@sentry/junior-github 0.108.0 → 0.109.0

package/SETUP.md

@@ -133,8 +133,8 @@ Use `additionalUserScopes` only when a human-identity integration flow requires
 ## 3) Runtime behavior
 
 - When either GitHub skill is active, authenticated `gh` and `git` commands cause the runtime to inject GitHub credentials automatically for the current turn.
-- The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations, Git smart-HTTP pushes, and user-attachment uploads to `uploads.github.com/user-attachments/assets` use repository-scoped `installation-write`. Unknown REST writes and GraphQL mutations are denied.
-- `user-read` and explicitly human `user-write` operations require the actor, or an explicitly delegated user subject, to authorize the GitHub App through the private OAuth flow. Junior-owned issue, pull request, branch, and asset-upload operations do not fall back to user OAuth.
+- The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations and Git smart-HTTP pushes use repository-scoped `installation-write`. User-attachment uploads to `uploads.github.com/user-attachments/assets` use `user-write`. Unknown REST writes and GraphQL mutations are denied.
+- `user-read` and explicitly human `user-write` operations require the actor, or an explicitly delegated user subject, to authorize the GitHub App through the private OAuth flow. Junior-owned issue, pull request, and branch operations do not fall back to user OAuth.
 - Headless resource-event turns use the `resource-event` system actor and may receive the same repository-scoped installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
 - Git commits use Junior as author and committer. Resolvable human run actors are credited once with `Co-Authored-By` trailers.
 - Issued credentials are reused only within the current turn, credential leases are cached by plugin grant and repository lease scope, and upstream 403 permission denials clear the cached lease before the next retry.

package/dist/db/schema.d.ts

@@ -15,6 +15,13 @@ export declare const githubIssueStateSchema: z.ZodEnum<{
     closed: "closed";
 }>;
 export type GitHubIssueState = z.output<typeof githubIssueStateSchema>;
+export declare const githubIssueStateReasonSchema: z.ZodEnum<{
+    completed: "completed";
+    duplicate: "duplicate";
+    not_planned: "not_planned";
+    reopened: "reopened";
+}>;
+export type GitHubIssueStateReason = z.output<typeof githubIssueStateReasonSchema>;
 /** Current provider projection for issues classified as Junior-owned. */
 export declare const juniorGitHubIssues: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "junior_github_issues";
@@ -107,6 +114,25 @@ export declare const juniorGitHubIssues: import("drizzle-orm/pg-core").PgTableWi
         }, {}, {
             $type: "open" | "closed";
         }>;
+        stateReason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state_reason";
+            tableName: "junior_github_issues";
+            dataType: "string";
+            columnType: "PgText";
+            data: "completed" | "duplicate" | "not_planned" | "reopened";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: "completed" | "duplicate" | "not_planned" | "reopened";
+        }>;
         openedAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "opened_at";
             tableName: "junior_github_issues";
@@ -478,6 +504,25 @@ export declare const githubSqlSchema: {
             }, {}, {
                 $type: "open" | "closed";
             }>;
+            stateReason: import("drizzle-orm/pg-core").PgColumn<{
+                name: "state_reason";
+                tableName: "junior_github_issues";
+                dataType: "string";
+                columnType: "PgText";
+                data: "completed" | "duplicate" | "not_planned" | "reopened";
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                $type: "completed" | "duplicate" | "not_planned" | "reopened";
+            }>;
             openedAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "opened_at";
                 tableName: "junior_github_issues";

