@sentry/junior-github 0.162.0 → 0.164.0

package/dist/index.js

@@ -730,16 +730,33 @@ import {
   pluginToolOutputSchema
 } from "@sentry/junior-plugin-api";
 import { z } from "zod";
-var RESERVED_SANDBOX_DIRECTORIES = /* @__PURE__ */ new Set([".junior", "data", "skills"]);
+
+// src/sandbox-paths.ts
+var RESERVED_SANDBOX_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".junior",
+  "data",
+  "skills"
+]);
+function isReservedSandboxDirectory(path) {
+  return RESERVED_SANDBOX_DIRECTORIES.has(path.toLowerCase());
+}
+
+// src/tools/clone-repository.ts
 var inputSchema = z.object({
   repo: z.string().describe('Repository in "owner/name" format.'),
-  directory: z.string().regex(/^[A-Za-z0-9._-]+$/).refine((value) => value !== "." && value !== "..", {
-    message: "Directory must be a single directory name."
-  }).describe("Optional destination directory under the sandbox root.").optional()
+  directory: z.string().regex(/^(?:[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*)$/).refine(
+    (value) => !value.split("/").some((part) => part === "." || part === ".."),
+    {
+      message: "Directory must be a relative path without . or .. segments."
+    }
+  ).describe(
+    "Optional destination directory under the sandbox root. Defaults to repos/{name}."
+  ).optional()
 }).strict();
 var cloneSchema = z.object({
   path: z.string(),
-  repo: z.string()
+  repo: z.string(),
+  workspaces: z.array(z.string())
 });
 var outputSchema = pluginToolOutputSchema.extend({
   target: z.literal("cloneRepository"),
@@ -753,7 +770,7 @@ function parseRepo(value) {
   return { owner: parts[0], name: parts[1] };
 }
 function defaultDirectory(repoName) {
-  return RESERVED_SANDBOX_DIRECTORIES.has(repoName) ? `${repoName}-repo` : repoName;
+  return `repos/${repoName}`;
 }
 function commandSignal(signal, timeoutMs) {
   const timeout = AbortSignal.timeout(timeoutMs);
@@ -802,7 +819,27 @@ function createGitHubCloneRepositoryTool(ctx) {
     async execute(input, options) {
       const repo = parseRepo(input.repo);
       const directory = input.directory ?? defaultDirectory(repo.name);
+      const rootSegment = directory.split("/")[0] ?? directory;
+      if (isReservedSandboxDirectory(rootSegment)) {
+        throw new PluginToolInputError(
+          `Directory conflicts with a reserved sandbox path: ${directory}`
+        );
+      }
       const path = `${ctx.sandbox.root}/${directory}`;
+      const parentDirectory = directory.includes("/") ? directory.slice(0, directory.lastIndexOf("/")) : void 0;
+      if (parentDirectory) {
+        const mkdir = await ctx.sandbox.run({
+          cmd: "mkdir",
+          args: ["-p", "--", `${ctx.sandbox.root}/${parentDirectory}`],
+          cwd: ctx.sandbox.root,
+          signal: commandSignal(options.signal, 3e4)
+        });
+        if (mkdir.exitCode !== 0) {
+          throw new PluginToolInputError(
+            `Failed to create clone parent directory: ${parentDirectory}`
+          );
+        }
+      }
       const exists = await ctx.sandbox.run({
         cmd: "bash",
         args: ["-c", `test -e "$1"`, "bash", path],
@@ -837,7 +874,20 @@ function createGitHubCloneRepositoryTool(ctx) {
           `GitHub repository clone failed: ${clone.stderr.trim() || `exit ${clone.exitCode}`}`
         );
       }
-      const data = { repo: `${repo.owner}/${repo.name}`, path };
+      const repoId = `${repo.owner}/${repo.name}`;
+      let workspaces = [];
+      try {
+        workspaces = await ctx.workspaces.findByRepository({
+          provider: "github",
+          repo: repoId
+        });
+      } catch (error) {
+        ctx.log.error("github.clone.workspaces_lookup.failed", {
+          repo: repoId,
+          error: error instanceof Error ? error.message : String(error)
+        });
+      }
+      const data = { repo: repoId, path, workspaces };
       return { target: "cloneRepository", ...data };
     }
   });
@@ -2550,8 +2600,200 @@ function createGitHubUpdatePullRequestTool(ctx) {
   });
 }
 
