@sentry/junior-github 0.115.0 → 0.116.0

package/SETUP.md

@@ -116,11 +116,11 @@ githubPlugin({
 });
 ```
 
-Junior records these permissions as plugin capabilities. Installation-read token requests remain read-only by requesting read-capable configured permissions at `read` level and omitting GitHub permission fields that have no `read` value. Installation-write token requests intentionally omit the `permissions` field, so GitHub applies the complete permission envelope approved on the App installation. GitHub remains the source of truth for whether a permission name or level exists.
+Installation-read token requests remain read-only by requesting read-capable configured permissions at `read` level and omitting GitHub permission fields that have no `read` value. Installation-write token requests intentionally omit the `permissions` field, so GitHub applies the complete permission envelope approved on the App installation. GitHub remains the source of truth for whether a permission name or level exists.
 
 GitHub App user-to-server tokens do not use OAuth scopes as their permission model. Their effective access is limited by the GitHub App's installed permissions, the app installation's repository access, and the requesting user's own GitHub access. Repository-scoped installation tokens instead use the App permission envelope and installation repository access without borrowing the requesting user's authority. GitHub returns an empty `scope` value for user-to-server tokens, so Junior cannot verify granted scopes from the token response.
 
-If you pass `additionalUserScopes`, Junior includes those values in the authorization URL and records the requested scope string as a local reauthorization contract. This does not expand or prove GitHub API permissions. Configure provider-enforced access in the GitHub App settings; `appPermissions` only declares capabilities and controls read-token downscoping:
+If you pass `additionalUserScopes`, Junior includes those values in the authorization URL and records the requested scope string as a local reauthorization contract. This does not expand or prove GitHub API permissions. Configure provider-enforced access in the GitHub App settings; `appPermissions` only controls read-token downscoping:
 
 ```ts
 githubPlugin({

package/dist/db/schema.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 export declare const githubPullRequestStateSchema: z.ZodEnum<{
-    merged: "merged";
     open: "open";
+    merged: "merged";
     closed_unmerged: "closed_unmerged";
 }>;
 export type GitHubPullRequestState = z.output<typeof githubPullRequestStateSchema>;
@@ -308,7 +308,7 @@ export declare const juniorGitHubPullRequests: import("drizzle-orm/pg-core").PgT
             tableName: "junior_github_pull_requests";
             dataType: "string";
             columnType: "PgText";
-            data: "merged" | "open" | "closed_unmerged";
+            data: "open" | "merged" | "closed_unmerged";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -320,7 +320,7 @@ export declare const juniorGitHubPullRequests: import("drizzle-orm/pg-core").PgT
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: "merged" | "open" | "closed_unmerged";
+            $type: "open" | "merged" | "closed_unmerged";
         }>;
         commitComposition: import("drizzle-orm/pg-core").PgColumn<{
             name: "commit_composition";
@@ -857,7 +857,7 @@ export declare const githubSqlSchema: {
                 tableName: "junior_github_pull_requests";
                 dataType: "string";
                 columnType: "PgText";
-                data: "merged" | "open" | "closed_unmerged";
+                data: "open" | "merged" | "closed_unmerged";
                 driverParam: string;
                 notNull: true;
                 hasDefault: false;
@@ -869,7 +869,7 @@ export declare const githubSqlSchema: {
                 identity: undefined;
                 generated: undefined;
             }, {}, {
-                $type: "merged" | "open" | "closed_unmerged";
+                $type: "open" | "merged" | "closed_unmerged";
             }>;
             commitComposition: import("drizzle-orm/pg-core").PgColumn<{
                 name: "commit_composition";

package/dist/index.js

@@ -64,15 +64,6 @@ function readGrantPermissions(permissions) {
   }
   return readOnly;
 }
-function permissionCapabilities(permissions) {
-  if (permissions === void 0) {
-    return void 0;
-  }
-  return Object.entries(permissions).map(([normalizedScope, rawLevel]) => {
-    const scope = normalizedScope.replace(/_/g, "-");
-    return `github.${scope}.${rawLevel}`;
-  }).sort();
-}
 
