@sentry/junior-github 0.114.0 → 0.116.0

package/SETUP.md

@@ -116,11 +116,11 @@ githubPlugin({
 });
 ```
 
-Junior records these permissions as plugin capabilities. Installation-read token requests remain read-only by requesting read-capable configured permissions at `read` level and omitting GitHub permission fields that have no `read` value. Installation-write token requests intentionally omit the `permissions` field, so GitHub applies the complete permission envelope approved on the App installation. GitHub remains the source of truth for whether a permission name or level exists.
+Installation-read token requests remain read-only by requesting read-capable configured permissions at `read` level and omitting GitHub permission fields that have no `read` value. Installation-write token requests intentionally omit the `permissions` field, so GitHub applies the complete permission envelope approved on the App installation. GitHub remains the source of truth for whether a permission name or level exists.
 
 GitHub App user-to-server tokens do not use OAuth scopes as their permission model. Their effective access is limited by the GitHub App's installed permissions, the app installation's repository access, and the requesting user's own GitHub access. Repository-scoped installation tokens instead use the App permission envelope and installation repository access without borrowing the requesting user's authority. GitHub returns an empty `scope` value for user-to-server tokens, so Junior cannot verify granted scopes from the token response.
 
-If you pass `additionalUserScopes`, Junior includes those values in the authorization URL and records the requested scope string as a local reauthorization contract. This does not expand or prove GitHub API permissions. Configure provider-enforced access in the GitHub App settings; `appPermissions` only declares capabilities and controls read-token downscoping:
+If you pass `additionalUserScopes`, Junior includes those values in the authorization URL and records the requested scope string as a local reauthorization contract. This does not expand or prove GitHub API permissions. Configure provider-enforced access in the GitHub App settings; `appPermissions` only controls read-token downscoping:
 
 ```ts
 githubPlugin({

package/dist/credential-support.d.ts

@@ -0,0 +1,90 @@
+import type { PluginCredentialResult, PluginGrant, PluginProviderAccount, PluginStoredTokens, IssueCredentialHookContext } from "@sentry/junior-plugin-api";
+import { type GitHubAppPermissions } from "./permissions.js";
+export type JsonRecord = Record<string, unknown>;
+export type GitHubGrantName = "installation-read" | "installation-write" | "user-read" | "user-write";
+export type GitHubGrantReason = "github.api-read" | "github.asset-upload" | "github.git-read" | "github.graphql-read" | "github.installation-write" | "github.user-read" | "github.user-write";
+export type GitHubGrant = PluginGrant & {
+    name: GitHubGrantName;
+    reason: GitHubGrantReason;
+};
+interface GitHubRequestParams {
+    body?: unknown;
+    method?: string;
+    token: string;
+}
+interface UserCredentialOptions {
+    clientIdEnv: string;
+    clientSecretEnv: string;
+    userScope?: string;
+}
+interface InstallationCredentialBaseOptions {
+    appIdEnv: string;
+    installationIdEnv: string;
+    privateKeyEnv: string;
+}
+type InstallationCredentialOptions = InstallationCredentialBaseOptions & ({
+    loadPermissions?: never;
+    permissions?: GitHubAppPermissions;
+    repositories: string[];
+} | {
+    loadPermissions?: never;
+    permissions: GitHubAppPermissions;
+    repositories?: never;
+} | {
+    loadPermissions: LoadInstallationReadPermissions;
+    permissions?: never;
+    repositories?: never;
+});
+type LoadInstallationReadPermissions = (input: {
+    appJwt: string;
+    installationId: number;
+}) => Promise<Record<string, "read">>;
+interface GitHubRepository {
+    name: string;
+    owner: string;
+}
+export declare const GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
+export declare const GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
+export declare const GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
+export declare const GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
+export declare const GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
+export declare const GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES: number;
+export declare const HTTP_READ_METHODS: Set<string>;
+export declare const USER_TOKEN_GRANTS: Set<string>;
+export declare const CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
+export declare const USER_WRITE_REQUIREMENTS: string[];
+export declare class GitHubPluginSetupError extends Error {
+    constructor(message: string);
+}
+/** Return whether a provider value is a JSON object. */
+export declare function isRecord(value: unknown): value is JsonRecord;
+/** Read a non-empty GitHub plugin environment value. */
+export declare function readEnv(name: string): string | undefined;
+/** Read a required GitHub plugin environment value. */
+export declare function requireEnv(name: string): string;
+/** Normalize configured GitHub OAuth scopes. */
+export declare function normalizeScopeList(scopes?: string[]): string[];
+/** Send an authenticated request to the GitHub API. */
+export declare function githubRequest(apiBase: string, path: string, params: GitHubRequestParams): Promise<unknown>;
+/** Return a credential result for invalid GitHub App configuration. */
+export declare function credentialUnavailable(message: string): PluginCredentialResult;
+/** Parse a GitHub repository from an API or Git URL. */
+export declare function githubRepositoryFromUrl(upstreamUrl: URL): GitHubRepository | undefined;
+/** Build the stable lease scope for a GitHub repository. */
+export declare function githubRepositoryLeaseScope(repository: GitHubRepository): string;
+/** Parse the repository bound to an installation-write lease. */
+export declare function githubRepositoryFromLeaseScope(leaseScope: string | undefined): GitHubRepository;
+/** Resolve the GitHub account associated with stored user tokens. */
+export declare function resolveUserAccount(tokens: PluginStoredTokens): Promise<PluginProviderAccount>;
+/** Issue a bounded GitHub user credential for an approved grant. */
+export declare function issueUserCredential(ctx: IssueCredentialHookContext, options: UserCredentialOptions): Promise<PluginCredentialResult>;
+/** Issue a bounded raw token for plugin-owned GitHub API calls. */
+export declare function issueInstallationToken(options: InstallationCredentialOptions): Promise<{
+    expiresAtMs: number;
+    token: string;
+}>;
+/** Issue a bounded GitHub App installation credential. */
+export declare function issueInstallationCredential(options: InstallationCredentialOptions): Promise<PluginCredentialResult>;
+/** Cache the installation's read permissions for one lease period. */
+export declare function createPermissionCache(): LoadInstallationReadPermissions;
+export {};

