@sentry/junior-github 0.155.0 → 0.157.0

package/dist/pull-request-outcomes/store.d.ts

@@ -48,6 +48,10 @@ export declare function recordGitHubPullRequestOutcome(db: GitHubDb, input: GitH
 }>;
 /** Return candidate conversations that have an associated unmerged pull request. */
 export declare function listGitHubUnfinishedWork(db: GitHubDb, conversationIds: string[]): Promise<string[]>;
+/** Return the latest merge time for each candidate conversation. */
+export declare function listGitHubFinishedWork(db: GitHubDb, conversationIds: string[]): Promise<Record<string, string>>;
+/** Return candidate conversations linked to any Junior-owned pull request. */
+export declare function listGitHubAssignedWork(db: GitHubDb, conversationIds: string[]): Promise<string[]>;
 /** Append native conversation ids to an existing Junior-owned PR projection. */
 export declare function recordGitHubPullRequestConversations(db: GitHubDb, input: GitHubPullRequestConversationsInput): Promise<boolean>;
 /** Link an existing Junior-owned PR to tracked issues across repositories. */

package/dist/pull-request-review-policy.d.ts

@@ -0,0 +1,6 @@
+/** Deny APPROVE while allowing change requests, comments, and dismissals. */
+export declare function assertGitHubPullRequestApprovalDenied(input: {
+    bodyText?: string;
+    method: string;
+    upstreamUrl: URL;
+}): void;

package/dist/tools/update-issue.d.ts

@@ -0,0 +1,51 @@
+import { type ToolRegistrationHookContext } from "@sentry/junior-plugin-api";
+/** Update mutable issue metadata while preserving Junior-owned body attribution. */
+export declare function createGitHubUpdateIssueTool(ctx: ToolRegistrationHookContext): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    repo: string;
+    number: number;
+    title?: string | undefined;
+    body?: string | undefined;
+    state?: "open" | "closed" | undefined;
+}, {
+    [x: string]: unknown;
+    body: string | null;
+    number: number;
+    state: string;
+    title: string;
+    url: string;
+    target: "updateIssue";
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+    subscribable?: {
+        identifier: string;
+        label: string;
+        namespace: string;
+        supportedEvents: string[];
+        type: string;
+        suggestedEvents?: string[] | undefined;
+    } | undefined;
+}, {
+    [x: string]: unknown;
+    body: string | null;
+    number: number;
+    state: string;
+    title: string;
+    url: string;
+    target: "updateIssue";
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+    subscribable?: {
+        identifier: string;
+        label: string;
+        namespace: string;
+        supportedEvents: string[];
+        type: string;
+        suggestedEvents?: string[] | undefined;
+    } | undefined;
+}>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.155.0",
+  "version": "0.157.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.155.0"
+    "@sentry/junior-plugin-api": "0.157.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/github-code/SKILL.md

@@ -5,7 +5,7 @@ description: Work with GitHub repositories, source code, branches, commits, pull
 
 # GitHub Code Operations
 
-Use `git` and `gh` for repository work. Use `github_createPullRequest`, not `gh pr create`, for new PRs.
+Use `git` and `gh` for repository work. Use `github_createPullRequest`, not `gh pr create`, for new PRs. Use `github_updatePullRequest`, not raw `gh api`/`gh pr edit`, when changing PR title, body, base, or open/closed state.
 
 ## References
 
@@ -64,7 +64,7 @@ Unless the user explicitly says not to create a PR, every completed repository e
 2. Commit using repo conventions; otherwise use `<type>(<scope>): <Subject>` in imperative present tense, with no agent branding.
 3. Push explicitly with `git push -u origin BRANCH`.
 4. Resolve the actual default branch.
-5. Reuse and update an existing PR for the branch; otherwise call `github_createPullRequest` with explicit repo, head, base, title, body, and `draft: true` unless the user or repo explicitly requires ready-for-review.
+5. Reuse and update an existing PR for the branch with `github_updatePullRequest`; otherwise call `github_createPullRequest` with explicit repo, head, base, title, body, and `draft: true` unless the user or repo explicitly requires ready-for-review.
 