+// src/tools/resolve-pull-request-review-thread.ts
+import {
+  definePluginTool as definePluginTool10,
+  PluginToolInputError as PluginToolInputError11,
+  pluginToolOutputSchema as pluginToolOutputSchema10
+} from "@sentry/junior-plugin-api";
+import { z as z10 } from "zod";
+
+// src/webhooks/ownership.ts
+var GITHUB_NOREPLY_DOMAIN = "users.noreply.github.com";
+function botLoginFromEmail(value) {
+  const email = value?.trim();
+  if (!email) return void 0;
+  const separator = email.lastIndexOf("@");
+  if (separator <= 0) return void 0;
+  const domain = email.slice(separator + 1).toLowerCase();
+  if (domain !== GITHUB_NOREPLY_DOMAIN) return void 0;
+  const localPart = email.slice(0, separator);
+  const login = localPart.slice(localPart.indexOf("+") + 1).trim();
+  return login.toLowerCase().endsWith("[bot]") ? login : void 0;
+}
+
+// src/tools/resolve-pull-request-review-thread.ts
+var inputSchema8 = z10.object({
+  repo: z10.string().describe(
+    'Repository in "owner/name" format. Required for repository-scoped credentials (GraphQL has no repo path).'
+  ),
+  threadId: z10.string().trim().min(1).describe(
+    "GitHub pull request review thread node ID (the same `threadId` / `id` variable used by `gh api graphql` resolveReviewThread)."
+  )
+}).strict();
+var outputSchema8 = pluginToolOutputSchema10.extend({
+  target: z10.literal("resolvePullRequestReviewThread"),
+  repo: z10.string(),
+  number: z10.number(),
+  threadId: z10.string(),
+  resolved: z10.boolean()
+});
+function parseRepo10(value) {
+  const parts = value.split("/").map((part) => part.trim());
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    throw new PluginToolInputError11('repo must use "owner/name" format');
+  }
+  return { owner: parts[0], name: parts[1], ref: `${parts[0]}/${parts[1]}` };
+}
+async function readJson7(response) {
+  const text2 = await response.text();
+  if (!text2) return void 0;
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return text2;
+  }
+}
+function githubError(payload) {
+  if (payload && typeof payload === "object" && !Array.isArray(payload)) {
+    const message = payload.message;
+    if (typeof message === "string" && message.trim()) return message.trim();
+  }
+  return "GitHub request failed";
+}
+function createGitHubResolvePullRequestReviewThreadTool(ctx, botEmail) {
+  return definePluginTool10({
+    annotations: {
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: false
+    },
+    description: "Resolve a GitHub pull request review thread. Use this instead of shelling out to `gh api graphql` for resolveReviewThread (GraphQL-only; no REST or `gh pr` equivalent). Only works on pull requests Junior authored.",
+    inputSchema: inputSchema8,
+    outputSchema: outputSchema8,
+    async execute(input) {
+      const parsedInput = inputSchema8.safeParse(input);
+      if (!parsedInput.success) {
+        throw new PluginToolInputError11(
+          "Invalid GitHub resolvePullRequestReviewThread input.",
+          { cause: parsedInput.error }
+        );
+      }
+      const repo = parseRepo10(parsedInput.data.repo);
+      const botLogin = botLoginFromEmail(botEmail)?.toLowerCase();
+      if (!botLogin) {
+        throw new Error("GitHub App bot identity is not configured.");
+      }
+      const query = `query ReviewThreadOwnership($threadId: ID!) {
+        node(id: $threadId) {
+          ... on PullRequestReviewThread {
+            id
+            isResolved
+            pullRequest {
+              number
+              repository { nameWithOwner }
+              author { login }
+            }
+          }
+        }
+      }`;
+      const lookupResponse = await ctx.egress.fetch({
+        provider: "github",
+        operation: "github.pull.review-thread.get",
+        request: new Request("https://api.github.com/graphql", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            operationName: "ReviewThreadOwnership",
+            query,
+            variables: { threadId: parsedInput.data.threadId }
+          })
+        })
+      });
+      const lookupPayload = await readJson7(lookupResponse);
+      if (!lookupResponse.ok) {
+        throw new Error(
+          `GitHub review thread lookup failed with HTTP ${lookupResponse.status}: ${githubError(lookupPayload)}`
+        );
+      }
+      const thread = z10.object({
+        data: z10.object({
+          node: z10.object({
+            id: z10.string(),
+            isResolved: z10.boolean(),
+            pullRequest: z10.object({
+              author: z10.object({ login: z10.string() }),
+              number: z10.number(),
+              repository: z10.object({ nameWithOwner: z10.string() })
+            })
+          }).nullable()
+        })
+      }).parse(lookupPayload).data.node;
+      if (!thread) throw new Error("GitHub review thread was not found.");
+      const pullRequest = thread.pullRequest;
+      const ownsPullRequest = pullRequest.repository.nameWithOwner.toLowerCase() === repo.ref.toLowerCase() && pullRequest.author.login.toLowerCase() === botLogin;
+      if (!ownsPullRequest) {
+        throw new Error(
+          "Junior can only resolve review threads on pull requests it authored."
+        );
+      }
+      if (thread.isResolved) {
+        return {
+          target: "resolvePullRequestReviewThread",
+          repo: repo.ref,
+          number: pullRequest.number,
+          threadId: thread.id,
+          resolved: true
+        };
+      }
+      const mutation = `mutation ResolveReviewThread($threadId: ID!) {
+        resolveReviewThread(input: {threadId: $threadId}) {
+          thread { id isResolved }
+        }
+      }`;
+      const resolveResponse = await ctx.egress.fetch({
+        provider: "github",
+        operation: `github.pull.review-thread.resolve:${repo.ref.toLowerCase()}`,
+        request: new Request("https://api.github.com/graphql", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            operationName: "ResolveReviewThread",
+            query: mutation,
+            variables: { threadId: thread.id }
+          })
+        })
+      });
+      const resolvePayload = await readJson7(resolveResponse);
+      if (!resolveResponse.ok) {
+        throw new Error(
+          `GitHub review thread resolution failed with HTTP ${resolveResponse.status}: ${githubError(resolvePayload)}`
+        );
+      }
+      const resolved = z10.object({
+        data: z10.object({
+          resolveReviewThread: z10.object({
+            thread: z10.object({ id: z10.string(), isResolved: z10.boolean() })
+          })
+        })
+      }).parse(resolvePayload).data.resolveReviewThread.thread;
+      if (resolved.id !== thread.id || !resolved.isResolved) {
+        throw new Error("GitHub did not resolve the requested review thread.");
+      }
+      return {
+        target: "resolvePullRequestReviewThread",
+        repo: repo.ref,
+        number: pullRequest.number,
+        threadId: resolved.id,
+        resolved: true
+      };
+    }
+  });
+}
+
 // src/tools.ts
-function createGitHubTools(ctx) {
+function createGitHubTools(ctx, botEmail) {
   return {
     cloneRepository: createGitHubCloneRepositoryTool(ctx),
     createIssue: createGitHubIssueTool(ctx),
@@ -2560,6 +2802,7 @@ function createGitHubTools(ctx) {
     getPullRequest: createGitHubGetPullRequestTool(ctx),
     getRelease: createGitHubGetReleaseTool(ctx),
     getRepository: createGitHubGetRepositoryTool(ctx),
+    resolvePullRequestReviewThread: createGitHubResolvePullRequestReviewThreadTool(ctx, botEmail),
     updateIssue: createGitHubUpdateIssueTool(ctx),
     updatePullRequest: createGitHubUpdatePullRequestTool(ctx)
   };
@@ -2570,7 +2813,7 @@ import { createHmac, timingSafeEqual } from "crypto";
 
 // src/issue-outcomes/store.ts
 import { and, eq, lte, sql as sql2 } from "drizzle-orm";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/db/schema.ts
 import { sql } from "drizzle-orm";
@@ -2582,18 +2825,18 @@ import {
   text,
   timestamp
 } from "drizzle-orm/pg-core";
-import { z as z10 } from "zod";
-var githubPullRequestStateSchema = z10.enum([
+import { z as z11 } from "zod";
+var githubPullRequestStateSchema = z11.enum([
   "closed_unmerged",
   "merged",
   "open"
 ]);
-var githubPullRequestCommitCompositionSchema = z10.enum([
+var githubPullRequestCommitCompositionSchema = z11.enum([
   "junior_only",
   "mixed"
 ]);
-var githubIssueStateSchema = z10.enum(["closed", "open"]);
-var githubIssueStateReasonSchema = z10.enum([
+var githubIssueStateSchema = z11.enum(["closed", "open"]);
+var githubIssueStateReasonSchema = z11.enum([
   "completed",
   "duplicate",
   "not_planned",
@@ -2663,21 +2906,21 @@ var juniorGitHubPullRequestIssues = pgTable(
 );
 
 // src/issue-outcomes/store.ts
-var githubIssueOutcomeInputSchema = z11.object({
-  candidateOwned: z11.boolean(),
-  closedAt: z11.date().optional(),
-  issueId: z11.string().min(1),
-  number: z11.number().int().positive(),
-  openedAt: z11.date(),
-  repositoryFullName: z11.string().min(1),
-  repositoryId: z11.string().min(1),
+var githubIssueOutcomeInputSchema = z12.object({
+  candidateOwned: z12.boolean(),
+  closedAt: z12.date().optional(),
+  issueId: z12.string().min(1),
+  number: z12.number().int().positive(),
+  openedAt: z12.date(),
+  repositoryFullName: z12.string().min(1),
+  repositoryId: z12.string().min(1),
   state: githubIssueStateSchema,
   stateReason: githubIssueStateReasonSchema.optional(),
-  updatedAt: z11.date()
+  updatedAt: z12.date()
 }).strict();
-var githubIssueConversationsInputSchema = z11.object({
-  conversationIds: z11.array(z11.string().min(1)).min(1),
-  issueId: z11.string().min(1)
+var githubIssueConversationsInputSchema = z12.object({
+  conversationIds: z12.array(z12.string().min(1)).min(1),
+  issueId: z12.string().min(1)
 }).strict();
 function projectionValues(input) {
   return {
@@ -2741,32 +2984,32 @@ async function recordGitHubIssueConversations(db, input) {
 
