@sentry/junior-github 0.132.0 → 0.134.0

package/dist/index.js

@@ -77,26 +77,139 @@ function readGrantPermissions(permissions) {
   return readOnly;
 }
 
-// src/tools/create-issue.ts
+// src/tools/clone-repository.ts
 import {
   definePluginTool,
+  PluginToolInputError,
+  pluginToolOutputSchema
+} from "@sentry/junior-plugin-api";
+import { z } from "zod";
+var RESERVED_SANDBOX_DIRECTORIES = /* @__PURE__ */ new Set([".junior", "data", "skills"]);
+var inputSchema = z.object({
+  repo: z.string().describe('Repository in "owner/name" format.'),
+  directory: z.string().regex(/^[A-Za-z0-9._-]+$/).refine((value) => value !== "." && value !== "..", {
+    message: "Directory must be a single directory name."
+  }).describe("Optional destination directory under the sandbox root.").optional()
+}).strict();
+var cloneSchema = z.object({
+  path: z.string(),
+  repo: z.string()
+});
+var outputSchema = pluginToolOutputSchema.extend({
+  target: z.literal("cloneRepository"),
+  ...cloneSchema.shape
+});
+function parseRepo(value) {
+  const parts = value.split("/").map((part) => part.trim());
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    throw new PluginToolInputError('repo must use "owner/name" format');
+  }
+  return { owner: parts[0], name: parts[1] };
+}
+function defaultDirectory(repoName) {
+  return RESERVED_SANDBOX_DIRECTORIES.has(repoName) ? `${repoName}-repo` : repoName;
+}
+function commandSignal(signal, timeoutMs) {
+  const timeout = AbortSignal.timeout(timeoutMs);
+  return signal ? AbortSignal.any([signal, timeout]) : timeout;
+}
+async function removePartialClone(ctx, path) {
+  try {
+    const result = await ctx.sandbox.run({
+      cmd: "rm",
+      args: ["-rf", "--", path],
+      cwd: ctx.sandbox.root,
+      signal: AbortSignal.timeout(3e4)
+    });
+    if (result.exitCode !== 0) {
+      ctx.log.warn("github.clone.cleanup.failed", {
+        path,
+        stderr: result.stderr
+      });
+    }
+  } catch (error) {
+    ctx.log.warn("github.clone.cleanup.failed", {
+      path,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+function createGitHubCloneRepositoryTool(ctx) {
+  return definePluginTool({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: false,
+      openWorldHint: true,
+      readOnlyHint: false
+    },
+    description: "Clone a GitHub repository into the sandbox workspace. The destination must not already exist.",
+    executionMode: "sequential",
+    inputSchema,
+    outputSchema,
+    async execute(input, options) {
+      const repo = parseRepo(input.repo);
+      const directory = input.directory ?? defaultDirectory(repo.name);
+      const path = `${ctx.sandbox.root}/${directory}`;
+      const exists = await ctx.sandbox.run({
+        cmd: "bash",
+        args: ["-c", `test -e "$1"`, "bash", path],
+        cwd: ctx.sandbox.root,
+        signal: commandSignal(options.signal, 3e4)
+      });
+      if (exists.exitCode === 0) {
+        throw new PluginToolInputError(`destination already exists: ${path}`);
+      }
+      let clone;
+      try {
+        clone = await ctx.sandbox.run({
+          cmd: "git",
+          args: [
+            "clone",
+            "--quiet",
+            "--depth=1",
+            "--",
+            `https://github.com/${repo.owner}/${repo.name}.git`,
+            directory
+          ],
+          cwd: ctx.sandbox.root,
+          signal: commandSignal(options.signal, 2 * 6e4)
+        });
+      } catch (error) {
+        await removePartialClone(ctx, path);
+        throw error;
+      }
+      if (clone.exitCode !== 0) {
+        await removePartialClone(ctx, path);
+        throw new PluginToolInputError(
+          `GitHub repository clone failed: ${clone.stderr.trim() || `exit ${clone.exitCode}`}`
+        );
+      }
+      const data = { repo: `${repo.owner}/${repo.name}`, path };
+      return { target: "cloneRepository", ...data };
+    }
+  });
+}
+
+// src/tools/create-issue.ts
+import {
+  definePluginTool as definePluginTool2,
   EgressAuthRequired,
-  PluginToolInputError as PluginToolInputError2,
+  PluginToolInputError as PluginToolInputError3,
   subscribableResourceSchema,
-  pluginToolOutputSchema
+  pluginToolOutputSchema as pluginToolOutputSchema2
 } from "@sentry/junior-plugin-api";
 import { Type } from "@sinclair/typebox";
 import { Value } from "@sinclair/typebox/value";
-import { z } from "zod";
+import { z as z2 } from "zod";
 
 // src/tools/footer.ts
-import { PluginToolInputError } from "@sentry/junior-plugin-api";
+import { PluginToolInputError as PluginToolInputError2 } from "@sentry/junior-plugin-api";
 var GITHUB_SESSION_FOOTER_START = "<!-- junior-session-footer:start -->";
 var GITHUB_SESSION_FOOTER_END = "<!-- junior-session-footer:end -->";
 var GITHUB_CONVERSATION_ID_MARKER = "junior-conversation-id:";
 function nonEmptyString(value, name) {
   if (!value?.trim()) {
-    throw new PluginToolInputError(`${name} is required`);
+    throw new PluginToolInputError2(`${name} is required`);
   }
   return value.trim();
 }
@@ -277,11 +390,11 @@ var createIssueInputSchema = Type.Object(
   },
   { additionalProperties: false }
 );
-var createIssueToolInputSchema = z.object({
-  repo: z.string().describe('Repository in "owner/name" format.'),
-  title: z.string().describe("Issue title."),
-  body: z.string().describe("Issue body. Junior appends the conversation footer.").optional(),
-  labels: z.array(z.string()).describe("Labels to apply to the issue.").optional()
+var createIssueToolInputSchema = z2.object({
+  repo: z2.string().describe('Repository in "owner/name" format.'),
+  title: z2.string().describe("Issue title."),
+  body: z2.string().describe("Issue body. Junior appends the conversation footer.").optional(),
+  labels: z2.array(z2.string()).describe("Labels to apply to the issue.").optional()
 }).strict();
 var createIssueStateSchema = Type.Union([
   Type.Object(
@@ -303,17 +416,17 @@ var createIssueStateSchema = Type.Union([
     { additionalProperties: false }
   )
 ]);
-var gitHubIssueDataSchema = z.object({
-  number: z.number(),
+var gitHubIssueDataSchema = z2.object({
+  number: z2.number(),
   subscribable: subscribableResourceSchema.optional(),
-  url: z.string()
+  url: z2.string()
 });
-var gitHubIssueOutputSchema = pluginToolOutputSchema.extend({
-  target: z.literal("createIssue"),
+var gitHubIssueOutputSchema = pluginToolOutputSchema2.extend({
+  target: z2.literal("createIssue"),
   ...gitHubIssueDataSchema.shape
 });
 function gitHubIssueToolResult(input, result, canSubscribe) {
-  const repo = parseRepo(input.repo);
+  const repo = parseRepo2(input.repo);
   const subscribable = canSubscribe ? gitHubIssueSubscribable({
     number: result.number,
     repo: `${repo.owner}/${repo.name}`
@@ -328,22 +441,22 @@ function parseCreateIssueInput(input) {
   try {
     return Value.Parse(createIssueInputSchema, input);
   } catch (error) {
-    throw new PluginToolInputError2("Invalid GitHub createIssue input.", {
+    throw new PluginToolInputError3("Invalid GitHub createIssue input.", {
       cause: error
     });
   }
 }
 function nonEmptyString2(value, name) {
   if (!value?.trim()) {
-    throw new PluginToolInputError2(`${name} is required`);
+    throw new PluginToolInputError3(`${name} is required`);
   }
   return value.trim();
 }
-function parseRepo(value) {
+function parseRepo2(value) {
   const repo = nonEmptyString2(value, "repo");
   const parts = repo.split("/");
   if (parts.length !== 2 || !parts[0]?.trim() || !parts[1]?.trim()) {
-    throw new PluginToolInputError2('repo must use "owner/name" format');
+    throw new PluginToolInputError3('repo must use "owner/name" format');
   }
   return {
     owner: parts[0].trim(),
@@ -395,7 +508,7 @@ function isDefinitiveGitHubIssueCreateRejection(error) {
   return [400, 401, 404, 410, 422].includes(error.status);
 }
 function createGitHubIssueRequest(conversationId, input, actor, dashboardUrl) {
-  const repo = parseRepo(input.repo);
+  const repo = parseRepo2(input.repo);
   const labels = input.labels?.map(
     (label) => nonEmptyString2(label, "labels entry")
   );
@@ -451,7 +564,7 @@ async function createGitHubIssue(ctx, request) {
   };
 }
 async function annotateIssue(ctx, input, result) {
-  const repo = parseRepo(input.repo);
+  const repo = parseRepo2(input.repo);
   await ctx.annotations?.upsert({
     kind: "resource_link",
     key: `${repo.owner.toLowerCase()}/${repo.name.toLowerCase()}#${result.number}`,
@@ -461,7 +574,7 @@ async function annotateIssue(ctx, input, result) {
   });
 }
 function createGitHubIssueTool(ctx) {
-  return definePluginTool({
+  return definePluginTool2({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -553,78 +666,78 @@ function createGitHubIssueTool(ctx) {
 