package/dist/index.js

@@ -1113,6 +1113,12 @@ var githubPullRequestCommitCompositionSchema = z5.enum([
   "mixed"
 ]);
 var githubIssueStateSchema = z5.enum(["closed", "open"]);
+var githubIssueStateReasonSchema = z5.enum([
+  "completed",
+  "duplicate",
+  "not_planned",
+  "reopened"
+]);
 var juniorGitHubIssues = pgTable(
   "junior_github_issues",
   {
@@ -1121,6 +1127,7 @@ var juniorGitHubIssues = pgTable(
     repositoryFullName: text("repository_full_name").notNull(),
     number: integer("number").notNull(),
     state: text("state").$type().notNull(),
+    stateReason: text("state_reason").$type(),
     openedAt: timestamp("opened_at", { withTimezone: true }).notNull(),
     closedAt: timestamp("closed_at", { withTimezone: true }),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull()
@@ -1164,6 +1171,7 @@ var githubIssueOutcomeInputSchema = z6.object({
   repositoryFullName: z6.string().min(1),
   repositoryId: z6.string().min(1),
   state: githubIssueStateSchema,
+  stateReason: githubIssueStateReasonSchema.optional(),
   updatedAt: z6.date()
 }).strict();
 function projectionValues(input) {
@@ -1174,6 +1182,7 @@ function projectionValues(input) {
     repositoryFullName: input.repositoryFullName,
     repositoryId: input.repositoryId,
     state: input.state,
+    stateReason: input.stateReason ?? null,
     updatedAt: input.updatedAt
   };
 }
@@ -1305,6 +1314,7 @@ var canonicalIssueOutcomeSchema = z8.object({
     created_at: z8.string(),
     id: z8.number().int().positive(),
     number: z8.number().int().positive(),
+    state_reason: githubIssueStateReasonSchema.nullable().optional(),
     updated_at: z8.string(),
     user: z8.object({ login: z8.string().min(1) }).strict()
   }).strict(),
@@ -1321,6 +1331,7 @@ var issueOutcomeSchema = z8.object({
     created_at: z8.string(),
     id: z8.number().int().positive(),
     number: z8.number().int().positive(),
+    state_reason: githubIssueStateReasonSchema.nullable().optional(),
     updated_at: z8.string(),
     user: z8.object({ login: z8.string().min(1) }).passthrough()
   }).passthrough(),
@@ -1337,6 +1348,7 @@ var issueOutcomeSchema = z8.object({
       created_at: provider.issue.created_at,
       id: provider.issue.id,
       number: provider.issue.number,
+      state_reason: provider.issue.state_reason,
       updated_at: provider.issue.updated_at,
       user: { login: provider.issue.user.login }
     },
@@ -1388,6 +1400,7 @@ function normalizeGitHubIssueOutcome(args) {
     repositoryFullName: parsed.repository.full_name,
     repositoryId: String(parsed.repository.id),
     state: parsed.action === "closed" ? "closed" : "open",
+    stateReason: parsed.action === "closed" ? issue.state_reason ?? void 0 : void 0,
     updatedAt
   };
 }
@@ -1636,8 +1649,7 @@ var pullRequestStatsSchema = z10.object({
   juniorOnly: z10.number().int().nonnegative(),
   medianMergeTimeMs: z10.number().nonnegative().nullable(),
   merged: z10.number().int().nonnegative(),
-  mixed: z10.number().int().nonnegative(),
-  open: z10.number().int().nonnegative()
+  mixed: z10.number().int().nonnegative()
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   const classified = row.juniorOnly + row.mixed;
@@ -1655,7 +1667,6 @@ var pullRequestRepositoryStatsSchema = z10.object({
   juniorOnly: z10.number().int().nonnegative(),
   merged: z10.number().int().nonnegative(),
   mixed: z10.number().int().nonnegative(),
-  open: z10.number().int().nonnegative(),
   repository: z10.string().min(1)
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
@@ -1665,19 +1676,23 @@ var pullRequestRepositoryStatsSchema = z10.object({
   };
 });
 var issueStatsSchema = z10.object({
-  closed: z10.number().int().nonnegative(),
+  closedCompleted: z10.number().int().nonnegative(),
+  closedDuplicate: z10.number().int().nonnegative(),
+  closedNotPlanned: z10.number().int().nonnegative(),
+  closedUnknown: z10.number().int().nonnegative(),
   created: z10.number().int().nonnegative(),
   days: z10.number().int().positive(),
-  medianCloseTimeMs: z10.number().nonnegative().nullable(),
-  open: z10.number().int().nonnegative()
+  medianCloseTimeMs: z10.number().nonnegative().nullable()
 }).strict().transform((row) => ({
   ...row,
   medianCloseTimeMs: row.medianCloseTimeMs ?? void 0