 // src/tools/create-issue.ts
 import {
@@ -527,6 +518,7 @@ import { z as z2 } from "zod";
 import { subscribableResourceSchema } from "@sentry/junior-plugin-api";
 var GITHUB_PULL_REQUEST_CREATE_IDEMPOTENCY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var GITHUB_PULL_REQUEST_CREATE_LOCK_TTL_MS = 6e4;
+var RESOURCE_LINK_LABEL_MAX_LENGTH = 256;
 var GitHubPullRequestCreateRejectedError = class extends Error {
   status;
   constructor(message, status) {
@@ -759,6 +751,20 @@ function gitHubPullRequestToolResult(input, result) {
   });
   return { ...result, ...subscribable ? { subscribable } : {} };
 }
+async function annotatePullRequest(ctx, input, result) {
+  const repo = parseRepo2(input.repo);
+  const label = `${repo.owner}/${repo.name} #${result.number}: ${nonEmptyString3(input.title, "title")}`.slice(
+    0,
+    RESOURCE_LINK_LABEL_MAX_LENGTH
+  );
+  await ctx.annotations?.upsert({
+    kind: "resource_link",
+    key: `${repo.owner.toLowerCase()}/${repo.name.toLowerCase()}#${result.number}`,
+    label,
+    url: result.url,
+    status: input.draft ? "draft" : "open"
+  });
+}
 function gitHubPullRequestStructuredResult(input, result) {
   const data = gitHubPullRequestToolResult(input, result);
   return {
@@ -788,12 +794,15 @@ function createGitHubPullRequestTool(ctx) {
         async () => {
           const state = createPullRequestState(await ctx.state.get(key));
           if (state?.status === "completed") {
+            const completedInput = state.input ?? parsedInput;
+            const completedResult = {
+              number: state.number,
+              url: state.url
+            };
+            await annotatePullRequest(ctx, completedInput, completedResult);
             return gitHubPullRequestStructuredResult(
-              state.input ?? parsedInput,
-              {
-                number: state.number,
-                url: state.url
-              }
+              completedInput,
+              completedResult
             );
           }
           if (state?.status === "pending") {
@@ -832,6 +841,7 @@ function createGitHubPullRequestTool(ctx) {
                 { cause: error }
               );
             }
+            await annotatePullRequest(ctx, parsedInput, result);
             return gitHubPullRequestStructuredResult(parsedInput, result);
           } catch (error) {
             if (isEgressAuthRequired2(error) || isDefinitiveGitHubPullRequestCreateRejection(error)) {
@@ -3826,7 +3836,6 @@ function githubPlugin(options = {}) {
   const declaredAppPermissions = normalizePermissions(options.appPermissions);
   const declaredReadPermissions = declaredAppPermissions ? readGrantPermissions(declaredAppPermissions) : void 0;
   const loadReadPermissions = createPermissionCache();
-  const appCapabilities = permissionCapabilities(declaredAppPermissions);
   const userScopes = normalizeScopeList(options.additionalUserScopes);
   const userScope = userScopes.length ? userScopes.join(" ") : void 0;
   return defineJuniorPlugin({
@@ -3835,7 +3844,6 @@ function githubPlugin(options = {}) {
       name: "github",
       displayName: "GitHub",
       description: "GitHub issue, pull request, and repository workflows via GitHub App",
-      ...appCapabilities ? { capabilities: appCapabilities } : {},
       configKeys: ["org", "repo"],
       domains: ["api.github.com", "github.com", "uploads.github.com"],
       envVars: {

package/dist/permissions.d.ts

@@ -1,8 +1,6 @@
 export type GitHubAppPermissionLevel = "admin" | "read" | "write";
 export type GitHubAppPermissions = Record<string, GitHubAppPermissionLevel>;
-/** Validate the configured GitHub App capability and read-token declaration. */
+/** Validate the configured GitHub App read-token permission declaration. */
 export declare function normalizePermissions(permissions: GitHubAppPermissions | undefined): GitHubAppPermissions | undefined;
 /** Build the read-only installation-token permission body. */
 export declare function readGrantPermissions(permissions: Record<string, unknown> | undefined): Record<string, "read">;
-/** Expose configured permissions as plugin capabilities for host policy checks. */
-export declare function permissionCapabilities(permissions: GitHubAppPermissions | undefined): string[] | undefined;

package/dist/plugin.d.ts

@@ -16,13 +16,13 @@ export interface GitHubPluginOptions {
      */
     additionalUserScopes?: string[];
     /**
-     * GitHub App permissions Junior should expose as capabilities and downscope
-     * to read for installation-read tokens.
+     * GitHub App permissions Junior should downscope to read for
+     * installation-read tokens.
      *
-     * Keys may use GitHub permission names with underscores or hyphens. Junior
-     * records these as plugin capabilities. Installation-write tokens inherit
-     * the App installation's complete permission envelope.
-     * GitHub remains the source of truth for whether a permission exists.
+     * Keys may use GitHub permission names with underscores or hyphens.
+     * Installation-write tokens inherit the App installation's complete
+     * permission envelope. GitHub remains the source of truth for whether a
+     * permission exists.
      */
     appPermissions?: GitHubAppPermissions;
     /** Environment variable containing the GitHub App id. */

package/dist/pull-request-outcomes/store.d.ts

@@ -15,8 +15,8 @@ declare const githubPullRequestOutcomeInputSchema: z.ZodObject<{
     repositoryFullName: z.ZodString;
     repositoryId: z.ZodString;
     state: z.ZodEnum<{
-        merged: "merged";
         open: "open";
+        merged: "merged";
         closed_unmerged: "closed_unmerged";
     }>;
     updatedAt: z.ZodDate;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.115.0",
+  "version": "0.116.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.115.0"
+    "@sentry/junior-plugin-api": "0.116.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",