OUTBOX_STRICT_CONFLICTS } from "./infra/outbox/outbox.service.js";
@@ -38,6 +40,8 @@ const SEAM_TOKENS = [
     ADMIN_USAGE_TIMINGS,
     EMBED_TOKEN_CLOCK,
     RUN_CONTEXT_CLOCK,
+    GIT_IDENTITY_API_BASE,
+    GIT_UPSTREAM_ORIGIN,
     OUTBOX_STRICT_CONFLICTS,
     OUTBOX_DISPATCH_FAILS,
     OUTBOX_FAST_PATH_SETTLED,

package/dist/platform/exclusions.js

@@ -282,6 +282,9 @@ export const PLATFORM_EXCLUSIONS = [
         category: "transport",
         reason: "Serves sandbox file bytes",
     },
+    // git gateway (sandbox git credentials spec §5): `GET` / `POST /git/v1/*` is git smart-HTTP for
+    // sandboxes, authenticated by run tickets, not an API; it is a raw api-role Fastify route
+    // (`git/gateway.route.ts`), not a Nest controller, so it is not listed (like the webhook)
     // devices (personal cloud devices, environments design phase 1)
     // connected machines (environments design phase 2): device sign-in by the program and on the
     // confirmation page, and disconnecting a machine. The machine's WebSocket (`GET /device/connect`)

package/dist/runtime/run-finish.d.ts

@@ -1,4 +1,5 @@
 import { type AppendEvent, EventLog } from "../conversations/event-log.js";
+import { GitRunEnd } from "../git/run-end.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { OutboxService } from "../infra/outbox/outbox.service.js";
@@ -30,6 +31,8 @@ export declare class RunFinish {
     readonly txHost: TransactionHost;
     /** A scheduled task's run follows its kernel run's end in the same transaction (spec §6). */
     private readonly taskRuns;
+    /** The run's git tickets are revoked and its fetch summaries written after the commit. */
+    private readonly gitRunEnd;
     /** The run's end owes the conversation's ensure-run backstop (transactional outbox spec §6). */
     private readonly outbox;
     /** A finished run's pending approvals are cancelled in its terminal transaction. */
@@ -39,6 +42,8 @@ export declare class RunFinish {
     constructor(kdb: KernelDb, eventLog: EventLog, txHost: TransactionHost, 
     /** A scheduled task's run follows its kernel run's end in the same transaction (spec §6). */
     taskRuns: Pick<ScheduledTaskRunTracker, "onRunFinished">, 
+    /** The run's git tickets are revoked and its fetch summaries written after the commit. */
+    gitRunEnd: Pick<GitRunEnd, "onRunFinished">, 
     /** The run's end owes the conversation's ensure-run backstop (transactional outbox spec §6). */
     outbox: Pick<OutboxService, "add">, 
     /** A finished run's pending approvals are cancelled in its terminal transaction. */

package/dist/runtime/run-finish.js

@@ -11,6 +11,8 @@ import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { EventLog } from "../conversations/event-log.js";
 import { pauseQueueIn } from "../conversations/queue.js";
+import { GitRunEnd } from "../git/run-end.js";
+import { afterCommit } from "../infra/database/after-commit.js";
 import { KernelDb } from "../infra/database/kernel-db.js";
 import { TransactionHost } from "../infra/database/transaction-host.js";
 import { Transactional } from "../infra/database/transactional.decorator.js";
@@ -30,12 +32,15 @@ let RunFinish = class RunFinish {
     eventLog;
     txHost;
     taskRuns;
+    gitRunEnd;
     outbox;
     approvals;
     questions;
     constructor(kdb, eventLog, txHost, 
     /** A scheduled task's run follows its kernel run's end in the same transaction (spec §6). */
     taskRuns, 
+    /** The run's git tickets are revoked and its fetch summaries written after the commit. */
+    gitRunEnd, 
     /** The run's end owes the conversation's ensure-run backstop (transactional outbox spec §6). */
     outbox, 
     /** A finished run's pending approvals are cancelled in its terminal transaction. */
@@ -46,6 +51,7 @@ let RunFinish = class RunFinish {
         this.eventLog = eventLog;
         this.txHost = txHost;
         this.taskRuns = taskRuns;
+        this.gitRunEnd = gitRunEnd;
         this.outbox = outbox;
         this.approvals = approvals;
         this.questions = questions;
@@ -122,6 +128,8 @@ let RunFinish = class RunFinish {
             .where("id", "=", a.runId)
             .execute();
         await this.taskRuns.onRunFinished(a.runId, a.status, failureMessage(a.event));
+        // the terminal status is committed first, then the tickets go (the one place runs end)
+        afterCommit(() => this.gitRunEnd.onRunFinished(a.runId));
         // a failed or stopped run pauses the queued messages until the person resumes (spec §5.7)
         if (a.status !== "completed")
             await pauseQueueIn(t, a.conversationId);
@@ -185,9 +193,10 @@ RunFinish = __decorate([
     __param(1, Inject(EventLog)),
     __param(2, Inject(TransactionHost)),
     __param(3, Inject(ScheduledTaskRunTracker)),
-    __param(4, Inject(OutboxService)),
-    __param(5, Inject(ApprovalsService)),
-    __param(6, Inject(QuestionsService))
+    __param(4, Inject(GitRunEnd)),
+    __param(5, Inject(OutboxService)),
+    __param(6, Inject(ApprovalsService)),
+    __param(7, Inject(QuestionsService))
 ], RunFinish);
 export { RunFinish };
 /**

