@capybara-hq/plugin-github 0.1.0-rc.0 → 0.1.0-rc.1

package/.capybara-plugin/plugin.json

@@ -2,11 +2,11 @@
   "$schema": "https://capybarahq.com/schemas/plugin.v1.schema.json",
   "schemaVersion": 1,
   "name": "github",
-  "version": "0.1.0-rc.0",
+  "version": "0.1.0-rc.1",
   "publisher": "Capybara",
   "description": {
-    "en": "Agents work with GitHub as the connected person: issues, pull requests, reviews, repositories and Actions runs, through GitHub's remote MCP server. Members connect with OAuth (a GitHub App or OAuth App the org admin registers) or, when the admin allows it, a personal access token",
-    "zh": "智能体以连接者本人的身份使用 GitHub：issue、拉取请求、评审、仓库与 Actions 运行，经 GitHub 的远程 MCP 服务器。成员用 OAuth（组织管理员注册的 GitHub App 或 OAuth App）连接，或在管理员允许时用个人访问令牌连接"
+    "en": "Agents work with GitHub as the connected person: issues, pull requests, reviews, repositories and Actions runs, through GitHub's remote MCP server. Each member connects with OAuth through a GitHub App (or OAuth App) the org admin registers",
+    "zh": "智能体以连接者本人的身份使用 GitHub：issue、拉取请求、评审、仓库与 Actions 运行，经 GitHub 的远程 MCP 服务器。每位成员通过组织管理员注册的 GitHub App（或 OAuth App）用 OAuth 连接"
   },
   "displayName": {
     "zh": "GitHub",
@@ -23,9 +23,6 @@
   "connectorTemplates": [
     {
       "path": "./connectors/github.json"
-    },
-    {
-      "path": "./connectors/github-pat.json"
     }
   ],
   "setupGuides": [
@@ -33,11 +30,6 @@
       "id": "github-oauth",
       "place": "connector-template",
       "template": "github"
-    },
-    {
-      "id": "github-pat",
-      "place": "connector-template",
-      "template": "github-pat"
     }
   ]
 }

package/README.md

@@ -1,6 +1,6 @@
 # @capybara-hq/plugin-github
 
-GitHub connector templates (declarative: no extension). Agents work with GitHub **as the
+The GitHub connector template (declarative: no extension). Agents work with GitHub **as the
 person using them**: issues, pull requests, comments and reviews, repository files and branches,
 and Actions runs and logs, through [GitHub's remote MCP server](https://github.com/github/github-mcp-server/blob/main/docs/remote-server.md)
 (`https://api.githubcopilot.com/mcp/`) on the [`connector-mcp`](../connector-mcp) connector.
@@ -8,14 +8,13 @@ and Actions runs and logs, through [GitHub's remote MCP server](https://github.c
 | Template | Auth | Default |
 |---|---|---|
 | `github` | Per-person OAuth (`oauth_code`, MCP discovery, manual client): the org admin registers a GitHub App (recommended: fine-grained permissions, per-installation repositories, tokens that expire after eight hours and are refreshed) or an OAuth App (classic scopes `repo`, `read:org`, `read:user`, `user:email`, `workflow`) | on |
-| `github-pat` | Per-person personal access token (`bearer`) | off: an org admin switches it on where tokens are allowed |
 
 GitHub does not support dynamic client registration, so the OAuth template always needs a client
 the org admin enters.
 
 ## Tools and policies
 
-Both templates set the endpoint header `X-MCP-Toolsets: context,repos,issues,pull_requests,users,actions`
+The template sets the endpoint header `X-MCP-Toolsets: context,repos,issues,pull_requests,users,actions`
 (GitHub's default toolsets plus `actions` for CI status). The header and the URL are editable per
 org (`editableEndpoint`): add toolsets, set `X-MCP-Readonly: true`, or point the URL at a GitHub
 Enterprise Cloud data residency host (`https://copilot-api.<subdomain>.ghe.com/mcp`). GitHub
@@ -32,17 +31,20 @@ annotation (read-only: allow, else ask) and goes through the drift review.
 
