@sentry/junior-github 0.206.0 → 0.208.0

package/README.md

@@ -26,7 +26,7 @@ export const plugins = defineJuniorPlugins([
 Full setup guide: https://junior.sentry.dev/extend/github-plugin/
 
 The plugin owns its signed webhook route, deployment, pull request, and release
-resource events, and normalized pull request and issue outcome projections.
+events, and normalized pull request and issue outcome projections.
 Those projections also feed native code-change records used by the dashboard
 Code page and person profiles. Core only owns delivery from plugin-published
-resource events into matching conversation subscriptions.
+events into matching conversation subscriptions.

package/SETUP.md

@@ -155,7 +155,7 @@ Use `additionalUserScopes` only when a human-identity integration flow requires
 - When either GitHub skill is active, authenticated `gh` and `git` commands cause the runtime to inject GitHub credentials automatically for the current turn.
 - The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations and Git smart-HTTP pushes use `installation-write`. User-attachment uploads to `uploads.github.com/user-attachments/assets` use `user-write`. Unknown REST writes and GraphQL mutations are denied.
 - `user-read` and explicitly human `user-write` operations require the actor, or an explicitly delegated user subject, to authorize the GitHub App through the private OAuth flow. Junior-owned issue, pull request, review, inline review comment, and branch operations do not fall back to user OAuth.
-- Headless resource-event turns use the `resource-event` system actor and may receive the same installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
+- Headless event turns use the `event` system actor and may receive the same installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
 - Git commits use Junior as author and committer. Resolvable human run actors are credited once with `Co-Authored-By` trailers. When the current actor has a linked GitHub identity, Junior prefers a GitHub noreply address so external automation can resolve a login for assignment.
 - Installation credential leases are cached on the host by grant name and reused across sandboxes until near expiry. User grants stay actor-scoped. Upstream 403 after injection clears the cached lease, issues a new token, and retries the hop once before recording permission denied.
 - Sandbox does not receive raw tokens via env; host applies Authorization header transforms for GitHub API and upload calls.

package/dist/{chunk-F2PJG6AF.js → chunk-XP2336UO.js}

@@ -1,7 +1,7 @@
-// src/webhooks/resource-events.ts
+// src/webhooks/events.ts
 import { z as z2 } from "zod";
 
-// src/resource-events/deployment.ts
+// src/events/deployment.ts
 var GITHUB_DEPLOYMENT_EVENTS = [
   "deployment.created",
   "deployment.queued",
@@ -36,7 +36,7 @@ function gitHubDeploymentSourceSubscribable(input) {
   };
 }
 
-// src/resource-events/issue.ts
+// src/events/issue.ts
 var GITHUB_ISSUE_EVENTS = [
   "issue.comment.created",
   "issue.opened",
@@ -65,9 +65,9 @@ function gitHubIssueSubscribable(input) {
   };
 }
 
-// src/resource-events/pull-request.ts
+// src/events/pull-request.ts
 import {
-  resourceEventMatchFieldsSchema
+  eventMatchFieldsSchema
 } from "@sentry/junior-plugin-api";
 var GITHUB_PULL_REQUEST_EVENTS = [
   "pull_request.checks.failed",
@@ -106,7 +106,7 @@ var GITHUB_PULL_REQUEST_SUGGESTED_EVENTS = [
   "pull_request.merged",
   "pull_request.closed_unmerged"
 ];
-var GITHUB_PULL_REQUEST_MATCH_FIELDS = resourceEventMatchFieldsSchema.parse({
+var GITHUB_PULL_REQUEST_MATCH_FIELDS = eventMatchFieldsSchema.parse({
   authorEmail: {
     kind: "string",
     description: "pull request author email when GitHub sends it"
@@ -145,7 +145,7 @@ function gitHubPullRequestSubscribable(input) {
   };
 }
 
-// src/resource-events/release.ts
+// src/events/release.ts
 var GITHUB_RELEASE_EVENTS = ["release.published"];
 var GITHUB_RELEASE_SUGGESTED_EVENTS = ["release.published"];
 function gitHubReleaseSourceResource(input) {
@@ -167,7 +167,7 @@ function gitHubReleaseSourceSubscribable(input) {
   };
 }
 