 // src/pull-request-outcomes/store.ts
 import { and as and2, eq as eq2, lte as lte2, ne, sql as sql3 } from "drizzle-orm";
-import { z as z12 } from "zod";
-var githubPullRequestOutcomeInputSchema = z12.object({
-  candidateOwned: z12.boolean(),
-  closedAt: z12.date().optional(),
+import { z as z13 } from "zod";
+var githubPullRequestOutcomeInputSchema = z13.object({
+  candidateOwned: z13.boolean(),
+  closedAt: z13.date().optional(),
   commitComposition: githubPullRequestCommitCompositionSchema.optional(),
-  mergedAt: z12.date().optional(),
-  number: z12.number().int().positive(),
-  openedAt: z12.date(),
-  pullRequestId: z12.string().min(1),
-  repositoryFullName: z12.string().min(1),
-  repositoryId: z12.string().min(1),
+  mergedAt: z13.date().optional(),
+  number: z13.number().int().positive(),
+  openedAt: z13.date(),
+  pullRequestId: z13.string().min(1),
+  repositoryFullName: z13.string().min(1),
+  repositoryId: z13.string().min(1),
   state: githubPullRequestStateSchema,
-  updatedAt: z12.date()
+  updatedAt: z13.date()
 }).strict();
-var githubPullRequestConversationsInputSchema = z12.object({
-  conversationIds: z12.array(z12.string().min(1)).min(1),
-  pullRequestId: z12.string().min(1)
+var githubPullRequestConversationsInputSchema = z13.object({
+  conversationIds: z13.array(z13.string().min(1)).min(1),
+  pullRequestId: z13.string().min(1)
 }).strict();
-var githubPullRequestLinkedIssuesInputSchema = z12.object({
-  linkedIssues: z12.array(
-    z12.object({
-      number: z12.number().int().positive(),
-      repositoryFullName: z12.string().min(1)
+var githubPullRequestLinkedIssuesInputSchema = z13.object({
+  linkedIssues: z13.array(
+    z13.object({
+      number: z13.number().int().positive(),
+      repositoryFullName: z13.string().min(1)
     }).strict()
   ).min(1),
-  pullRequestId: z12.string().min(1)
+  pullRequestId: z13.string().min(1)
 }).strict();
 function projectionValues2(input) {
   return {
@@ -2931,55 +3174,39 @@ async function recordGitHubPullRequestLinkedIssues(db, input) {
 }
 
 // src/webhooks/issue-outcome.ts
-import { z as z13 } from "zod";
-
-// src/webhooks/ownership.ts
-var GITHUB_NOREPLY_DOMAIN = "users.noreply.github.com";
-function botLoginFromEmail(value) {
-  const email = value?.trim();
-  if (!email) return void 0;
-  const separator = email.lastIndexOf("@");
-  if (separator <= 0) return void 0;
-  const domain = email.slice(separator + 1).toLowerCase();
-  if (domain !== GITHUB_NOREPLY_DOMAIN) return void 0;
-  const localPart = email.slice(0, separator);
-  const login = localPart.slice(localPart.indexOf("+") + 1).trim();
-  return login.toLowerCase().endsWith("[bot]") ? login : void 0;
-}
-
-// src/webhooks/issue-outcome.ts
-var canonicalIssueOutcomeSchema = z13.object({
-  action: z13.enum(["opened", "closed", "reopened"]),
-  issue: z13.object({
-    body: z13.string().nullable().optional(),
-    closed_at: z13.string().nullable().optional(),
-    created_at: z13.string(),
-    id: z13.number().int().positive(),
-    number: z13.number().int().positive(),
+import { z as z14 } from "zod";
+var canonicalIssueOutcomeSchema = z14.object({
+  action: z14.enum(["opened", "closed", "reopened"]),
+  issue: z14.object({
+    body: z14.string().nullable().optional(),
+    closed_at: z14.string().nullable().optional(),
+    created_at: z14.string(),
+    id: z14.number().int().positive(),
+    number: z14.number().int().positive(),
     state_reason: githubIssueStateReasonSchema.nullable().optional(),
-    updated_at: z13.string(),
-    user: z13.object({ login: z13.string().min(1) }).strict()
+    updated_at: z14.string(),
+    user: z14.object({ login: z14.string().min(1) }).strict()
   }).strict(),
-  repository: z13.object({
-    full_name: z13.string().min(1),
-    id: z13.number().int().positive()
+  repository: z14.object({
+    full_name: z14.string().min(1),
+    id: z14.number().int().positive()
   }).strict()
 }).strict();
-var issueOutcomeSchema = z13.object({
-  action: z13.enum(["opened", "closed", "reopened"]),
-  issue: z13.object({
-    body: z13.string().nullable().optional(),
-    closed_at: z13.string().nullable().optional(),
-    created_at: z13.string(),
-    id: z13.number().int().positive(),
-    number: z13.number().int().positive(),
+var issueOutcomeSchema = z14.object({
+  action: z14.enum(["opened", "closed", "reopened"]),
+  issue: z14.object({
+    body: z14.string().nullable().optional(),
+    closed_at: z14.string().nullable().optional(),
+    created_at: z14.string(),
+    id: z14.number().int().positive(),
+    number: z14.number().int().positive(),
     state_reason: githubIssueStateReasonSchema.nullable().optional(),
-    updated_at: z13.string(),
-    user: z13.object({ login: z13.string().min(1) }).passthrough()
+    updated_at: z14.string(),
+    user: z14.object({ login: z14.string().min(1) }).passthrough()
   }).passthrough(),
-  repository: z13.object({
-    full_name: z13.string().min(1),
-    id: z13.number().int().positive()
+  repository: z14.object({
+    full_name: z14.string().min(1),
+    id: z14.number().int().positive()
   }).passthrough()
 }).passthrough().transform(
   (provider) => canonicalIssueOutcomeSchema.parse({
@@ -3000,7 +3227,7 @@ var issueOutcomeSchema = z13.object({
     }
   })
 );
-var issueLifecycleActionSchema = z13.object({ action: z13.string() }).passthrough();
+var issueLifecycleActionSchema = z14.object({ action: z14.string() }).passthrough();
 function timestamp2(value) {
   if (!value) return void 0;
   const parsed = new Date(value);
@@ -3046,21 +3273,21 @@ function normalizeGitHubIssueOutcome(args) {
     updatedAt
   };
 }
-var canonicalIssueConversationSchema = z13.object({
-  issue: z13.object({
-    body: z13.string().nullable().optional(),
-    id: z13.number().int().positive(),
-    user: z13.object({ login: z13.string().min(1) }).strict()
+var canonicalIssueConversationSchema = z14.object({
+  issue: z14.object({
+    body: z14.string().nullable().optional(),
+    id: z14.number().int().positive(),
+    user: z14.object({ login: z14.string().min(1) }).strict()
   }).strict(),
-  sender: z13.object({ login: z13.string().min(1) }).strict().optional()
+  sender: z14.object({ login: z14.string().min(1) }).strict().optional()
 }).strict();
-var issueConversationSchema = z13.object({
-  issue: z13.object({
-    body: z13.string().nullable().optional(),
-    id: z13.number().int().positive(),
-    user: z13.object({ login: z13.string().min(1) }).passthrough()
+var issueConversationSchema = z14.object({
+  issue: z14.object({
+    body: z14.string().nullable().optional(),
+    id: z14.number().int().positive(),
+    user: z14.object({ login: z14.string().min(1) }).passthrough()
   }).passthrough(),
-  sender: z13.object({ login: z13.string().min(1) }).passthrough().optional()
+  sender: z14.object({ login: z14.string().min(1) }).passthrough().optional()
 }).passthrough().transform(
   (provider) => canonicalIssueConversationSchema.parse({
     issue: {
@@ -3087,41 +3314,41 @@ function normalizeGitHubIssueConversations(args) {
 }
 
