@sentry/junior-github 0.199.0 → 0.201.0

package/dist/resource-events/pull-request.d.ts

@@ -1,6 +1,8 @@
 import { type SubscribableResource } from "@sentry/junior-plugin-api";
 export declare const GITHUB_PULL_REQUEST_EVENTS: readonly ["pull_request.checks.failed", "pull_request.checks.recovered", "pull_request.comment.created", "pull_request.opened", "pull_request.ready_for_review", "pull_request.review.approved", "pull_request.review.changes_requested", "pull_request.review.commented", "pull_request.review_comment.created", "pull_request.merged", "pull_request.closed_unmerged"];
 export type GitHubPullRequestEvent = (typeof GITHUB_PULL_REQUEST_EVENTS)[number];
+/** Combine provider defaults with app guidance for pull request events. */
+export declare function gitHubPullRequestEventGuidance(guidance?: Partial<Record<GitHubPullRequestEvent, string>>): Partial<Record<GitHubPullRequestEvent, string>>;
 /** App-configured pull request resource event behavior. */
 export interface GitHubPullRequestEventOptions {
     /** App guidance applied within the matching subscription or event task instruction. */

package/dist/testing.js

@@ -1,6 +1,6 @@
 import {
   normalizeGitHubResourceEvents
-} from "./chunk-6OPIFILN.js";
+} from "./chunk-F2PJG6AF.js";
 export {
   normalizeGitHubResourceEvents
 };

package/dist/tools/submit-pull-request-review.d.ts

@@ -0,0 +1,42 @@
+import { type PluginEgress } from "@sentry/junior-plugin-api";
+/** Submit a comment or change-request review through GitHub's REST API. */
+export declare function createGitHubSubmitPullRequestReviewTool(egress: PluginEgress): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    repo: string;
+    number: number;
+    event: "COMMENT" | "REQUEST_CHANGES";
+    body: string;
+    comments?: {
+        path: string;
+        body: string;
+        line: number;
+        side: "LEFT" | "RIGHT";
+        startLine?: number | undefined;
+        startSide?: "LEFT" | "RIGHT" | undefined;
+    }[] | undefined;
+}, {
+    [x: string]: unknown;
+    target: "submitPullRequestReview";
+    repo: string;
+    number: number;
+    reviewId: number;
+    state: string;
+    url: string;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}, {
+    [x: string]: unknown;
+    target: "submitPullRequestReview";
+    repo: string;
+    number: number;
+    reviewId: number;
+    state: string;
+    url: string;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}>;

package/dist/tools/update-pull-request-feedback.d.ts

@@ -0,0 +1,59 @@
+import { type PluginEgress } from "@sentry/junior-plugin-api";
+/**
+ * GitHub has reactions but no feedback state. This tool maps each state to a
+ * reaction and keeps at most one state reaction that Junior owns. It does not
+ * change reactions from other users.
+ */
+declare const STATUS_TO_REACTION_CONTENT: {
+    readonly reviewing: "eyes";
+    readonly addressed: "+1";
+    readonly declined: "-1";
+};
+type FeedbackStatus = keyof typeof STATUS_TO_REACTION_CONTENT;
+type PullRequestCommentKind = "conversation" | "review";
+/** Build the GitHub API path for one pull request comment's reactions. */
+export declare function pullRequestCommentReactionsPath(input: {
+    owner: string;
+    name: string;
+    commentKind: PullRequestCommentKind;
+    commentId: number;
+}): string;
+/** Return the GitHub reaction for one feedback state. */
+export declare function pullRequestFeedbackReactionContent(status: FeedbackStatus): (typeof STATUS_TO_REACTION_CONTENT)[FeedbackStatus];
+/**
+ * Set Junior's feedback reaction on a pull request comment. Replace only
+ * state reactions Junior previously added to the same comment.
+ */
+export declare function createGitHubUpdatePullRequestFeedbackTool(ctx: {
+    egress: PluginEgress;
+}, botEmail: string | undefined): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    repo: string;
+    commentKind: "conversation" | "review";
+    commentId: number;
+    status: "reviewing" | "addressed" | "declined";
+}, {
+    [x: string]: unknown;
+    target: "updatePullRequestFeedback";
+    repo: string;
+    commentId: number;
+    status: "reviewing" | "addressed" | "declined";
+    reactionId: number;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}, {
+    [x: string]: unknown;
+    target: "updatePullRequestFeedback";
+    repo: string;
+    commentId: number;
+    status: "reviewing" | "addressed" | "declined";
+    reactionId: number;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}>;
+export {};