 PR titles use the same conventional form as commits: `<type>(<scope>): <Subject>` or `<type>: <Subject>`. Match the current dominant change, not the latest commit or a stale title.
 
@@ -72,9 +72,9 @@ Write the PR body for a reviewer who knows the product but not this change. Use
 
 Explain what this PR changes and why it matters. Add only context the diff cannot show. Keep the body short by default; add structure only when it helps. Omit empty or `N/A` sections, file-by-file narration, copied commit logs, and redundant diff summaries.
 
-Treat the current title, body, and commit messages as fallible context. After material follow-up commits, re-check the title and rewrite the body against the current diff. Never include customer data, PII, secrets, or sensitive thread context, especially in public repositories. Resolve requested assignee/reviewer handles from evidence; skip unconfirmed identities.
+Treat the current title, body, and commit messages as fallible context. After material follow-up commits, re-check the title and rewrite the body against the current diff with `github_updatePullRequest`. Never include customer data, PII, secrets, or sensitive thread context, especially in public repositories. Resolve requested assignee/reviewer handles from evidence; skip unconfirmed identities.
 
-If PR creation is blocked, report the exact failed command/tool call and leave the committed branch intact.
+If PR creation or update is blocked, report the exact failed command/tool call and leave the committed branch intact.
 
 ### 6. Follow and report
 

package/skills/github-code/references/api-surface.md

@@ -1,6 +1,6 @@
 # GitHub API Surface — code & pull requests
 
-PR creation uses Junior's `github_createPullRequest` tool. Supported mutations use allowlisted REST endpoints through `gh api`; generic GraphQL-backed `gh pr` mutations are not supported.
+PR creation uses Junior's `github_createPullRequest` tool. PR title, body, base, and open/closed state updates use `github_updatePullRequest` so Junior keeps requester attribution and the conversation footer. Other supported mutations use allowlisted REST endpoints through `gh api`; generic GraphQL-backed `gh pr` mutations are not supported.
 
 ## Repo scoping
 
@@ -42,11 +42,11 @@ Treat explicit repo flags as command-targeting safety rails, not as a credential
 | Rerun workflow job                 | `gh run rerun --job JOB_ID -R owner/repo`                                                                               |
 | Cancel workflow run                | `gh run cancel RUN_ID -R owner/repo`                                                                                     |
 | Create pull request (draft)        | `github_createPullRequest({ repo: "owner/repo", head: "BRANCH", base: "BASE", title: "...", body: "...", draft: true })` |
-| Update pull request                | `gh api repos/owner/repo/pulls/NUMBER --method PATCH --input payload.json`                                               |
+| Update pull request                | `github_updatePullRequest({ repo: "owner/repo", number: NUMBER, title?: "...", body?: "...", base?: "BASE", state?: "open" \| "closed" })` |
 | Mark ready for review              | `gh api repos/owner/repo/pulls/NUMBER/ready_for_review --method POST`                                                    |
 | Request reviewers                  | `gh api repos/owner/repo/pulls/NUMBER/requested_reviewers --method POST --input reviewers.json`                          |
 | Remove requested reviewers         | `gh api repos/owner/repo/pulls/NUMBER/requested_reviewers --method DELETE --input reviewers.json`                        |
-| Close pull request                 | `gh api repos/owner/repo/pulls/NUMBER --method PATCH -f state=closed`                                                    |
+| Close pull request                 | `github_updatePullRequest({ repo: "owner/repo", number: NUMBER, state: "closed" })`                                      |
 | Submit pull request review         | `gh api repos/owner/repo/pulls/NUMBER/reviews --method POST --input review.json`                                         |
 | Post inline review comment         | `gh api repos/owner/repo/pulls/NUMBER/comments --method POST --input comment.json`                                       |
 | Reply to inline review comment     | `gh api repos/owner/repo/pulls/NUMBER/comments/COMMENT_ID/replies --method POST --input reply.json`                      |
@@ -75,6 +75,7 @@ jr-rpc config set github.repo owner/repo
 - If the commit changes workflow files under `.github/workflows`, the App installation needs Workflows write in addition to Contents write.
 - Before rebasing, merge-base analysis, blame/history inspection, or a base comparison, check whether the repository is shallow. Fetch a bounded depth of the base into `refs/remotes/origin/BASE`, deepen incrementally until the needed ancestry is present, and compare against `origin/BASE`; use `--unshallow` only when bounded deepening is insufficient. Never force-push to work around missing ancestry.
 - Before `github_createPullRequest`, push the head branch explicitly and resolve the target repo's default branch for `base`. That push requires GitHub write access to the remote.
+- Use `github_updatePullRequest` for title, body, base, or open/closed state changes. Do not raw-`PATCH` `/repos/.../pulls/NUMBER`; that path is denied so Junior can keep the conversation footer.
 - Merge, fork creation, REST contents/Git database writes, and repository administration are outside the current write allowlist.
 - Pull request reviews and inline review comments use the same repository-scoped `installation-write` credential as other bot-owned PR writes, so they post as Junior even on headless turns. Merge remains denied.
 - If the explicit `git push` fails with 401/403 or another access/permission error, verify the repo context and retry once. If it still fails, load troubleshooting guidance and report the exact command failure.