package/dist/db/schema.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 export declare const githubPullRequestStateSchema: z.ZodEnum<{
-    merged: "merged";
     open: "open";
+    merged: "merged";
     closed_unmerged: "closed_unmerged";
 }>;
 export type GitHubPullRequestState = z.output<typeof githubPullRequestStateSchema>;
@@ -308,7 +308,7 @@ export declare const juniorGitHubPullRequests: import("drizzle-orm/pg-core").PgT
             tableName: "junior_github_pull_requests";
             dataType: "string";
             columnType: "PgText";
-            data: "merged" | "open" | "closed_unmerged";
+            data: "open" | "merged" | "closed_unmerged";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -320,7 +320,7 @@ export declare const juniorGitHubPullRequests: import("drizzle-orm/pg-core").PgT
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: "merged" | "open" | "closed_unmerged";
+            $type: "open" | "merged" | "closed_unmerged";
         }>;
         commitComposition: import("drizzle-orm/pg-core").PgColumn<{
             name: "commit_composition";
@@ -857,7 +857,7 @@ export declare const githubSqlSchema: {
                 tableName: "junior_github_pull_requests";
                 dataType: "string";
                 columnType: "PgText";
-                data: "merged" | "open" | "closed_unmerged";
+                data: "open" | "merged" | "closed_unmerged";
                 driverParam: string;
                 notNull: true;
                 hasDefault: false;
@@ -869,7 +869,7 @@ export declare const githubSqlSchema: {
                 identity: undefined;
                 generated: undefined;
             }, {}, {
-                $type: "merged" | "open" | "closed_unmerged";
+                $type: "open" | "merged" | "closed_unmerged";
             }>;
             commitComposition: import("drizzle-orm/pg-core").PgColumn<{
                 name: "commit_composition";

package/dist/git-config.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Git identity and commit-hook setup for GitHub sandboxes.
+ */
+import type { Actor, SandboxPrepareHookContext } from "@sentry/junior-plugin-api";
+/**
+ * Build `Co-Authored-By` trailers crediting human run actors.
+ *
+ * `run.actors` is attribution only (see `multi-actor-runs.md`): a steerer
+ * without a resolvable name and email is silently omitted rather than
+ * denying the commit. Dedupes by identity and resolved email so the same human
+ * under two display profiles, or an actor matching the bot identity, only ever
+ * produces one line.
+ */
+export declare function additionalActorCoauthorTrailers(args: {
+    actors?: Actor[];
+    botEmail: string;
+}): string[];
+/** Build the hook that replaces model-supplied commit attribution. */
+export declare function prepareCommitMsgHook(): string;
+/** Set one global Git option inside the prepared sandbox. */
+export declare function configureGit(ctx: SandboxPrepareHookContext, key: string, value: string): Promise<void>;