package/dist/runtime/runtime.module.js

@@ -12,6 +12,7 @@ import { AttachmentsModule } from "../conversations/attachments.module.js";
 import { EventLogModule } from "../conversations/event-log.js";
 import { TitlesModule } from "../conversations/titles.js";
 import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { GitModule } from "../git/git.module.js";
 import { IdentityModule } from "../identity/identity.module.js";
 import { LockService } from "../infra/lock/lock.service.js";
 import { QueueModule } from "../infra/queue/queue.module.js";
@@ -58,6 +59,7 @@ RuntimeModule = __decorate([
             IdentityModule,
             SkillsModule,
             ToolsModule,
+            GitModule,
             ProvidersModule,
             RunJobsModule,
             SubagentsModule,

package/dist/runtime/waits.js

@@ -19,7 +19,7 @@ import { Transactional } from "../infra/database/transactional.decorator.js";
 import { KernelEvents } from "../infra/events/kernel-events.js";
 import { OutboxService } from "../infra/outbox/outbox.service.js";
 import { KERNEL_LOGGER } from "../infra/tokens.js";
-import { ApprovalsService, NETWORK_ASK_CANCELLED_NOTE, } from "../tools/approvals.service.js";
+import { ApprovalsService, GIT_ASK_CANCELLED_NOTE, NETWORK_ASK_CANCELLED_NOTE, } from "../tools/approvals.service.js";
 import { APPROVAL_CANCELLED_TEXT, INPUT_CANCELLED_TEXT, RUN_STOPPED_TEXT, ToolPipeline, } from "../tools/pipeline.js";
 import { QuestionsService } from "../tools/questions.service.js";
 import { RunAbort } from "./abort.js";
@@ -338,13 +338,15 @@ let Waits = class Waits {
             .orderBy("attempt")
             .execute();
         for (const a of approvals) {
-            // a network ask's command already ran: its kept result, then why access stays blocked
-            // (network ask-to-allow spec §6.7)
-            const kept = a.kind === "network" ? a.detail?.result : null;
+            // a network or git ask's command already ran: its kept result, then why access stays
+            // blocked or the push was not made (network ask-to-allow spec §6.7)
+            const kept = a.kind === "network" || a.kind === "git"
+                ? a.detail?.result
+                : null;
             cancelled.set(a.call_id, kept
                 ? {
                     toolKey: a.tool_key,
-                    text: `${kept.content}\n\n${NETWORK_ASK_CANCELLED_NOTE}`,
+                    text: `${kept.content}\n\n${a.kind === "git" ? GIT_ASK_CANCELLED_NOTE : NETWORK_ASK_CANCELLED_NOTE}`,
                     isError: kept.isError,
                 }
                 : { toolKey: a.tool_key, text: APPROVAL_CANCELLED_TEXT });

package/dist/schedules/fire.d.ts

@@ -25,9 +25,9 @@ export declare function localTimeOf(at: Date, timeZone: string): string;
  *    count), then the task run and the task rows: the checks in order (task paused since the
  *    scan, unless a person's "run now"; a tick fired more than 10 minutes past the org's catch-up
  *    window, `missed`, unless a "run now"; org disabled, creator inactive or not a member, agent
- *    gone or not visible, conversation gone, connection inactive,
- *    overlap, rate limit, device offline, queue paused), each a `skipped` run with its reason, the
- *    lasting ones also pausing the task; then `fired_at` is written, after the rate limit count,
+ *    gone or not visible, conversation gone, connection inactive or its extension disabled in the
+ *    org, overlap, rate limit, device offline, queue paused), each a `skipped` run with its reason,
+ *    the lasting ones also pausing the task; then `fired_at` is written, after the rate limit count,
  *    with the run's delayed settle check owed (`sched-settle`, {@link settle}).
  *    A run whose claim committed before (a retried job) goes straight to the start.
  * 2. The start, idempotent: `new` creates the conversation with its first message keyed by the