package/skills/github-code/references/troubleshooting-workarounds.md

@@ -18,6 +18,8 @@ Use this table to recover quickly while keeping operations deterministic.
 | `github_createPullRequest` returns upstream 401/403                                | The App installation or target repository does not permit the operation.            | Use the structured upstream denial to verify installation scope and accepted permissions; do not request user OAuth for this bot-owned operation.                                                      |
 | `github_createPullRequest` returns 422 for `head`                                  | The head branch was not pushed or the explicit head ref is wrong.                   | Push the branch, then retry with explicit `repo`, `head`, and `base` values.                                                                                                                           |
 | `github_createPullRequest` fails with 422 validation on `base`                     | The `base` branch does not exist in the target repo.                                | Resolve the default branch with `gh repo view owner/repo --json defaultBranchRef --jq .defaultBranchRef.name`, then retry with that value as `base`.                                                   |
+| `403` names `github_updatePullRequest`                                             | Raw PR title/body/base/state PATCH was blocked so Junior can own the footer.        | Retry with `github_updatePullRequest`; do not use `gh api .../pulls/NUMBER --method PATCH` or `gh pr edit`.                                                                                            |
+| `github_updatePullRequest` returns upstream 401/403                                | The App installation or target repository does not permit the operation.            | Use the structured upstream denial to verify installation scope and accepted permissions; do not request user OAuth for this bot-owned operation.                                                      |
 | `git blame`, long log history, or old commits are missing after clone              | Repo was cloned shallow by design.                                                  | Fetch the required ref and deepen it incrementally; use `--unshallow` only when bounded deepening is insufficient.                                                                                     |
 | Rebase, merge-base, or `origin/BASE...HEAD` comparison fails or gives odd ancestry | Required ancestry or the remote-tracking base ref is absent from the shallow clone. | Fetch a bounded depth into `BASE:refs/remotes/origin/BASE`, deepen that base ref until the merge base exists, and compare or rebase against `origin/BASE`. Never force-push around incomplete history. |
 | Tests fail because dependencies or executables are missing                         | Repository dependencies were not installed.                                         | Detect the lockfile and run the repo-native frozen/immutable install. Do not rewrite the lockfile unless dependency changes are part of the task.                                                      |

package/skills/github-issues/SKILL.md

@@ -5,7 +5,7 @@ description: Create, update, comment on, label, and inspect GitHub issues with c
 
 # GitHub Issue Operations
 
-Issue create via Junior's `github_createIssue` tool; update, comment, label, state, and inspection via `gh` CLI.
+Create issues with `github_createIssue`. Update issue title, body, or state with `github_updateIssue`. Use `gh` for comments, labels, and inspection.
 Use only for GitHub issues. For pull requests, branches, pushes, or PR creation order questions, load `github-code` instead.
 