 // src/webhooks/pull-request-outcome.ts
-import { z as z14 } from "zod";
-var canonicalPullRequestOutcomeSchema = z14.object({
-  action: z14.enum(["opened", "closed", "reopened"]),
-  pull_request: z14.object({
-    body: z14.string().nullable().optional(),
-    closed_at: z14.string().nullable().optional(),
-    created_at: z14.string(),
-    id: z14.number().int().positive(),
-    merged: z14.boolean(),
-    merged_at: z14.string().nullable().optional(),
-    number: z14.number().int().positive(),
-    updated_at: z14.string(),
-    user: z14.object({ login: z14.string().min(1) }).strict()
+import { z as z15 } from "zod";
+var canonicalPullRequestOutcomeSchema = z15.object({
+  action: z15.enum(["opened", "closed", "reopened"]),
+  pull_request: z15.object({
+    body: z15.string().nullable().optional(),
+    closed_at: z15.string().nullable().optional(),
+    created_at: z15.string(),
+    id: z15.number().int().positive(),
+    merged: z15.boolean(),
+    merged_at: z15.string().nullable().optional(),
+    number: z15.number().int().positive(),
+    updated_at: z15.string(),
+    user: z15.object({ login: z15.string().min(1) }).strict()
   }).strict(),
-  repository: z14.object({
-    full_name: z14.string().min(1),
-    id: z14.number().int().positive()
+  repository: z15.object({
+    full_name: z15.string().min(1),
+    id: z15.number().int().positive()
   }).strict()
 }).strict();
-var pullRequestOutcomeSchema = z14.object({
-  action: z14.enum(["opened", "closed", "reopened"]),
-  pull_request: z14.object({
-    body: z14.string().nullable().optional(),
-    closed_at: z14.string().nullable().optional(),
-    created_at: z14.string(),
-    id: z14.number().int().positive(),
-    merged: z14.boolean(),
-    merged_at: z14.string().nullable().optional(),
-    number: z14.number().int().positive(),
-    updated_at: z14.string(),
-    user: z14.object({ login: z14.string().min(1) }).passthrough()
+var pullRequestOutcomeSchema = z15.object({
+  action: z15.enum(["opened", "closed", "reopened"]),
+  pull_request: z15.object({
+    body: z15.string().nullable().optional(),
+    closed_at: z15.string().nullable().optional(),
+    created_at: z15.string(),
+    id: z15.number().int().positive(),
+    merged: z15.boolean(),
+    merged_at: z15.string().nullable().optional(),
+    number: z15.number().int().positive(),
+    updated_at: z15.string(),
+    user: z15.object({ login: z15.string().min(1) }).passthrough()
   }).passthrough(),
-  repository: z14.object({
-    full_name: z14.string().min(1),
-    id: z14.number().int().positive()
+  repository: z15.object({
+    full_name: z15.string().min(1),
+    id: z15.number().int().positive()
   }).passthrough()
 }).passthrough().transform(
   (provider) => canonicalPullRequestOutcomeSchema.parse({
@@ -3143,24 +3370,24 @@ var pullRequestOutcomeSchema = z14.object({
     }
   })
 );
-var pullRequestLifecycleActionSchema = z14.object({ action: z14.string() }).passthrough();
-var canonicalPullRequestConversationSchema = z14.object({
-  pull_request: z14.object({
-    body: z14.string().nullable().optional(),
-    id: z14.number().int().positive(),
-    user: z14.object({ login: z14.string().min(1) }).strict()
+var pullRequestLifecycleActionSchema = z15.object({ action: z15.string() }).passthrough();
+var canonicalPullRequestConversationSchema = z15.object({
+  pull_request: z15.object({
+    body: z15.string().nullable().optional(),
+    id: z15.number().int().positive(),
+    user: z15.object({ login: z15.string().min(1) }).strict()
   }).strict(),
-  repository: z14.object({ full_name: z14.string().min(1) }).strict(),
-  sender: z14.object({ login: z14.string().min(1) }).strict()
+  repository: z15.object({ full_name: z15.string().min(1) }).strict(),
+  sender: z15.object({ login: z15.string().min(1) }).strict()
 }).strict();
-var pullRequestConversationSchema = z14.object({
-  pull_request: z14.object({
-    body: z14.string().nullable().optional(),
-    id: z14.number().int().positive(),
-    user: z14.object({ login: z14.string().min(1) }).passthrough()
+var pullRequestConversationSchema = z15.object({
+  pull_request: z15.object({
+    body: z15.string().nullable().optional(),
+    id: z15.number().int().positive(),
+    user: z15.object({ login: z15.string().min(1) }).passthrough()
   }).passthrough(),
-  repository: z14.object({ full_name: z14.string().min(1) }).passthrough(),
-  sender: z14.object({ login: z14.string().min(1) }).passthrough()
+  repository: z15.object({ full_name: z15.string().min(1) }).passthrough(),
+  sender: z15.object({ login: z15.string().min(1) }).passthrough()
 }).passthrough().transform(
   (provider) => canonicalPullRequestConversationSchema.parse({
     pull_request: {
@@ -3400,14 +3627,14 @@ function createGitHubWebhookRoute(args) {
 