-// src/resource-events/repository.ts
+// src/events/repository.ts
 function gitHubRepositoryResource(input) {
   return {
     label: `GitHub repository ${input.repo}`,
@@ -921,7 +921,7 @@ function checkSuiteHeadBranch(value) {
   const branch = value?.trim();
   return branch ? branch : void 0;
 }
-function buildCheckSuiteResourceEvent(args) {
+function buildCheckSuiteEvent(args) {
   const pullRequestNumber = args.pullRequestNumber;
   const resource = pullRequestNumber === void 0 ? gitHubRepositoryResource({ repo: args.repo }) : gitHubPullRequestResource({
     number: pullRequestNumber,
@@ -1037,7 +1037,7 @@ function normalizeCheckSuiteEvents(deliveryId, body, options) {
   );
   if (sameRepoPullRequests.length === 0) {
     return [
-      buildCheckSuiteResourceEvent({
+      buildCheckSuiteEvent({
         ...shared,
         ...headBranch ? { headBranch } : void 0
       })
@@ -1047,7 +1047,7 @@ function normalizeCheckSuiteEvents(deliveryId, body, options) {
     const facts = options?.pullRequestFactsByNumber?.[pullRequest.number];
     const pullRequestHeadBranch = checkSuiteHeadBranch(pullRequest.head?.ref) ?? headBranch;
     return pullRequestTargets(
-      buildCheckSuiteResourceEvent({
+      buildCheckSuiteEvent({
         ...shared,
         ...facts?.authorEmail ? { authorEmail: facts.authorEmail } : void 0,
         ...facts?.authorUsername ? { authorUsername: facts.authorUsername } : void 0,
@@ -1070,7 +1070,8 @@ function parseCheckSuitePublishTargets(body) {
     gitHubRepositoryResource({ repo }).identifier
   ]);
   for (const pullRequest of parsed.data.check_suite.pull_requests) {
-    if (!isCheckSuiteRepositoryPullRequest(pullRequest, repository.id)) continue;
+    if (!isCheckSuiteRepositoryPullRequest(pullRequest, repository.id))
+      continue;
     identifiers.add(
       gitHubPullRequestResource({ number: pullRequest.number, repo }).identifier
     );
@@ -1223,7 +1224,7 @@ async function loadCheckSuiteFacts(args) {
   return facts.failingChecks || facts.pullRequestFactsByNumber ? facts : void 0;
 }
 
-// src/webhooks/resource-events.ts
+// src/webhooks/events.ts
 function gitHubEventKey2(deliveryId, eventType) {
   return `github:${deliveryId}:${eventType}`;
 }
@@ -1799,7 +1800,7 @@ function normalizeReleaseEvent(deliveryId, body) {
     })
   );
 }
-function normalizeGitHubResourceEvents(args) {
+function normalizeGitHubEvents(args) {
   switch (args.eventName) {
     case "deployment":
       return normalizeDeploymentEvent(args.deliveryId, args.body);
@@ -1872,5 +1873,5 @@ export {
   parseCheckSuitePublishTargets,
   needsCheckSuitePullRequestFacts,
   loadCheckSuiteFacts,
-  normalizeGitHubResourceEvents
+  normalizeGitHubEvents
 };

package/dist/{resource-events → events}/pull-request.d.ts

@@ -3,9 +3,9 @@ export declare const GITHUB_PULL_REQUEST_EVENTS: readonly ["pull_request.checks.
 export type GitHubPullRequestEvent = (typeof GITHUB_PULL_REQUEST_EVENTS)[number];
 /** Combine provider defaults with app guidance for pull request events. */
 export declare function gitHubPullRequestEventGuidance(guidance?: Partial<Record<GitHubPullRequestEvent, string>>): Partial<Record<GitHubPullRequestEvent, string>>;
-/** App-configured pull request resource event behavior. */
+/** App-configured pull request event behavior. */
 export interface GitHubPullRequestEventOptions {
-    /** App guidance applied within the matching subscription or event task instruction. */
+    /** App guidance applied within the matching subscription or event automation instruction. */
     guidance?: Partial<Record<GitHubPullRequestEvent, string>>;
     /** Temporary subscription created after Junior creates a pull request. */
     subscribeAfterCreate?: GitHubPullRequestSubscriptionConfig;

package/dist/index.js

@@ -35,7 +35,7 @@ import {
   issueUserCredential,
   loadCheckSuiteFacts,
   needsCheckSuitePullRequestFacts,
-  normalizeGitHubResourceEvents,
+  normalizeGitHubEvents,
   normalizePermissions,
   normalizeScopeList,
   parseCheckSuitePublishTargets,
@@ -43,7 +43,7 @@ import {
   readGrantPermissions,
   requireEnv,
   resolveUserAccount
-} from "./chunk-F2PJG6AF.js";
+} from "./chunk-XP2336UO.js";
 