 ## Reference loading
@@ -93,7 +93,8 @@ Run [references/issue-quality-checklist.md](references/issue-quality-checklist.m
 ### 5. Execute
 
 - Use `github_createIssue` for new issues so Junior owns idempotency and session-link footers.
-- Use `gh issue` commands from [references/api-surface.md](references/api-surface.md) for non-create operations.
+- Use `github_updateIssue` for issue title, body, or state changes so Junior preserves requester attribution and the session footer.
+- Use `gh` commands from [references/api-surface.md](references/api-surface.md) for comments, labels, assignees, and read-only operations.
 - For issue listing or other read-only inspection, prefer `--json` output so empty results still produce deterministic stdout.
 - Check duplicates silently before creating a new issue. Do not mention this check in the final reply unless a duplicate blocks creation.
 

package/skills/github-issues/references/api-surface.md

@@ -1,6 +1,6 @@
 # GitHub Issue API Surface
 
-Issue creation uses Junior's `github_createIssue` tool. Other issue operations use allowlisted REST endpoints through `gh api`; generic GraphQL-backed `gh issue` mutations are not supported.
+Issue creation uses `github_createIssue`. Issue title, body, and state updates use `github_updateIssue` so Junior keeps requester attribution and the conversation footer. Comments, labels, assignees, and reads use allowlisted REST endpoints through `gh api`; generic GraphQL-backed `gh issue` mutations are not supported.
 
 ## Repo scoping
 
@@ -13,18 +13,20 @@ Treat explicit repo flags as command-targeting safety rails, not as a credential
 | Permission capability | Operations                                                                           |
 | --------------------- | ------------------------------------------------------------------------------------ |
 | `github.issues.read`  | `gh issue view`, `gh api /repos/.../comments`                                        |
-| `github.issues.write` | `github_createIssue` and allowlisted REST issue lifecycle endpoints through `gh api` |
+| `github.issues.write` | Typed issue create/update tools and allowlisted comment, label, or assignee endpoints through `gh api` |
 
 ## Command matrix
 
 | Operation           | Command                                                                                                       |
 | ------------------- | ------------------------------------------------------------------------------------------------------------- |
 | Create issue        | `github_createIssue({ repo: "owner/repo", title: "...", body: "...", labels: ["..."] })`                      |
-| Update issue fields | `gh api repos/owner/repo/issues/NUMBER --method PATCH --input payload.json`                                   |
-| Close issue         | `gh api repos/owner/repo/issues/NUMBER --method PATCH -f state=closed`                                        |
-| Reopen issue        | `gh api repos/owner/repo/issues/NUMBER --method PATCH -f state=open`                                          |
+| Update issue fields | `github_updateIssue({ repo: "owner/repo", number: NUMBER, title?: "...", body?: "...", state?: "open" \| "closed" })` |
+| Close issue         | `github_updateIssue({ repo: "owner/repo", number: NUMBER, state: "closed" })`                              |
+| Reopen issue        | `github_updateIssue({ repo: "owner/repo", number: NUMBER, state: "open" })`                                |
 | Add labels          | `gh api repos/owner/repo/issues/NUMBER/labels --method POST --input labels.json`                              |
 | Remove label        | `gh api repos/owner/repo/issues/NUMBER/labels/LABEL --method DELETE`                                          |
+| Add assignees       | `gh api repos/owner/repo/issues/NUMBER/assignees --method POST --input assignees.json`                        |
+| Remove assignees    | `gh api repos/owner/repo/issues/NUMBER/assignees --method DELETE --input assignees.json`                      |
 | Add comment         | `gh api repos/owner/repo/issues/NUMBER/comments --method POST --input comment.json`                           |
 | List issues         | `gh issue list --repo owner/repo --json number,title,state,url --limit 20`                                    |
 | Read issue          | `gh issue view NUMBER --repo owner/repo --json number,title,state,labels,assignees,author,url,body`           |
@@ -42,5 +44,7 @@ jr-rpc config set github.repo owner/repo
 - Prefer `--json` output for machine-readable parsing where available.
 - Use `gh api` for endpoints not fully covered by `gh issue` subcommands.
 - For creation, call `github_createIssue` directly instead of shelling out to `gh issue create`.
+- Use `github_updateIssue` for title, body, or state changes. Raw issue PATCH is denied because GitHub also uses that endpoint for pull requests.
+- Use the dedicated assignees endpoint for assignment changes. Do not send `assignees` through `github_updateIssue`.
 - Keep `--repo owner/repo` explicit when working across repositories.
 - Return actionable errors for access, permission, not-found, and validation failures.