 // src/tools/get-deployment.ts
 import {
-  definePluginTool as definePluginTool2,
-  PluginToolInputError as PluginToolInputError3,
-  pluginToolOutputSchema as pluginToolOutputSchema2,
+  definePluginTool as definePluginTool3,
+  PluginToolInputError as PluginToolInputError4,
+  pluginToolOutputSchema as pluginToolOutputSchema3,
   subscribableResourceSchema as subscribableResourceSchema2
 } from "@sentry/junior-plugin-api";
-import { z as z2 } from "zod";
-var commitShaSchema = z2.string().regex(/^[0-9a-f]{40}$/i);
-var inputSchema = z2.object({
-  repo: z2.string().describe('Repository in "owner/name" format.'),
+import { z as z3 } from "zod";
+var commitShaSchema = z3.string().regex(/^[0-9a-f]{40}$/i);
+var inputSchema2 = z3.object({
+  repo: z3.string().describe('Repository in "owner/name" format.'),
   commitSha: commitShaSchema.describe(
     "Full 40-character Git commit SHA recorded by the deployment."
   ),
-  environment: z2.string().trim().min(1).describe(
+  environment: z3.string().trim().min(1).describe(
     'Optional GitHub deployment environment, such as "Production". Omit to inspect and watch deployments for the commit across environments.'
   ).optional()
 }).strict();
-var statusSchema = z2.object({
-  createdAt: z2.string(),
-  creator: z2.string().nullable(),
-  description: z2.string().nullable(),
-  environmentUrl: z2.string().nullable(),
-  id: z2.number(),
-  logUrl: z2.string().nullable(),
-  state: z2.string()
+var statusSchema = z3.object({
+  createdAt: z3.string(),
+  creator: z3.string().nullable(),
+  description: z3.string().nullable(),
+  environmentUrl: z3.string().nullable(),
+  id: z3.number(),
+  logUrl: z3.string().nullable(),
+  state: z3.string()
 }).strict();
-var deploymentSchema = z2.object({
-  createdAt: z2.string(),
-  creator: z2.string().nullable(),
-  description: z2.string().nullable(),
-  environment: z2.string(),
-  id: z2.number(),
+var deploymentSchema = z3.object({
+  createdAt: z3.string(),
+  creator: z3.string().nullable(),
+  description: z3.string().nullable(),
+  environment: z3.string(),
+  id: z3.number(),
   latestStatus: statusSchema.nullable(),
-  ref: z2.string(),
+  ref: z3.string(),
   sha: commitShaSchema,
-  updatedAt: z2.string(),
-  url: z2.string()
+  updatedAt: z3.string(),
+  url: z3.string()
 }).strict();
-var deploymentSourceSchema = z2.object({
+var deploymentSourceSchema = z3.object({
   commitSha: commitShaSchema,
   deployment: deploymentSchema.nullable(),
-  environment: z2.string().nullable(),
-  repo: z2.string(),
+  environment: z3.string().nullable(),
+  repo: z3.string(),
   subscribable: subscribableResourceSchema2.optional()
 }).strict();
-var outputSchema = pluginToolOutputSchema2.extend({
-  target: z2.literal("getDeployment"),
+var outputSchema2 = pluginToolOutputSchema3.extend({
+  target: z3.literal("getDeployment"),
   ...deploymentSourceSchema.shape
 }).strict();
-var providerCreatorSchema = z2.object({ login: z2.string() }).passthrough().nullable();
-var providerDeploymentSchema = z2.object({
-  created_at: z2.string(),
+var providerCreatorSchema = z3.object({ login: z3.string() }).passthrough().nullable();
+var providerDeploymentSchema = z3.object({
+  created_at: z3.string(),
   creator: providerCreatorSchema,
-  description: z2.string().nullable(),
-  environment: z2.string(),
-  id: z2.number(),
-  ref: z2.string(),
+  description: z3.string().nullable(),
+  environment: z3.string(),
+  id: z3.number(),
+  ref: z3.string(),
   sha: commitShaSchema,
-  updated_at: z2.string()
+  updated_at: z3.string()
 }).passthrough();
-var providerStatusSchema = z2.object({
-  created_at: z2.string(),
+var providerStatusSchema = z3.object({
+  created_at: z3.string(),
   creator: providerCreatorSchema,
-  description: z2.string().nullable().optional(),
-  environment_url: z2.string().nullable().optional(),
-  id: z2.number(),
-  log_url: z2.string().nullable().optional(),
-  state: z2.string()
+  description: z3.string().nullable().optional(),
+  environment_url: z3.string().nullable().optional(),
+  id: z3.number(),
+  log_url: z3.string().nullable().optional(),
+  state: z3.string()
 }).passthrough();
-function parseRepo2(value) {
+function parseRepo3(value) {
   const parts = value.split("/").map((part) => part.trim());
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
-    throw new PluginToolInputError3('repo must use "owner/name" format');
+    throw new PluginToolInputError4('repo must use "owner/name" format');
   }
   return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
 }
@@ -641,7 +754,7 @@ function throwLookupError(target, status, body) {
   const message = `GitHub ${target} lookup failed with HTTP ${status}`;
   const hasValidationErrors = body !== null && typeof body === "object" && !Array.isArray(body) && Array.isArray(body.errors) && body.errors.length > 0;
   if (target === "deployment" && (status === 404 || status === 422 && hasValidationErrors)) {
-    throw new PluginToolInputError3(message);
+    throw new PluginToolInputError4(message);
   }
   throw new Error(message);
 }
@@ -649,7 +762,7 @@ function repositoryUrl(repo, path) {
   return `https://api.github.com/repos/${encodeURIComponent(repo.owner)}/${encodeURIComponent(repo.name)}/${path}`;
 }
 function createGitHubGetDeploymentTool(ctx) {
-  return definePluginTool2({
+  return definePluginTool3({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -657,10 +770,10 @@ function createGitHubGetDeploymentTool(ctx) {
       readOnlyHint: true
     },
     description: "Get the latest GitHub deployment and status for an exact repository and full commit SHA, optionally limited to one environment. The result remains subscribable when no deployment exists yet, so use it before waiting for a deployment outcome.",
-    inputSchema,
-    outputSchema,
+    inputSchema: inputSchema2,
+    outputSchema: outputSchema2,
     async execute(input) {
-      const repo = parseRepo2(input.repo);
+      const repo = parseRepo3(input.repo);
       const commitSha = input.commitSha.toLowerCase();
       const deploymentsUrl = new URL(repositoryUrl(repo, "deployments"));
       deploymentsUrl.searchParams.set("sha", commitSha);
@@ -686,7 +799,7 @@ function createGitHubGetDeploymentTool(ctx) {
           deploymentsBody
         );
       }
-      const providerDeployment = z2.array(providerDeploymentSchema).parse(deploymentsBody)[0];
+      const providerDeployment = z3.array(providerDeploymentSchema).parse(deploymentsBody)[0];
       let deployment = null;
       if (providerDeployment) {
         const statusesResponse = await ctx.egress.fetch({
@@ -710,7 +823,7 @@ function createGitHubGetDeploymentTool(ctx) {
             statusesBody
           );
         }
-        const providerStatus = z2.array(providerStatusSchema).parse(statusesBody)[0];
+        const providerStatus = z3.array(providerStatusSchema).parse(statusesBody)[0];
         deployment = {
           createdAt: providerDeployment.created_at,
           creator: providerDeployment.creator?.login ?? null,
@@ -754,14 +867,14 @@ function createGitHubGetDeploymentTool(ctx) {
 