 }));
 var issueRepositoryStatsSchema = z10.object({
-  closed: z10.number().int().nonnegative(),
+  closedCompleted: z10.number().int().nonnegative(),
+  closedDuplicate: z10.number().int().nonnegative(),
+  closedNotPlanned: z10.number().int().nonnegative(),
+  closedUnknown: z10.number().int().nonnegative(),
   created: z10.number().int().nonnegative(),
-  open: z10.number().int().nonnegative(),
   repository: z10.string().min(1)
 }).strict();
 function queryRows(result) {
@@ -1707,8 +1722,7 @@ async function aggregatePullRequestWindows(args) {
         ${table.mergedAt},
         ${table.closedAt}
       FROM ${table}
-      WHERE ${table.state} = 'open'
-        OR ${table.openedAt} >= ${oldestStart}
+      WHERE ${table.openedAt} >= ${oldestStart}
         OR ${table.mergedAt} >= ${oldestStart}
         OR ${table.closedAt} >= ${oldestStart}
     )
@@ -1727,8 +1741,6 @@ async function aggregatePullRequestWindows(args) {
           WHERE recent_pull_requests.state = 'closed_unmerged'
             AND recent_pull_requests.closed_at >= windows.start_at
         )::integer AS "closed",
-      count(recent_pull_requests.pull_request_id)
-        FILTER (WHERE recent_pull_requests.state = 'open')::integer AS "open",
       count(recent_pull_requests.pull_request_id)
         FILTER (
           WHERE recent_pull_requests.state = 'merged'
@@ -1781,7 +1793,6 @@ async function aggregatePullRequestRepositories(args) {
         WHERE ${table.state} = 'closed_unmerged'
           AND ${table.closedAt} >= ${start}
       )::integer AS "closed",
-      count(*) FILTER (WHERE ${table.state} = 'open')::integer AS "open",
       count(*) FILTER (
         WHERE ${table.state} = 'merged'
           AND ${table.mergedAt} >= ${start}
@@ -1798,8 +1809,7 @@ async function aggregatePullRequestRepositories(args) {
           AND ${table.commitComposition} IS NULL
       )::integer AS "compositionUnknown"
     FROM ${table}
-    WHERE ${table.state} = 'open'
-      OR ${table.openedAt} >= ${start}
+    WHERE ${table.openedAt} >= ${start}
       OR ${table.mergedAt} >= ${start}
       OR ${table.closedAt} >= ${start}
     GROUP BY ${table.repositoryFullName}
@@ -1824,11 +1834,11 @@ async function aggregateIssueWindows(args) {
       SELECT
         ${table.issueId},
         ${table.state},
+        ${table.stateReason},
         ${table.openedAt},
         ${table.closedAt}
       FROM ${table}
-      WHERE ${table.state} = 'open'
-        OR ${table.openedAt} >= ${oldestStart}
+      WHERE ${table.openedAt} >= ${oldestStart}
         OR ${table.closedAt} >= ${oldestStart}
     )
     SELECT
@@ -1839,10 +1849,27 @@ async function aggregateIssueWindows(args) {
       count(recent_issues.issue_id)
         FILTER (
           WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason = 'completed'
             AND recent_issues.closed_at >= windows.start_at
-        )::integer AS "closed",
+        )::integer AS "closedCompleted",
+      count(recent_issues.issue_id)
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason = 'duplicate'
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedDuplicate",
+      count(recent_issues.issue_id)
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason = 'not_planned'
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedNotPlanned",
       count(recent_issues.issue_id)
-        FILTER (WHERE recent_issues.state = 'open')::integer AS "open",
+        FILTER (
+          WHERE recent_issues.state = 'closed'
+            AND recent_issues.state_reason IS NULL
+            AND recent_issues.closed_at >= windows.start_at
+        )::integer AS "closedUnknown",
       (
         percentile_cont(0.5) WITHIN GROUP (
           ORDER BY extract(
@@ -1869,15 +1896,30 @@ async function aggregateIssueRepositories(args) {
       count(*) FILTER (WHERE ${table.openedAt} >= ${start})::integer
         AS "created",
       count(*) FILTER (
-        WHERE ${table.state} = 'closed' AND ${table.closedAt} >= ${start}
-      )::integer AS "closed",
-      count(*) FILTER (WHERE ${table.state} = 'open')::integer AS "open"
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} = 'completed'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedCompleted",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} = 'duplicate'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedDuplicate",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} = 'not_planned'