package/dist/index.d.ts

@@ -1,40 +1,2 @@
-import { type PluginRegistration } from "@sentry/junior-plugin-api";
-import { type GitHubAppPermissions } from "./permissions.js";
+export { githubPlugin, type GitHubPluginOptions } from "./plugin.js";
 export type { GitHubAppPermissionLevel } from "./permissions.js";
-/** Configure the built-in GitHub plugin manifest and hooks. */
-export interface GitHubPluginOptions {
-    /**
-     * Extra OAuth `scope` values to request during GitHub App user authorization.
-     *
-     * GitHub App user tokens report empty scopes, so Junior treats this as a
-     * local reauthorization contract only. Effective access still comes from the
-     * app permissions, installation repositories, and requesting user's access.
-     */
-    additionalUserScopes?: string[];
-    /**
-     * GitHub App permissions Junior should expose as capabilities and downscope
-     * to read for installation-read tokens.
-     *
-     * Keys may use GitHub permission names with underscores or hyphens. Junior
-     * records these as plugin capabilities. Installation-write tokens inherit
-     * the App installation's complete permission envelope.
-     * GitHub remains the source of truth for whether a permission exists.
-     */
-    appPermissions?: GitHubAppPermissions;
-    /** Environment variable containing the GitHub App id. */
-    appIdEnv?: string;
-    /** Environment variable containing Junior's Git committer email. */
-    botEmailEnv?: string;
-    /** Environment variable containing Junior's Git committer name. */
-    botNameEnv?: string;
-    /** Environment variable containing the GitHub App OAuth client id. */
-    clientIdEnv?: string;
-    /** Environment variable containing the GitHub App OAuth client secret. */
-    clientSecretEnv?: string;
-    /** Environment variable containing the GitHub App installation id. */
-    installationIdEnv?: string;
-    /** Environment variable containing the GitHub App private key. */
-    privateKeyEnv?: string;
-}
-/** Register GitHub runtime hooks for repository workflows. */
-export declare function githubPlugin(options?: GitHubPluginOptions): PluginRegistration;

package/dist/index.js

@@ -3,8 +3,7 @@ import {
   normalizeGitHubResourceEvents
 } from "./chunk-JDNXIBCQ.js";
 
-// src/index.ts
-import { createPrivateKey, createSign } from "crypto";
+// src/plugin.ts
 import {
   defineJuniorPlugin,
   EgressPolicyDenied
@@ -65,15 +64,6 @@ function readGrantPermissions(permissions) {
   }
   return readOnly;
 }
-function permissionCapabilities(permissions) {
-  if (permissions === void 0) {
-    return void 0;
-  }
-  return Object.entries(permissions).map(([normalizedScope, rawLevel]) => {
-    const scope = normalizedScope.replace(/_/g, "-");
-    return `github.${scope}.${rawLevel}`;
-  }).sort();
-}
 
