@sentry/junior-github 0.157.0 → 0.159.0

package/dist/index.js

@@ -20,7 +20,8 @@ import {
 // src/plugin.ts
 import {
   defineJuniorPlugin,
-  EgressPolicyDenied as EgressPolicyDenied2
+  EgressPolicyDenied as EgressPolicyDenied2,
+  enforceEgressPolicy
 } from "@sentry/junior-plugin-api";
 
 // src/permissions.ts
@@ -4638,6 +4639,36 @@ function shouldInspectGitHubGraphqlResponse(ctx) {
   const contentType = ctx.response.headers.get("content-type");
   return contentType ? /\bjson\b/i.test(contentType) : false;
 }
+var GITHUB_BODY_WRITES = [
+  {
+    denialMessage: `GitHub issue creation must use the github_createIssue tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "createIssue",
+    method: "POST",
+    operation: "github.issue.create",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/issues$/
+  },
+  {
+    denialMessage: `GitHub pull request creation must use the github_createPullRequest tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "createPullRequest",
+    method: "POST",
+    operation: "github.pull.create",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/pulls$/
+  },
+  {
+    denialMessage: `GitHub issue updates must use the github_updateIssue tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "updateIssue",
+    method: "PATCH",
+    operation: "github.issue.update",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+$/
+  },
+  {
+    denialMessage: `GitHub pull request updates must use the github_updatePullRequest tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "updatePullRequest",
+    method: "PATCH",
+    operation: "github.pull.update",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+$/
+  }
+];
 function githubApiWriteGrantName(method, upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
   if (!isGitHubApiUrl2(upstreamUrl)) {
@@ -4653,26 +4684,19 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   ) || /^\/repos\/[^/]+\/[^/]+\/actions\/jobs\/[^/]+\/rerun$/.test(pathname))) {
     return "installation-write";
   }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(pathname)) {
+  if (GITHUB_BODY_WRITES.some(
+    (write) => write.method === method && write.restPath.test(pathname)
+  )) {
     return "installation-write";
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+\/comments$/.test(pathname)) {
     return "installation-write";
   }
-  if (method === "PATCH" && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+$/.test(pathname)) {
-    return "installation-write";
-  }
   if ((method === "POST" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+\/(labels|assignees)(?:\/[^/]+)?$/.test(
     pathname
   )) {
     return "installation-write";
   }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(pathname)) {
-    return "installation-write";
-  }
-  if (method === "PATCH" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+$/.test(pathname)) {
-    return "installation-write";
-  }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/ready_for_review$/.test(pathname)) {
     return "installation-write";
   }
@@ -4694,17 +4718,6 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   }
   return void 0;
 }
-function isGitHubIssueCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(upstreamUrl.pathname.toLowerCase());
-}
-function isGitHubPullCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(upstreamUrl.pathname.toLowerCase());
-}
-function isGitHubResourceUpdateRestRequest(method, upstreamUrl, resource) {
-  return method === "PATCH" && isGitHubApiUrl2(upstreamUrl) && new RegExp(`^/repos/[^/]+/[^/]+/${resource}/[^/]+$`).test(
-    upstreamUrl.pathname.toLowerCase()
-  );
-}
 function isGitHubGraphqlMutation(method, upstreamUrl, bodyText, field) {
   if (method !== "POST" || !isGitHubGraphqlUrl(upstreamUrl)) return false;
   const parsed = parseGitHubGraphqlRequest(bodyText);
@@ -4716,64 +4729,26 @@ function isGitHubGraphqlMutation(method, upstreamUrl, bodyText, field) {
     `\\bmutation\\s+${escapeRegExp2(parsed.operationName)}\\b`
   ).test(parsed.normalized);
 }
-function assertGitHubWriteAllowed(input) {
+function applyGitHubEgressPolicy(input) {
   assertGitHubPullRequestApprovalDenied({
     ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
     method: input.method,
     upstreamUrl: input.upstreamUrl
   });
-  if (input.operation === "github.issue.create") return;
-  if (input.operation === "github.issue.update") return;
-  if (input.operation === "github.pull.create") return;
-  if (input.operation === "github.pull.update") return;
-  if (isGitHubIssueCreateRestRequest(input.method, input.upstreamUrl) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "createIssue"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub issue creation must use the github_createIssue tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
-  if (isGitHubPullCreateRestRequest(input.method, input.upstreamUrl) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "createPullRequest"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub pull request creation must use the github_createPullRequest tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
-  if (isGitHubResourceUpdateRestRequest(
-    input.method,
-    input.upstreamUrl,
-    "issues"
-  ) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "updateIssue"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub issue updates must use the github_updateIssue tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
-  if (isGitHubResourceUpdateRestRequest(
-    input.method,
-    input.upstreamUrl,
-    "pulls"
-  ) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "updatePullRequest"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub pull request updates must use the github_updatePullRequest tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
+  const pathname = input.upstreamUrl.pathname.toLowerCase();
+  const write = GITHUB_BODY_WRITES.find(
+    (candidate) => candidate.method === input.method && isGitHubApiUrl2(input.upstreamUrl) && candidate.restPath.test(pathname) || isGitHubGraphqlMutation(
+      input.method,
+      input.upstreamUrl,
+      input.bodyText,
+      candidate.graphqlField
+    )
+  );
+  if (!write) return;
+  enforceEgressPolicy({
+    allowed: input.operation === write.operation,
+    denialMessage: write.denialMessage
+  });
 }
 function grantForAccess(access, reason, name, leaseScope) {
   return {
@@ -4796,7 +4771,7 @@ function repositoryLeaseScope(upstreamUrl) {
 async function githubGrantForEgress(ctx) {
   const method = ctx.request.method.toUpperCase();
   const upstreamUrl = new URL(ctx.request.url);
-  assertGitHubWriteAllowed({
+  applyGitHubEgressPolicy({
     ...ctx.request.bodyText !== void 0 ? { bodyText: ctx.request.bodyText } : {},
     method,
     ...ctx.request.operation ? { operation: ctx.request.operation } : {},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.157.0",
+  "version": "0.159.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.157.0"
+    "@sentry/junior-plugin-api": "0.159.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/github-code/SKILL.md

@@ -81,3 +81,5 @@ If PR creation or update is blocked, report the exact failed command/tool call a
 When PR creation returns a subscribable resource hint, subscribe to suggested review/CI events. Report only actionable feedback addressed, build failures fixed, fully green/ready state, or merge.
 
 Return: repo, branch, PR URL/number, checks and results, pre-existing failures, and anything not run with the reason.
+
+When you mention a pull request in a user-facing reply, always include a direct link. Prefer the full PR URL or a Markdown link such as `[#123](https://github.com/owner/repo/pull/123)`. `owner/repo#number` is also fine. Do not leave bare `PR #123` text without a URL or repo.