 // src/plugin.ts
 import {
@@ -703,7 +703,7 @@ function createGitHubIssueTool(ctx) {
             return gitHubIssueToolResult(
               completedInput,
               completedResult,
-              ctx.resourceEvents.canSubscribe
+              ctx.events.canSubscribe
             );
           }
           if (state?.status === "pending") {
@@ -746,7 +746,7 @@ function createGitHubIssueTool(ctx) {
             return gitHubIssueToolResult(
               parsedInput,
               result,
-              ctx.resourceEvents.canSubscribe
+              ctx.events.canSubscribe
             );
           } catch (error) {
             if (isEgressAuthRequired(error) || isDefinitiveGitHubIssueCreateRejection(error)) {
@@ -942,7 +942,7 @@ function createGitHubGetDeploymentTool(ctx) {
           url: `https://github.com/${repo.ref}/deployments`
         };
       }
-      const subscribable = ctx.resourceEvents.canSubscribe ? gitHubDeploymentSourceSubscribable({
+      const subscribable = ctx.events.canSubscribe ? gitHubDeploymentSourceSubscribable({
         commitSha,
         environment: input.environment,
         repo: repo.ref
@@ -968,7 +968,7 @@ import {
   EgressAuthRequired as EgressAuthRequired2,
   PluginToolInputError as PluginToolInputError5,
   pluginToolOutputSchema as pluginToolOutputSchema4,
-  resourceEventSubscriptionResultSchema,
+  watchResultSchema,
   subscribableResourceSchema as subscribableResourceSchema3
 } from "@sentry/junior-plugin-api";
 import { Type as Type2 } from "@sinclair/typebox";
@@ -1045,7 +1045,7 @@ var gitHubPullRequestDataSchema = z4.object({
   number: z4.number(),
   url: z4.string(),
   subscribable: subscribableResourceSchema3.optional(),
-  subscription: resourceEventSubscriptionResultSchema.optional()
+  subscription: watchResultSchema.optional()
 });
 var gitHubPullRequestOutputSchema = pluginToolOutputSchema4.merge(
   gitHubPullRequestDataSchema.extend({
@@ -1223,7 +1223,7 @@ async function gitHubPullRequestStructuredResult(ctx, input, result, subscriptio
   const base = gitHubPullRequestToolResult(
     input,
     result,
-    ctx.resourceEvents.canSubscribe
+    ctx.events.canSubscribe
   );
   if (!subscriptionConfig || !base.subscribable) {
     return {
@@ -1232,7 +1232,7 @@ async function gitHubPullRequestStructuredResult(ctx, input, result, subscriptio
     };
   }
   try {
-    const subscription = await ctx.resourceEvents.subscribe({
+    const subscription = await ctx.events.subscribe({
       events: subscriptionConfig.events,
       intent: subscriptionConfig.intent,
       resource: base.subscribable
@@ -1240,7 +1240,7 @@ async function gitHubPullRequestStructuredResult(ctx, input, result, subscriptio
     const data = gitHubPullRequestToolResult(
       input,
       result,
-      ctx.resourceEvents.canSubscribe,
+      ctx.events.canSubscribe,
       subscriptionConfig.events
     );
     return {
@@ -1408,7 +1408,7 @@ function createGitHubGetPullRequestTool(ctx) {
       openWorldHint: true,
       readOnlyHint: true
     },
-    description: "Get a GitHub pull request. Use this when an existing PR may need resource-event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
+    description: "Get a GitHub pull request. Use this when an existing PR may need event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
     inputSchema: inputSchema3,
     outputSchema: outputSchema3,
     async execute(input) {
@@ -1444,7 +1444,7 @@ function createGitHubGetPullRequestTool(ctx) {
         state: z5.string(),
         title: z5.string()
       }).parse(parsed);
-      const subscribable = ctx.resourceEvents.canSubscribe ? gitHubPullRequestSubscribable({
+      const subscribable = ctx.events.canSubscribe ? gitHubPullRequestSubscribable({
         number: providerResult.number,
         repo: repo.ref
       }) : void 0;
@@ -1606,7 +1606,7 @@ function createGitHubGetReleaseTool(ctx) {
           );
         }
       }
-      const subscribable = ctx.resourceEvents.canSubscribe ? gitHubReleaseSourceSubscribable({
+      const subscribable = ctx.events.canSubscribe ? gitHubReleaseSourceSubscribable({
         repo: repo.ref,
         tag
       }) : void 0;
@@ -1672,7 +1672,7 @@ function createGitHubGetRepositoryTool(ctx) {
       openWorldHint: true,
       readOnlyHint: true
     },
-    description: "Get a GitHub repository. Use this when repository-wide issue activity may need resource-event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
+    description: "Get a GitHub repository. Use this when repository-wide issue activity may need event monitoring; the result includes a subscribable hint when GitHub webhooks are configured.",
     inputSchema: inputSchema5,
     outputSchema: outputSchema5,
     async execute(input) {
@@ -1703,7 +1703,7 @@ function createGitHubGetRepositoryTool(ctx) {
         html_url: z7.string(),
         private: z7.boolean()
       }).parse(parsed);
-      const subscribable = ctx.resourceEvents.canSubscribe ? gitHubRepositorySubscribable({
+      const subscribable = ctx.events.canSubscribe ? gitHubRepositorySubscribable({