 // src/tools/create-pull-request.ts
 import {
-  definePluginTool as definePluginTool3,
+  definePluginTool as definePluginTool4,
   EgressAuthRequired as EgressAuthRequired2,
-  PluginToolInputError as PluginToolInputError4,
-  pluginToolOutputSchema as pluginToolOutputSchema3
+  PluginToolInputError as PluginToolInputError5,
+  pluginToolOutputSchema as pluginToolOutputSchema4
 } from "@sentry/junior-plugin-api";
 import { Type as Type2 } from "@sinclair/typebox";
 import { Value as Value2 } from "@sinclair/typebox/value";
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 import { subscribableResourceSchema as subscribableResourceSchema3 } from "@sentry/junior-plugin-api";
 var GITHUB_PULL_REQUEST_CREATE_IDEMPOTENCY_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
 var GITHUB_PULL_REQUEST_CREATE_LOCK_TTL_MS = 6e4;
@@ -800,13 +913,13 @@ var createPullRequestInputSchema = Type2.Object(
   },
   { additionalProperties: false }
 );
-var createPullRequestToolInputSchema = z3.object({
-  repo: z3.string().describe('Repository in "owner/name" format.'),
-  title: z3.string().describe("Pull request title."),
-  head: z3.string().describe("Head branch or owner:branch ref."),
-  base: z3.string().describe("Base branch."),
-  body: z3.string().describe("Pull request body. Junior appends the conversation footer.").optional(),
-  draft: z3.boolean().describe("Whether to open the pull request as a draft.").optional()
+var createPullRequestToolInputSchema = z4.object({
+  repo: z4.string().describe('Repository in "owner/name" format.'),
+  title: z4.string().describe("Pull request title."),
+  head: z4.string().describe("Head branch or owner:branch ref."),
+  base: z4.string().describe("Base branch."),
+  body: z4.string().describe("Pull request body. Junior appends the conversation footer.").optional(),
+  draft: z4.boolean().describe("Whether to open the pull request as a draft.").optional()
 }).strict();
 var createPullRequestStateSchema = Type2.Union([
   Type2.Object(
@@ -828,35 +941,35 @@ var createPullRequestStateSchema = Type2.Union([
     { additionalProperties: false }
   )
 ]);
-var gitHubPullRequestDataSchema = z3.object({
-  number: z3.number(),
-  url: z3.string(),
+var gitHubPullRequestDataSchema = z4.object({
+  number: z4.number(),
+  url: z4.string(),
   subscribable: subscribableResourceSchema3.optional()
 });
-var gitHubPullRequestOutputSchema = pluginToolOutputSchema3.extend({
-  target: z3.literal("createPullRequest"),
+var gitHubPullRequestOutputSchema = pluginToolOutputSchema4.extend({
+  target: z4.literal("createPullRequest"),
   ...gitHubPullRequestDataSchema.shape
 });
 function parseCreatePullRequestInput(input) {
   try {
     return Value2.Parse(createPullRequestInputSchema, input);
   } catch (error) {
-    throw new PluginToolInputError4("Invalid GitHub createPullRequest input.", {
+    throw new PluginToolInputError5("Invalid GitHub createPullRequest input.", {
       cause: error
     });
   }
 }
 function nonEmptyString3(value, name) {
   if (!value?.trim()) {
-    throw new PluginToolInputError4(`${name} is required`);
+    throw new PluginToolInputError5(`${name} is required`);
   }
   return value.trim();
 }
-function parseRepo3(value) {
+function parseRepo4(value) {
   const repo = nonEmptyString3(value, "repo");
   const parts = repo.split("/");
   if (parts.length !== 2 || !parts[0]?.trim() || !parts[1]?.trim()) {
-    throw new PluginToolInputError4('repo must use "owner/name" format');
+    throw new PluginToolInputError5('repo must use "owner/name" format');
   }
   return {
     owner: parts[0].trim(),
@@ -926,7 +1039,7 @@ function isDefinitiveGitHubPullRequestCreateRejection(error) {
   return [400, 401, 404, 410, 422].includes(error.status);
 }
 function createGitHubPullRequestRequest(conversationId, input, actor, dashboardUrl) {
-  const repo = parseRepo3(input.repo);
+  const repo = parseRepo4(input.repo);
   const payload = {
     title: nonEmptyString3(input.title, "title"),
     head: nonEmptyString3(input.head, "head"),
@@ -985,7 +1098,7 @@ async function createGitHubPullRequest(ctx, request) {
   };
 }
 function gitHubPullRequestToolResult(input, result, canSubscribe) {
-  const repo = parseRepo3(input.repo);
+  const repo = parseRepo4(input.repo);
   const subscribable = canSubscribe ? gitHubPullRequestSubscribable({
     number: result.number,
     repo: `${repo.owner}/${repo.name}`
@@ -993,7 +1106,7 @@ function gitHubPullRequestToolResult(input, result, canSubscribe) {
   return { ...result, ...subscribable ? { subscribable } : {} };
 }
 async function annotatePullRequest(ctx, input, result) {
-  const repo = parseRepo3(input.repo);
+  const repo = parseRepo4(input.repo);
   await ctx.annotations?.upsert({
     kind: "resource_link",
     key: `${repo.owner.toLowerCase()}/${repo.name.toLowerCase()}#${result.number}`,
@@ -1010,7 +1123,7 @@ function gitHubPullRequestStructuredResult(input, result, canSubscribe) {
   };
 }
 function createGitHubPullRequestTool(ctx) {
-  return definePluginTool3({
+  return definePluginTool4({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -1102,37 +1215,37 @@ function createGitHubPullRequestTool(ctx) {
 
 // src/tools/get-pull-request.ts
 import {
-  definePluginTool as definePluginTool4,
-  PluginToolInputError as PluginToolInputError5,
-  pluginToolOutputSchema as pluginToolOutputSchema4
+  definePluginTool as definePluginTool5,
+  PluginToolInputError as PluginToolInputError6,
+  pluginToolOutputSchema as pluginToolOutputSchema5
 } from "@sentry/junior-plugin-api";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { subscribableResourceSchema as subscribableResourceSchema4 } from "@sentry/junior-plugin-api";
-var commitShaSchema2 = z4.string().regex(/^[0-9a-f]{40}$/i);
-var inputSchema2 = z4.object({
-  repo: z4.string().describe('Repository in "owner/name" format.'),
-  number: z4.number().int().positive().describe("Pull request number.")
+var commitShaSchema2 = z5.string().regex(/^[0-9a-f]{40}$/i);
+var inputSchema3 = z5.object({
+  repo: z5.string().describe('Repository in "owner/name" format.'),
+  number: z5.number().int().positive().describe("Pull request number.")
 }).strict();
-var pullRequestSchema = z4.object({
-  base: z4.string(),
-  draft: z4.boolean(),
-  head: z4.string(),
+var pullRequestSchema = z5.object({
+  base: z5.string(),
+  draft: z5.boolean(),
+  head: z5.string(),
   headSha: commitShaSchema2,
-  merged: z4.boolean(),
-  number: z4.number(),
-  state: z4.string(),
+  merged: z5.boolean(),
+  number: z5.number(),
+  state: z5.string(),
   subscribable: subscribableResourceSchema4.optional(),
-  title: z4.string(),
-  url: z4.string()
+  title: z5.string(),
+  url: z5.string()
 });
-var outputSchema2 = pluginToolOutputSchema4.extend({
-  target: z4.literal("getPullRequest"),
+var outputSchema3 = pluginToolOutputSchema5.extend({
+  target: z5.literal("getPullRequest"),
   ...pullRequestSchema.shape
 });
-function parseRepo4(value) {
+function parseRepo5(value) {
   const parts = value.split("/").map((part) => part.trim());
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
-    throw new PluginToolInputError5('repo must use "owner/name" format');
+    throw new PluginToolInputError6('repo must use "owner/name" format');
   }
   return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
 }
@@ -1146,7 +1259,7 @@ async function readJson2(response) {
   }
 }
 function createGitHubGetPullRequestTool(ctx) {
-  return definePluginTool4({
+  return definePluginTool5({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -1154,10 +1267,10 @@ function createGitHubGetPullRequestTool(ctx) {
       readOnlyHint: true
     },
     description: "Get a GitHub pull request. Use this when an existing PR may need resource-event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
-    inputSchema: inputSchema2,
-    outputSchema: outputSchema2,
+    inputSchema: inputSchema3,
+    outputSchema: outputSchema3,
     async execute(input) {
-      const repo = parseRepo4(input.repo);
+      const repo = parseRepo5(input.repo);
       const response = await ctx.egress.fetch({
         provider: "github",
         operation: "github.pull.get",
@@ -1176,15 +1289,15 @@ function createGitHubGetPullRequestTool(ctx) {
         throw new Error(
           `GitHub pull request lookup failed with HTTP ${response.status}`
         );
-      const providerResult = z4.object({
-        base: z4.object({ ref: z4.string() }),
-        draft: z4.boolean(),
-        head: z4.object({ ref: z4.string(), sha: commitShaSchema2 }),
-        html_url: z4.string(),
-        merged: z4.boolean().optional().default(false),
-        number: z4.number(),
-        state: z4.string(),
-        title: z4.string()
+      const providerResult = z5.object({
+        base: z5.object({ ref: z5.string() }),
+        draft: z5.boolean(),
+        head: z5.object({ ref: z5.string(), sha: commitShaSchema2 }),
+        html_url: z5.string(),
+        merged: z5.boolean().optional().default(false),
+        number: z5.number(),
+        state: z5.string(),
+        title: z5.string()
       }).parse(parsed);
       const subscribable = ctx.resourceEvents.canSubscribe ? gitHubPullRequestSubscribable({
         number: providerResult.number,
@@ -1212,54 +1325,54 @@ function createGitHubGetPullRequestTool(ctx) {
 