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedNotPlanned",
+      count(*) FILTER (
+        WHERE ${table.state} = 'closed'
+          AND ${table.stateReason} IS NULL
+          AND ${table.closedAt} >= ${start}
+      )::integer AS "closedUnknown"
     FROM ${table}
-    WHERE ${table.state} = 'open'
-      OR ${table.openedAt} >= ${start}
+    WHERE ${table.openedAt} >= ${start}
       OR ${table.closedAt} >= ${start}
     GROUP BY ${table.repositoryFullName}
-    ORDER BY "created" DESC, "closed" DESC, "repository" ASC
+    ORDER BY "created" DESC, "closedCompleted" DESC, "repository" ASC
     LIMIT 25
   `);
   return z10.array(issueRepositoryStatsSchema).parse(queryRows(result));
@@ -1918,7 +1960,10 @@ async function buildGitHubOutcomeReport(args) {
         label: "Junior-only merge rate \xB7 30d",
         value: formatPercent(thirtyDays.juniorOnlyRate)
       },
-      { label: "PRs open now", value: String(thirtyDays.open) },
+      {
+        label: "PRs closed unmerged \xB7 30d",
+        value: String(thirtyDays.closed)
+      },
       {
         label: "PR merge rate \xB7 30d",
         value: formatPercent(thirtyDays.mergeRate)
@@ -1928,7 +1973,19 @@ async function buildGitHubOutcomeReport(args) {
         value: formatDuration(thirtyDays.medianMergeTimeMs)
       },
       { label: "issues created \xB7 30d", value: String(issueThirtyDays.created) },
-      { label: "issues open now", value: String(issueThirtyDays.open) }
+      {
+        label: "issues completed \xB7 30d",
+        tone: issueThirtyDays.closedCompleted > 0 ? "good" : "neutral",
+        value: String(issueThirtyDays.closedCompleted)
+      },
+      {
+        label: "issues closed as duplicate \xB7 30d",
+        value: String(issueThirtyDays.closedDuplicate)
+      },
+      {
+        label: "issues closed as not planned \xB7 30d",
+        value: String(issueThirtyDays.closedNotPlanned)
+      }
     ],
     recordSets: [
       {
@@ -1963,7 +2020,6 @@ async function buildGitHubOutcomeReport(args) {
           { key: "created", label: "Created" },
           { key: "merged", label: "Merged" },
           { key: "closed", label: "Closed unmerged" },
-          { key: "open", label: "Open now" },
           { key: "commitComposition", label: "Merged commit composition" },
           { key: "mergeRate", label: "Merge rate" }
         ],
@@ -1974,7 +2030,6 @@ async function buildGitHubOutcomeReport(args) {
             created: String(stats.created),
             merged: String(stats.merged),
             closed: String(stats.closed),
-            open: String(stats.open),
             commitComposition: formatCommitComposition(stats),
             mergeRate: formatPercent(stats.mergeRate)
           }
@@ -1985,8 +2040,10 @@ async function buildGitHubOutcomeReport(args) {
         fields: [
           { key: "window", label: "Window" },
           { key: "created", label: "Created" },
-          { key: "closed", label: "Closed" },
-          { key: "open", label: "Open now" },
+          { key: "completed", label: "Completed" },
+          { key: "duplicate", label: "Duplicate" },
+          { key: "notPlanned", label: "Not planned" },
+          { key: "unknown", label: "Unknown reason" },
           { key: "closeTime", label: "Median close time" }
         ],
         records: issueWindows.map((stats) => ({
@@ -1994,8 +2051,10 @@ async function buildGitHubOutcomeReport(args) {
           values: {
             window: `${stats.days} days`,
             created: String(stats.created),
-            closed: String(stats.closed),
-            open: String(stats.open),
+            completed: String(stats.closedCompleted),
+            duplicate: String(stats.closedDuplicate),
+            notPlanned: String(stats.closedNotPlanned),
+            unknown: String(stats.closedUnknown),
             closeTime: formatDuration(stats.medianCloseTimeMs)
           }
         }))
@@ -2006,16 +2065,20 @@ async function buildGitHubOutcomeReport(args) {
         fields: [
           { key: "repository", label: "Repository" },
           { key: "created", label: "Created" },
