@sentry/junior-github 0.158.0 → 0.160.0

package/dist/index.js

@@ -20,7 +20,8 @@ import {
 // src/plugin.ts
 import {
   defineJuniorPlugin,
-  EgressPolicyDenied as EgressPolicyDenied2
+  EgressPolicyDenied as EgressPolicyDenied2,
+  enforceEgressPolicy
 } from "@sentry/junior-plugin-api";
 
 // src/permissions.ts
@@ -2694,19 +2695,30 @@ async function recordGitHubIssueOutcome(db, input) {
   const outcome = githubIssueOutcomeInputSchema.parse(input);
   const values = projectionValues(outcome);
   if (!outcome.candidateOwned) {
-    await db.update(juniorGitHubIssues).set(values).where(
+    const updated = await db.update(juniorGitHubIssues).set(values).where(
       and(
         eq(juniorGitHubIssues.issueId, outcome.issueId),
         lte(juniorGitHubIssues.updatedAt, outcome.updatedAt)
       )
-    );
-    return;
+    ).returning({
+      conversationIds: juniorGitHubIssues.conversationIds
+    });
+    return {
+      applied: updated.length > 0,
+      conversationIds: updated[0]?.conversationIds ?? []
+    };
   }
-  await db.insert(juniorGitHubIssues).values({ issueId: outcome.issueId, ...values }).onConflictDoUpdate({
+  const inserted = await db.insert(juniorGitHubIssues).values({ issueId: outcome.issueId, ...values }).onConflictDoUpdate({
     target: juniorGitHubIssues.issueId,
     set: values,
     where: lte(juniorGitHubIssues.updatedAt, outcome.updatedAt)
+  }).returning({
+    conversationIds: juniorGitHubIssues.conversationIds
   });
+  return {
+    applied: inserted.length > 0,
+    conversationIds: inserted[0]?.conversationIds ?? []
+  };
 }
 async function recordGitHubIssueConversations(db, input) {
   const association = githubIssueConversationsInputSchema.parse(input);
@@ -3341,7 +3353,23 @@ function createGitHubWebhookRoute(args) {
         }
       }
       if (issueOutcome) {
-        await recordGitHubIssueOutcome(args.db, issueOutcome);
+        const recordedOutcome = await recordGitHubIssueOutcome(
+          args.db,
+          issueOutcome
+        );
+        if (recordedOutcome.applied && issueOutcome.state === "closed") {
+          await Promise.all(
+            recordedOutcome.conversationIds.map(
+              (conversationId) => args.annotations.forConversation(conversationId).upsert({
+                kind: "resource_link",
+                key: `${issueOutcome.repositoryFullName.toLowerCase()}#${issueOutcome.number}`,
+                label: `${issueOutcome.repositoryFullName}#${issueOutcome.number}`,
+                url: `https://github.com/${issueOutcome.repositoryFullName}/issues/${issueOutcome.number}`,
+                status: "closed"
+              })
+            )
+          );
+        }
       }
       const recordedIssueConversations = issueConversations ? await recordGitHubIssueConversations(args.db, issueConversations) : false;
       const recordedPullRequestConversations = pullRequestConversations ? await recordGitHubPullRequestConversations(
@@ -4638,6 +4666,36 @@ function shouldInspectGitHubGraphqlResponse(ctx) {
   const contentType = ctx.response.headers.get("content-type");
   return contentType ? /\bjson\b/i.test(contentType) : false;
 }
+var GITHUB_BODY_WRITES = [
+  {
+    denialMessage: `GitHub issue creation must use the github_createIssue tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "createIssue",
+    method: "POST",
+    operation: "github.issue.create",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/issues$/
+  },
+  {
+    denialMessage: `GitHub pull request creation must use the github_createPullRequest tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "createPullRequest",
+    method: "POST",
+    operation: "github.pull.create",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/pulls$/
+  },
+  {
+    denialMessage: `GitHub issue updates must use the github_updateIssue tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "updateIssue",
+    method: "PATCH",
+    operation: "github.issue.update",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+$/
+  },
+  {
+    denialMessage: `GitHub pull request updates must use the github_updatePullRequest tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`,
+    graphqlField: "updatePullRequest",
+    method: "PATCH",
+    operation: "github.pull.update",
+    restPath: /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+$/
+  }
+];
 function githubApiWriteGrantName(method, upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
   if (!isGitHubApiUrl2(upstreamUrl)) {
@@ -4653,26 +4711,19 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   ) || /^\/repos\/[^/]+\/[^/]+\/actions\/jobs\/[^/]+\/rerun$/.test(pathname))) {
     return "installation-write";
   }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(pathname)) {
+  if (GITHUB_BODY_WRITES.some(
+    (write) => write.method === method && write.restPath.test(pathname)
+  )) {
     return "installation-write";
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+\/comments$/.test(pathname)) {
     return "installation-write";
   }
-  if (method === "PATCH" && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+$/.test(pathname)) {
-    return "installation-write";
-  }
   if ((method === "POST" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+\/(labels|assignees)(?:\/[^/]+)?$/.test(
     pathname
   )) {
     return "installation-write";
   }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(pathname)) {
-    return "installation-write";
-  }
-  if (method === "PATCH" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+$/.test(pathname)) {
-    return "installation-write";
-  }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/ready_for_review$/.test(pathname)) {
     return "installation-write";
   }
@@ -4694,17 +4745,6 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   }
   return void 0;
 }
-function isGitHubIssueCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(upstreamUrl.pathname.toLowerCase());
-}
-function isGitHubPullCreateRestRequest(method, upstreamUrl) {
-  return method === "POST" && isGitHubApiUrl2(upstreamUrl) && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(upstreamUrl.pathname.toLowerCase());
-}
-function isGitHubResourceUpdateRestRequest(method, upstreamUrl, resource) {
-  return method === "PATCH" && isGitHubApiUrl2(upstreamUrl) && new RegExp(`^/repos/[^/]+/[^/]+/${resource}/[^/]+$`).test(
-    upstreamUrl.pathname.toLowerCase()
-  );
-}
 function isGitHubGraphqlMutation(method, upstreamUrl, bodyText, field) {
   if (method !== "POST" || !isGitHubGraphqlUrl(upstreamUrl)) return false;
   const parsed = parseGitHubGraphqlRequest(bodyText);
@@ -4716,64 +4756,26 @@ function isGitHubGraphqlMutation(method, upstreamUrl, bodyText, field) {
     `\\bmutation\\s+${escapeRegExp2(parsed.operationName)}\\b`
   ).test(parsed.normalized);
 }
-function assertGitHubWriteAllowed(input) {
+function applyGitHubEgressPolicy(input) {
   assertGitHubPullRequestApprovalDenied({
     ...input.bodyText !== void 0 ? { bodyText: input.bodyText } : {},
     method: input.method,
     upstreamUrl: input.upstreamUrl
   });
-  if (input.operation === "github.issue.create") return;
-  if (input.operation === "github.issue.update") return;
-  if (input.operation === "github.pull.create") return;
-  if (input.operation === "github.pull.update") return;
-  if (isGitHubIssueCreateRestRequest(input.method, input.upstreamUrl) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "createIssue"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub issue creation must use the github_createIssue tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
-  if (isGitHubPullCreateRestRequest(input.method, input.upstreamUrl) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "createPullRequest"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub pull request creation must use the github_createPullRequest tool so Junior can own idempotency and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
-  if (isGitHubResourceUpdateRestRequest(
-    input.method,
-    input.upstreamUrl,
-    "issues"
-  ) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "updateIssue"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub issue updates must use the github_updateIssue tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
-  if (isGitHubResourceUpdateRestRequest(
-    input.method,
-    input.upstreamUrl,
-    "pulls"
-  ) || isGitHubGraphqlMutation(
-    input.method,
-    input.upstreamUrl,
-    input.bodyText,
-    "updatePullRequest"
-  )) {
-    throw new EgressPolicyDenied2(
-      `GitHub pull request updates must use the github_updatePullRequest tool so Junior can own requester attribution and the conversation footer. ${CREATE_TOOL_ROUTING_GUIDANCE}`
-    );
-  }
+  const pathname = input.upstreamUrl.pathname.toLowerCase();
+  const write = GITHUB_BODY_WRITES.find(
+    (candidate) => candidate.method === input.method && isGitHubApiUrl2(input.upstreamUrl) && candidate.restPath.test(pathname) || isGitHubGraphqlMutation(
+      input.method,
+      input.upstreamUrl,
+      input.bodyText,
+      candidate.graphqlField
+    )
+  );
+  if (!write) return;
+  enforceEgressPolicy({
+    allowed: input.operation === write.operation,
+    denialMessage: write.denialMessage
+  });
 }
 function grantForAccess(access, reason, name, leaseScope) {
   return {
@@ -4796,7 +4798,7 @@ function repositoryLeaseScope(upstreamUrl) {
 async function githubGrantForEgress(ctx) {
   const method = ctx.request.method.toUpperCase();
   const upstreamUrl = new URL(ctx.request.url);
-  assertGitHubWriteAllowed({
+  applyGitHubEgressPolicy({
     ...ctx.request.bodyText !== void 0 ? { bodyText: ctx.request.bodyText } : {},
     method,
     ...ctx.request.operation ? { operation: ctx.request.operation } : {},

