@sentry/junior-github 0.249.0 → 0.250.0

package/SETUP.md

@@ -164,11 +164,9 @@ Use `additionalUserScopes` only when a human-identity integration flow requires
 
 Run as a regular sandbox `bash` command while the relevant skill is active:
 
-Clone a repository with a shallow checkout by default:
-
-```bash
-gh repo clone owner/repo -- --depth=1
-```
+Clone a repository with the `github_cloneRepository` tool. It makes a shallow
+checkout. It first checks for a matching Workspace. Do not use `git clone` or
+`gh repo clone`, because they skip that check.
 
 Deepen later only if the task needs more history:
 

package/dist/{chunk-EYBKPQTJ.js → chunk-D75O3CY3.js}

@@ -104,6 +104,20 @@ function gitHubPullRequestEventGuidance(guidance) {
   }
   return merged;
 }
+var GITHUB_PULL_REQUEST_OUTCOME_GUIDANCE = {
+  "pull_request.review.approved": "Mention each person in People involved, or the person who asked for the pull request if that line is missing. Say who approved it and link it. Do not merge it unless asked.",
+  "pull_request.merged": "Mention each person in People involved, or the person who asked for the pull request if that line is missing. Say that it merged and link it."
+};
+function gitHubPullRequestCreateWatch(config) {
+  const outcomeEvents = Object.keys(
+    GITHUB_PULL_REQUEST_OUTCOME_GUIDANCE
+  );
+  return {
+    events: [.../* @__PURE__ */ new Set([...config.events, ...outcomeEvents])],
+    guidance: GITHUB_PULL_REQUEST_OUTCOME_GUIDANCE,
+    intent: config.intent
+  };
+}
 var GITHUB_PULL_REQUEST_SUGGESTED_EVENTS = [
   "pull_request.checks.failed",
   "pull_request.comment.created",
@@ -1910,6 +1924,7 @@ export {
   gitHubDeploymentSourceSubscribable,
   GITHUB_PULL_REQUEST_EVENTS,
   gitHubPullRequestEventGuidance,
+  gitHubPullRequestCreateWatch,
   GITHUB_PULL_REQUEST_SUGGESTED_EVENTS,
   GITHUB_PULL_REQUEST_MATCH_FIELDS,
   GITHUB_PULL_REQUEST_IDENTIFIER,

package/dist/events/pull-request.d.ts

@@ -15,6 +15,12 @@ export interface GitHubPullRequestSubscriptionConfig {
     events: GitHubPullRequestEvent[];
     intent: string;
 }
+/** Build the Watch created after Junior creates a pull request. */
+export declare function gitHubPullRequestCreateWatch(config: GitHubPullRequestSubscriptionConfig): {
+    events: GitHubPullRequestEvent[];
+    guidance: Partial<Record<GitHubPullRequestEvent, string>>;
+    intent: string;
+};
 export declare const GITHUB_PULL_REQUEST_SUGGESTED_EVENTS: readonly ["pull_request.checks.failed", "pull_request.comment.created", "pull_request.ready_for_review", "pull_request.review.changes_requested", "pull_request.review.commented", "pull_request.review_comment.created", "pull_request.merged", "pull_request.closed_unmerged"];
 /** Exact values GitHub may set on pull request event data. Missing keys do not match. */
 export declare const GITHUB_PULL_REQUEST_MATCH_FIELDS: Record<string, {

package/dist/index.js

@@ -30,6 +30,7 @@ import {
   credentialUnavailable,
   gitHubDeploymentSourceSubscribable,
   gitHubIssueSubscribable,
+  gitHubPullRequestCreateWatch,
   gitHubPullRequestEventGuidance,
   gitHubPullRequestSubscribable,
   gitHubReleaseSourceSubscribable,
@@ -51,7 +52,7 @@ import {
   readGrantPermissions,
   requireEnv,
   resolveUserAccount
-} from "./chunk-EYBKPQTJ.js";
+} from "./chunk-D75O3CY3.js";
 