-          { key: "closed", label: "Closed" },
-          { key: "open", label: "Open now" }
+          { key: "completed", label: "Completed" },
+          { key: "duplicate", label: "Duplicate" },
+          { key: "notPlanned", label: "Not planned" },
+          { key: "unknown", label: "Unknown reason" }
         ],
         records: issueRepositories.map(({ repository, ...stats }) => ({
           id: repository,
           values: {
             repository,
             created: String(stats.created),
-            closed: String(stats.closed),
-            open: String(stats.open)
+            completed: String(stats.closedCompleted),
+            duplicate: String(stats.closedDuplicate),
+            notPlanned: String(stats.closedNotPlanned),
+            unknown: String(stats.closedUnknown)
           }
         }))
       }
@@ -2641,28 +2704,6 @@ function githubRepositoryFromLeaseScope(leaseScope) {
   }
   return { owner: match[1], name: match[2] };
 }
-function githubRepositoryIdFromUploadUrl(upstreamUrl) {
-  const repositoryId = Number(upstreamUrl.searchParams.get("repository_id"));
-  if (!Number.isSafeInteger(repositoryId) || repositoryId <= 0) {
-    throw new EgressPolicyDenied(
-      "GitHub asset upload request is missing a valid repository_id."
-    );
-  }
-  return repositoryId;
-}
-function githubRepositoryIdLeaseScope(repositoryId) {
-  return `repository-id:${repositoryId}`;
-}
-function githubRepositoryIdFromLeaseScope(leaseScope) {
-  const match = /^repository-id:(\d+)$/.exec(leaseScope ?? "");
-  const repositoryId = Number(match?.[1]);
-  if (!Number.isSafeInteger(repositoryId) || repositoryId <= 0) {
-    throw new GitHubPluginSetupError(
-      "GitHub asset upload grant is missing a repository id lease scope."
-    );
-  }
-  return repositoryId;
-}
 async function resolveUserAccount(tokens) {
   const account = await githubRequest("https://api.github.com", "/user", {
     token: tokens.accessToken
@@ -2843,8 +2884,7 @@ async function issueInstallationToken(options) {
   const permissions = "permissions" in options ? options.permissions : typeof options.loadPermissions === "function" ? await options.loadPermissions({ appJwt, installationId }) : void 0;
   const body = {
     ...permissions ? { permissions } : {},
-    ..."repositories" in options ? { repositories: options.repositories } : {},
-    ..."repositoryIds" in options ? { repository_ids: options.repositoryIds } : {}
+    ..."repositories" in options ? { repositories: options.repositories } : {}
   };
   const accessTokenResponse = await githubRequest(
     "https://api.github.com",
@@ -2864,7 +2904,6 @@ async function issueInstallationToken(options) {
 async function issueInstallationCredential(options) {
   const token = await issueInstallationToken(options);
   return createCredentialLease({
-    ...options.domains ? { domains: options.domains } : {},
     token: token.token,
     expiresAtMs: token.expiresAtMs
   });
@@ -3183,13 +3222,7 @@ async function githubGrantForEgress(ctx) {
     upstreamUrl
   });
   if (isGitHubAssetUploadRequest(method, upstreamUrl)) {
-    const repositoryId = githubRepositoryIdFromUploadUrl(upstreamUrl);
-    return grantForAccess(
-      "write",
-      "github.asset-upload",
-      "installation-write",
-      githubRepositoryIdLeaseScope(repositoryId)
-    );
+    return grantForAccess("write", "github.asset-upload", "user-write");
   }
   const smartHttpAccess = githubSmartHttpAccess(upstreamUrl);
   if (smartHttpAccess) {
@@ -3423,18 +3456,6 @@ function githubPlugin(options = {}) {
             });
           }
           if (ctx.grant.name === "installation-write") {
-            if (ctx.grant.reason === "github.asset-upload") {
-              const repositoryId = githubRepositoryIdFromLeaseScope(
-                ctx.grant.leaseScope
-              );
-              return await issueInstallationCredential({
-                appIdEnv,
-                domains: GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS,
-                privateKeyEnv,
-                installationIdEnv,
-                repositoryIds: [repositoryId]
-              });
-            }
             const repository = githubRepositoryFromLeaseScope(
               ctx.grant.leaseScope
             );