         repo: providerResult.full_name
       }) : void 0;
       const data = {
@@ -1843,7 +1843,7 @@ function createGitHubUpdateIssueTool(ctx) {
         state: z8.string(),
         title: z8.string()
       }).parse(parsed);
-      const subscribable = ctx.resourceEvents.canSubscribe ? gitHubIssueSubscribable({
+      const subscribable = ctx.events.canSubscribe ? gitHubIssueSubscribable({
         number: providerResult.number,
         repo: repo.ref
       }) : void 0;
@@ -1990,7 +1990,7 @@ function createGitHubUpdatePullRequestTool(ctx) {
         state: z9.string(),
         title: z9.string()
       }).parse(parsed);
-      const subscribable = ctx.resourceEvents.canSubscribe ? gitHubPullRequestSubscribable({
+      const subscribable = ctx.events.canSubscribe ? gitHubPullRequestSubscribable({
         number: providerResult.number,
         repo: repo.ref
       }) : void 0;
@@ -2108,7 +2108,7 @@ function createGitHubUpdatePullRequestFeedbackTool(ctx, botEmail) {
       openWorldHint: true,
       readOnlyHint: false
     },
-    description: "Set Junior's status reaction on GitHub pull request feedback: reviewing (eyes), addressed (+1), or declined (-1). Use the commentId and commentKind from the resource event. Replaces only Junior's prior status reaction on that comment.",
+    description: "Set Junior's status reaction on GitHub pull request feedback: reviewing (eyes), addressed (+1), or declined (-1). Use the commentId and commentKind from the event. Replaces only Junior's prior status reaction on that comment.",
     exposure: "direct",
     inputSchema: inputSchema8,
     outputSchema: outputSchema8,
@@ -3400,7 +3400,7 @@ function createGitHubWebhookRoute(args) {
         pullRequestLinkedIssues
       ) : false;
       const checkSuitePublishTargets = eventName === "check_suite" ? parseCheckSuitePublishTargets(body) : void 0;
-      const checkSuiteMatchKeys = checkSuitePublishTargets && args.resourceEvents.neededMatchKeys ? await args.resourceEvents.neededMatchKeys(checkSuitePublishTargets) : [];
+      const checkSuiteMatchKeys = checkSuitePublishTargets && args.events.neededMatchKeys ? await args.events.neededMatchKeys(checkSuitePublishTargets) : [];
       const checkSuiteFacts = eventName === "check_suite" ? await loadCheckSuiteFacts({
         appIdEnv: args.appIdEnv,
         body,
@@ -3409,15 +3409,17 @@ function createGitHubWebhookRoute(args) {
         log: args.log,
         privateKeyEnv: args.privateKeyEnv
       }) : void 0;
-      const resourceEvents = normalizeGitHubResourceEvents({
+      const events = normalizeGitHubEvents({
         body,
         ...checkSuiteFacts ? { checkSuiteFacts } : void 0,
         deliveryId,
         eventName
       });
-      const feedbackTarget = pullRequestFeedbackTarget(resourceEvents);
-      const hasMatch = args.resourceEvents.hasMatch;
-      const feedbackHasMatch = feedbackTarget && hasMatch ? (await Promise.all(resourceEvents.map((event) => hasMatch(event)))).some(Boolean) : false;
+      const feedbackTarget = pullRequestFeedbackTarget(events);
+      const hasMatch = args.events.hasMatch;
+      const feedbackHasMatch = feedbackTarget && hasMatch ? (await Promise.all(events.map((event) => hasMatch(event)))).some(
+        Boolean
+      ) : false;
       if (feedbackTarget && feedbackHasMatch) {
         try {
           await args.markFeedbackReviewing(feedbackTarget);
@@ -3430,10 +3432,10 @@ function createGitHubWebhookRoute(args) {
           });
         }
       }
-      for (const event of resourceEvents) {
-        await args.resourceEvents.publish(event);
+      for (const event of events) {
+        await args.events.publish(event);
       }
-      if (!pullRequestOutcome && !issueOutcome && !recordedIssueConversations && !recordedPullRequestConversations && !recordedPullRequestLinkedIssues && resourceEvents.length === 0) {
+      if (!pullRequestOutcome && !issueOutcome && !recordedIssueConversations && !recordedPullRequestConversations && !recordedPullRequestLinkedIssues && events.length === 0) {
         return new Response("Ignored", { status: 202 });
       }
       return new Response("Accepted", { status: 202 });
@@ -3908,6 +3910,7 @@ async function prepareWorkspace(ctx) {
     GIT_CONFIG_GLOBAL: "/dev/null",
     GIT_CONFIG_NOSYSTEM: "1"
   };
+  const finalize = [];
   for (const { owner, name, path, repo } of repos) {
     const parent = path.includes("/") ? path.slice(0, path.lastIndexOf("/")) : void 0;
     if (parent) {
@@ -3943,7 +3946,9 @@ async function prepareWorkspace(ctx) {
       env: gitEnv
     }) : void 0;
     const detachedSha = detachedHead?.stdout.trim();
-    const validDetachedSha = detachedHead?.exitCode === 0 && detachedSha && /^[0-9a-f]{40,64}$/.test(detachedSha) ? detachedSha : void 0;
+    const validDetachedHead = Boolean(
+      detachedHead?.exitCode === 0 && detachedSha && /^[0-9a-f]{40,64}$/.test(detachedSha)
+    );
     const upstream = branch?.exitCode === 0 && branchName ? await ctx.sandbox.run({
       cmd: "git",
       args: [
@@ -3959,91 +3964,23 @@ async function prepareWorkspace(ctx) {