package/dist/schedules/fire.js

@@ -72,9 +72,9 @@ const DEVICE_GONE = new Set(["device.not_found", "device.unavailable", "sandbox.
  *    count), then the task run and the task rows: the checks in order (task paused since the
  *    scan, unless a person's "run now"; a tick fired more than 10 minutes past the org's catch-up
  *    window, `missed`, unless a "run now"; org disabled, creator inactive or not a member, agent
- *    gone or not visible, conversation gone, connection inactive,
- *    overlap, rate limit, device offline, queue paused), each a `skipped` run with its reason, the
- *    lasting ones also pausing the task; then `fired_at` is written, after the rate limit count,
+ *    gone or not visible, conversation gone, connection inactive or its extension disabled in the
+ *    org, overlap, rate limit, device offline, queue paused), each a `skipped` run with its reason,
+ *    the lasting ones also pausing the task; then `fired_at` is written, after the rate limit count,
  *    with the run's delayed settle check owed (`sched-settle`, {@link settle}).
  *    A run whose claim committed before (a retried job) goes straight to the start.
  * 2. The start, idempotent: `new` creates the conversation with its first message keyed by the
@@ -279,10 +279,13 @@ let ScheduledTaskFirer = class ScheduledTaskFirer {
                 !conn ||
                 conn.orgId !== orgId ||
                 conn.status !== "active" ||
-                !conn.pluginEnabled ||
                 conn.agentId !== task.agentId) {
                 return skip("target_gone");
             }
+            // the org switched the channel's extension off: the task stays active and recovers when it
+            // is switched on again (unlike a target that is gone)
+            if (!conn.pluginEnabled)
+                return skip("plugin_disabled");
             if (chat.chatType === "group") {
                 // a group has no current conversation: each run starts its own thread at its first post
                 // (spec §8), which needs a channel with threads; the creator must have written there

package/dist/schedules/grant-rules.d.ts

@@ -71,6 +71,35 @@ export declare function networkGrantRefusal(host: string, ctx: NetworkGrantConte
     code: GrantRefusalCode;
     message: string;
 } | null;
+/**
+ * A git push grant (sandbox git credentials spec §7): `git:push` lets the task's unattended runs
+ * push to any repository the creator's git source reaches, `git:push:<owner>/<repo>` to that one.
+ */
+export declare const GIT_PUSH_GRANT = "git:push";
+/** The prefix of a per-repository git push grant (`git:push:<owner>/<repo>`). */
+export declare const GIT_PUSH_REPO_GRANT_PREFIX = "git:push:";
+/** The `spec_hash` a git push grant is stored with (no tool definition behind it). */
+export declare const GIT_GRANT_SPEC_HASH = "git";
+/**
+ * A repository as policies, grants and asks key it: `<owner>/<repo>` lower-cased (hosts compare
+ * repositories without case), a trailing `.git` dropped; null when it is not of that shape or a
+ * segment is `.` / `..`.
+ */
+export declare function normalizeGitRepo(repo: string): string | null;
+/** Whether a grant key is a git push grant (`git:push` or `git:push:<owner>/<repo>`). */
+export declare const isGitGrantKey: (key: string) => boolean;
+/** The grant key of pushes to `repo` (normalized by the caller), or to any repository. */
+export declare const gitPushGrantKey: (repo?: string) => string;
+/**
+ * Why a git push grant key cannot be one of a task's grants, or null when it can: the org forbids
+ * it (`forbiddenTools` lists the key or `git:push`) or the repository is not `<owner>/<repo>`
+ * (`not_grantable`). The key is compared as given (callers normalize it with
+ * {@link normalizeGitGrantKey} first).
+ */
+export declare function gitGrantRefusal(key: string, ctx: Pick<GrantContext, "forbiddenTools">): {
+    code: GrantRefusalCode;
+    message: string;
+} | null;
 /** The prefix of a sandbox tier grant's key (sandbox dev tiers spec §11.4): only `tier:open` exists. */
 export declare const TIER_GRANT_PREFIX = "tier:";
 /** Whether a grant key is a sandbox tier grant (`tier:<tier>`). */
@@ -92,3 +121,14 @@ export declare function tierGrantRefusal(key: string, ctx: {
     code: GrantRefusalCode;
     message: string;
 } | null;
+/**
+ * Whether the org's `forbiddenTools` forbid the git push grant `key` (normalized): it lists
+ * `git:push` or the key, each entry compared normalized (`git:push:Acme/App` forbids
+ * `git:push:acme/app`).
+ */
+export declare function gitPushForbidden(forbiddenTools: readonly string[], key: string): boolean;
+/**
+ * A git push grant key as stored: the repository normalized ({@link normalizeGitRepo}); the key
+ * unchanged when its repository is not of the shape (then {@link gitGrantRefusal} refuses it).
+ */
+export declare function normalizeGitGrantKey(key: string): string;