 // src/outcomes/profile-report.ts
 import { sql as sql4 } from "drizzle-orm";
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var DAY_MS = 24 * 60 * 60 * 1e3;
 var WINDOWS = [7, 30, 90];
-var pullRequestStatsSchema = z15.object({
-  closed: z15.number().int().nonnegative(),
-  created: z15.number().int().nonnegative(),
-  days: z15.number().int().positive(),
-  merged: z15.number().int().nonnegative()
+var pullRequestStatsSchema = z16.object({
+  closed: z16.number().int().nonnegative(),
+  created: z16.number().int().nonnegative(),
+  days: z16.number().int().positive(),
+  merged: z16.number().int().nonnegative()
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   return {
@@ -3415,13 +3642,13 @@ var pullRequestStatsSchema = z15.object({
     mergeRate: terminal > 0 ? row.merged / terminal : void 0
   };
 });
-var issueStatsSchema = z15.object({
-  created: z15.number().int().nonnegative(),
-  days: z15.number().int().positive()
+var issueStatsSchema = z16.object({
+  created: z16.number().int().nonnegative(),
+  days: z16.number().int().positive()
 }).strict();
-var daySchema = z15.object({
-  created: z15.number().int().nonnegative(),
-  date: z15.string().date()
+var daySchema = z16.object({
+  created: z16.number().int().nonnegative(),
+  date: z16.string().date()
 }).strict();
 function queryRows(result) {
   if (typeof result !== "object" || result === null || !("rows" in result) || !Array.isArray(result.rows)) {
@@ -3494,7 +3721,7 @@ async function aggregatePullRequestWindows(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z15.array(pullRequestStatsSchema).parse(queryRows(result));
+  return z16.array(pullRequestStatsSchema).parse(queryRows(result));
 }
 async function aggregateIssueWindows(args) {
   const starts = WINDOWS.map(
@@ -3527,7 +3754,7 @@ async function aggregateIssueWindows(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z15.array(issueStatsSchema).parse(queryRows(result));
+  return z16.array(issueStatsSchema).parse(queryRows(result));
 }
 async function aggregateOpenedDays(args) {
   const end = new Date(args.nowMs);
@@ -3557,7 +3784,7 @@ async function aggregateOpenedDays(args) {
     LEFT JOIN daily ON daily.day = days.day
     ORDER BY days.day
   `);
-  return z15.array(daySchema).parse(queryRows(result));
+  return z16.array(daySchema).parse(queryRows(result));
 }
 async function buildGitHubProfileReport(args) {
   const [windows, pullRequestDays, issueWindows, issueDays] = await Promise.all(
@@ -3638,18 +3865,18 @@ async function buildGitHubProfileReport(args) {
 