     const upstreamRef = upstream?.stdout.trim();
     const upstreamPrefix = "refs/remotes/origin/";
     const upstreamBranch = upstreamRef?.startsWith(upstreamPrefix) ? upstreamRef.slice(upstreamPrefix.length) : void 0;
-    if (worktree.exitCode === 0 && (branchName || validDetachedSha)) {
-      const localBranch = branchName || "workspace-detached";
-      const remoteBranch = upstreamBranch || branchName;
-      const remoteRef = remoteBranch ? `${upstreamPrefix}${remoteBranch}` : validDetachedSha;
-      const tempDir = await ctx.sandbox.run({
-        cmd: "mktemp",
-        args: ["-d", `${ctx.sandbox.juniorRoot}/workspace-refresh.XXXXXX`],
-        cwd: ctx.sandbox.root
-      });
-      const refreshGitDir = tempDir.stdout.trim();
-      if (tempDir.exitCode !== 0 || !refreshGitDir) {
-        throw new Error(
-          `GitHub workspace refresh temp directory failed for ${repo}: ${tempDir.stderr.trim() || `exit ${tempDir.exitCode}`}`
-        );
-      }
-      for (const args of [
-        [
-          "--git-dir",
-          refreshGitDir,
-          "--work-tree",
-          path,
-          "init",
-          "--quiet",
-          "--initial-branch",
-          localBranch
-        ],
-        [
-          "--git-dir",
-          refreshGitDir,
-          "--work-tree",
-          path,
-          "remote",
-          "add",
-          "origin",
-          cloneUrl
-        ],
-        [
-          "--git-dir",
-          refreshGitDir,
-          "--work-tree",
-          path,
-          "fetch",
-          "--quiet",
-          "--prune",
-          "--tags",
-          "origin",
-          "+refs/heads/*:refs/remotes/origin/*",
-          ...validDetachedSha ? [validDetachedSha] : []
-        ],
-        ...validDetachedSha ? [
-          [
-            "--git-dir",
-            refreshGitDir,
-            "--work-tree",
-            path,
-            "update-ref",
-            "--no-deref",
-            "HEAD",
-            validDetachedSha
-          ]
-        ] : [],
-        [
-          "--git-dir",
-          refreshGitDir,
-          "--work-tree",
-          path,
-          "reset",
-          "--hard",
-          remoteRef
-        ],
-        ...remoteBranch && branchName ? [
-          [
-            "--git-dir",
-            refreshGitDir,
-            "--work-tree",
-            path,
-            "branch",
-            `--set-upstream-to=origin/${remoteBranch}`,
-            branchName
-          ]
-        ] : []
-      ]) {
+    if (worktree.exitCode === 0 && (branchName || validDetachedHead)) {
+      const target = upstreamBranch ? `${upstreamPrefix}${upstreamBranch}` : "HEAD";
+      if (upstreamBranch) {
         const result2 = await ctx.sandbox.run({
           cmd: "git",
-          args,
+          args: [
+            "-c",
+            "credential.helper=",
+            "-C",
+            path,
+            "fetch",
+            "--quiet",
+            "--no-tags",
+            "--no-recurse-submodules",
+            cloneUrl,
+            `+refs/heads/${upstreamBranch}:${target}`
+          ],
           cwd: ctx.sandbox.root,
           env: gitEnv
         });
@@ -4053,32 +3990,7 @@ async function prepareWorkspace(ctx) {
           );
         }
       }
-      for (const [cmd, args] of [
-        ["rm", ["-rf", "--", `${path}/.git`]],
-        ["mv", ["--", refreshGitDir, `${path}/.git`]]
-      ]) {
-        const result2 = await ctx.sandbox.run({
-          cmd,
-          args: [...args],
-          cwd: ctx.sandbox.root
-        });
-        if (result2.exitCode !== 0) {
-          throw new Error(
-            `GitHub workspace metadata replacement failed for ${repo}: ${result2.stderr.trim() || `exit ${result2.exitCode}`}`
-          );
-        }
-      }
-      const clean = await ctx.sandbox.run({
-        cmd: "git",
-        args: ["-C", path, "clean", "-fd"],
-        cwd: ctx.sandbox.root,
-        env: gitEnv
-      });
-      if (clean.exitCode !== 0) {
-        throw new Error(
-          `GitHub workspace refresh failed for ${repo}: ${clean.stderr.trim() || `exit ${clean.exitCode}`}`
-        );
-      }
+      finalize.push({ path, repo, target });
       continue;
     }
     const cleanup = await ctx.sandbox.run({
@@ -4102,7 +4014,28 @@ async function prepareWorkspace(ctx) {
         `GitHub workspace clone failed for ${repo}: ${result.stderr.trim() || `exit ${result.exitCode}`}`
       );
     }
+    finalize.push({ path, repo, target: "HEAD" });
   }
+  return async () => {
+    for (const { path, repo, target } of finalize) {
+      for (const args of [
+        ["-C", path, "reset", "--hard", target],
+        ["-C", path, "clean", "-fd"]
+      ]) {
+        const result = await ctx.sandbox.run({
+          cmd: "git",
+          args,
+          cwd: ctx.sandbox.root,
+          env: gitEnv
+        });
+        if (result.exitCode !== 0) {
+          throw new Error(
+            `GitHub workspace refresh failed for ${repo}: ${result.stderr.trim() || `exit ${result.exitCode}`}`
+          );
+        }
+      }
+    }
+  };
 }
 