 // src/plugin.ts
 import {
@@ -1447,17 +1448,17 @@ async function gitHubPullRequestStructuredResult(ctx, input, result, subscriptio
       ...base
     };
   }
+  const watch = gitHubPullRequestCreateWatch(subscriptionConfig);
   try {
     const subscription = await ctx.events.subscribe({
-      events: subscriptionConfig.events,
-      intent: subscriptionConfig.intent,
+      ...watch,
       resource: base.subscribable
     });
     const data = gitHubPullRequestToolResult(
       input,
       result,
       ctx.events.canSubscribe,
-      subscriptionConfig.events
+      watch.events
     );
     return {
       objectAnnotations,
@@ -3518,6 +3519,102 @@ function normalizeGitHubPullRequestLinkedIssues(args) {
   } : void 0;
 }
 
+// src/webhooks/pull-request-people.ts
+import { z as z19 } from "zod";
+var PEOPLE_EVENTS = /* @__PURE__ */ new Set([
+  "pull_request.review.approved",
+  "pull_request.merged"
+]);
+var MAX_PEOPLE = 20;
+var PAGE_SIZE = 100;
+var MAX_PAGES = 3;
+var CO_AUTHOR_TRAILER = /^co-authored-by:[^<\n]*<([^>\s]+@[^>\s]+)>\s*$/gim;
+var GITHUB_NOREPLY_EMAIL = /^(?:\d+\+)?(?<login>[^@+]+)@users\.noreply\.github\.com$/i;
+var webhookSchema = z19.object({
+  pull_request: z19.object({
+    assignees: z19.array(z19.object({ login: z19.string().min(1) })).nullish(),
+    number: z19.number(),
+    user: z19.object({ login: z19.string().min(1) }).nullish()
+  }),
+  repository: z19.object({ full_name: z19.string().min(1) })
+});
+var commitPageSchema = z19.array(
+  z19.object({
+    author: z19.object({ login: z19.string().min(1) }).nullish(),
+    commit: z19.object({ message: z19.string() })
+  })
+);
+async function loadGitHubPullRequestPeople(args) {
+  const people = /* @__PURE__ */ new Map();
+  const addLogin = (login) => {
+    if (/\[bot\]$/i.test(login)) return;
+    const key = `github:${login.toLowerCase()}`;
+    if (!people.has(key))
+      people.set(key, { provider: "github", handle: login });
+  };
+  const addEmail = (value) => {
+    const email = value.toLowerCase();
+    const login = GITHUB_NOREPLY_EMAIL.exec(email)?.groups?.login;
+    if (login) addLogin(login);
+    else if (!people.has(`email:${email}`)) {
+      people.set(`email:${email}`, { email });
+    }
+  };
+  args.logins.forEach(addLogin);
+  for (let page = 1; page <= MAX_PAGES; page += 1) {
+    const commits = commitPageSchema.parse(
+      await args.loadPage(page, PAGE_SIZE)
+    );
+    for (const commit of commits) {
+      if (commit.author) addLogin(commit.author.login);
+      for (const match of commit.commit.message.matchAll(CO_AUTHOR_TRAILER)) {
+        addEmail(match[1]);
+      }
+    }
+    if (commits.length < PAGE_SIZE) break;
+  }
+  return [...people.values()].slice(0, MAX_PEOPLE);
+}
+async function withGitHubPullRequestPeople(args) {
+  const { hasMatch } = args;
+  const peopleEvents = args.events.filter(
+    (event) => PEOPLE_EVENTS.has(event.eventType)
+  );
+  const parsed = webhookSchema.safeParse(args.body);
+  if (peopleEvents.length === 0 || !hasMatch || !args.load || !parsed.success) {
+    return args.events;
+  }
+  const matches = await Promise.all(
+    peopleEvents.map((event) => hasMatch(event))
+  );
+  if (!matches.some(Boolean)) return args.events;
+  const { pull_request: pullRequest, repository } = parsed.data;
+  const target = {
+    logins: [
+      ...pullRequest.user ? [pullRequest.user.login] : [],
+      ...(pullRequest.assignees ?? []).map((assignee) => assignee.login)
+    ],
+    number: pullRequest.number,
+    repositoryFullName: repository.full_name
+  };
+  let people;
+  try {
+    people = await args.load(target);
+  } catch (error) {
+    args.log?.error("GitHub pull request people lookup failed", {
+      deliveryId: args.deliveryId,
+      errorType: error instanceof Error ? error.name : "UnknownError",
+      number: target.number,
+      repository: target.repositoryFullName
+    });
+    return args.events;
+  }
+  if (people.length === 0) return args.events;
+  return args.events.map(
+    (event) => PEOPLE_EVENTS.has(event.eventType) ? { ...event, people } : event
+  );
+}
+
 // src/webhooks/handler.ts
 function verifyGitHubSignature(body, signature, secret) {
   if (!secret || !signature.startsWith("sha256=")) return false;
@@ -3710,15 +3807,22 @@ function createGitHubWebhookRoute(args) {
         log: args.log,
         privateKeyEnv: args.privateKeyEnv
       }) : void 0;
-      const events = normalizeGitHubEvents({
+      const hasMatch = args.events.hasMatch;
+      const events = await withGitHubPullRequestPeople({
         body,
-        botEmail,
-        ...checkSuiteFacts ? { checkSuiteFacts } : void 0,
         deliveryId,
-        eventName
+        events: normalizeGitHubEvents({
+          body,
+          botEmail,
+          ...checkSuiteFacts ? { checkSuiteFacts } : void 0,
+          deliveryId,
+          eventName
+        }),
+        hasMatch,
+        load: args.loadPullRequestPeople,
+        log: args.log
       });
       const feedbackTarget = pullRequestFeedbackTarget(events);
-      const hasMatch = args.events.hasMatch;
       const feedbackHasMatch = feedbackTarget && hasMatch ? (await Promise.all(events.map((event) => hasMatch(event)))).some(
         Boolean
       ) : false;
@@ -3749,18 +3853,18 @@ function createGitHubWebhookRoute(args) {
 }
 