package/dist/webhooks/handler.d.ts

@@ -1,6 +1,11 @@
 import type { CodeChangePublisher, PluginConversationAnnotations, PluginLogger, PluginRoute, ResourceEventPublisher } from "@sentry/junior-plugin-api";
 import type { GitHubDb } from "../db/database.js";
 import type { GitHubPullRequestCommitComposition } from "../db/schema.js";
+interface FeedbackTarget {
+    commentId: number;
+    commentKind: "conversation" | "review";
+    repo: string;
+}
 /** Create the public, signed GitHub webhook route owned by the plugin. */
 export declare function createGitHubWebhookRoute(args: {
     annotations: PluginConversationAnnotations;
@@ -15,7 +20,9 @@ export declare function createGitHubWebhookRoute(args: {
     installationId(): string | undefined;
     installationIdEnv: string;
     log?: Pick<PluginLogger, "error">;
+    markFeedbackReviewing(input: FeedbackTarget): Promise<void>;
     privateKeyEnv: string;
     resourceEvents: ResourceEventPublisher;
     webhookSecret(): string | undefined;
 }): PluginRoute;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.199.0",
+  "version": "0.201.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.199.0"
+    "@sentry/junior-plugin-api": "0.201.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",

package/skills/github-code/SKILL.md

@@ -3,36 +3,37 @@ name: github-code
 description: Work with GitHub repositories, source code, branches, commits, pull requests, reviews, diffs, CI, and repository credentials. Use for implementation, source investigation, clone/fetch/branch workflows, PR creation or updates, review feedback, GitHub Actions checks, and repository permission failures. Prefer this skill for repository tasks even when they concern a Sentry product.
 ---
 
-# GitHub Code Operations
+# GitHub code
 
 Use `git` and `gh` for repository work.
 
-| Action | Tool / command |
-| --- | --- |
-| Create PR | `github_createPullRequest` (not `gh pr create`) |
-| Update PR title/body/base/state | `github_updatePullRequest` (not raw PATCH / `gh pr edit`) |
-| Resolve review thread | `github_resolvePullRequestReviewThread` (not raw GraphQL) |
-| Clone missing repo | `github_cloneRepository`; on Workspace match error use `switchWorkspace` |
+| Action                          | Tool / command                                                           |
+| ------------------------------- | ------------------------------------------------------------------------ |
+| Create PR                       | `github_createPullRequest` (not `gh pr create`)                          |
+| Update PR title/body/base/state | `github_updatePullRequest`                                               |
+| Submit PR review                | `github_submitPullRequestReview`                                         |
+| Resolve review thread           | `github_resolvePullRequestReviewThread`                                  |
+| Clone missing repo              | `github_cloneRepository`; on Workspace match error use `switchWorkspace` |
 
 ## Open when needed
 
-| Need | Read |
-| --- | --- |
-| Commands, permissions, allowlist | [references/api-surface.md](references/api-surface.md) |
-| Edit → verify → PR packaging | [references/workflow.md](references/workflow.md) |
-| Failed command or permission recovery | [references/troubleshooting-workarounds.md](references/troubleshooting-workarounds.md) |
+| Need                          | Read                                                                                   |
+| ----------------------------- | -------------------------------------------------------------------------------------- |
+| Commands and permissions      | [references/api-surface.md](references/api-surface.md)                                 |
+| Edit, verify, and open a PR   | [references/workflow.md](references/workflow.md)                                       |
+| Command or permission failure | [references/troubleshooting-workarounds.md](references/troubleshooting-workarounds.md) |
 