package/dist/issue-outcomes/store.d.ts

@@ -30,8 +30,13 @@ export type GitHubIssueConversationsInput = z.output<typeof githubIssueConversat
  * Record the newest lifecycle projection for one Junior-owned issue.
  * Ownership-qualified opening or closing events insert; later events update
  * existing rows, and older provider timestamps cannot regress them.
+ * Returns the written row state so follow-up annotation updates stay scoped to
+ * associated conversations.
  */
-export declare function recordGitHubIssueOutcome(db: GitHubDb, input: GitHubIssueOutcomeInput): Promise<void>;
+export declare function recordGitHubIssueOutcome(db: GitHubDb, input: GitHubIssueOutcomeInput): Promise<{
+    applied: boolean;
+    conversationIds: string[];
+}>;
 /** Append native conversation ids to an existing Junior-owned issue projection. */
 export declare function recordGitHubIssueConversations(db: GitHubDb, input: GitHubIssueConversationsInput): Promise<boolean>;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.158.0",
+  "version": "0.160.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.158.0"
+    "@sentry/junior-plugin-api": "0.160.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/github-code/SKILL.md

@@ -81,3 +81,5 @@ If PR creation or update is blocked, report the exact failed command/tool call a
 When PR creation returns a subscribable resource hint, subscribe to suggested review/CI events. Report only actionable feedback addressed, build failures fixed, fully green/ready state, or merge.
 
 Return: repo, branch, PR URL/number, checks and results, pre-existing failures, and anything not run with the reason.
+
+When you mention a pull request in a user-facing reply, always include a direct link. Prefer the full PR URL or a Markdown link such as `[#123](https://github.com/owner/repo/pull/123)`. `owner/repo#number` is also fine. Do not leave bare `PR #123` text without a URL or repo.