 // src/pull-request-outcomes/commit-composition.ts
-import { z as z19 } from "zod";
-var canonicalCommitSchema = z19.object({
-  authorEmail: z19.string().nullable(),
-  authorLogin: z19.string().nullable()
+import { z as z20 } from "zod";
+var canonicalCommitSchema = z20.object({
+  authorEmail: z20.string().nullable(),
+  authorLogin: z20.string().nullable()
 }).strict();
-var providerCommitSchema = z19.object({
-  author: z19.object({ login: z19.string() }).passthrough().nullable(),
-  commit: z19.object({
-    author: z19.object({ email: z19.string() }).passthrough().nullable()
+var providerCommitSchema = z20.object({
+  author: z20.object({ login: z20.string() }).passthrough().nullable(),
+  commit: z20.object({
+    author: z20.object({ email: z20.string() }).passthrough().nullable()
   }).passthrough()
 }).passthrough();
-var commitPageSchema = z19.array(providerCommitSchema).transform(
+var commitPageSchema2 = z20.array(providerCommitSchema).transform(
   (commits) => commits.map(
     (commit) => canonicalCommitSchema.parse({
       authorEmail: commit.commit.author?.email ?? null,
@@ -3768,8 +3872,8 @@ var commitPageSchema = z19.array(providerCommitSchema).transform(
     })
   )
 );
-var PAGE_SIZE = 100;
-var MAX_PAGES = 3;
+var PAGE_SIZE2 = 100;
+var MAX_PAGES2 = 3;
 var MAX_LISTED_COMMITS = 250;
 async function classifyGitHubPullRequestCommitComposition(args) {
   const botEmail = args.botEmail.trim().toLowerCase();
@@ -3780,9 +3884,9 @@ async function classifyGitHubPullRequestCommitComposition(args) {
   }
   let foundCommit = false;
   let inspectedCommits = 0;
-  for (let page = 1; page <= MAX_PAGES; page += 1) {
-    const commits = commitPageSchema.parse(
-      await args.loadPage(page, PAGE_SIZE)
+  for (let page = 1; page <= MAX_PAGES2; page += 1) {
+    const commits = commitPageSchema2.parse(
+      await args.loadPage(page, PAGE_SIZE2)
     );
     inspectedCommits += commits.length;
     for (const commit of commits) {
@@ -3793,8 +3897,8 @@ async function classifyGitHubPullRequestCommitComposition(args) {
       }
     }
     if (inspectedCommits >= MAX_LISTED_COMMITS) return void 0;
-    if (commits.length < PAGE_SIZE) break;
-    if (page === MAX_PAGES) return void 0;
+    if (commits.length < PAGE_SIZE2) break;
+    if (page === MAX_PAGES2) return void 0;
   }
   return foundCommit ? "junior_only" : void 0;
 }
@@ -4918,41 +5022,43 @@ function githubPlugin(options = {}) {
         };
       },
       routes(ctx) {
+        const loadPullRequestCommitPage = async (pullRequest) => {
+          const [owner, name, ...extra] = pullRequest.repositoryFullName.split("/");
+          if (!owner || !name || extra.length > 0) {
+            throw new Error(
+              "GitHub pull request commits received an invalid repository name"
+            );
+          }
+          const token = await issueInstallationToken({
+            appIdEnv,
+            privateKeyEnv,
+            installationIdEnv,
+            permissions: { pull_requests: "read" },
+            repositories: [name]
+          });
+          return async (page, perPage) => await githubRequest(
+            "https://api.github.com",
+            `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls/${pullRequest.number}/commits?per_page=${perPage}&page=${page}`,
+            { token: token.token }
+          );
+        };
         return [
           createGitHubWebhookRoute({
             annotations: ctx.annotations,
             appIdEnv,
             botEmail: () => readEnv(botEmailEnv),
-            classifyPullRequestCommits: async ({
-              number,
-              repositoryFullName
-            }) => {
-              const [owner, name, ...extra] = repositoryFullName.split("/");
-              if (!owner || !name || extra.length > 0) {
-                throw new Error(
-                  "GitHub pull request commit classification received an invalid repository name"
-                );
-              }
-              const token = await issueInstallationToken({
-                appIdEnv,
-                privateKeyEnv,
-                installationIdEnv,
-                permissions: { pull_requests: "read" },
-                repositories: [name]
-              });
-              return await classifyGitHubPullRequestCommitComposition({
-                botEmail: requireEnv(botEmailEnv),
-                loadPage: async (page, perPage) => await githubRequest(
-                  "https://api.github.com",
-                  `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}/pulls/${number}/commits?per_page=${perPage}&page=${page}`,
-                  { token: token.token }
-                )
-              });
-            },
+            classifyPullRequestCommits: async (pullRequest) => await classifyGitHubPullRequestCommitComposition({
+              botEmail: requireEnv(botEmailEnv),
+              loadPage: await loadPullRequestCommitPage(pullRequest)
+            }),
             codeChanges: ctx.codeChanges,
             db: ctx.db,
             installationId: () => readEnv(installationIdEnv),
             installationIdEnv,
+            loadPullRequestPeople: async (pullRequest) => await loadGitHubPullRequestPeople({
+              logins: pullRequest.logins,
+              loadPage: await loadPullRequestCommitPage(pullRequest)
+            }),
             log: ctx.log,
             markFeedbackReviewing: async ({ commentId, commentKind, repo }) => {
               const [owner, name, ...extra] = repo.split("/");