 // src/egress-policy.ts
@@ -4576,7 +4509,7 @@ function githubPlugin(options = {}) {
   const userScope = userScopes.length ? userScopes.join(" ") : void 0;
   return defineJuniorPlugin({
     packageName: "@sentry/junior-github",
-    resourceEvents: {
+    events: {
       resourceTypes: [
         {
           type: "deployment_source",
@@ -4770,7 +4703,7 @@ function githubPlugin(options = {}) {
               );
             },
             privateKeyEnv,
-            resourceEvents: ctx.resourceEvents,
+            events: ctx.events,
             webhookSecret: () => readEnv("GITHUB_WEBHOOK_SECRET")
           })
         ];

package/dist/plugin.d.ts

@@ -1,11 +1,11 @@
 /**
  * GitHub plugin runtime boundary.
  *
- * This module composes GitHub hooks, resource events, and credentials.
+ * This module composes GitHub hooks, events, and credentials.
  */
 import { type PluginRegistration } from "@sentry/junior-plugin-api";
 import { type GitHubAppPermissions } from "./permissions.js";
-import { type GitHubPullRequestEventOptions } from "./resource-events/pull-request.js";
+import { type GitHubPullRequestEventOptions } from "./events/pull-request.js";
 /** Configure the built-in GitHub plugin manifest and hooks. */
 export interface GitHubPluginOptions {
     /**
@@ -40,7 +40,7 @@ export interface GitHubPluginOptions {
     installationIdEnv?: string;
     /** Environment variable containing the GitHub App private key. */
     privateKeyEnv?: string;
-    /** App-configured pull request resource event behavior. */
+    /** App-configured pull request event behavior. */
     pullRequestEvents?: GitHubPullRequestEventOptions;
 }
 /** Register GitHub runtime hooks for repository workflows. */

package/dist/testing.d.ts

@@ -1,2 +1,2 @@
 /** Test-only access to GitHub webhook normalization for runtime eval fixtures. */
-export { normalizeGitHubResourceEvents } from "./webhooks/resource-events.js";
+export { normalizeGitHubEvents } from "./webhooks/events.js";

package/dist/testing.js

@@ -1,6 +1,6 @@
 import {
-  normalizeGitHubResourceEvents
-} from "./chunk-F2PJG6AF.js";
+  normalizeGitHubEvents
+} from "./chunk-XP2336UO.js";
 export {
-  normalizeGitHubResourceEvents
+  normalizeGitHubEvents
 };

package/dist/tools/create-pull-request.d.ts

@@ -1,5 +1,5 @@
 import { type ToolRegistrationHookContext } from "@sentry/junior-plugin-api";
-import { type GitHubPullRequestSubscriptionConfig } from "../resource-events/pull-request.js";
+import { type GitHubPullRequestSubscriptionConfig } from "../events/pull-request.js";
 /** Own PR creation so provider writes use host egress and the footer stays deterministic. */
 export declare function createGitHubPullRequestTool(ctx: ToolRegistrationHookContext, subscriptionConfig?: GitHubPullRequestSubscriptionConfig): import("@sentry/junior-plugin-api").PluginToolDefinition<{
     repo: string;