 // src/outcomes/report.ts
 import { sql as sql6 } from "drizzle-orm";
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 
 // src/outcomes/cost.ts
 import { sql as sql5 } from "drizzle-orm";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var DAY_MS2 = 24 * 60 * 60 * 1e3;
-var costWindowSchema = z16.object({
-  days: z16.number().int().positive(),
-  issueCostUsd: z16.number().nonnegative().nullable(),
-  medianIssueCostUsd: z16.number().nonnegative().nullable(),
-  medianPullRequestCostUsd: z16.number().nonnegative().nullable(),
-  pullRequestCostUsd: z16.number().nonnegative().nullable()
+var costWindowSchema = z17.object({
+  days: z17.number().int().positive(),
+  issueCostUsd: z17.number().nonnegative().nullable(),
+  medianIssueCostUsd: z17.number().nonnegative().nullable(),
+  medianPullRequestCostUsd: z17.number().nonnegative().nullable(),
+  pullRequestCostUsd: z17.number().nonnegative().nullable()
 }).strict().transform((row) => ({
   days: row.days,
   issueCostUsd: row.issueCostUsd ?? void 0,
@@ -3657,12 +3884,12 @@ var costWindowSchema = z16.object({
   medianPullRequestCostUsd: row.medianPullRequestCostUsd ?? void 0,
   pullRequestCostUsd: row.pullRequestCostUsd ?? void 0
 }));
-var repositoryCostSchema = z16.object({
-  issueCostUsd: z16.number().nonnegative().nullable(),
-  medianIssueCostUsd: z16.number().nonnegative().nullable(),
-  medianPullRequestCostUsd: z16.number().nonnegative().nullable(),
-  pullRequestCostUsd: z16.number().nonnegative().nullable(),
-  repository: z16.string().min(1)
+var repositoryCostSchema = z17.object({
+  issueCostUsd: z17.number().nonnegative().nullable(),
+  medianIssueCostUsd: z17.number().nonnegative().nullable(),
+  medianPullRequestCostUsd: z17.number().nonnegative().nullable(),
+  pullRequestCostUsd: z17.number().nonnegative().nullable(),
+  repository: z17.string().min(1)
 }).strict().transform((row) => ({
   issueCostUsd: row.issueCostUsd ?? void 0,
   medianIssueCostUsd: row.medianIssueCostUsd ?? void 0,
@@ -3867,7 +4094,7 @@ async function aggregateGitHubCostWindows(args) {
     INNER JOIN issue_window ON issue_window.days = pull_request_window.days
     ORDER BY pull_request_window.days
   `);
-  return z16.array(costWindowSchema).parse(queryRows2(result));
+  return z17.array(costWindowSchema).parse(queryRows2(result));
 }
 async function aggregateGitHubRepositoryCosts(args) {
   if (!await hasConversationUsageTable(args.db)) {
@@ -3965,7 +4192,7 @@ async function aggregateGitHubRepositoryCosts(args) {
       ON issue_totals.repository = repositories.repository
     ORDER BY "repository" ASC
   `);
-  return z16.array(repositoryCostSchema).parse(queryRows2(result));
+  return z17.array(repositoryCostSchema).parse(queryRows2(result));
 }
 function formatCostUsd(value) {
   if (value === void 0) return "\u2014";
@@ -3980,12 +4207,12 @@ function formatCostUsd(value) {
 // src/outcomes/report.ts
 var DAY_MS3 = 24 * 60 * 60 * 1e3;
 var WINDOWS2 = [7, 30, 90];
-var pullRequestStatsSchema2 = z17.object({
-  closed: z17.number().int().nonnegative(),
-  created: z17.number().int().nonnegative(),
-  days: z17.number().int().positive(),
-  medianMergeTimeMs: z17.number().nonnegative().nullable(),
-  merged: z17.number().int().nonnegative()
+var pullRequestStatsSchema2 = z18.object({
+  closed: z18.number().int().nonnegative(),
+  created: z18.number().int().nonnegative(),
+  days: z18.number().int().positive(),
+  medianMergeTimeMs: z18.number().nonnegative().nullable(),
+  merged: z18.number().int().nonnegative()
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   return {
@@ -3994,12 +4221,12 @@ var pullRequestStatsSchema2 = z17.object({
     mergeRate: terminal > 0 ? row.merged / terminal : void 0
   };
 });
-var pullRequestRepositoryStatsSchema = z17.object({
-  closed: z17.number().int().nonnegative(),
-  created: z17.number().int().nonnegative(),
-  juniorOnly: z17.number().int().nonnegative(),
-  merged: z17.number().int().nonnegative(),
-  repository: z17.string().min(1)
+var pullRequestRepositoryStatsSchema = z18.object({
+  closed: z18.number().int().nonnegative(),
+  created: z18.number().int().nonnegative(),
+  juniorOnly: z18.number().int().nonnegative(),
+  merged: z18.number().int().nonnegative(),
+  repository: z18.string().min(1)
 }).strict().transform((row) => {
   const terminal = row.merged + row.closed;
   return {
@@ -4007,33 +4234,33 @@ var pullRequestRepositoryStatsSchema = z17.object({
     mergeRate: terminal > 0 ? row.merged / terminal : void 0
   };
 });
-var issueStatsSchema2 = z17.object({
-  closedCompleted: z17.number().int().nonnegative(),
-  closedDuplicate: z17.number().int().nonnegative(),
-  closedNotPlanned: z17.number().int().nonnegative(),
-  closedUnknown: z17.number().int().nonnegative(),
-  created: z17.number().int().nonnegative(),
-  days: z17.number().int().positive(),
-  medianCloseTimeMs: z17.number().nonnegative().nullable()
+var issueStatsSchema2 = z18.object({
+  closedCompleted: z18.number().int().nonnegative(),
+  closedDuplicate: z18.number().int().nonnegative(),
+  closedNotPlanned: z18.number().int().nonnegative(),
+  closedUnknown: z18.number().int().nonnegative(),
+  created: z18.number().int().nonnegative(),
+  days: z18.number().int().positive(),
+  medianCloseTimeMs: z18.number().nonnegative().nullable()
 }).strict().transform((row) => ({
   ...row,
   medianCloseTimeMs: row.medianCloseTimeMs ?? void 0
 }));
-var pullRequestDaySchema = z17.object({
-  created: z17.number().int().nonnegative(),
-  date: z17.string().date()
+var pullRequestDaySchema = z18.object({
+  created: z18.number().int().nonnegative(),
+  date: z18.string().date()
 }).strict();
-var issueDaySchema = z17.object({
-  created: z17.number().int().nonnegative(),
-  date: z17.string().date()
+var issueDaySchema = z18.object({
+  created: z18.number().int().nonnegative(),
+  date: z18.string().date()
 }).strict();
-var issueRepositoryStatsSchema = z17.object({
-  closedCompleted: z17.number().int().nonnegative(),
-  closedDuplicate: z17.number().int().nonnegative(),
-  closedNotPlanned: z17.number().int().nonnegative(),
-  closedUnknown: z17.number().int().nonnegative(),
-  created: z17.number().int().nonnegative(),
-  repository: z17.string().min(1)
+var issueRepositoryStatsSchema = z18.object({
+  closedCompleted: z18.number().int().nonnegative(),
+  closedDuplicate: z18.number().int().nonnegative(),
+  closedNotPlanned: z18.number().int().nonnegative(),
+  closedUnknown: z18.number().int().nonnegative(),
+  created: z18.number().int().nonnegative(),
+  repository: z18.string().min(1)
 }).strict();
 function queryRows3(result) {
   if (typeof result !== "object" || result === null || !("rows" in result) || !Array.isArray(result.rows)) {
@@ -4097,7 +4324,7 @@ async function aggregatePullRequestWindows2(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z17.array(pullRequestStatsSchema2).parse(queryRows3(result));
+  return z18.array(pullRequestStatsSchema2).parse(queryRows3(result));
 }
 async function aggregatePullRequestDays(args) {
   const end = new Date(args.nowMs);
@@ -4125,7 +4352,7 @@ async function aggregatePullRequestDays(args) {
     LEFT JOIN daily ON daily.day = days.day
     ORDER BY days.day
   `);
-  return z17.array(pullRequestDaySchema).parse(queryRows3(result));
+  return z18.array(pullRequestDaySchema).parse(queryRows3(result));
 }
 async function aggregatePullRequestRepositories(args) {
   const start = new Date(args.nowMs - 30 * DAY_MS3);
@@ -4155,7 +4382,7 @@ async function aggregatePullRequestRepositories(args) {
     ORDER BY "merged" DESC, "created" DESC, "repository" ASC
     LIMIT 25
   `);
-  return z17.array(pullRequestRepositoryStatsSchema).parse(queryRows3(result));
+  return z18.array(pullRequestRepositoryStatsSchema).parse(queryRows3(result));
 }
 async function aggregateIssueWindows2(args) {
   const starts = WINDOWS2.map(
@@ -4224,7 +4451,7 @@ async function aggregateIssueWindows2(args) {
     GROUP BY windows.days
     ORDER BY windows.days
   `);
-  return z17.array(issueStatsSchema2).parse(queryRows3(result));
+  return z18.array(issueStatsSchema2).parse(queryRows3(result));
 }
 async function aggregateIssueDays(args) {
   const end = new Date(args.nowMs);
@@ -4252,7 +4479,7 @@ async function aggregateIssueDays(args) {
     LEFT JOIN daily ON daily.day = days.day
     ORDER BY days.day
   `);
-  return z17.array(issueDaySchema).parse(queryRows3(result));
+  return z18.array(issueDaySchema).parse(queryRows3(result));
 }
 async function aggregateIssueRepositories(args) {
   const start = new Date(args.nowMs - 30 * DAY_MS3);
@@ -4289,7 +4516,7 @@ async function aggregateIssueRepositories(args) {
     ORDER BY "created" DESC, "closedCompleted" DESC, "repository" ASC
     LIMIT 25
   `);
-  return z17.array(issueRepositoryStatsSchema).parse(queryRows3(result));
+  return z18.array(issueRepositoryStatsSchema).parse(queryRows3(result));
 }
 function formatPercent2(value) {
   return value === void 0 ? "\u2014" : `${Math.round(value * 100)}%`;
@@ -4453,18 +4680,18 @@ async function buildGitHubOutcomeReport(args) {
 }
 
 // src/pull-request-outcomes/commit-composition.ts
-import { z as z18 } from "zod";
-var canonicalCommitSchema = z18.object({
-  authorEmail: z18.string().nullable(),
-  authorLogin: z18.string().nullable()
+import { z as z19 } from "zod";
+var canonicalCommitSchema = z19.object({
+  authorEmail: z19.string().nullable(),
+  authorLogin: z19.string().nullable()
 }).strict();
-var providerCommitSchema = z18.object({
-  author: z18.object({ login: z18.string() }).passthrough().nullable(),
-  commit: z18.object({
-    author: z18.object({ email: z18.string() }).passthrough().nullable()
+var providerCommitSchema = z19.object({
+  author: z19.object({ login: z19.string() }).passthrough().nullable(),
+  commit: z19.object({
+    author: z19.object({ email: z19.string() }).passthrough().nullable()
   }).passthrough()
 }).passthrough();
-var commitPageSchema = z18.array(providerCommitSchema).transform(
+var commitPageSchema = z19.array(providerCommitSchema).transform(
   (commits) => commits.map(
     (commit) => canonicalCommitSchema.parse({
       authorEmail: commit.commit.author?.email ?? null,
@@ -4911,6 +5138,63 @@ function linkifyGitHubReferences(text2) {
   }).join("\n");
 }
 