package/dist/schedules/grant-rules.js

@@ -1,4 +1,5 @@
 import { validateAllowHost, } from "@capybara-hq/plugin-sdk";
+import { GIT_REPO_MAX_CHARS } from "../conversations/events.js";
 import { orgAllows } from "../local-devices/network-grants.js";
 import { roleAtLeast } from "../orgs/roles.js";
 import { isFixedAsk } from "../tools/fixed-ask.js";
@@ -13,6 +14,9 @@ export { TIER_GRANT_SPEC_HASH, TIER_OPEN_GRANT_KEY };
  * undefined when the agent does not have it now.
  */
 export function grantRefusalOf(toolKey, tool, ctx) {
+    // a git push grant belongs to no tool (sandbox git credentials spec §7)
+    if (isGitGrantKey(toolKey))
+        return gitGrantRefusal(toolKey, ctx);
     if (ctx.forbiddenTools.includes(toolKey) ||
         (tool !== undefined && ctx.forbiddenTools.includes(tool.key))) {
         return {
@@ -89,6 +93,61 @@ export function networkGrantRefusal(host, ctx) {
     }
     return null;
 }
+/**
+ * A git push grant (sandbox git credentials spec §7): `git:push` lets the task's unattended runs
+ * push to any repository the creator's git source reaches, `git:push:<owner>/<repo>` to that one.
+ */
+export const GIT_PUSH_GRANT = "git:push";
+/** The prefix of a per-repository git push grant (`git:push:<owner>/<repo>`). */
+export const GIT_PUSH_REPO_GRANT_PREFIX = `${GIT_PUSH_GRANT}:`;
+/** The `spec_hash` a git push grant is stored with (no tool definition behind it). */
+export const GIT_GRANT_SPEC_HASH = "git";
+/** The shape of `<owner>/<repo>` (one owner segment, one repository segment). */
+const GIT_REPO_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+/**
+ * A repository as policies, grants and asks key it: `<owner>/<repo>` lower-cased (hosts compare
+ * repositories without case), a trailing `.git` dropped; null when it is not of that shape or a
+ * segment is `.` / `..`.
+ */
+export function normalizeGitRepo(repo) {
+    const r = repo
+        .trim()
+        .replace(/\.git$/i, "")
+        .toLowerCase();
+    if (r.length > GIT_REPO_MAX_CHARS || !GIT_REPO_PATTERN.test(r))
+        return null;
+    if (r.split("/").some((seg) => seg === "." || seg === ".."))
+        return null;
+    return r;
+}
+/** Whether a grant key is a git push grant (`git:push` or `git:push:<owner>/<repo>`). */
+export const isGitGrantKey = (key) => key === GIT_PUSH_GRANT || key.startsWith(GIT_PUSH_REPO_GRANT_PREFIX);
+/** The grant key of pushes to `repo` (normalized by the caller), or to any repository. */
+export const gitPushGrantKey = (repo) => repo === undefined ? GIT_PUSH_GRANT : `${GIT_PUSH_REPO_GRANT_PREFIX}${repo}`;
+/**
+ * Why a git push grant key cannot be one of a task's grants, or null when it can: the org forbids
+ * it (`forbiddenTools` lists the key or `git:push`) or the repository is not `<owner>/<repo>`
+ * (`not_grantable`). The key is compared as given (callers normalize it with
+ * {@link normalizeGitGrantKey} first).
+ */
+export function gitGrantRefusal(key, ctx) {
+    if (gitPushForbidden(ctx.forbiddenTools, key)) {
+        return {
+            code: "forbidden",
+            message: `The organization does not allow ${key} in scheduled runs`,
+        };
+    }
+    if (key === GIT_PUSH_GRANT)
+        return null;
+    const repo = key.slice(GIT_PUSH_REPO_GRANT_PREFIX.length);
+    if (normalizeGitRepo(repo) !== repo) {
+        return {
+            code: "not_grantable",
+            message: `${key} cannot be approved for a scheduled task: name one repository as git:push:<owner>/<repo>`,
+        };
+    }
+    return null;
+}
 /** The prefix of a sandbox tier grant's key (sandbox dev tiers spec §11.4): only `tier:open` exists. */
 export const TIER_GRANT_PREFIX = "tier:";
 /** Whether a grant key is a sandbox tier grant (`tier:<tier>`). */
@@ -124,3 +183,27 @@ export function tierGrantRefusal(key, ctx) {
     }
     return null;
 }
+/**
+ * Whether the org's `forbiddenTools` forbid the git push grant `key` (normalized): it lists
+ * `git:push` or the key, each entry compared normalized (`git:push:Acme/App` forbids
+ * `git:push:acme/app`).
+ */
+export function gitPushForbidden(forbiddenTools, key) {
+    return forbiddenTools.some((entry) => {
+        const lowered = entry.trim().toLowerCase();
+        if (!isGitGrantKey(lowered))
+            return false;
+        const e = normalizeGitGrantKey(lowered);
+        return e === GIT_PUSH_GRANT || e === key;
+    });
+}
+/**
+ * A git push grant key as stored: the repository normalized ({@link normalizeGitRepo}); the key
+ * unchanged when its repository is not of the shape (then {@link gitGrantRefusal} refuses it).
+ */
+export function normalizeGitGrantKey(key) {
+    if (key === GIT_PUSH_GRANT || !key.startsWith(GIT_PUSH_REPO_GRANT_PREFIX))
+        return key;
+    const repo = normalizeGitRepo(key.slice(GIT_PUSH_REPO_GRANT_PREFIX.length));
+    return repo === null ? key : gitPushGrantKey(repo);
+}