package/dist/tools/get-deployment.d.ts

@@ -2,7 +2,7 @@ import { type PluginEgress } from "@sentry/junior-plugin-api";
 /** Read deployment metadata and expose its stable subscription identity. */
 export declare function createGitHubGetDeploymentTool(ctx: {
     egress: PluginEgress;
-    resourceEvents: {
+    events: {
         canSubscribe: boolean;
     };
 }): import("@sentry/junior-plugin-api").PluginToolDefinition<{

package/dist/tools/get-pull-request.d.ts

@@ -2,7 +2,7 @@ import { type PluginEgress } from "@sentry/junior-plugin-api";
 /** Read one PR and expose its stable subscription identity when webhooks are enabled. */
 export declare function createGitHubGetPullRequestTool(ctx: {
     egress: PluginEgress;
-    resourceEvents: {
+    events: {
         canSubscribe: boolean;
     };
 }): import("@sentry/junior-plugin-api").PluginToolDefinition<{

package/dist/tools/get-release.d.ts

@@ -2,7 +2,7 @@ import { type PluginEgress } from "@sentry/junior-plugin-api";
 /** Read release metadata and expose its stable subscription identity. */
 export declare function createGitHubGetReleaseTool(ctx: {
     egress: PluginEgress;
-    resourceEvents: {
+    events: {
         canSubscribe: boolean;
     };
 }): import("@sentry/junior-plugin-api").PluginToolDefinition<{

package/dist/tools/get-repository.d.ts

@@ -2,7 +2,7 @@ import { type PluginEgress } from "@sentry/junior-plugin-api";
 /** Read one repository and expose its stable subscription identity. */
 export declare function createGitHubGetRepositoryTool(ctx: {
     egress: PluginEgress;
-    resourceEvents: {
+    events: {
         canSubscribe: boolean;
     };
 }): import("@sentry/junior-plugin-api").PluginToolDefinition<{

package/dist/tools/update-issue.d.ts

@@ -5,7 +5,7 @@ export declare function createGitHubUpdateIssueTool(ctx: {
     conversationId?: string;
     egress: PluginEgress;
     log: PluginLogger;
-    resourceEvents: {
+    events: {
         canSubscribe: boolean;
     };
     slack?: {

package/dist/tools/update-pull-request.d.ts

@@ -5,7 +5,7 @@ export declare function createGitHubUpdatePullRequestTool(ctx: {
     conversationId?: string;
     egress: PluginEgress;
     log: PluginLogger;
-    resourceEvents: {
+    events: {
         canSubscribe: boolean;
     };
     slack?: {

package/dist/tools.d.ts

@@ -1,4 +1,4 @@
 import type { PluginToolDefinition, ToolRegistrationHookContext } from "@sentry/junior-plugin-api";
-import type { GitHubPullRequestSubscriptionConfig } from "./resource-events/pull-request.js";
+import type { GitHubPullRequestSubscriptionConfig } from "./events/pull-request.js";
 /** Build the GitHub plugin's runtime tools from their per-tool modules. */
 export declare function createGitHubTools(ctx: ToolRegistrationHookContext, botEmail?: string, pullRequestSubscription?: GitHubPullRequestSubscriptionConfig): Record<string, PluginToolDefinition>;

package/dist/webhooks/check-suite.d.ts

@@ -1,7 +1,7 @@
 /**
- * GitHub check suite resource events.
+ * GitHub check suite events.
  */
-import type { ResourceEventInput } from "@sentry/junior-plugin-api";
+import type { EventInput } from "@sentry/junior-plugin-api";
 export type GitHubFailingCheck = {
     checkRunId: number;
     conclusion: string;
@@ -27,7 +27,7 @@ export declare function buildCheckSuiteUrl(args: {
     repo: string;
 }): string;
 /** Build the trusted data and summary for one check-suite event. */
-export declare function buildCheckSuiteResourceEvent(args: {
+export declare function buildCheckSuiteEvent(args: {
     appName?: string;
     authorEmail?: string;
     authorUsername?: string;
@@ -43,13 +43,13 @@ export declare function buildCheckSuiteResourceEvent(args: {
     pullRequestNumber?: number;
     repo: string;
     suiteConclusion: string;
-}): ResourceEventInput;
+}): EventInput;
 /** Keep only failed check runs from one suite. */
 export declare function selectFailingChecks(checkRuns: unknown, options?: {
     checkSuiteId?: number;
 }): GitHubFailingCheck[];
 /** Normalize a completed check suite for attached PRs, or the repository alone. */
-export declare function normalizeCheckSuiteEvents(deliveryId: string, body: unknown, options?: GitHubCheckSuiteFacts): ResourceEventInput[];
+export declare function normalizeCheckSuiteEvents(deliveryId: string, body: unknown, options?: GitHubCheckSuiteFacts): EventInput[];
 /** Identifiers and event types one completed check suite may publish. */
 export declare function parseCheckSuitePublishTargets(body: unknown): {
     eventTypes: string[];

