@sentry/junior-github 0.184.0 → 0.185.0

package/README.md

@@ -26,8 +26,7 @@ export const plugins = defineJuniorPlugins([
 Full setup guide: https://junior.sentry.dev/extend/github-plugin/
 
 The plugin owns its signed webhook route, deployment, pull request, and release
-resource events, normalized pull request and issue outcome projections, and
-dashboard operational report. Core only owns delivery from plugin-published
+resource events, and normalized pull request and issue outcome projections.
+Those projections also feed native code-change records used by the dashboard
+Code page and person profiles. Core only owns delivery from plugin-published
 resource events into matching conversation subscriptions.
-
-Person profiles call `hooks.profileReport` for Junior-owned GitHub work attributed through conversation actors.

package/SETUP.md

@@ -111,9 +111,9 @@ pnpm exec junior upgrade
 ```
 
 The migrations create `junior_github_pull_requests` and
-`junior_github_issues`, which back webhook ingestion and the `/system` outcome
-report. When a tracked pull request merges, Junior also reads its commit list
-and records whether every Git author was Junior's configured bot or whether the
+`junior_github_issues`, which back webhook ingestion and outcome projections.
+When a tracked pull request merges, Junior also reads its commit list and
+records whether every Git author was Junior's configured bot or whether the
 pull request contained non-Junior-authored commits.
 The pull request projection also stores associated native Junior conversation
 ids as an opaque, deduplicated `text[]` without a foreign key.
@@ -138,7 +138,7 @@ githubPlugin({
 
 Installation-read token requests remain read-only by requesting read-capable configured permissions at `read` level and omitting GitHub permission fields that have no `read` value. Installation-write token requests intentionally omit the `permissions` field, so GitHub applies the complete permission envelope approved on the App installation. GitHub remains the source of truth for whether a permission name or level exists.
 
-GitHub App user-to-server tokens do not use OAuth scopes as their permission model. Their effective access is limited by the GitHub App's installed permissions, the app installation's repository access, and the requesting user's own GitHub access. Repository-scoped installation tokens instead use the App permission envelope and installation repository access without borrowing the requesting user's authority. GitHub returns an empty `scope` value for user-to-server tokens, so Junior cannot verify granted scopes from the token response.
+GitHub App user-to-server tokens do not use OAuth scopes as their permission model. Their effective access is limited by the GitHub App's installed permissions, the app installation's repository access, and the requesting user's own GitHub access. Installation tokens use the App permissions and installation repository access without borrowing the requesting user's authority. GitHub returns an empty `scope` value for user-to-server tokens, so Junior cannot verify granted scopes from the token response.
 
 If you pass `additionalUserScopes`, Junior includes those values in the authorization URL and records the requested scope string as a local reauthorization contract. This does not expand or prove GitHub API permissions. Configure provider-enforced access in the GitHub App settings; `appPermissions` only controls read-token downscoping:
 
@@ -148,16 +148,16 @@ githubPlugin({
 });
 ```
 
-Use `additionalUserScopes` only when a human-identity integration flow requires specific GitHub OAuth scope parameters in the authorization URL. Do not rely on it to authorize Junior-owned repository or workflow writes — those use repository-scoped installation tokens and the permissions approved on the GitHub App installation.
+Use `additionalUserScopes` only when a human-identity integration flow requires specific GitHub OAuth scope parameters in the authorization URL. Do not rely on it to authorize Junior-owned repository or workflow writes — those use installation tokens and the permissions approved on the GitHub App installation.
 
 ## 3) Runtime behavior
 
 - When either GitHub skill is active, authenticated `gh` and `git` commands cause the runtime to inject GitHub credentials automatically for the current turn.
-- The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations and Git smart-HTTP pushes use repository-scoped `installation-write`. User-attachment uploads to `uploads.github.com/user-attachments/assets` use `user-write`. Unknown REST writes and GraphQL mutations are denied.
+- The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations and Git smart-HTTP pushes use `installation-write`. User-attachment uploads to `uploads.github.com/user-attachments/assets` use `user-write`. Unknown REST writes and GraphQL mutations are denied.
 - `user-read` and explicitly human `user-write` operations require the actor, or an explicitly delegated user subject, to authorize the GitHub App through the private OAuth flow. Junior-owned issue, pull request, review, inline review comment, and branch operations do not fall back to user OAuth.
-- Headless resource-event turns use the `resource-event` system actor and may receive the same repository-scoped installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
+- Headless resource-event turns use the `resource-event` system actor and may receive the same installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
 - Git commits use Junior as author and committer. Resolvable human run actors are credited once with `Co-Authored-By` trailers.
-- Issued credentials are reused only within the current turn, credential leases are cached by plugin grant and repository lease scope, and upstream 403 permission denials clear the cached lease before the next retry.
+- Installation credential leases are cached on the host by grant name and reused across sandboxes until near expiry. User grants stay actor-scoped. Upstream 403 after injection clears the cached lease, issues a new token, and retries the hop once before recording permission denied.
 - Sandbox does not receive raw tokens via env; host applies Authorization header transforms for GitHub API and upload calls.
 