package/dist/schedules/scheduled-tasks.service.d.ts

@@ -255,9 +255,9 @@ export declare class ScheduledTasksService {
     /** Each task with its latest settled non-trial run, in one query. */
     private withLastRuns;
     /**
-     * The chats the caller can point a `chat` task at (spec §8): per active connection of the org,
-     * their DM threads (archived included) and, on a channel with threads, the groups they have a
-     * thread in. Members up (`schedules.use`, the route's).
+     * The chats the caller can point a `chat` task at (spec §8): per active connection of the org
+     * whose extension is enabled in it, their DM threads (archived included) and, on a channel with
+     * threads, the groups they have a thread in. Members up (`schedules.use`, the route's).
      */
     chatTargets(orgId: string, accountId: string): Promise<ChatTarget[]>;
     /**
@@ -322,9 +322,9 @@ export declare class ScheduledTasksService {
      * - the mode and its fields agree (`conversation`: a conversation and no chat; `chat`: a chat
      *   and no conversation; `new`: neither);
      * - `conversation`: the creator's live chat conversation with this agent, still accessible;
-     * - `chat`: the connection is active and bound to this agent; a DM needs a thread row (archived
-     *   allowed) of the creator in that chat; a group needs the creator's thread row in the group
-     *   and a channel with threads.
+     * - `chat`: the connection is active, its channel extension is enabled in this org, and it is
+     *   bound to this agent; a DM needs a thread row (archived allowed) of the creator in that chat;
+     *   a group needs the creator's thread row in the group and a channel with threads.
      */
     private checkTarget;
     /** The channel's declared features; undefined when its extension is not loaded here. */
@@ -347,7 +347,9 @@ export declare class ScheduledTasksService {
      * `deviceId`, the task's device (null: none can be determined, the device rule is skipped),
      * stored with `spec_hash` `network` and no connector (plan P-D7), and only when
      * `source.fromSession` (a person on the task page; never a token, the Platform tool or the
-     * schedule tools). Duplicates keep the last.
+     * schedule tools). Each git push key (`git:push`, `git:push:<owner>/<repo>`, the repository
+     * lower-cased) is refused by {@link gitGrantRefusal} and stored with `spec_hash` `git` and no
+     * connector, also only when `source.fromSession`. Duplicates keep the last.
      */
     private resolveGrants;
     /**