package/dist/webhooks/events.d.ts

@@ -0,0 +1,12 @@
+import type { EventInput } from "@sentry/junior-plugin-api";
+import { type GitHubCheckSuiteFacts } from "./check-suite.js";
+export type { GitHubCheckSuiteFacts, GitHubCheckSuitePullRequestFacts, GitHubFailingCheck, } from "./check-suite.js";
+export { buildCheckSuiteEvent, buildCheckSuiteUrl, loadCheckSuiteFacts, needsCheckSuitePullRequestFacts, parseCheckSuiteFactsTarget, parseCheckSuitePublishTargets, selectFailingChecks, } from "./check-suite.js";
+/** Read the check suite target used to load missing suite facts. */
+/** Normalize one verified GitHub delivery into conversation events. */
+export declare function normalizeGitHubEvents(args: {
+    body: unknown;
+    checkSuiteFacts?: GitHubCheckSuiteFacts;
+    deliveryId: string;
+    eventName: string;
+}): EventInput[];

package/dist/webhooks/handler.d.ts

@@ -1,4 +1,4 @@
-import type { CodeChangePublisher, PluginConversationAnnotations, PluginLogger, PluginRoute, ResourceEventPublisher } from "@sentry/junior-plugin-api";
+import type { CodeChangePublisher, PluginConversationAnnotations, PluginLogger, PluginRoute, EventPublisher } from "@sentry/junior-plugin-api";
 import type { GitHubDb } from "../db/database.js";
 import type { GitHubPullRequestCommitComposition } from "../db/schema.js";
 interface FeedbackTarget {
@@ -22,7 +22,7 @@ export declare function createGitHubWebhookRoute(args: {
     log?: Pick<PluginLogger, "error">;
     markFeedbackReviewing(input: FeedbackTarget): Promise<void>;
     privateKeyEnv: string;
-    resourceEvents: ResourceEventPublisher;
+    events: EventPublisher;
     webhookSecret(): string | undefined;
 }): PluginRoute;
 export {};

package/dist/workspace-prepare.d.ts

@@ -1,3 +1,3 @@
-import type { WorkspacePrepareHookContext } from "@sentry/junior-plugin-api";
+import type { WorkspaceFinalize, WorkspacePrepareHookContext } from "@sentry/junior-plugin-api";
 /** Clone missing GitHub repositories or refresh existing Workspace checkouts. */
-export declare function prepareWorkspace(ctx: WorkspacePrepareHookContext): Promise<void>;
+export declare function prepareWorkspace(ctx: WorkspacePrepareHookContext): Promise<WorkspaceFinalize>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.206.0",
+  "version": "0.208.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.206.0"
+    "@sentry/junior-plugin-api": "0.208.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",

package/skills/github-issues/SKILL.md

@@ -28,11 +28,11 @@ Use only for GitHub issues. For pull requests, branches, pushes, or PR creation
 - Resolve the issue number for non-create operations.
 - Keep `--repo owner/repo` explicit on `gh` commands so the command itself targets the intended repository, not a stale default.
 - When the user explicitly asks for durable work in response to GitHub issue
-  activity, use an event task instead of polling:
+  activity, use an event automation instead of polling:
   - Use namespace `github`. One issue uses identifier `owner/repo#number` and
     resource type `issue`; repo-wide issue activity uses identifier
     `owner/repo` and resource type `repository`.
-  - Use the event names currently exposed by the resource-event catalog; search
+  - Use the event names currently exposed by the event catalog; search
     it when the requested event is unclear.
   - Put every requested issue state in the same task's `events` array. Create
     separate tasks only when the work to perform is different.

package/dist/webhooks/resource-events.d.ts

@@ -1,12 +0,0 @@
-import type { ResourceEventInput } from "@sentry/junior-plugin-api";
-import { type GitHubCheckSuiteFacts } from "./check-suite.js";
-export type { GitHubCheckSuiteFacts, GitHubCheckSuitePullRequestFacts, GitHubFailingCheck, } from "./check-suite.js";
-export { buildCheckSuiteResourceEvent, buildCheckSuiteUrl, loadCheckSuiteFacts, needsCheckSuitePullRequestFacts, parseCheckSuiteFactsTarget, parseCheckSuitePublishTargets, selectFailingChecks, } from "./check-suite.js";
-/** Read the check suite target used to load missing suite facts. */
-/** Normalize one verified GitHub delivery into conversation resource events. */
-export declare function normalizeGitHubResourceEvents(args: {
-    body: unknown;
-    checkSuiteFacts?: GitHubCheckSuiteFacts;
-    deliveryId: string;
-    eventName: string;
-}): ResourceEventInput[];