 // src/tools/get-release.ts
 import {
-  definePluginTool as definePluginTool5,
-  PluginToolInputError as PluginToolInputError6,
-  pluginToolOutputSchema as pluginToolOutputSchema5,
+  definePluginTool as definePluginTool6,
+  PluginToolInputError as PluginToolInputError7,
+  pluginToolOutputSchema as pluginToolOutputSchema6,
   subscribableResourceSchema as subscribableResourceSchema5
 } from "@sentry/junior-plugin-api";
-import { z as z5 } from "zod";
-var inputSchema3 = z5.object({
-  repo: z5.string().describe('Repository in "owner/name" format.'),
-  tag: z5.string().trim().min(1).describe(
+import { z as z6 } from "zod";
+var inputSchema4 = z6.object({
+  repo: z6.string().describe('Repository in "owner/name" format.'),
+  tag: z6.string().trim().min(1).describe(
     "Optional release tag name. Omit to inspect and watch every published release in the repository."
   ).optional()
 }).strict();
-var releaseSchema = z5.object({
-  createdAt: z5.string(),
-  draft: z5.boolean(),
-  htmlUrl: z5.string(),
-  id: z5.number(),
-  name: z5.string().nullable(),
-  prerelease: z5.boolean(),
-  publishedAt: z5.string().nullable(),
-  tagName: z5.string(),
-  targetCommitish: z5.string()
+var releaseSchema = z6.object({
+  createdAt: z6.string(),
+  draft: z6.boolean(),
+  htmlUrl: z6.string(),
+  id: z6.number(),
+  name: z6.string().nullable(),
+  prerelease: z6.boolean(),
+  publishedAt: z6.string().nullable(),
+  tagName: z6.string(),
+  targetCommitish: z6.string()
 }).strict();
-var releaseSourceSchema = z5.object({
+var releaseSourceSchema = z6.object({
   release: releaseSchema.nullable(),
-  repo: z5.string(),
+  repo: z6.string(),
   subscribable: subscribableResourceSchema5.optional(),
-  tag: z5.string().nullable()
+  tag: z6.string().nullable()
 }).strict();
-var outputSchema3 = pluginToolOutputSchema5.extend({
-  target: z5.literal("getRelease"),
+var outputSchema4 = pluginToolOutputSchema6.extend({
+  target: z6.literal("getRelease"),
   ...releaseSourceSchema.shape
 }).strict();
-var providerReleaseSchema = z5.object({
-  created_at: z5.string(),
-  draft: z5.boolean(),
-  html_url: z5.string(),
-  id: z5.number(),
-  name: z5.string().nullable(),
-  prerelease: z5.boolean(),
-  published_at: z5.string().nullable(),
-  tag_name: z5.string(),
-  target_commitish: z5.string()
+var providerReleaseSchema = z6.object({
+  created_at: z6.string(),
+  draft: z6.boolean(),
+  html_url: z6.string(),
+  id: z6.number(),
+  name: z6.string().nullable(),
+  prerelease: z6.boolean(),
+  published_at: z6.string().nullable(),
+  tag_name: z6.string(),
+  target_commitish: z6.string()
 }).passthrough();
-function parseRepo5(value) {
+function parseRepo6(value) {
   const parts = value.split("/").map((part) => part.trim());
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
-    throw new PluginToolInputError6('repo must use "owner/name" format');
+    throw new PluginToolInputError7('repo must use "owner/name" format');
   }
   return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
 }
@@ -1289,7 +1402,7 @@ function mapRelease(providerRelease) {
   };
 }
 function createGitHubGetReleaseTool(ctx) {
-  return definePluginTool5({
+  return definePluginTool6({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -1297,10 +1410,10 @@ function createGitHubGetReleaseTool(ctx) {
       readOnlyHint: true
     },
     description: "Get a GitHub release for an exact repository, optionally limited to one tag. The result remains subscribable when no release exists yet, so use it before waiting for a published release. Omit the tag to watch every published release in the repository.",
-    inputSchema: inputSchema3,
-    outputSchema: outputSchema3,
+    inputSchema: inputSchema4,
+    outputSchema: outputSchema4,
     async execute(input) {
-      const repo = parseRepo5(input.repo);
+      const repo = parseRepo6(input.repo);
       const tag = input.tag?.trim() || void 0;
       let release = null;
       if (tag) {
@@ -1367,31 +1480,31 @@ function createGitHubGetReleaseTool(ctx) {
 
 // src/tools/get-repository.ts
 import {
-  definePluginTool as definePluginTool6,
-  PluginToolInputError as PluginToolInputError7,
-  pluginToolOutputSchema as pluginToolOutputSchema6,
+  definePluginTool as definePluginTool7,
+  PluginToolInputError as PluginToolInputError8,
+  pluginToolOutputSchema as pluginToolOutputSchema7,
   subscribableResourceSchema as subscribableResourceSchema6
 } from "@sentry/junior-plugin-api";
-import { z as z6 } from "zod";
-var inputSchema4 = z6.object({
-  repo: z6.string().describe('Repository in "owner/name" format.')
+import { z as z7 } from "zod";
+var inputSchema5 = z7.object({
+  repo: z7.string().describe('Repository in "owner/name" format.')
 }).strict();
-var repositorySchema = z6.object({
-  defaultBranch: z6.string(),
-  description: z6.string().nullable(),
-  fullName: z6.string(),
-  private: z6.boolean(),
+var repositorySchema = z7.object({
+  defaultBranch: z7.string(),
+  description: z7.string().nullable(),
+  fullName: z7.string(),
+  private: z7.boolean(),
   subscribable: subscribableResourceSchema6.optional(),
-  url: z6.string()
+  url: z7.string()
 });
-var outputSchema4 = pluginToolOutputSchema6.extend({
-  target: z6.literal("getRepository"),
+var outputSchema5 = pluginToolOutputSchema7.extend({
+  target: z7.literal("getRepository"),
   ...repositorySchema.shape
 });
-function parseRepo6(value) {
+function parseRepo7(value) {
   const parts = value.split("/").map((part) => part.trim());
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
-    throw new PluginToolInputError7('repo must use "owner/name" format');
+    throw new PluginToolInputError8('repo must use "owner/name" format');
   }
   return { owner: parts[0], name: parts[1] };
 }
@@ -1405,7 +1518,7 @@ async function readJson4(response) {
   }
 }
 function createGitHubGetRepositoryTool(ctx) {
-  return definePluginTool6({
+  return definePluginTool7({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -1413,10 +1526,10 @@ function createGitHubGetRepositoryTool(ctx) {
       readOnlyHint: true
     },
     description: "Get a GitHub repository. Use this when repository-wide issue activity may need resource-event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
-    inputSchema: inputSchema4,
-    outputSchema: outputSchema4,
+    inputSchema: inputSchema5,
+    outputSchema: outputSchema5,
     async execute(input) {
-      const repo = parseRepo6(input.repo);
+      const repo = parseRepo7(input.repo);
       const response = await ctx.egress.fetch({
         provider: "github",
         operation: "github.repository.get",
@@ -1432,16 +1545,16 @@ function createGitHubGetRepositoryTool(ctx) {
       });
       const parsed = await readJson4(response);
       if (!response.ok) {
-        throw new PluginToolInputError7(
+        throw new PluginToolInputError8(
           `GitHub repository lookup failed with HTTP ${response.status}`
         );
       }
-      const providerResult = z6.object({
-        default_branch: z6.string(),
-        description: z6.string().nullable(),
-        full_name: z6.string(),
-        html_url: z6.string(),
-        private: z6.boolean()
+      const providerResult = z7.object({
+        default_branch: z7.string(),
+        description: z7.string().nullable(),
+        full_name: z7.string(),
+        html_url: z7.string(),
+        private: z7.boolean()
       }).parse(parsed);
       const subscribable = ctx.resourceEvents.canSubscribe ? gitHubRepositorySubscribable({
         repo: providerResult.full_name
@@ -1464,49 +1577,49 @@ function createGitHubGetRepositoryTool(ctx) {
 