 // src/tools/create-issue.ts
 import {
@@ -528,6 +518,7 @@ import { z as z2 } from "zod";
 import { subscribableResourceSchema } from "@sentry/junior-plugin-api";
 var GITHUB_PULL_REQUEST_CREATE_IDEMPOTENCY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var GITHUB_PULL_REQUEST_CREATE_LOCK_TTL_MS = 6e4;
+var RESOURCE_LINK_LABEL_MAX_LENGTH = 256;
 var GitHubPullRequestCreateRejectedError = class extends Error {
   status;
   constructor(message, status) {
@@ -760,6 +751,20 @@ function gitHubPullRequestToolResult(input, result) {
   });
   return { ...result, ...subscribable ? { subscribable } : {} };
 }
+async function annotatePullRequest(ctx, input, result) {
+  const repo = parseRepo2(input.repo);
+  const label = `${repo.owner}/${repo.name} #${result.number}: ${nonEmptyString3(input.title, "title")}`.slice(
+    0,
+    RESOURCE_LINK_LABEL_MAX_LENGTH
+  );
+  await ctx.annotations?.upsert({
+    kind: "resource_link",
+    key: `${repo.owner.toLowerCase()}/${repo.name.toLowerCase()}#${result.number}`,
+    label,
+    url: result.url,
+    status: input.draft ? "draft" : "open"
+  });
+}
 function gitHubPullRequestStructuredResult(input, result) {
   const data = gitHubPullRequestToolResult(input, result);
   return {
@@ -789,12 +794,15 @@ function createGitHubPullRequestTool(ctx) {
         async () => {
           const state = createPullRequestState(await ctx.state.get(key));
           if (state?.status === "completed") {
+            const completedInput = state.input ?? parsedInput;
+            const completedResult = {
+              number: state.number,
+              url: state.url
+            };
+            await annotatePullRequest(ctx, completedInput, completedResult);
             return gitHubPullRequestStructuredResult(
-              state.input ?? parsedInput,
-              {
-                number: state.number,
-                url: state.url
-              }
+              completedInput,
+              completedResult
             );
           }
           if (state?.status === "pending") {
@@ -833,6 +841,7 @@ function createGitHubPullRequestTool(ctx) {
                 { cause: error }
               );
             }
+            await annotatePullRequest(ctx, parsedInput, result);
             return gitHubPullRequestStructuredResult(parsedInput, result);
           } catch (error) {
             if (isEgressAuthRequired2(error) || isDefinitiveGitHubPullRequestCreateRejection(error)) {
@@ -1828,10 +1837,14 @@ var costWindowSchema = z10.object({
 }));
 var repositoryCostSchema = z10.object({
   issueCostUsd: z10.number().nonnegative().nullable(),
+  medianIssueCostUsd: z10.number().nonnegative().nullable(),
+  medianPullRequestCostUsd: z10.number().nonnegative().nullable(),
   pullRequestCostUsd: z10.number().nonnegative().nullable(),
   repository: z10.string().min(1)
 }).strict().transform((row) => ({
   issueCostUsd: row.issueCostUsd ?? void 0,
+  medianIssueCostUsd: row.medianIssueCostUsd ?? void 0,
+  medianPullRequestCostUsd: row.medianPullRequestCostUsd ?? void 0,
   pullRequestCostUsd: row.pullRequestCostUsd ?? void 0,
   repository: row.repository
 }));
@@ -2048,7 +2061,8 @@ async function aggregateGitHubRepositoryCosts(args) {
     WITH pull_request_entities AS (
       SELECT
         ${pullRequests.repositoryFullName} AS repository,
-        conversation_ids.ids AS ids
+        conversation_ids.ids AS ids,
+        ${conversationTreeCost} AS cost_usd
       FROM ${pullRequests}
       CROSS JOIN LATERAL (
         SELECT ${pullRequestConversationIds} AS ids
@@ -2057,7 +2071,8 @@ async function aggregateGitHubRepositoryCosts(args) {
     ), issue_entities AS (
       SELECT
         ${issues.repositoryFullName} AS repository,
-        conversation_ids.ids AS ids
+        conversation_ids.ids AS ids,
+        ${conversationTreeCost} AS cost_usd
       FROM ${issues}
       CROSS JOIN LATERAL (
         SELECT ${issueConversationIds} AS ids
@@ -2079,7 +2094,15 @@ async function aggregateGitHubRepositoryCosts(args) {
               WHERE pull_request_entities.repository = repositories.repository