 `guides/github-oauth.md` (template `github`: GitHub App settings, the OAuth App alternative, the
 kernel checks `public-url`, `oauth-client`, `oauth-token-endpoint`, `connector-tools`, and how a
-member connects and revokes) and `guides/github-pat.md` (template `github-pat`: when to allow
-tokens, and the fine-grained token a member creates), each with a Chinese version. Preview with
+member connects and revokes), with a Chinese version. Preview with
 `capybara-plugin guide github-oauth --audience admin` from this directory.
 
 ## Tests
 
 ```bash
 pnpm exec vitest run plugins/github
-# live, against GitHub (opens and closes an issue in the scratch repository):
+# live, against GitHub (lists the tools and calls get_me; read-only):
 CAPYBARA_TEST_LIVE_TOOLS=1 pnpm exec vitest run plugins/github/test/live -t live
 ```
 
-The live test needs `CAPYBARA_TEST_GITHUB_MCP_TOKEN` (a personal access token) and
-`CAPYBARA_TEST_GITHUB_REPO` (`owner/name`). Keep them in an env file outside the repository.
+The live test needs `CAPYBARA_TEST_GITHUB_MCP_TOKEN`: a personal access token stands in for a
+member's OAuth token, since the OAuth flow needs a browser. Keep it in an env file outside the
+repository.
+
+A personal access token template was dropped before release: OAuth through a GitHub App gives
+expiring tokens, per-installation repositories and admin control, which a member-made token does not.

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@capybara-hq/plugin-github",
-  "version": "0.1.0-rc.0",
+  "version": "0.1.0-rc.1",
   "type": "module",
   "license": "Apache-2.0",
-  "description": "GitHub connector templates: issues, pull requests, reviews, repositories and Actions through GitHub's remote MCP server, as the connected person (GitHub App / OAuth App or a personal access token)",
+  "description": "GitHub connector template: issues, pull requests, reviews, repositories and Actions through GitHub's remote MCP server, as the connected person (OAuth through a GitHub App or OAuth App)",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/capybara-hq/plugins.git",