 ## Always
 
-- Resolve repo from the request, then `github.repo`. Run `jr-rpc config get github.repo` standalone.
-- Keep `--repo owner/repo` explicit on `gh`; use `git -C PATH` for local repos.
-- Read applicable `AGENTS.md` before editing. Narrower repo/task instructions win.
-- Preserve unrelated work. Never force-push, delete refs, or do destructive merges.
-- Base conclusions on repository evidence. Do not claim a check ran unless it did.
-- Push the branch before creating a bot-owned PR. Runtime injects installation credentials; never ask for a user token for bot pushes.
-- Tool-routing denials need the named tool. Only upstream denials justify permission remediation.
-- Stop for ambiguous targets, missing access, destructive ops, or unresolved upstream permission failures.
-- Unless the user opts out, finish completed edits with a pushed branch and PR (draft by default).
-- Report to the user: repo, branch, PR URL/number, local check results, and anything not run.
-
-Do not install or repair the GitHub plugin runtime from this skill. The plugin manifest owns that.
+- Use the requested repo. Otherwise read `github.repo` with standalone `jr-rpc config get github.repo`.
+- Pass `--repo owner/repo` to `gh`. Use `git -C PATH` for local repos.
+- Read each applicable `AGENTS.md` before edits.
+- Keep unrelated work. Never force-push, delete refs, or make destructive merges.
+- Use repository evidence. Report only checks you ran.
+- Push before `github_createPullRequest`. Never ask for a token for bot pushes.
+- When an error names a tool, use it. Change permissions only when GitHub rejected the request.
+- Stop for an unclear target, missing access, destructive work, or a GitHub permission failure.
+- Unless the user opts out, push completed work and open a draft PR.
+- Report repo, branch, PR, checks, and skipped checks.
+
+Do not install or repair the GitHub plugin from this skill.

package/skills/github-code/references/api-surface.md

@@ -1,56 +1,58 @@
-# GitHub API surface — code and pull requests
+# GitHub commands and permissions
 
-PR create/update and review-thread resolve use the tools named in `SKILL.md`. Other supported mutations use allowlisted REST through `gh api`. Generic GraphQL-backed `gh pr` mutations are not supported.
+Use the tools in `SKILL.md` to create or update a PR, submit a review, or resolve a review thread. Use supported REST endpoints for other writes. Do not use GraphQL mutations.
 
 ## Repo targeting
 
-When the user omits `owner/repo`, resolve with standalone `jr-rpc config get github.repo`, then pass `--repo owner/repo` on the next `gh`/`git` command. Explicit repo flags target the command; they are not a credential scope.
+If the user omits `owner/repo`, run `jr-rpc config get github.repo`. Then pass `--repo owner/repo` to `gh`.
 
 ## Permissions
 
-| Capability | Commands |
-| --- | --- |
-| `github.actions.read` | `gh run list`, `gh run view`, `gh run watch`, `gh workflow list`, `gh workflow view` |
-| `github.actions.write` | `gh workflow run`, `gh run rerun`, `gh run cancel` |
-| `github.contents.read` | `gh repo clone`, `git fetch` |
-| `github.contents.write` | Git smart-HTTP `git push` only |
-| `github.workflows.write` | Workflow-file changes on push |
-| `github.pull-requests.read` | `gh pr view`, `gh pr list`, `gh pr diff`, `gh pr checks` |
-| `github.pull-requests.write` | Typed PR create and allowlisted REST PR lifecycle |
+| Capability                   | Commands                                                                             |
+| ---------------------------- | ------------------------------------------------------------------------------------ |
+| `github.actions.read`        | `gh run list`, `gh run view`, `gh run watch`, `gh workflow list`, `gh workflow view` |
+| `github.actions.write`       | `gh workflow run`, `gh run rerun`, `gh run cancel`                                   |
+| `github.contents.read`       | `gh repo clone`, `git fetch`                                                         |
+| `github.contents.write`      | Git smart-HTTP `git push` only                                                       |
+| `github.workflows.write`     | Workflow-file changes on push                                                        |
+| `github.pull-requests.read`  | `gh pr view`, `gh pr list`, `gh pr diff`, `gh pr checks`                             |
+| `github.pull-requests.write` | GitHub tools and supported REST writes                                               |
 