 // src/tools/update-pull-request.ts
 import {
-  definePluginTool as definePluginTool7,
-  PluginToolInputError as PluginToolInputError8,
-  pluginToolOutputSchema as pluginToolOutputSchema7
+  definePluginTool as definePluginTool8,
+  PluginToolInputError as PluginToolInputError9,
+  pluginToolOutputSchema as pluginToolOutputSchema8
 } from "@sentry/junior-plugin-api";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 import { subscribableResourceSchema as subscribableResourceSchema7 } from "@sentry/junior-plugin-api";
-var inputSchema5 = z7.object({
-  repo: z7.string().describe('Repository in "owner/name" format.'),
-  number: z7.number().int().positive().describe("Pull request number."),
-  title: z7.string().trim().min(1).optional().describe("Replacement pull request title."),
-  body: z7.string().optional().describe(
+var inputSchema6 = z8.object({
+  repo: z8.string().describe('Repository in "owner/name" format.'),
+  number: z8.number().int().positive().describe("Pull request number."),
+  title: z8.string().trim().min(1).optional().describe("Replacement pull request title."),
+  body: z8.string().optional().describe(
     "Replacement pull request body. Junior appends requester attribution and the conversation footer."
   ),
-  base: z7.string().trim().min(1).optional().describe("Replacement base branch."),
-  state: z7.enum(["open", "closed"]).optional().describe("Replacement pull request state.")
+  base: z8.string().trim().min(1).optional().describe("Replacement base branch."),
+  state: z8.enum(["open", "closed"]).optional().describe("Replacement pull request state.")
 }).strict().refine(
   ({ title, body, base, state }) => title !== void 0 || body !== void 0 || base !== void 0 || state !== void 0,
   { message: "At least one pull request field must be provided." }
 );
-var pullRequestSchema2 = z7.object({
-  base: z7.string(),
-  body: z7.string().nullable(),
-  draft: z7.boolean(),
-  number: z7.number(),
-  state: z7.string(),
+var pullRequestSchema2 = z8.object({
+  base: z8.string(),
+  body: z8.string().nullable(),
+  draft: z8.boolean(),
+  number: z8.number(),
+  state: z8.string(),
   subscribable: subscribableResourceSchema7.optional(),
-  title: z7.string(),
-  url: z7.string()
+  title: z8.string(),
+  url: z8.string()
 });
-var outputSchema5 = pluginToolOutputSchema7.extend({
-  target: z7.literal("updatePullRequest"),
+var outputSchema6 = pluginToolOutputSchema8.extend({
+  target: z8.literal("updatePullRequest"),
   ...pullRequestSchema2.shape
 });
 function nonEmptyString4(value, name) {
   if (!value?.trim()) {
-    throw new PluginToolInputError8(`${name} is required`);
+    throw new PluginToolInputError9(`${name} is required`);
   }
   return value.trim();
 }
-function parseRepo7(value) {
+function parseRepo8(value) {
   const parts = value.split("/").map((part) => part.trim());
   if (parts.length !== 2 || !parts[0] || !parts[1]) {
-    throw new PluginToolInputError8('repo must use "owner/name" format');
+    throw new PluginToolInputError9('repo must use "owner/name" format');
   }
   return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
 }
@@ -1528,7 +1641,7 @@ function githubApiErrorMessage3(payload) {
   return "GitHub request failed";
 }
 function createGitHubUpdatePullRequestTool(ctx) {
-  return definePluginTool7({
+  return definePluginTool8({
     annotations: {
       destructiveHint: true,
       idempotentHint: true,
@@ -1536,18 +1649,18 @@ function createGitHubUpdatePullRequestTool(ctx) {
       readOnlyHint: false
     },
     description: "Update an existing GitHub pull request's title, body, base branch, or open/closed state. Use this instead of raw GitHub API calls when changing PR metadata.",
-    inputSchema: inputSchema5,
-    outputSchema: outputSchema5,
+    inputSchema: inputSchema6,
+    outputSchema: outputSchema6,
     async execute(input) {
-      const parsedInput = inputSchema5.safeParse(input);
+      const parsedInput = inputSchema6.safeParse(input);
       if (!parsedInput.success) {
-        throw new PluginToolInputError8(
+        throw new PluginToolInputError9(
           "Invalid GitHub updatePullRequest input.",
           { cause: parsedInput.error }
         );
       }
       const update = parsedInput.data;
-      const repo = parseRepo7(update.repo);
+      const repo = parseRepo8(update.repo);
       const payload = {
         ...update.title !== void 0 ? { title: update.title } : {},
         ...update.body !== void 0 ? {
@@ -1582,14 +1695,14 @@ function createGitHubUpdatePullRequestTool(ctx) {
           `GitHub pull request update failed with HTTP ${response.status}: ${githubApiErrorMessage3(parsed)}`
         );
       }
-      const providerResult = z7.object({
-        base: z7.object({ ref: z7.string() }),
-        body: z7.string().nullable().optional().default(null),
-        draft: z7.boolean(),
-        html_url: z7.string(),
-        number: z7.number(),
-        state: z7.string(),
-        title: z7.string()
+      const providerResult = z8.object({
+        base: z8.object({ ref: z8.string() }),
+        body: z8.string().nullable().optional().default(null),
+        draft: z8.boolean(),
+        html_url: z8.string(),
+        number: z8.number(),
+        state: z8.string(),
+        title: z8.string()
       }).parse(parsed);
       const subscribable = ctx.resourceEvents.canSubscribe ? gitHubPullRequestSubscribable({
         number: providerResult.number,
@@ -1616,6 +1729,7 @@ function createGitHubUpdatePullRequestTool(ctx) {
 // src/tools.ts
 function createGitHubTools(ctx) {
   return {
+    cloneRepository: createGitHubCloneRepositoryTool(ctx),
     createIssue: createGitHubIssueTool(ctx),
     createPullRequest: createGitHubPullRequestTool(ctx),
     getDeployment: createGitHubGetDeploymentTool(ctx),
@@ -1631,7 +1745,7 @@ import { createHmac, timingSafeEqual } from "crypto";
 
 // src/issue-outcomes/store.ts
 import { and, eq, lte, sql as sql2 } from "drizzle-orm";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/db/schema.ts
 import { sql } from "drizzle-orm";
@@ -1643,18 +1757,18 @@ import {
   text,
   timestamp
 } from "drizzle-orm/pg-core";
-import { z as z8 } from "zod";
-var githubPullRequestStateSchema = z8.enum([
+import { z as z9 } from "zod";
+var githubPullRequestStateSchema = z9.enum([
   "closed_unmerged",
   "merged",
   "open"
 ]);
-var githubPullRequestCommitCompositionSchema = z8.enum([
+var githubPullRequestCommitCompositionSchema = z9.enum([
   "junior_only",
   "mixed"
 ]);
-var githubIssueStateSchema = z8.enum(["closed", "open"]);
-var githubIssueStateReasonSchema = z8.enum([
+var githubIssueStateSchema = z9.enum(["closed", "open"]);
+var githubIssueStateReasonSchema = z9.enum([
   "completed",
   "duplicate",
   "not_planned",
@@ -1723,21 +1837,21 @@ var juniorGitHubPullRequestIssues = pgTable(
 );
 