             ) AS ids
           ) AS conversation_ids
-        ), 0)::double precision AS pull_request_cost_usd
+        ), 0)::double precision AS pull_request_cost_usd,
+        (
+          SELECT percentile_cont(0.5) WITHIN GROUP (
+            ORDER BY pull_request_entities.cost_usd
+          )
+          FROM pull_request_entities
+          WHERE pull_request_entities.repository = repositories.repository
+            AND pull_request_entities.cost_usd > 0
+        )::double precision AS median_pull_request_cost_usd
       FROM repositories
     ), issue_totals AS (
       SELECT
@@ -2093,21 +2116,32 @@ async function aggregateGitHubRepositoryCosts(args) {
               WHERE issue_entities.repository = repositories.repository
             ) AS ids
           ) AS conversation_ids
-        ), 0)::double precision AS issue_cost_usd
+        ), 0)::double precision AS issue_cost_usd,
+        (
+          SELECT percentile_cont(0.5) WITHIN GROUP (
+            ORDER BY issue_entities.cost_usd
+          )
+          FROM issue_entities
+          WHERE issue_entities.repository = repositories.repository
+            AND issue_entities.cost_usd > 0
+        )::double precision AS median_issue_cost_usd
       FROM repositories
     )
     SELECT
       repositories.repository AS "repository",
       coalesce(pull_request_totals.pull_request_cost_usd, 0)::double precision
         AS "pullRequestCostUsd",
+      pull_request_totals.median_pull_request_cost_usd
+        AS "medianPullRequestCostUsd",
       coalesce(issue_totals.issue_cost_usd, 0)::double precision
-        AS "issueCostUsd"
+        AS "issueCostUsd",
+      issue_totals.median_issue_cost_usd AS "medianIssueCostUsd"
     FROM repositories
     LEFT JOIN pull_request_totals
       ON pull_request_totals.repository = repositories.repository
     LEFT JOIN issue_totals
       ON issue_totals.repository = repositories.repository
-    ORDER BY "pullRequestCostUsd" DESC, "issueCostUsd" DESC, "repository" ASC
+    ORDER BY "repository" ASC
   `);
   return z10.array(repositoryCostSchema).parse(queryRows(result));
 }
@@ -2548,7 +2582,7 @@ async function buildGitHubOutcomeReport(args) {
           { key: "merged", label: "Merged" },
           { key: "closed", label: "Closed unmerged" },
           { key: "mergeRate", label: "Closure merge rate" },
-          { key: "cost", label: "Cost" }
+          { key: "medianCost", label: "Median cost" }
         ],
         records: repositories.map(({ repository, ...stats }) => ({
           id: repository,
@@ -2559,8 +2593,8 @@ async function buildGitHubOutcomeReport(args) {
             closed: String(stats.closed),
             juniorOnly: String(stats.juniorOnly),
             mergeRate: formatPercent(stats.mergeRate),
-            cost: formatCostUsd(
-              repositoryCostByName.get(repository)?.pullRequestCostUsd ?? 0
+            medianCost: formatCostUsd(
+              repositoryCostByName.get(repository)?.medianPullRequestCostUsd
             )
           }
         }))
@@ -2575,7 +2609,7 @@ async function buildGitHubOutcomeReport(args) {
           { key: "duplicate", label: "Duplicate" },
           { key: "notPlanned", label: "Not planned" },
           { key: "unknown", label: "Unknown reason" },
-          { key: "cost", label: "Cost" }
+          { key: "medianCost", label: "Median cost" }
         ],
         records: issueRepositories.map(({ repository, ...stats }) => ({
           id: repository,
@@ -2586,8 +2620,8 @@ async function buildGitHubOutcomeReport(args) {
             duplicate: String(stats.closedDuplicate),
             notPlanned: String(stats.closedNotPlanned),
             unknown: String(stats.closedUnknown),
-            cost: formatCostUsd(
-              repositoryCostByName.get(repository)?.issueCostUsd ?? 0
+            medianCost: formatCostUsd(
+              repositoryCostByName.get(repository)?.medianIssueCostUsd
             )
           }
         }))
@@ -2649,87 +2683,7 @@ async function classifyGitHubPullRequestCommitComposition(args) {
   return foundCommit ? "junior_only" : void 0;
 }
 