 ## Commands
 
-| Operation | Command |
-| --- | --- |
-| Clone (default shallow) | `gh repo clone owner/repo [DIR] -- --depth=1` |
-| Fetch bounded base | `git -C DIR fetch --depth=N origin BASE:refs/remotes/origin/BASE` |
-| Deepen base | `git -C DIR fetch --deepen=N origin BASE:refs/remotes/origin/BASE` |
-| Unshallow | `git -C DIR fetch --unshallow origin` |
-| Shallow check | `git -C DIR rev-parse --is-shallow-repository` |
-| Branch / status | `git -C DIR branch --show-current` / `git -C DIR status --short --branch` |
-| Log / diff vs base | `git -C DIR log origin/BASE..HEAD --oneline` / `git -C DIR diff origin/BASE...HEAD` |
-| Default branch | `gh repo view owner/repo --json defaultBranchRef --jq .defaultBranchRef.name` |
-| Create branch | `git -C DIR checkout -b BRANCH` |
-| Commit | `git -C DIR add -A && git -C DIR commit -m "message"` |
-| Push | `git -C DIR push -u origin BRANCH` |
-| Workflow dispatch | `gh workflow run WORKFLOW --repo owner/repo --ref REF [-f key=value]` |
-| Rerun / cancel | `gh run rerun RUN_ID -R owner/repo [--failed]` / `gh run cancel RUN_ID -R owner/repo` |
-| Ready for review | `gh api repos/owner/repo/pulls/NUMBER/ready_for_review --method POST` |
-| Request reviewers | `gh api repos/owner/repo/pulls/NUMBER/requested_reviewers --method POST --input reviewers.json` |
-| Submit review | `gh api repos/owner/repo/pulls/NUMBER/reviews --method POST --input review.json` |
-| Inline review comment | `gh api repos/owner/repo/pulls/NUMBER/comments --method POST --input comment.json` |
-| View PR / checks | `gh pr view NUMBER --repo owner/repo` / `gh pr checks NUMBER --repo owner/repo` |
-| Diff PR | `gh pr diff NUMBER --repo owner/repo` |
-| List runs | `gh run list -R owner/repo --workflow WORKFLOW` |
-| View / watch run | `gh run view RUN_ID -R owner/repo` / `gh run watch RUN_ID -R owner/repo --exit-status` |
+| Operation               | Command                                                                                         |
+| ----------------------- | ----------------------------------------------------------------------------------------------- |
+| Clone (default shallow) | `gh repo clone owner/repo [DIR] -- --depth=1`                                                   |
+| Fetch bounded base      | `git -C DIR fetch --depth=N origin BASE:refs/remotes/origin/BASE`                               |
+| Deepen base             | `git -C DIR fetch --deepen=N origin BASE:refs/remotes/origin/BASE`                              |
+| Unshallow               | `git -C DIR fetch --unshallow origin`                                                           |
+| Shallow check           | `git -C DIR rev-parse --is-shallow-repository`                                                  |
+| Branch / status         | `git -C DIR branch --show-current` / `git -C DIR status --short --branch`                       |
+| Log / diff vs base      | `git -C DIR log origin/BASE..HEAD --oneline` / `git -C DIR diff origin/BASE...HEAD`             |
+| Default branch          | `gh repo view owner/repo --json defaultBranchRef --jq .defaultBranchRef.name`                   |
+| Create branch           | `git -C DIR checkout -b BRANCH`                                                                 |
+| Commit                  | `git -C DIR add -A && git -C DIR commit -m "message"`                                           |
+| Push                    | `git -C DIR push -u origin BRANCH`                                                              |
+| Workflow dispatch       | `gh workflow run WORKFLOW --repo owner/repo --ref REF [-f key=value]`                           |
+| Rerun / cancel          | `gh run rerun RUN_ID -R owner/repo [--failed]` / `gh run cancel RUN_ID -R owner/repo`           |
+| Ready for review        | `gh api repos/owner/repo/pulls/NUMBER/ready_for_review --method POST`                           |
+| Request reviewers       | `gh api repos/owner/repo/pulls/NUMBER/requested_reviewers --method POST --input reviewers.json` |
+| Submit review           | `github_submitPullRequestReview`                                                                |
+| Set feedback status     | `github_updatePullRequestFeedback`                                                              |
+| Resolve review thread   | `github_resolvePullRequestReviewThread`                                                         |
+| Inline review comment   | `gh api repos/owner/repo/pulls/NUMBER/comments --method POST --input comment.json`              |
+| View PR / checks        | `gh pr view NUMBER --repo owner/repo` / `gh pr checks NUMBER --repo owner/repo`                 |
+| Diff PR                 | `gh pr diff NUMBER --repo owner/repo`                                                           |
+| List runs               | `gh run list -R owner/repo --workflow WORKFLOW`                                                 |
+| View / watch run        | `gh run view RUN_ID -R owner/repo` / `gh run watch RUN_ID -R owner/repo --exit-status`          |
 