+// src/workspace-prepare.ts
+async function prepareWorkspace(ctx) {
+  const repos = ctx.repos.map((entry) => {
+    const [owner, name, ...rest] = entry.repo.split("/");
+    if (!owner || !name || rest.length > 0) {
+      throw new Error(`Invalid GitHub repository: ${entry.repo}`);
+    }
+    const segments = entry.path.split("/");
+    if (segments.length === 0 || segments.some(
+      (part) => !part || part === "." || part === ".." || !/^[A-Za-z0-9._-]+$/.test(part)
+    ) || isReservedSandboxDirectory(segments[0])) {
+      throw new Error(`Invalid workspace checkout path: ${entry.path}`);
+    }
+    return { owner, name, path: entry.path, repo: entry.repo };
+  });
+  const paths = /* @__PURE__ */ new Set();
+  for (const entry of repos) {
+    const key = entry.path.toLowerCase();
+    if (paths.has(key)) {
+      throw new Error(`Workspace checkout path collision: ${entry.path}`);
+    }
+    paths.add(key);
+  }
+  for (const { owner, name, path, repo } of repos) {
+    const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : void 0;
+    if (parent) {
+      const mkdir = await ctx.sandbox.run({
+        cmd: "mkdir",
+        args: ["-p", "--", parent],
+        cwd: ctx.sandbox.root
+      });
+      if (mkdir.exitCode !== 0) {
+        throw new Error(
+          `GitHub workspace checkout parent failed for ${repo}: ${mkdir.stderr.trim() || `exit ${mkdir.exitCode}`}`
+        );
+      }
+    }
+    const result = await ctx.sandbox.run({
+      cmd: "git",
+      args: [
+        "clone",
+        "--quiet",
+        "--depth=1",
+        "--",
+        `https://github.com/${owner}/${name}.git`,
+        path
+      ],
+      cwd: ctx.sandbox.root
+    });
+    if (result.exitCode !== 0) {
+      throw new Error(
+        `GitHub workspace clone failed for ${repo}: ${result.stderr.trim() || `exit ${result.exitCode}`}`
+      );
+    }
+  }
+}
+
 // src/plugin.ts
 function githubSmartHttpAccess(upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
@@ -5142,6 +5426,28 @@ function githubApiWriteGrantName(method, upstreamUrl) {
   }
   return void 0;
 }
+function reviewThreadResolveRepository(operation, method, upstreamUrl, bodyText) {
+  const prefix = "github.pull.review-thread.resolve:";
+  if (method !== "POST" || !isGitHubGraphqlUrl(upstreamUrl) || !operation?.startsWith(prefix)) {
+    return void 0;
+  }
+  const repository = operation.slice(prefix.length);
+  if (!/^[^/]+\/[^/]+$/.test(repository)) return void 0;
+  const parsed = parseGitHubGraphqlRequest(bodyText);
+  if (parsed?.operationName !== "ResolveReviewThread" || !/\bmutation\s+ResolveReviewThread\b/.test(parsed.normalized) || !/\bresolveReviewThread\b/.test(parsed.normalized)) {
+    return void 0;
+  }
+  return repository;
+}
+function repositoryLeaseScopeFromRef(repository) {
+  const [owner, name] = repository.split("/");
+  if (!owner || !name) {
+    throw new EgressPolicyDenied2(
+      "GitHub review thread resolution does not identify a target repository."
+    );
+  }
+  return githubRepositoryLeaseScope({ owner, name });
+}
 function isGitHubGraphqlMutation(method, upstreamUrl, bodyText, field) {
   if (method !== "POST" || !isGitHubGraphqlUrl(upstreamUrl)) return false;
   const parsed = parseGitHubGraphqlRequest(bodyText);
@@ -5233,6 +5539,20 @@ async function githubGrantForEgress(ctx) {
       repositoryLeaseScope(upstreamUrl)
     );
   }
+  const reviewThreadRepository = reviewThreadResolveRepository(
+    ctx.request.operation,
+    method,
+    upstreamUrl,
+    ctx.request.bodyText
+  );
+  if (reviewThreadRepository) {
+    return grantForAccess(
+      "write",
+      "github.installation-write",
+      "installation-write",
+      repositoryLeaseScopeFromRef(reviewThreadRepository)
+    );
+  }
   const graphqlAccess = githubGraphqlAccess(
     method,
     upstreamUrl,
@@ -5451,8 +5771,9 @@ function githubPlugin(options = {}) {
         });
       },
       tools(ctx) {
-        return createGitHubTools(ctx);
+        return createGitHubTools(ctx, readEnv(botEmailEnv));
       },
+      workspacePrepare: prepareWorkspace,
       async sandboxPrepare(ctx) {
         const hooksPath = `${ctx.sandbox.juniorRoot}/git-hooks`;
         await ctx.sandbox.writeFile({
@@ -5469,11 +5790,8 @@ function githubPlugin(options = {}) {
         if (ctx.tool.name !== "bash") {
           return;
         }
-        const botName = readEnv(botNameEnv);
-        const botEmail = readEnv(botEmailEnv);
-        if (!botName || !botEmail) {
-          return;
-        }
+        const botName = requireEnv(botNameEnv);
+        const botEmail = requireEnv(botEmailEnv);
         ctx.env.set("GIT_AUTHOR_NAME", botName);
         ctx.env.set("GIT_AUTHOR_EMAIL", botEmail);
         ctx.env.set("JUNIOR_GIT_AUTHOR_NAME", botName);

package/dist/sandbox-paths.d.ts

@@ -0,0 +1,4 @@
+/** Sandbox root directories reserved for Junior runtime material. */
+export declare const RESERVED_SANDBOX_DIRECTORIES: Set<string>;
+/** True when a checkout path collides with a reserved sandbox root (case-insensitive). */
+export declare function isReservedSandboxDirectory(path: string): boolean;

package/dist/tools/clone-repository.d.ts

@@ -7,6 +7,7 @@ export declare function createGitHubCloneRepositoryTool(ctx: ToolRegistrationHoo
     [x: string]: unknown;
     path: string;
     repo: string;
+    workspaces: string[];
     target: "cloneRepository";
     truncated?: boolean | undefined;
     continuation?: {
@@ -17,6 +18,7 @@ export declare function createGitHubCloneRepositoryTool(ctx: ToolRegistrationHoo
     [x: string]: unknown;
     path: string;
     repo: string;
+    workspaces: string[];
     target: "cloneRepository";
     truncated?: boolean | undefined;
     continuation?: {

package/dist/tools/resolve-pull-request-review-thread.d.ts

@@ -0,0 +1,30 @@
+import { type ToolRegistrationHookContext } from "@sentry/junior-plugin-api";
+/** Resolve one review thread after GitHub proves it belongs to a Junior-authored PR. */
+export declare function createGitHubResolvePullRequestReviewThreadTool(ctx: ToolRegistrationHookContext, botEmail: string | undefined): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    repo: string;
+    threadId: string;
+}, {
+    [x: string]: unknown;
+    target: "resolvePullRequestReviewThread";
+    repo: string;
+    number: number;
+    threadId: string;
+    resolved: boolean;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}, {
+    [x: string]: unknown;
+    target: "resolvePullRequestReviewThread";
+    repo: string;
+    number: number;
+    threadId: string;
+    resolved: boolean;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}>;

package/dist/tools.d.ts

@@ -1,3 +1,3 @@
 import type { PluginToolDefinition, ToolRegistrationHookContext } from "@sentry/junior-plugin-api";
 /** Build the GitHub plugin's runtime tools from their per-tool modules. */
-export declare function createGitHubTools(ctx: ToolRegistrationHookContext): Record<string, PluginToolDefinition>;
+export declare function createGitHubTools(ctx: ToolRegistrationHookContext, botEmail?: string): Record<string, PluginToolDefinition>;

package/dist/workspace-prepare.d.ts

@@ -0,0 +1,3 @@
+import type { WorkspacePrepareHookContext } from "@sentry/junior-plugin-api";
+/** Clone GitHub repositories into their host-selected Workspace paths. */
+export declare function prepareWorkspace(ctx: WorkspacePrepareHookContext): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.162.0",
+  "version": "0.164.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.162.0"
+    "@sentry/junior-plugin-api": "0.164.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/github-code/SKILL.md