-// src/index.ts
-var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
-var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
-var GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
-var GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
-var GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
-var MAX_LEASE_MS = 60 * 60 * 1e3;
-var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
-var USER_REFRESH_TIMEOUT_MS = 2e4;
-var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
-var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
-var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
-var CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
-var USER_WRITE_REQUIREMENTS = [
-  "requesting GitHub user permission to perform this operation"
-];
-var GITHUB_CREDENTIAL_DOMAINS = ["api.github.com", "github.com"];
-var GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS = [
-  ...GITHUB_CREDENTIAL_DOMAINS,
-  "uploads.github.com"
-];
-var GitHubUserRefreshRejectedError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitHubUserRefreshRejectedError";
-  }
-};
-var GitHubRequestError = class extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.name = "GitHubRequestError";
-    this.status = status;
-  }
-};
-var GitHubPluginSetupError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "GitHubPluginSetupError";
-  }
-};
-function isRecord(value) {
-  return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function readEnv(name) {
-  const value = process.env[name];
-  if (typeof value !== "string") {
-    return void 0;
-  }
-  const trimmed = value.trim();
-  return trimmed ? trimmed : void 0;
-}
-function requireEnv(name) {
-  const value = readEnv(name);
-  if (!value) {
-    throw new GitHubPluginSetupError(`Missing ${name}`);
-  }
-  return value;
-}
-function normalizeScopeList(scopes) {
-  return [
-    ...new Set(
-      (scopes ?? []).flatMap((scope) => String(scope).split(/\s+/)).map((scope) => scope.trim()).filter(Boolean)
-    )
-  ].sort();
-}
-function normalizeOAuthScope(scope) {
-  const normalized = normalizeScopeList(scope ? [scope] : []);
-  return normalized.length ? normalized.join(" ") : void 0;
-}
-function hasRequiredOAuthScope(storedScope, requiredScope) {
-  const required = normalizeScopeList(requiredScope ? [requiredScope] : []);
-  if (required.length === 0) {
-    return true;
-  }
-  const stored = new Set(normalizeScopeList(storedScope ? [storedScope] : []));
-  if (stored.size === 0) {
-    return false;
-  }
-  return required.every((scope) => stored.has(scope));
-}
+// src/git-config.ts
 function cleanIdentityPart(value) {
   return String(value ?? "").replaceAll("\n", " ").replaceAll("\r", " ").replace(/[<>]/g, "").trim();
 }
@@ -2937,6 +2891,92 @@ async function configureGit(ctx, key, value) {
     );
   }
 }
+
+// src/credential-support.ts
+import { createPrivateKey, createSign } from "crypto";
+var GITHUB_APP_ID_ENV = "GITHUB_APP_ID";
+var GITHUB_APP_PRIVATE_KEY_ENV = "GITHUB_APP_PRIVATE_KEY";
+var GITHUB_INSTALLATION_ID_ENV = "GITHUB_INSTALLATION_ID";
+var GITHUB_AUTH_TOKEN_ENV = "GITHUB_TOKEN";
+var GITHUB_AUTH_TOKEN_PLACEHOLDER = "ghp_host_managed_credential";
+var MAX_LEASE_MS = 60 * 60 * 1e3;
+var REFRESH_BUFFER_MS = 5 * 60 * 1e3;
+var USER_REFRESH_TIMEOUT_MS = 2e4;
+var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
+var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
+var CREATE_TOOL_ROUTING_GUIDANCE = "This is a Junior tool-routing denial, not a GitHub permission failure. Do not ask the user for GitHub permissions; retry with the required Junior tool.";
+var USER_WRITE_REQUIREMENTS = [
+  "requesting GitHub user permission to perform this operation"
+];
+var GITHUB_CREDENTIAL_DOMAINS = ["api.github.com", "github.com"];
+var GITHUB_ASSET_UPLOAD_CREDENTIAL_DOMAINS = [
+  ...GITHUB_CREDENTIAL_DOMAINS,
+  "uploads.github.com"
+];
+var GitHubUserRefreshRejectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitHubUserRefreshRejectedError";
+  }
+};
+var GitHubRequestError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "GitHubRequestError";
+    this.status = status;
+  }
+};
+var GitHubPluginSetupError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "GitHubPluginSetupError";
+  }
+};
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function readEnv(name) {
+  const value = process.env[name];