 ## Notes
 
 - Prefer `--json` where available. Pass clone flags after `--`.
-- Local commit does not call GitHub. Push uses installation credentials (`contents.write`; workflow files also need `workflows.write`).
-- Before history-dependent git work, deepen shallow clones; never force-push around missing ancestry.
-- Push head and resolve default `base` before `github_createPullRequest`.
-- Denied: merge, forks, REST contents/Git database writes, repo admin, raw PR PATCH, raw GraphQL mutations.
-- Reviews and inline comments post as the App bot via `installation-write`.
+- A local commit does not call GitHub. A push uses installation credentials. Workflow changes also need `workflows.write`.
+- Deepen a shallow clone before work that needs old history. Do not force-push to work around missing history.
+- Push `head` and read the default `base` before `github_createPullRequest`.
+- Junior does not support merges, forks, repository administration, REST content or Git database writes, direct PR update or review writes, or GraphQL mutations.
+- Reviews and inline comments use the App bot.
 - PR comments/labels/assignees use issue endpoints; load `github-issues` for those.
 - Embed local images with `publishImage` first (public URL). Do not use private Slack file links.

package/skills/github-code/references/troubleshooting-workarounds.md

@@ -1,33 +1,32 @@
-# GitHub CLI troubleshooting — code and pull requests
+# GitHub troubleshooting
 