 // src/issue-outcomes/store.ts
-var githubIssueOutcomeInputSchema = z9.object({
-  candidateOwned: z9.boolean(),
-  closedAt: z9.date().optional(),
-  issueId: z9.string().min(1),
-  number: z9.number().int().positive(),
-  openedAt: z9.date(),
-  repositoryFullName: z9.string().min(1),
-  repositoryId: z9.string().min(1),
+var githubIssueOutcomeInputSchema = z10.object({
+  candidateOwned: z10.boolean(),
+  closedAt: z10.date().optional(),
+  issueId: z10.string().min(1),
+  number: z10.number().int().positive(),
+  openedAt: z10.date(),
+  repositoryFullName: z10.string().min(1),
+  repositoryId: z10.string().min(1),
   state: githubIssueStateSchema,
   stateReason: githubIssueStateReasonSchema.optional(),
-  updatedAt: z9.date()
+  updatedAt: z10.date()
 }).strict();
-var githubIssueConversationsInputSchema = z9.object({
-  conversationIds: z9.array(z9.string().min(1)).min(1),
-  issueId: z9.string().min(1)
+var githubIssueConversationsInputSchema = z10.object({
+  conversationIds: z10.array(z10.string().min(1)).min(1),
+  issueId: z10.string().min(1)
 }).strict();
 function projectionValues(input) {
   return {
@@ -1790,32 +1904,32 @@ async function recordGitHubIssueConversations(db, input) {
 
 // src/pull-request-outcomes/store.ts
 import { and as and2, eq as eq2, lte as lte2, sql as sql3 } from "drizzle-orm";
-import { z as z10 } from "zod";
-var githubPullRequestOutcomeInputSchema = z10.object({
-  candidateOwned: z10.boolean(),
-  closedAt: z10.date().optional(),
+import { z as z11 } from "zod";
+var githubPullRequestOutcomeInputSchema = z11.object({
+  candidateOwned: z11.boolean(),
+  closedAt: z11.date().optional(),
   commitComposition: githubPullRequestCommitCompositionSchema.optional(),
-  mergedAt: z10.date().optional(),
-  number: z10.number().int().positive(),
-  openedAt: z10.date(),
-  pullRequestId: z10.string().min(1),
-  repositoryFullName: z10.string().min(1),
-  repositoryId: z10.string().min(1),
+  mergedAt: z11.date().optional(),
+  number: z11.number().int().positive(),
+  openedAt: z11.date(),
+  pullRequestId: z11.string().min(1),
+  repositoryFullName: z11.string().min(1),
+  repositoryId: z11.string().min(1),
   state: githubPullRequestStateSchema,
-  updatedAt: z10.date()
+  updatedAt: z11.date()
 }).strict();
-var githubPullRequestConversationsInputSchema = z10.object({
-  conversationIds: z10.array(z10.string().min(1)).min(1),
-  pullRequestId: z10.string().min(1)
+var githubPullRequestConversationsInputSchema = z11.object({
+  conversationIds: z11.array(z11.string().min(1)).min(1),
+  pullRequestId: z11.string().min(1)
 }).strict();
-var githubPullRequestLinkedIssuesInputSchema = z10.object({
-  linkedIssues: z10.array(
-    z10.object({
-      number: z10.number().int().positive(),
-      repositoryFullName: z10.string().min(1)
+var githubPullRequestLinkedIssuesInputSchema = z11.object({
+  linkedIssues: z11.array(
+    z11.object({
+      number: z11.number().int().positive(),
+      repositoryFullName: z11.string().min(1)
     }).strict()
   ).min(1),
-  pullRequestId: z10.string().min(1)
+  pullRequestId: z11.string().min(1)
 }).strict();
 function projectionValues2(input) {
   return {
@@ -1905,7 +2019,7 @@ async function recordGitHubPullRequestLinkedIssues(db, input) {
 }
 
 // src/webhooks/issue-outcome.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/webhooks/ownership.ts
 var GITHUB_NOREPLY_DOMAIN = "users.noreply.github.com";
@@ -1922,38 +2036,38 @@ function botLoginFromEmail(value) {
 }
 
 // src/webhooks/issue-outcome.ts
-var canonicalIssueOutcomeSchema = z11.object({
-  action: z11.enum(["opened", "closed", "reopened"]),
-  issue: z11.object({
-    body: z11.string().nullable().optional(),
-    closed_at: z11.string().nullable().optional(),
-    created_at: z11.string(),
-    id: z11.number().int().positive(),
-    number: z11.number().int().positive(),
+var canonicalIssueOutcomeSchema = z12.object({
+  action: z12.enum(["opened", "closed", "reopened"]),
+  issue: z12.object({
+    body: z12.string().nullable().optional(),
+    closed_at: z12.string().nullable().optional(),
+    created_at: z12.string(),
+    id: z12.number().int().positive(),
+    number: z12.number().int().positive(),
     state_reason: githubIssueStateReasonSchema.nullable().optional(),
-    updated_at: z11.string(),
-    user: z11.object({ login: z11.string().min(1) }).strict()
+    updated_at: z12.string(),
+    user: z12.object({ login: z12.string().min(1) }).strict()
   }).strict(),
-  repository: z11.object({
-    full_name: z11.string().min(1),
-    id: z11.number().int().positive()
+  repository: z12.object({
+    full_name: z12.string().min(1),
+    id: z12.number().int().positive()
   }).strict()
 }).strict();
-var issueOutcomeSchema = z11.object({
-  action: z11.enum(["opened", "closed", "reopened"]),
-  issue: z11.object({
-    body: z11.string().nullable().optional(),
-    closed_at: z11.string().nullable().optional(),
-    created_at: z11.string(),
-    id: z11.number().int().positive(),
-    number: z11.number().int().positive(),
+var issueOutcomeSchema = z12.object({
+  action: z12.enum(["opened", "closed", "reopened"]),
+  issue: z12.object({
+    body: z12.string().nullable().optional(),
+    closed_at: z12.string().nullable().optional(),
+    created_at: z12.string(),
+    id: z12.number().int().positive(),
+    number: z12.number().int().positive(),
     state_reason: githubIssueStateReasonSchema.nullable().optional(),
-    updated_at: z11.string(),
-    user: z11.object({ login: z11.string().min(1) }).passthrough()
+    updated_at: z12.string(),
+    user: z12.object({ login: z12.string().min(1) }).passthrough()
   }).passthrough(),
-  repository: z11.object({
-    full_name: z11.string().min(1),
-    id: z11.number().int().positive()
+  repository: z12.object({
+    full_name: z12.string().min(1),
+    id: z12.number().int().positive()
   }).passthrough()
 }).passthrough().transform(
   (provider) => canonicalIssueOutcomeSchema.parse({
@@ -1974,7 +2088,7 @@ var issueOutcomeSchema = z11.object({
     }
   })
 );
-var issueLifecycleActionSchema = z11.object({ action: z11.string() }).passthrough();
+var issueLifecycleActionSchema = z12.object({ action: z12.string() }).passthrough();
 function timestamp2(value) {
   if (!value) return void 0;
   const parsed = new Date(value);
@@ -2020,21 +2134,21 @@ function normalizeGitHubIssueOutcome(args) {
     updatedAt
   };
 }
-var canonicalIssueConversationSchema = z11.object({
-  issue: z11.object({
-    body: z11.string().nullable().optional(),
-    id: z11.number().int().positive(),
-    user: z11.object({ login: z11.string().min(1) }).strict()
+var canonicalIssueConversationSchema = z12.object({
+  issue: z12.object({
+    body: z12.string().nullable().optional(),
+    id: z12.number().int().positive(),
+    user: z12.object({ login: z12.string().min(1) }).strict()
   }).strict(),
-  sender: z11.object({ login: z11.string().min(1) }).strict().optional()
+  sender: z12.object({ login: z12.string().min(1) }).strict().optional()
 }).strict();
-var issueConversationSchema = z11.object({
-  issue: z11.object({
-    body: z11.string().nullable().optional(),
-    id: z11.number().int().positive(),
-    user: z11.object({ login: z11.string().min(1) }).passthrough()
+var issueConversationSchema = z12.object({
+  issue: z12.object({
+    body: z12.string().nullable().optional(),
+    id: z12.number().int().positive(),
+    user: z12.object({ login: z12.string().min(1) }).passthrough()
   }).passthrough(),
-  sender: z11.object({ login: z11.string().min(1) }).passthrough().optional()
+  sender: z12.object({ login: z12.string().min(1) }).passthrough().optional()
 }).passthrough().transform(
   (provider) => canonicalIssueConversationSchema.parse({
     issue: {
@@ -2061,41 +2175,41 @@ function normalizeGitHubIssueConversations(args) {
 }
 