package/dist/issue-outcomes/store.d.ts

@@ -12,6 +12,12 @@ declare const githubIssueOutcomeInputSchema: z.ZodObject<{
         open: "open";
         closed: "closed";
     }>;
+    stateReason: z.ZodOptional<z.ZodEnum<{
+        completed: "completed";
+        duplicate: "duplicate";
+        not_planned: "not_planned";
+        reopened: "reopened";
+    }>>;
     updatedAt: z.ZodDate;
 }, z.core.$strict>;
 export type GitHubIssueOutcomeInput = z.output<typeof githubIssueOutcomeInputSchema>;

package/migrations/0004_marvelous_toad_men.sql

@@ -0,0 +1,5 @@
+ALTER TABLE "junior_github_issues" ADD COLUMN "state_reason" text;
+--> statement-breakpoint
+UPDATE "junior_github_issues"
+SET "state_reason" = 'completed'
+WHERE "state" = 'closed';

package/migrations/meta/0004_snapshot.json

@@ -0,0 +1,275 @@
+{
+  "id": "6e0acdc7-db48-4ebf-846e-0589fc32afb5",
+  "prevId": "fb7f4132-d92f-4127-be54-23f93c79034b",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.junior_github_issues": {
+      "name": "junior_github_issues",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_full_name": {
+          "name": "repository_full_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "number": {
+          "name": "number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state_reason": {
+          "name": "state_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "junior_github_issues_opened_at_idx": {
+          "name": "junior_github_issues_opened_at_idx",
+          "columns": [
+            {
+              "expression": "opened_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "junior_github_issues_closed_at_idx": {
+          "name": "junior_github_issues_closed_at_idx",
+          "columns": [
+            {
+              "expression": "closed_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "junior_github_issues_open_idx": {
+          "name": "junior_github_issues_open_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"junior_github_issues\".\"state\" = 'open'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.junior_github_pull_requests": {
+      "name": "junior_github_pull_requests",
+      "schema": "",
+      "columns": {
+        "pull_request_id": {
+          "name": "pull_request_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_full_name": {
+          "name": "repository_full_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "number": {
+          "name": "number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "commit_composition": {
+          "name": "commit_composition",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conversation_ids": {
+          "name": "conversation_ids",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "ARRAY[]::text[]"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "merged_at": {
+          "name": "merged_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "junior_github_pull_requests_opened_at_idx": {
+          "name": "junior_github_pull_requests_opened_at_idx",
+          "columns": [
+            {
+              "expression": "opened_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "junior_github_pull_requests_merged_at_idx": {
+          "name": "junior_github_pull_requests_merged_at_idx",
+          "columns": [
+            {
+              "expression": "merged_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "junior_github_pull_requests_closed_at_idx": {
+          "name": "junior_github_pull_requests_closed_at_idx",
+          "columns": [
+            {
+              "expression": "closed_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "junior_github_pull_requests_open_idx": {
+          "name": "junior_github_pull_requests_open_idx",
+          "columns": [
+            {
+              "expression": "pull_request_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"junior_github_pull_requests\".\"state\" = 'open'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/migrations/meta/_journal.json

@@ -29,6 +29,13 @@
       "when": 1784762053015,
       "tag": "0003_pull_request_conversations",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1784774242129,
+      "tag": "0004_marvelous_toad_men",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.108.0",
+  "version": "0.109.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.108.0"
+    "@sentry/junior-plugin-api": "0.109.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/attach-github-assets/SOURCES.md

@@ -13,10 +13,10 @@
 
 - **Adopted:** preserve the upstream one-file-per-upload behavior, supported formats, markdown output, and upload endpoint.
 - **Adopted:** preserve the upstream MIT license in the skill directory as explicitly required.
-- **Replaced:** direct `gh auth token` access with Junior's host-managed, repository-scoped installation credential injection so credentials never enter script output or files.
+- **Replaced:** direct `gh auth token` access with Junior's host-managed requesting-user OAuth credential injection so credentials never enter script output or files.
 - **Replaced:** numeric repository-id override with explicit `owner/repo`; the script resolves the id through authenticated `gh api`.
 - **Narrowed:** automatic activation requires a concrete local path and GitHub destination.
-- **Deferred:** live upload verification because it would create an external GitHub asset; deterministic mocked validation is sufficient for implementation checks.
+- **Verified:** a live upload with the repository-scoped installation credential returned HTTP 500; the endpoint's upstream implementation uses a user token.
 