-| Symptom | Likely cause | Fix |
-| --- | --- | --- |
-| `unknown command` from `gh` | Runtime `gh` missing or too old | Report GitHub plugin runtime dependency unavailable |
-| `unknown flag: --depth` on clone | Clone flags before `--` | `gh repo clone owner/repo -- --depth=1` |
-| Missing `--repo` | No explicit target | Resolve `github.repo`, pass `--repo owner/repo` |
-| Wrong repo authenticated | Stale default | Pass `--repo owner/repo` or update `github.repo` |
-| GraphQL: could not resolve repository | Bad slug or no access | Validate `owner/repo` and App install |
-| 401 Unauthorized | Credential rejected | Confirm target; distinguish user OAuth vs installation setup |
-| `junior-auth-required` `user-write` | Missing/stale user OAuth | Follow private OAuth prompt; never ask for pasted tokens |
-| `git push` 401/403 | Install scope, remote, or permissions | Verify remote/repo, retry once, then report install scope |
-| `permission_denied` `source: "upstream"` | GitHub 403 after inject | Not a local runtime block; use grant/account/SSO fields |
-| 403 without upstream `permission_denied` | Local policy denial | Read body; follow required-tool guidance |
-| `Token scopes: none` on `gh auth status` | Normal for App user tokens | Use App permissions / accepted-permissions headers |
-| `github_createPullRequest` 401/403 | Install/repo lacks write | Report install scope; do not fall back to user OAuth |
-| Create PR 422 on `head` | Branch not pushed | Push branch; retry with explicit head/base |
-| Create/update PR 422 on `base` | Base missing | Resolve default branch; retry |
-| 403 names `github_updatePullRequest` | Raw PR PATCH blocked | Use `github_updatePullRequest` |
-| GraphQL mutations not enabled | Raw resolve blocked | Use `github_resolvePullRequestReviewThread` (bot-authored PRs only) |
-| Missing blame/old history | Shallow clone | Deepen needed refs; `--unshallow` only if required |
-| Odd ancestry / rebase fails | Base ref missing locally | Fetch `BASE:refs/remotes/origin/BASE`, deepen, use `origin/BASE` |
-| Missing deps in tests | Not installed | Frozen/immutable install for the lockfile; do not rewrite lockfile |
-| Frozen install fails | Drift or registry | Report exact failure |
-| `dnf install gh failed` | Plugin bootstrap | Report runtime bootstrap failure; do not repair from skill |
+| Problem                                                    | Action                                                                                    |
+| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
+| `gh` reports an unknown command                            | Report that the GitHub plugin is unavailable. Do not install it.                          |
+| Clone rejects `--depth`                                    | Put clone flags after `--`: `gh repo clone owner/repo -- --depth=1`.                      |
+| Repository is missing or wrong                             | Read `github.repo`, then pass `--repo owner/repo`.                                        |
+| GraphQL cannot find the repository                         | Check `owner/repo` and the GitHub App installation.                                       |
+| `junior-auth-required` with `user-write`                   | Follow the private OAuth prompt. Never ask for a pasted token.                            |
+| `git push` returns 401 or 403                              | Check the remote and repository. Retry once, then report the installation access failure. |
+| `permission_denied` has `source: "upstream"`               | GitHub rejected the request. Report the grant, account, or SSO details.                   |
+| Other 403 response                                         | Read the error and use the tool it names.                                                 |
+| `gh auth status` shows no token scopes                     | This is normal for GitHub App user tokens. Check App permissions instead.                 |
+| `github_createPullRequest` returns 401 or 403              | Report the installation access failure. Do not use user OAuth.                            |
+| PR creation returns 422 for `head`                         | Push the branch, then retry with explicit `head` and `base`.                              |
+| PR create or update returns 422 for `base`                 | Read the default branch, then retry.                                                      |
+| 403 names `github_updatePullRequest`                       | Use `github_updatePullRequest`.                                                           |
+| PR review reports blocked GraphQL mutations                | Use `github_submitPullRequestReview`.                                                     |
+| Review-thread resolution reports blocked GraphQL mutations | Use `github_resolvePullRequestReviewThread`. It works only on bot-authored PRs.           |
+| Blame or old history is missing                            | Deepen the needed refs. Unshallow only when required.                                     |
+| Rebase has missing ancestry                                | Fetch `BASE:refs/remotes/origin/BASE`, deepen it, and use `origin/BASE`.                  |
+| Dependencies are missing                                   | Run the frozen install. Do not change the lockfile.                                       |
+| Frozen install fails                                       | Report the exact failure.                                                                 |
+| Plugin setup fails                                         | Report the setup failure. Do not repair it from the skill.                                |
 
 ## Retry rules
 
-- Retry once for transient transport after verifying repo context.
-- Do not loop on repeated 401/403/404 validation errors.
-- `user-read`/`user-write` gaps → private App OAuth. `installation-*` failures → App permission/install/host setup only.
-- Prefer `permission_denied` structured fields over guessing.
-- Persistent permission problems: report remediation and stop.
+- Retry a transport failure once after you check the repository.
+- Do not repeat 401, 403, 404, or validation failures.
+- A `user-read` or `user-write` failure needs private App OAuth.
+- An `installation-*` failure needs an App permission or installation fix.
+- Use structured `permission_denied` details when present.