 // src/webhooks/pull-request-outcome.ts
-import { z as z12 } from "zod";
-var canonicalPullRequestOutcomeSchema = z12.object({
-  action: z12.enum(["opened", "closed", "reopened"]),
-  pull_request: z12.object({
-    body: z12.string().nullable().optional(),
-    closed_at: z12.string().nullable().optional(),
-    created_at: z12.string(),
-    id: z12.number().int().positive(),
-    merged: z12.boolean(),
-    merged_at: z12.string().nullable().optional(),
-    number: z12.number().int().positive(),
-    updated_at: z12.string(),
-    user: z12.object({ login: z12.string().min(1) }).strict()
+import { z as z13 } from "zod";
+var canonicalPullRequestOutcomeSchema = z13.object({
+  action: z13.enum(["opened", "closed", "reopened"]),
+  pull_request: z13.object({
+    body: z13.string().nullable().optional(),
+    closed_at: z13.string().nullable().optional(),
+    created_at: z13.string(),
+    id: z13.number().int().positive(),
+    merged: z13.boolean(),
+    merged_at: z13.string().nullable().optional(),
+    number: z13.number().int().positive(),
+    updated_at: z13.string(),
+    user: z13.object({ login: z13.string().min(1) }).strict()
   }).strict(),
-  repository: z12.object({
-    full_name: z12.string().min(1),
-    id: z12.number().int().positive()
+  repository: z13.object({
+    full_name: z13.string().min(1),
+    id: z13.number().int().positive()
   }).strict()
 }).strict();
-var pullRequestOutcomeSchema = z12.object({
-  action: z12.enum(["opened", "closed", "reopened"]),
-  pull_request: z12.object({
-    body: z12.string().nullable().optional(),
-    closed_at: z12.string().nullable().optional(),
-    created_at: z12.string(),
-    id: z12.number().int().positive(),
-    merged: z12.boolean(),
-    merged_at: z12.string().nullable().optional(),
-    number: z12.number().int().positive(),
-    updated_at: z12.string(),
-    user: z12.object({ login: z12.string().min(1) }).passthrough()
+var pullRequestOutcomeSchema = z13.object({
+  action: z13.enum(["opened", "closed", "reopened"]),
+  pull_request: z13.object({
+    body: z13.string().nullable().optional(),
+    closed_at: z13.string().nullable().optional(),
+    created_at: z13.string(),
+    id: z13.number().int().positive(),
+    merged: z13.boolean(),
+    merged_at: z13.string().nullable().optional(),
+    number: z13.number().int().positive(),
+    updated_at: z13.string(),
+    user: z13.object({ login: z13.string().min(1) }).passthrough()
   }).passthrough(),
-  repository: z12.object({
-    full_name: z12.string().min(1),
-    id: z12.number().int().positive()
+  repository: z13.object({
+    full_name: z13.string().min(1),
+    id: z13.number().int().positive()
   }).passthrough()
 }).passthrough().transform(
   (provider) => canonicalPullRequestOutcomeSchema.parse({
@@ -2117,24 +2231,24 @@ var pullRequestOutcomeSchema = z12.object({
     }
   })
 );
-var pullRequestLifecycleActionSchema = z12.object({ action: z12.string() }).passthrough();
-var canonicalPullRequestConversationSchema = z12.object({
-  pull_request: z12.object({
-    body: z12.string().nullable().optional(),
-    id: z12.number().int().positive(),
-    user: z12.object({ login: z12.string().min(1) }).strict()
+var pullRequestLifecycleActionSchema = z13.object({ action: z13.string() }).passthrough();
+var canonicalPullRequestConversationSchema = z13.object({
+  pull_request: z13.object({
+    body: z13.string().nullable().optional(),
+    id: z13.number().int().positive(),
+    user: z13.object({ login: z13.string().min(1) }).strict()
   }).strict(),
-  repository: z12.object({ full_name: z12.string().min(1) }).strict(),
-  sender: z12.object({ login: z12.string().min(1) }).strict()
+  repository: z13.object({ full_name: z13.string().min(1) }).strict(),
+  sender: z13.object({ login: z13.string().min(1) }).strict()
 }).strict();
-var pullRequestConversationSchema = z12.object({
-  pull_request: z12.object({
-    body: z12.string().nullable().optional(),
-    id: z12.number().int().positive(),
-    user: z12.object({ login: z12.string().min(1) }).passthrough()
+var pullRequestConversationSchema = z13.object({
+  pull_request: z13.object({
+    body: z13.string().nullable().optional(),
+    id: z13.number().int().positive(),
+    user: z13.object({ login: z13.string().min(1) }).passthrough()
   }).passthrough(),
-  repository: z12.object({ full_name: z12.string().min(1) }).passthrough(),
-  sender: z12.object({ login: z12.string().min(1) }).passthrough()
+  repository: z13.object({ full_name: z13.string().min(1) }).passthrough(),
+  sender: z13.object({ login: z13.string().min(1) }).passthrough()
 }).passthrough().transform(
   (provider) => canonicalPullRequestConversationSchema.parse({
     pull_request: {
@@ -2342,18 +2456,18 @@ function createGitHubWebhookRoute(args) {
 