+  if (typeof value !== "string") {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed ? trimmed : void 0;
+}
+function requireEnv(name) {
+  const value = readEnv(name);
+  if (!value) {
+    throw new GitHubPluginSetupError(`Missing ${name}`);
+  }
+  return value;
+}
+function normalizeScopeList(scopes) {
+  return [
+    ...new Set(
+      (scopes ?? []).flatMap((scope) => String(scope).split(/\s+/)).map((scope) => scope.trim()).filter(Boolean)
+    )
+  ].sort();
+}
+function normalizeOAuthScope(scope) {
+  const normalized = normalizeScopeList(scope ? [scope] : []);
+  return normalized.length ? normalized.join(" ") : void 0;
+}
+function hasRequiredOAuthScope(storedScope, requiredScope) {
+  const required = normalizeScopeList(requiredScope ? [requiredScope] : []);
+  if (required.length === 0) {
+    return true;
+  }
+  const stored = new Set(normalizeScopeList(storedScope ? [storedScope] : []));
+  if (stored.size === 0) {
+    return false;
+  }
+  return required.every((scope) => stored.has(scope));
+}
+function isGitHubApiUrl(upstreamUrl) {
+  return upstreamUrl.hostname.toLowerCase() === "api.github.com";
+}
 function base64Url(input) {
   return Buffer.from(input).toString("base64").replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
 }
@@ -3437,6 +3477,8 @@ function createPermissionCache() {
     return await pending;
   };
 }
+
+// src/plugin.ts
 function githubSmartHttpAccess(upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
   const service = upstreamUrl.searchParams.get("service")?.toLowerCase();
@@ -3455,14 +3497,14 @@ function githubSmartHttpAccess(upstreamUrl) {
 function isGitHubGraphqlUrl(upstreamUrl) {
   return upstreamUrl.hostname.toLowerCase() === "api.github.com" && upstreamUrl.pathname.toLowerCase().endsWith("/graphql");
 }
-function isGitHubApiUrl(upstreamUrl) {
+function isGitHubApiUrl2(upstreamUrl) {
   return upstreamUrl.hostname.toLowerCase() === "api.github.com";
 }
 function isGitHubAssetUploadRequest(method, upstreamUrl) {
   return method === "POST" && upstreamUrl.hostname.toLowerCase() === "uploads.github.com" && upstreamUrl.pathname === "/user-attachments/assets";
 }
 function githubUserReadReason(method, upstreamUrl) {
-  if (method !== "GET" || !isGitHubApiUrl(upstreamUrl)) {
+  if (method !== "GET" || !isGitHubApiUrl2(upstreamUrl)) {
     return void 0;
   }
   return upstreamUrl.pathname.toLowerCase() === "/user" ? "github.user-read" : void 0;
@@ -3590,7 +3632,7 @@ function shouldInspectGitHubGraphqlResponse(ctx) {
 }
 function githubApiWriteGrantName(method, upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
-  if (!isGitHubApiUrl(upstreamUrl)) {
+  if (!isGitHubApiUrl2(upstreamUrl)) {
     return void 0;
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/actions\/workflows\/[^/]+\/dispatches$/.test(
@@ -3632,10 +3674,10 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   return void 0;
 }
 function isGitHubIssueCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(upstreamUrl.pathname.toLowerCase());
+  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(upstreamUrl.pathname.toLowerCase());
 }
 function isGitHubPullCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(upstreamUrl.pathname.toLowerCase());
+  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(upstreamUrl.pathname.toLowerCase());
 }
 function isGitHubIssueCreateGraphqlMutation(method, upstreamUrl, bodyText) {
   if (method !== "POST" || !isGitHubGraphqlUrl(upstreamUrl)) {
@@ -3794,7 +3836,6 @@ function githubPlugin(options = {}) {
   const declaredAppPermissions = normalizePermissions(options.appPermissions);
   const declaredReadPermissions = declaredAppPermissions ? readGrantPermissions(declaredAppPermissions) : void 0;
   const loadReadPermissions = createPermissionCache();
-  const appCapabilities = permissionCapabilities(declaredAppPermissions);
   const userScopes = normalizeScopeList(options.additionalUserScopes);
   const userScope = userScopes.length ? userScopes.join(" ") : void 0;
   return defineJuniorPlugin({
@@ -3803,7 +3844,6 @@ function githubPlugin(options = {}) {
       name: "github",
       displayName: "GitHub",
       description: "GitHub issue, pull request, and repository workflows via GitHub App",
-      ...appCapabilities ? { capabilities: appCapabilities } : {},
       configKeys: ["org", "repo"],
       domains: ["api.github.com", "github.com", "uploads.github.com"],
       envVars: {