@@ -5,7 +5,7 @@ description: Work with GitHub repositories, source code, branches, commits, pull
 
 # GitHub Code Operations
 
-Use `git` and `gh` for repository work. Use `github_createPullRequest`, not `gh pr create`, for new PRs. Use `github_updatePullRequest`, not raw `gh api`/`gh pr edit`, when changing PR title, body, base, or open/closed state.
+Use `git` and `gh` for repository work. Use `github_createPullRequest`, not `gh pr create`, for new PRs. Use `github_updatePullRequest`, not raw `gh api`/`gh pr edit`, when changing PR title, body, base, or open/closed state. Use `github_resolvePullRequestReviewThread`, not raw `gh api graphql` `resolveReviewThread`, when resolving review threads on Junior-authored PRs.
 
 ## References
 

package/skills/github-code/references/api-surface.md

@@ -1,6 +1,6 @@
 # GitHub API Surface — code & pull requests
 
-PR creation uses Junior's `github_createPullRequest` tool. PR title, body, base, and open/closed state updates use `github_updatePullRequest` so Junior keeps requester attribution and the conversation footer. Other supported mutations use allowlisted REST endpoints through `gh api`; generic GraphQL-backed `gh pr` mutations are not supported.
+PR creation uses Junior's `github_createPullRequest` tool. PR title, body, base, and open/closed state updates use `github_updatePullRequest` so Junior keeps requester attribution and the conversation footer. Review-thread resolve uses `github_resolvePullRequestReviewThread` because GitHub exposes only the GraphQL `resolveReviewThread` mutation (no REST endpoint and no first-class `gh pr` subcommand). Other supported mutations use allowlisted REST endpoints through `gh api`; generic GraphQL-backed `gh pr` mutations are not supported.
 
 ## Repo scoping
 
@@ -50,6 +50,7 @@ Treat explicit repo flags as command-targeting safety rails, not as a credential
 | Submit pull request review         | `gh api repos/owner/repo/pulls/NUMBER/reviews --method POST --input review.json`                                         |
 | Post inline review comment         | `gh api repos/owner/repo/pulls/NUMBER/comments --method POST --input comment.json`                                       |
 | Reply to inline review comment     | `gh api repos/owner/repo/pulls/NUMBER/comments/COMMENT_ID/replies --method POST --input reply.json`                      |
+| Resolve review thread              | `github_resolvePullRequestReviewThread({ repo: "owner/repo", threadId: "PRRT_..." })` (GraphQL `resolveReviewThread` substitute; Junior-authored PRs only) |
 | View pull request                  | `gh pr view NUMBER --repo owner/repo [--json ...]`                                                                       |
 | List pull requests                 | `gh pr list --repo owner/repo [--state open \| closed \| merged]`                                                        |
 | Diff pull request                  | `gh pr diff NUMBER --repo owner/repo`                                                                                    |
@@ -78,6 +79,7 @@ jr-rpc config set github.repo owner/repo
 - Use `github_updatePullRequest` for title, body, base, or open/closed state changes. Do not raw-`PATCH` `/repos/.../pulls/NUMBER`; that path is denied so Junior can keep the conversation footer.
 - Merge, fork creation, REST contents/Git database writes, and repository administration are outside the current write allowlist.
 - Pull request reviews and inline review comments use the same repository-scoped `installation-write` credential as other bot-owned PR writes, so they post as Junior even on headless turns. Merge remains denied.
+- Resolve review threads with `github_resolvePullRequestReviewThread`. That tool is the Junior equivalent of `gh api graphql` `resolveReviewThread`; raw GraphQL mutations stay denied, and the tool only succeeds on Junior-authored PRs.
 - If the explicit `git push` fails with 401/403 or another access/permission error, verify the repo context and retry once. If it still fails, load troubleshooting guidance and report the exact command failure.
 - PR comments, labels, and assignees use GitHub's issue endpoints; use the `github-issues` REST guidance for those operations. All allowlisted bot writes share the same repository-scoped `installation-write` credential.
 - To embed a local image in a GitHub issue, pull request, review, or comment, call `publishImage` first. That tool returns a durable public URL. The published image is public to anyone on the internet who has the URL. Embed the URL with normal GitHub Markdown. Do not use private Slack file links or conversation attachment URLs.

package/skills/github-code/references/troubleshooting-workarounds.md

@@ -19,6 +19,7 @@ Use this table to recover quickly while keeping operations deterministic.
 | `github_createPullRequest` returns 422 for `head`                                  | The head branch was not pushed or the explicit head ref is wrong.                   | Push the branch, then retry with explicit `repo`, `head`, and `base` values.                                                                                                                           |
 | `github_createPullRequest` fails with 422 validation on `base`                     | The `base` branch does not exist in the target repo.                                | Resolve the default branch with `gh repo view owner/repo --json defaultBranchRef --jq .defaultBranchRef.name`, then retry with that value as `base`.                                                   |
 | `403` names `github_updatePullRequest`                                             | Raw PR title/body/base/state PATCH was blocked so Junior can own the footer.        | Retry with `github_updatePullRequest`; do not use `gh api .../pulls/NUMBER --method PATCH` or `gh pr edit`.                                                                                            |
+| `GraphQL mutations are not enabled` / resolve thread denied                        | Raw `gh api graphql` `resolveReviewThread` is blocked.                              | Retry with `github_resolvePullRequestReviewThread({ repo, threadId })`. Only Junior-authored PRs are allowed.                                                                                          |
 | `github_updatePullRequest` returns upstream 401/403                                | The App installation or target repository does not permit the operation.            | Use the structured upstream denial to verify installation scope and accepted permissions; do not request user OAuth for this bot-owned operation.                                                      |
 | `git blame`, long log history, or old commits are missing after clone              | Repo was cloned shallow by design.                                                  | Fetch the required ref and deepen it incrementally; use `--unshallow` only when bounded deepening is insufficient.                                                                                     |
 | Rebase, merge-base, or `origin/BASE...HEAD` comparison fails or gives odd ancestry | Required ancestry or the remote-tracking base ref is absent from the shallow clone. | Fetch a bounded depth into `BASE:refs/remotes/origin/BASE`, deepen that base ref until the merge base exists, and compare or rebase against `origin/BASE`. Never force-push around incomplete history. |