 // src/outcomes/report.ts
 import { sql as sql5 } from "drizzle-orm";
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/outcomes/cost.ts
 import { sql as sql4 } from "drizzle-orm";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var DAY_MS = 24 * 60 * 60 * 1e3;
-var costWindowSchema = z13.object({
-  days: z13.number().int().positive(),
-  issueCostUsd: z13.number().nonnegative().nullable(),
-  medianIssueCostUsd: z13.number().nonnegative().nullable(),
-  medianPullRequestCostUsd: z13.number().nonnegative().nullable(),
-  pullRequestCostUsd: z13.number().nonnegative().nullable()
+var costWindowSchema = z14.object({
+  days: z14.number().int().positive(),
+  issueCostUsd: z14.number().nonnegative().nullable(),
+  medianIssueCostUsd: z14.number().nonnegative().nullable(),
+  medianPullRequestCostUsd: z14.number().nonnegative().nullable(),
+  pullRequestCostUsd: z14.number().nonnegative().nullable()
 }).strict().transform((row) => ({
   days: row.days,
   issueCostUsd: row.issueCostUsd ?? void 0,
@@ -2361,12 +2475,12 @@ var costWindowSchema = z13.object({
   medianPullRequestCostUsd: row.medianPullRequestCostUsd ?? void 0,
   pullRequestCostUsd: row.pullRequestCostUsd ?? void 0
 }));
-var repositoryCostSchema = z13.object({
-  issueCostUsd: z13.number().nonnegative().nullable(),
-  medianIssueCostUsd: z13.number().nonnegative().nullable(),
-  medianPullRequestCostUsd: z13.number().nonnegative().nullable(),
-  pullRequestCostUsd: z13.number().nonnegative().nullable(),
-  repository: z13.string().min(1)
+var repositoryCostSchema = z14.object({
+  issueCostUsd: z14.number().nonnegative().nullable(),
+  medianIssueCostUsd: z14.number().nonnegative().nullable(),
+  medianPullRequestCostUsd: z14.number().nonnegative().nullable(),
+  pullRequestCostUsd: z14.number().nonnegative().nullable(),
+  repository: z14.string().min(1)
 }).strict().transform((row) => ({
   issueCostUsd: row.issueCostUsd ?? void 0,
   medianIssueCostUsd: row.medianIssueCostUsd ?? void 0,
@@ -2571,7 +2685,7 @@ async function aggregateGitHubCostWindows(args) {
     INNER JOIN issue_window ON issue_window.days = pull_request_window.days
     ORDER BY pull_request_window.days
   `);
-  return z13.array(costWindowSchema).parse(queryRows(result));
+  return z14.array(costWindowSchema).parse(queryRows(result));
 }
 async function aggregateGitHubRepositoryCosts(args) {
   if (!await hasConversationUsageTable(args.db)) {
@@ -2669,7 +2783,7 @@ async function aggregateGitHubRepositoryCosts(args) {
       ON issue_totals.repository = repositories.repository
     ORDER BY "repository" ASC
   `);
-  return z13.array(repositoryCostSchema).parse(queryRows(result));
+  return z14.array(repositoryCostSchema).parse(queryRows(result));
 }
 function formatCostUsd(value) {
   if (value === void 0) return "\u2014";
@@ -2684,12 +2798,12 @@ function formatCostUsd(value) {
 // src/outcomes/report.ts
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
 var WINDOWS = [7, 30, 90];
-var pullRequestStatsSchema = z14.object({
-  closed: z14.number().int().nonnegative(),
-  created: z14.number().int().nonnegative(),
-  days: z14.number().int().positive(),
-  medianMergeTimeMs: z14.number().nonnegative().nullable(),
-  merged: z14.number().int().nonnegative()
+var pullRequestStatsSchema = z15.object({
+  closed: z15.number().int().nonnegative(),
+  created: z15.number().int().nonnegative(),
+  days: z15.number().int().positive(),
+  medianMergeTimeMs: z15.number().nonnegative().nullable(),
+  merged: z15.number().int().nonnegative()
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   return {
@@ -2698,12 +2812,12 @@ var pullRequestStatsSchema = z14.object({
     mergeRate: terminal > 0 ? row.merged / terminal : void 0
   };
 });
-var pullRequestRepositoryStatsSchema = z14.object({
-  closed: z14.number().int().nonnegative(),
-  created: z14.number().int().nonnegative(),
-  juniorOnly: z14.number().int().nonnegative(),
-  merged: z14.number().int().nonnegative(),
-  repository: z14.string().min(1)
+var pullRequestRepositoryStatsSchema = z15.object({
+  closed: z15.number().int().nonnegative(),
+  created: z15.number().int().nonnegative(),
+  juniorOnly: z15.number().int().nonnegative(),
+  merged: z15.number().int().nonnegative(),
+  repository: z15.string().min(1)
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   return {
@@ -2711,33 +2825,33 @@ var pullRequestRepositoryStatsSchema = z14.object({
     mergeRate: terminal > 0 ? row.merged / terminal : void 0
   };
 });
-var issueStatsSchema = z14.object({
-  closedCompleted: z14.number().int().nonnegative(),
-  closedDuplicate: z14.number().int().nonnegative(),
-  closedNotPlanned: z14.number().int().nonnegative(),
-  closedUnknown: z14.number().int().nonnegative(),
-  created: z14.number().int().nonnegative(),
-  days: z14.number().int().positive(),
-  medianCloseTimeMs: z14.number().nonnegative().nullable()
+var issueStatsSchema = z15.object({
+  closedCompleted: z15.number().int().nonnegative(),
+  closedDuplicate: z15.number().int().nonnegative(),
+  closedNotPlanned: z15.number().int().nonnegative(),
+  closedUnknown: z15.number().int().nonnegative(),
+  created: z15.number().int().nonnegative(),
+  days: z15.number().int().positive(),
+  medianCloseTimeMs: z15.number().nonnegative().nullable()
 }).strict().transform((row) => ({
   ...row,
   medianCloseTimeMs: row.medianCloseTimeMs ?? void 0
 }));
-var pullRequestDaySchema = z14.object({
-  created: z14.number().int().nonnegative(),
-  date: z14.string().date()
+var pullRequestDaySchema = z15.object({
+  created: z15.number().int().nonnegative(),
+  date: z15.string().date()
 }).strict();
-var issueDaySchema = z14.object({
-  created: z14.number().int().nonnegative(),
-  date: z14.string().date()
+var issueDaySchema = z15.object({
+  created: z15.number().int().nonnegative(),
+  date: z15.string().date()
 }).strict();
-var issueRepositoryStatsSchema = z14.object({
-  closedCompleted: z14.number().int().nonnegative(),
-  closedDuplicate: z14.number().int().nonnegative(),
-  closedNotPlanned: z14.number().int().nonnegative(),
-  closedUnknown: z14.number().int().nonnegative(),
-  created: z14.number().int().nonnegative(),
-  repository: z14.string().min(1)
+var issueRepositoryStatsSchema = z15.object({
+  closedCompleted: z15.number().int().nonnegative(),
+  closedDuplicate: z15.number().int().nonnegative(),
+  closedNotPlanned: z15.number().int().nonnegative(),
+  closedUnknown: z15.number().int().nonnegative(),
+  created: z15.number().int().nonnegative(),
+  repository: z15.string().min(1)
 }).strict();
 function queryRows2(result) {
   if (typeof result !== "object" || result === null || !("rows" in result) || !Array.isArray(result.rows)) {
@@ -2801,7 +2915,7 @@ async function aggregatePullRequestWindows(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z14.array(pullRequestStatsSchema).parse(queryRows2(result));
+  return z15.array(pullRequestStatsSchema).parse(queryRows2(result));
 }
 async function aggregatePullRequestDays(args) {
   const end = new Date(args.nowMs);
@@ -2829,7 +2943,7 @@ async function aggregatePullRequestDays(args) {
     LEFT JOIN daily ON daily.day = days.day
     ORDER BY days.day
   `);
-  return z14.array(pullRequestDaySchema).parse(queryRows2(result));
+  return z15.array(pullRequestDaySchema).parse(queryRows2(result));
 }
 async function aggregatePullRequestRepositories(args) {
   const start = new Date(args.nowMs - 30 * DAY_MS2);
@@ -2859,7 +2973,7 @@ async function aggregatePullRequestRepositories(args) {
     ORDER BY "merged" DESC, "created" DESC, "repository" ASC
     LIMIT 25
   `);
-  return z14.array(pullRequestRepositoryStatsSchema).parse(queryRows2(result));
+  return z15.array(pullRequestRepositoryStatsSchema).parse(queryRows2(result));
 }
 async function aggregateIssueWindows(args) {
   const starts = WINDOWS.map(
@@ -2928,7 +3042,7 @@ async function aggregateIssueWindows(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z14.array(issueStatsSchema).parse(queryRows2(result));
+  return z15.array(issueStatsSchema).parse(queryRows2(result));
 }
 async function aggregateIssueDays(args) {
   const end = new Date(args.nowMs);
@@ -2956,7 +3070,7 @@ async function aggregateIssueDays(args) {
     LEFT JOIN daily ON daily.day = days.day
     ORDER BY days.day
   `);
-  return z14.array(issueDaySchema).parse(queryRows2(result));
+  return z15.array(issueDaySchema).parse(queryRows2(result));
 }
 async function aggregateIssueRepositories(args) {
   const start = new Date(args.nowMs - 30 * DAY_MS2);
@@ -2993,7 +3107,7 @@ async function aggregateIssueRepositories(args) {
     ORDER BY "created" DESC, "closedCompleted" DESC, "repository" ASC
     LIMIT 25
   `);
-  return z14.array(issueRepositoryStatsSchema).parse(queryRows2(result));
+  return z15.array(issueRepositoryStatsSchema).parse(queryRows2(result));
 }
 function formatPercent(value) {
   return value === void 0 ? "\u2014" : `${Math.round(value * 100)}%`;
@@ -3157,18 +3271,18 @@ async function buildGitHubOutcomeReport(args) {
 }
 
 // src/pull-request-outcomes/commit-composition.ts
-import { z as z15 } from "zod";
-var canonicalCommitSchema = z15.object({
-  authorEmail: z15.string().nullable(),
-  authorLogin: z15.string().nullable()
+import { z as z16 } from "zod";
+var canonicalCommitSchema = z16.object({
+  authorEmail: z16.string().nullable(),
+  authorLogin: z16.string().nullable()
 }).strict();
-var providerCommitSchema = z15.object({
-  author: z15.object({ login: z15.string() }).passthrough().nullable(),
-  commit: z15.object({
-    author: z15.object({ email: z15.string() }).passthrough().nullable()
+var providerCommitSchema = z16.object({
+  author: z16.object({ login: z16.string() }).passthrough().nullable(),
+  commit: z16.object({
+    author: z16.object({ email: z16.string() }).passthrough().nullable()
   }).passthrough()
 }).passthrough();
-var commitPageSchema = z15.array(providerCommitSchema).transform(
+var commitPageSchema = z16.array(providerCommitSchema).transform(
   (commits) => commits.map(
     (commit) => canonicalCommitSchema.parse({
       authorEmail: commit.commit.author?.email ?? null,
@@ -4192,10 +4306,18 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   if ((method === "POST" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/requested_reviewers$/.test(pathname)) {
     return "installation-write";
   }
+  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/comments(?:\/[^/]+\/replies)?$/.test(
+    pathname
+  )) {
+    return "installation-write";
+  }
+  if ((method === "PATCH" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/pulls\/comments\/[^/]+$/.test(pathname)) {
+    return "installation-write";
+  }
   if (/^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/reviews(?:\/[^/]+(?:\/(events|dismissals))?)?$/.test(
     pathname
   ) && !HTTP_READ_METHODS.has(method)) {
-    return "user-write";
+    return "installation-write";
   }
   return void 0;
 }