 ## Coverage
 

package/skills/attach-github-assets/SPEC.md

@@ -23,7 +23,7 @@ Out of scope:
 - Run `scripts/upload.sh` once per local file.
 - Return image markdown or a bare video URL.
 - Surface per-file failures exactly enough for the user to act.
-- Use the GitHub plugin's repository-scoped installation credential injection; do not retrieve tokens in the script.
+- Use the GitHub plugin's requesting-user OAuth credential injection; do not retrieve tokens in the script.
 
 ## Reference Architecture
 
@@ -40,7 +40,7 @@ Out of scope:
 ## Known Limitations
 
 - GitHub's user-attachment endpoint is not part of the documented public REST API.
-- A real upload requires GitHub to accept the repository-scoped installation credential for the target repository.
+- A real upload requires the requesting user to authorize the GitHub App.
 
 ## Maintenance Notes
 

package/skills/github-code/SKILL.md

@@ -21,7 +21,8 @@ Use `git` and `gh` for repository work. Use `github_createPullRequest`, not `gh
 - Read applicable `AGENTS.md` files before editing. Narrower repo/task instructions win.
 - Preserve unrelated work. Never force-push, delete refs, or perform destructive merges.
 - Base conclusions on repository evidence. Do not claim a check ran unless it did.
-- Supported App-owned writes use an automatically injected repository-scoped credential. Try the operation before requesting remediation; ask for no user token.
+- For Junior-owned pull requests, push the branch before creating the PR. The runtime supplies repository-scoped GitHub App credentials for both; try the operations before requesting remediation and never ask for a user token.
+- A tool-routing denial requires the named tool; only an upstream denial justifies permission remediation.
 - Stop for ambiguous targets, missing access, destructive operations, or unresolved upstream permission failures.
 
 ## Workflow
@@ -36,9 +37,7 @@ For edits, choose the smallest credible validation path before changing files. C
 
 ### 2. Investigate
 
-Establish where the behavior lives, current versus requested behavior, root cause or gap, and the smallest proof of correctness. Read linked issues, PRs, specs, and failing output when provided. If the request is investigation-only, report evidence without editing.
-
-For non-trivial architecture, API, security, concurrency, migration, or broad cross-file work, use the available advisor after gathering evidence and before editing. Resolve material concerns in the plan.
+Establish where the behavior lives, current versus requested behavior, root cause or gap, and the smallest proof of correctness. Read linked issues, PRs, specs, and failing output when provided. For pull requests, inspect conversation comments, inline review comments, reviews, the diff, and checks. If the request is investigation-only, report evidence without editing.
 
 ### 3. Edit
 
@@ -56,8 +55,6 @@ Do not install or repair the GitHub plugin runtime itself; that is manifest-owne
 
 Run targeted changed-file/package checks before broad suites. Separate regressions from baseline failures. For instruction-only changes, run available structural checks and perform a content-consistency review.
 
-For non-trivial work, review the final diff and initial results with the available advisor before packaging. Address material correctness, regression, and testing concerns, then rerun affected checks.
-
 ### 5. Package every completed edit
 
 Unless the user explicitly says not to create a PR, every completed repository edit must end in a pushed branch and PR. Default to draft; honor an explicit user or repo instruction to open it ready for review. Do not stop at local changes or a commit.
@@ -77,11 +74,3 @@ If PR creation is blocked, report the exact failed command/tool call and leave t
 When PR creation returns a subscribable resource hint, subscribe to suggested review/CI events. Report only actionable feedback addressed, build failures fixed, fully green/ready state, or merge.
 
 Return: repo, branch, PR URL/number, checks and results, pre-existing failures, and anything not run with the reason.
-
-## Operation notes
-
-- **Clone/history:** clone shallowly by default; deepen before any operation that relies on omitted ancestry.
-- **PR inspection:** read conversation comments, inline review comments, reviews, diff, and checks.
-- **PR mutation:** push before create; use only supported endpoints in the API reference.
-- **Workflow dispatch:** `gh workflow run` is supported only for workflows declaring `workflow_dispatch`.
-- **Permissions:** a tool-routing denial requires the named tool; only an upstream denial justifies permission remediation.