 ## 4) CLI usage
@@ -188,14 +188,14 @@ The plugin uses installation credentials for read-only GitHub traffic, workflow
 Committing and pushing code uses more than one GitHub surface:
 
 - Creating the local Git commit does not call GitHub. Junior sets the GitHub App bot as author and committer and credits resolvable human actors with `Co-Authored-By` trailers.
-- Pushing a branch with Git smart HTTP (`git push`) uses the repository-scoped `installation-write` grant and requires the App installation to have `Contents: write`. Workflow-file changes also require the installation to have `Workflows: write`.
+- Pushing a branch with Git smart HTTP (`git push`) uses the `installation-write` grant and requires the App installation to have `Contents: write`. Workflow-file changes also require the installation to have `Workflows: write`.
 - The smart-HTTP classifier does not distinguish Junior-managed branches or independently detect force updates or ref deletion. Use GitHub branch protection and limit the App installation to repositories where Junior may push.
 - REST Git database and ref writes are denied by the current write allowlist. Use Git smart HTTP (`git push`) for branch updates instead.
 - Opening the PR after the branch exists is separate: `github_createPullRequest` needs pull-request write permission, but it should not create or push commits itself.
 
 Fork creation is not part of the default PR path and is denied by the current write allowlist. Do not grant `Administration: write` for routine PR creation; push a branch explicitly and create the PR with `github_createPullRequest` instead.
 
-Repository scoping and the egress allowlist are the write boundaries. Credential injection is provider-domain scoped for sandbox traffic to `api.github.com` and `github.com` during turns with a signed credential context. Keep repo context explicit, and let the plugin choose the grant for the outbound request.
+The egress allowlist and App installation repositories are the write boundaries. Credential injection is provider-domain scoped for sandbox traffic to `api.github.com` and `github.com` during turns with a signed credential context. Keep repo context explicit, and let the plugin choose the grant for the outbound request.
 
 Be careful with mixed-surface PR commands. Use the allowlisted REST endpoints
 rather than GraphQL-backed `gh pr` mutation commands. PR-native title, body,

package/dist/{chunk-KXAUXJ3Q.js → chunk-QWTU33O7.js}

@@ -578,18 +578,6 @@ function githubRepositoryFromUrl(upstreamUrl) {
   const name = rawName ? decodeGitHubPathSegment(rawName) : void 0;
   return owner && name ? { owner, name } : void 0;
 }
-function githubRepositoryLeaseScope(repository) {
-  return `repository:${repository.owner.toLowerCase()}/${repository.name.toLowerCase()}`;
-}
-function githubRepositoryFromLeaseScope(leaseScope) {
-  const match = /^repository:([^/]+)\/([^/]+)$/.exec(leaseScope ?? "");
-  if (!match?.[1] || !match[2]) {
-    throw new GitHubPluginSetupError(
-      "GitHub installation write grant is missing a repository lease scope."
-    );
-  }
-  return { owner: match[1], name: match[2] };
-}
 async function resolveUserAccount(tokens) {
   const account = await githubRequest("https://api.github.com", "/user", {
     token: tokens.accessToken
@@ -769,9 +757,10 @@ async function issueInstallationToken(options) {
   }
   const appJwt = createAppJwt(appId, options.privateKeyEnv);
   const permissions = "permissions" in options ? options.permissions : typeof options.loadPermissions === "function" ? await options.loadPermissions({ appJwt, installationId }) : void 0;
+  const repositories = "repositories" in options ? options.repositories : void 0;
   const body = {
     ...permissions ? { permissions } : void 0,
-    ..."repositories" in options ? { repositories: options.repositories } : void 0
+    ...repositories ? { repositories } : void 0
   };
   const accessTokenResponse = await githubRequest(
     "https://api.github.com",
@@ -1794,8 +1783,6 @@ export {
   githubRequest,
   credentialUnavailable,
   githubRepositoryFromUrl,
-  githubRepositoryLeaseScope,
-  githubRepositoryFromLeaseScope,
   resolveUserAccount,
   issueUserCredential,
   issueInstallationToken,

package/dist/credential-support.d.ts

@@ -25,11 +25,7 @@ interface InstallationCredentialBaseOptions {
 type InstallationCredentialOptions = InstallationCredentialBaseOptions & ({
     loadPermissions?: never;
     permissions?: GitHubAppPermissions;
-    repositories: string[];
-} | {
-    loadPermissions?: never;
-    permissions: GitHubAppPermissions;
-    repositories?: never;
+    repositories?: string[];
 } | {
     loadPermissions: LoadInstallationReadPermissions;
     permissions?: never;
@@ -70,10 +66,6 @@ export declare function githubRequest(apiBase: string, path: string, params: Git
 export declare function credentialUnavailable(message: string): PluginCredentialResult;
 /** Parse a GitHub repository from an API or Git URL. */
 export declare function githubRepositoryFromUrl(upstreamUrl: URL): GitHubRepository | undefined;
-/** Build the stable lease scope for a GitHub repository. */
-export declare function githubRepositoryLeaseScope(repository: GitHubRepository): string;
-/** Parse the repository bound to an installation-write lease. */
-export declare function githubRepositoryFromLeaseScope(leaseScope: string | undefined): GitHubRepository;
 /** Resolve the GitHub account associated with stored user tokens. */
 export declare function resolveUserAccount(tokens: PluginStoredTokens): Promise<PluginProviderAccount>;
 /** Issue a bounded GitHub user credential for an approved grant. */