package/dist/outcomes/cost.d.ts

@@ -21,14 +21,20 @@ declare const costWindowSchema: z.ZodPipe<z.ZodObject<{
 }>>;
 declare const repositoryCostSchema: z.ZodPipe<z.ZodObject<{
     issueCostUsd: z.ZodNullable<z.ZodNumber>;
+    medianIssueCostUsd: z.ZodNullable<z.ZodNumber>;
+    medianPullRequestCostUsd: z.ZodNullable<z.ZodNumber>;
     pullRequestCostUsd: z.ZodNullable<z.ZodNumber>;
     repository: z.ZodString;
 }, z.core.$strict>, z.ZodTransform<{
     issueCostUsd: number | undefined;
+    medianIssueCostUsd: number | undefined;
+    medianPullRequestCostUsd: number | undefined;
     pullRequestCostUsd: number | undefined;
     repository: string;
 }, {
     issueCostUsd: number | null;
+    medianIssueCostUsd: number | null;
+    medianPullRequestCostUsd: number | null;
     pullRequestCostUsd: number | null;
     repository: string;
 }>>;

package/dist/permissions.d.ts

@@ -1,8 +1,6 @@
 export type GitHubAppPermissionLevel = "admin" | "read" | "write";
 export type GitHubAppPermissions = Record<string, GitHubAppPermissionLevel>;
-/** Validate the configured GitHub App capability and read-token declaration. */
+/** Validate the configured GitHub App read-token permission declaration. */
 export declare function normalizePermissions(permissions: GitHubAppPermissions | undefined): GitHubAppPermissions | undefined;
 /** Build the read-only installation-token permission body. */
 export declare function readGrantPermissions(permissions: Record<string, unknown> | undefined): Record<string, "read">;
-/** Expose configured permissions as plugin capabilities for host policy checks. */
-export declare function permissionCapabilities(permissions: GitHubAppPermissions | undefined): string[] | undefined;

package/dist/plugin.d.ts

@@ -0,0 +1,44 @@
+/**
+ * GitHub plugin runtime boundary.
+ *
+ * This module composes GitHub hooks and owns GitHub egress policy.
+ */
+import { type PluginRegistration } from "@sentry/junior-plugin-api";
+import { type GitHubAppPermissions } from "./permissions.js";
+/** Configure the built-in GitHub plugin manifest and hooks. */
+export interface GitHubPluginOptions {
+    /**
+     * Extra OAuth `scope` values to request during GitHub App user authorization.
+     *
+     * GitHub App user tokens report empty scopes, so Junior treats this as a
+     * local reauthorization contract only. Effective access still comes from the
+     * app permissions, installation repositories, and requesting user's access.
+     */
+    additionalUserScopes?: string[];
+    /**
+     * GitHub App permissions Junior should downscope to read for
+     * installation-read tokens.
+     *
+     * Keys may use GitHub permission names with underscores or hyphens.
+     * Installation-write tokens inherit the App installation's complete
+     * permission envelope. GitHub remains the source of truth for whether a
+     * permission exists.
+     */
+    appPermissions?: GitHubAppPermissions;
+    /** Environment variable containing the GitHub App id. */
+    appIdEnv?: string;
+    /** Environment variable containing Junior's Git committer email. */
+    botEmailEnv?: string;
+    /** Environment variable containing Junior's Git committer name. */
+    botNameEnv?: string;
+    /** Environment variable containing the GitHub App OAuth client id. */
+    clientIdEnv?: string;
+    /** Environment variable containing the GitHub App OAuth client secret. */
+    clientSecretEnv?: string;
+    /** Environment variable containing the GitHub App installation id. */
+    installationIdEnv?: string;
+    /** Environment variable containing the GitHub App private key. */
+    privateKeyEnv?: string;
+}
+/** Register GitHub runtime hooks for repository workflows. */
+export declare function githubPlugin(options?: GitHubPluginOptions): PluginRegistration;

package/dist/pull-request-outcomes/store.d.ts

@@ -15,8 +15,8 @@ declare const githubPullRequestOutcomeInputSchema: z.ZodObject<{
     repositoryFullName: z.ZodString;
     repositoryId: z.ZodString;
     state: z.ZodEnum<{
-        merged: "merged";
         open: "open";
+        merged: "merged";
         closed_unmerged: "closed_unmerged";
     }>;
     updatedAt: z.ZodDate;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.114.0",
+  "version": "0.116.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.114.0"
+    "@sentry/junior-plugin-api": "0.116.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/attach-github-assets/SOURCES.md

@@ -5,7 +5,8 @@
 - `intercom/2x-skills@59213af`, `plugins/pr-tools/skills/attach-github-assets/SKILL.md` — upstream runtime intent and supported use cases; primary source; high confidence; MIT.
 - `intercom/2x-skills@59213af`, `plugins/pr-tools/skills/attach-github-assets/scripts/upload.sh` — upstream endpoint, MIME mapping, and response contract; primary implementation source; high confidence; MIT.
 - `intercom/2x-skills@59213af`, `plugins/pr-tools/LICENSE` — upstream copyright and license notice; authoritative legal source; high confidence.
-- `packages/junior-github/src/index.ts` — local GitHub credential and egress boundary; authoritative local source; high confidence.
+- `packages/junior-github/src/credential-support.ts` — local GitHub credential boundary; authoritative local source; high confidence.
+- `packages/junior-github/src/plugin.ts` — local GitHub egress boundary; authoritative local source; high confidence.
 - `packages/junior-github/skills/github-code/SKILL.md` — local repository targeting and credential guidance; authoritative local convention; high confidence.
 - GitHub REST API documentation — no documented user-attachment upload operation found; official source; medium confidence for absence.