package/connectors/github-pat.json

@@ -1,119 +0,0 @@
-{
-  "displayName": {
-    "zh": "GitHub（个人访问令牌）",
-    "en": "GitHub (personal access token)"
-  },
-  "description": "The same GitHub tools as the GitHub template, but each member pastes a personal access token of their own (fine-grained recommended) instead of connecting with OAuth. Off by default: an org admin switches it on where personal access tokens are allowed.",
-  "icon": "./icon.svg",
-  "defaultEnabled": false,
-  "template": {
-    "plugin": "connector-mcp",
-    "pluginVersion": "^0.1.0-rc.1",
-    "connector": "mcp",
-    "endpoint": {
-      "url": "https://api.githubcopilot.com/mcp/",
-      "headers": {
-        "X-MCP-Toolsets": "context,repos,issues,pull_requests,users,actions"
-      }
-    },
-    "editableEndpoint": ["url", "headers"],
-    "auth": {
-      "type": "bearer",
-      "ownership": "personal"
-    },
-    "defaultToolPolicies": {
-      "get_me": "allow",
-      "get_teams": "allow",
-      "get_team_members": "allow",
-      "ui_get": "allow",
-      "get_commit": "allow",
-      "get_file_contents": "allow",
-      "get_file_blame": "allow",
-      "get_latest_release": "allow",
-      "get_release_by_tag": "allow",
-      "get_tag": "allow",
-      "list_branches": "allow",
-      "list_commits": "allow",
-      "list_releases": "allow",
-      "list_repository_collaborators": "allow",
-      "list_tags": "allow",
-      "search_code": "allow",
-      "search_commits": "allow",
-      "search_repositories": "allow",
-      "issue_read": "allow",
-      "list_issues": "allow",
-      "search_issues": "allow",
-      "list_issue_types": "allow",
-      "list_issue_fields": "allow",
-      "get_label": "allow",
-      "find_duplicate": "allow",
-      "issue_dependency_read": "allow",
-      "issue_artifact_read": "allow",
-      "pull_request_read": "allow",
-      "list_pull_requests": "allow",
-      "search_pull_requests": "allow",
-      "search_users": "allow",
-      "actions_get": "allow",
-      "actions_list": "allow",
-      "get_job_logs": "allow",
-      "create_branch": "ask",
-      "create_or_update_file": "ask",
-      "push_files": "ask",
-      "delete_file": "ask",
-      "create_repository": "ask",
-      "fork_repository": "ask",
-      "create_issue": "ask",
-      "issue_write": "ask",
-      "add_issue_comment": "ask",
-      "update_issue_comment": "ask",
-      "sub_issue_write": "ask",
-      "add_sub_issue": "ask",
-      "remove_sub_issue": "ask",
-      "reprioritize_sub_issue": "ask",
-      "set_issue_fields": "ask",
-      "update_issue_assignees": "ask",
-      "update_issue_body": "ask",
-      "update_issue_labels": "ask",
-      "update_issue_milestone": "ask",
-      "update_issue_state": "ask",
-      "update_issue_title": "ask",
-      "update_issue_type": "ask",
-      "issue_dependency_write": "ask",
-      "issue_artifact_write": "ask",
-      "add_issue_reaction": "ask",
-      "add_issue_comment_reaction": "ask",
-      "remove_issue_reaction": "ask",
-      "remove_issue_comment_reaction": "ask",
-      "hide_issue_comment": "ask",
-      "unhide_issue_comment": "ask",
-      "create_pull_request": "ask",
-      "update_pull_request": "ask",
-      "update_pull_request_branch": "ask",
-      "update_pull_request_body": "ask",
-      "update_pull_request_title": "ask",
-      "update_pull_request_state": "ask",
-      "update_pull_request_draft_state": "ask",
-      "merge_pull_request": "ask",
-      "request_pull_request_reviewers": "ask",
-      "pull_request_review_write": "ask",
-      "create_pull_request_review": "ask",
-      "submit_pending_pull_request_review": "ask",
-      "delete_pending_pull_request_review": "ask",
-      "add_comment_to_pending_review": "ask",
-      "add_pull_request_review_comment": "ask",
-      "add_reply_to_pull_request_comment": "ask",
-      "resolve_review_thread": "ask",
-      "unresolve_review_thread": "ask",
-      "add_pull_request_review_comment_reaction": "ask",
-      "remove_pull_request_review_comment_reaction": "ask",
-      "hide_pull_request_review": "ask",
-      "unhide_pull_request_review": "ask",
-      "hide_pull_request_review_comment": "ask",
-      "unhide_pull_request_review_comment": "ask",
-      "assign_copilot_to_issue": "ask",
-      "request_copilot_review": "ask",
-      "actions_run_trigger": "ask",
-      "delete_repository": "deny"
-    }
-  }
-}

package/guides/github-pat.md

@@ -1,58 +0,0 @@
-# Set up the GitHub connector with personal access tokens
-
-This template gives agents the same GitHub tools as the **GitHub** template, but each member pastes
-a personal access token of their own instead of connecting with OAuth. Agents then act on GitHub
-as that member, with what the token allows.
-
-::: audience admin
-The template starts switched off. Switch it on only where personal access tokens are acceptable:
-they are created and scoped by each member, and a classic token reaches every repository the
-member can. Prefer the **GitHub** template (a GitHub App) where you can.
-
-If your GitHub organization requires approval of fine-grained tokens, an owner approves each
-member's token under **Settings → Personal access tokens → Pending requests**. To forbid classic
-tokens, set **Settings → Personal access tokens → Restrict access via personal access tokens
-(classic)**.
-
-Reads run directly; writes ask the member first and deleting a repository is denied, as in the
-**GitHub** template.
-
-::check capybara:connector-tools A member connected and the tool list was read
-:::
-
-::: audience member
-## Create a token
-
-Open **Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new
-token** on GitHub (`https://github.com/settings/personal-access-tokens/new`) and choose:
-
-```yaml title="Fine-grained token (GitHub connector)"
-# Personal access token for the "{{templateName}}" connector template ({{pluginName}} {{pluginVersion}}).
-# Reference: https://docs.github.com/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens (checked 2026-11-12).
-Resource owner: (your account or the organization that owns the repositories)
-Expiration: 90 days or less
-Repository access: Only select repositories
-Repository permissions:
-  Actions: Read and write
-  Commit statuses: Read-only
-  Contents: Read and write
-  Issues: Read and write
-  Metadata: Read-only
-  Pull requests: Read and write
-  Workflows: Read and write   # only to change files under .github/workflows
-Organization permissions:
-  Members: Read-only
-```
-
-Fine-grained tokens have no Checks permission; Actions and Commit statuses cover CI status.
-A classic token works too (scopes `repo`, `read:org`, `read:user`, `user:email`, `workflow`); with
-one, GitHub hides the tools the token's scopes do not cover.
-
-## Connect
-
-Paste the token in **Connect**. It is stored encrypted and never shown again. When it expires,
-connect again with a new token. **Disconnect** deletes it in Capybara; delete the token on GitHub
-as well when you no longer need it.
-
-::check capybara:connector-connected Your GitHub token is connected
-:::

package/guides/github-pat.zh.md

@@ -1,53 +0,0 @@
-# 用个人访问令牌设置 GitHub 连接器
-
-本模板给智能体的 GitHub 工具和 **GitHub** 模板相同，区别是每位成员粘贴自己的个人访问令牌，而不是用 OAuth
-连接。智能体以这位成员的身份操作 GitHub，能做什么由令牌决定。
-
-::: audience admin
-本模板默认关闭。只在允许个人访问令牌的组织里打开：令牌由成员自己创建、自己决定范围，经典令牌能访问成员能
-访问的所有仓库。能用 **GitHub** 模板（GitHub App）时优先用它。
-
-如果 GitHub 组织要求审批细粒度令牌，需要组织所有者在 **Settings → Personal access tokens → Pending
-requests** 里批准每位成员的令牌。要禁止经典令牌，设置 **Settings → Personal access tokens → Restrict access
-via personal access tokens (classic)**。
-
-和 **GitHub** 模板一样：读取直接执行，写入先征求成员同意，删除仓库默认禁止。
-
-::check capybara:connector-tools 已有成员连接并读到工具列表
-:::
-
-::: audience member
-## 创建令牌
-
-在 GitHub 上打开 **Settings → Developer settings → Personal access tokens → Fine-grained tokens →
-Generate new token**（`https://github.com/settings/personal-access-tokens/new`），按下面选择：
-
-```yaml title="细粒度令牌（GitHub 连接器）"
-# Personal access token for the "{{templateName}}" connector template ({{pluginName}} {{pluginVersion}}).
-# Reference: https://docs.github.com/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens (checked 2026-11-12).
-Resource owner: (your account or the organization that owns the repositories)
-Expiration: 90 days or less
-Repository access: Only select repositories
-Repository permissions:
-  Actions: Read and write
-  Commit statuses: Read-only
-  Contents: Read and write
-  Issues: Read and write
-  Metadata: Read-only
-  Pull requests: Read and write
-  Workflows: Read and write   # only to change files under .github/workflows
-Organization permissions:
-  Members: Read-only
-```
-
-细粒度令牌没有 Checks 权限；CI 状态由 Actions 和 Commit statuses 覆盖。
-也可以用经典令牌（scope 为 `repo`、`read:org`、`read:user`、`user:email`、`workflow`）；这时 GitHub 会隐藏
-令牌 scope 覆盖不到的工具。
-
-## 连接
-
-在**连接**里粘贴令牌。令牌加密保存，之后不再显示。过期后用新令牌重新连接。**断开连接**会删除 Capybara 里的
-令牌；不再需要时也请在 GitHub 上删除它。
-
-::check capybara:connector-connected 你的 GitHub 令牌已连接
-:::