package/dist/testing.js

@@ -1,6 +1,6 @@
 import {
   normalizeGitHubEvents
-} from "./chunk-EYBKPQTJ.js";
+} from "./chunk-D75O3CY3.js";
 export {
   normalizeGitHubEvents
 };

package/dist/webhooks/handler.d.ts

@@ -1,6 +1,7 @@
-import type { CodeChangePublisher, PluginConversationAnnotations, PluginLogger, PluginRoute, EventPublisher } from "@sentry/junior-plugin-api";
+import type { CodeChangePublisher, PluginConversationAnnotations, PluginLogger, PluginRoute, EventPerson, EventPublisher } from "@sentry/junior-plugin-api";
 import type { GitHubDb } from "../db/database.js";
 import type { GitHubPullRequestCommitComposition } from "../db/schema.js";
+import { type GitHubPullRequestPeopleTarget } from "./pull-request-people.js";
 interface FeedbackTarget {
     commentId: number;
     commentKind: "conversation" | "review";
@@ -19,6 +20,8 @@ export declare function createGitHubWebhookRoute(args: {
     db: GitHubDb;
     installationId(): string | undefined;
     installationIdEnv: string;
+    /** Load the people involved in a pull request for approvals and merges. */
+    loadPullRequestPeople?(target: GitHubPullRequestPeopleTarget): Promise<EventPerson[]>;
     log?: Pick<PluginLogger, "error">;
     markFeedbackReviewing(input: FeedbackTarget): Promise<void>;
     privateKeyEnv: string;

package/dist/webhooks/pull-request-people.d.ts

@@ -0,0 +1,31 @@
+import type { EventInput, EventPerson, EventPublisher, PluginLogger } from "@sentry/junior-plugin-api";
+/** The pull request that a people lookup reads. */
+export interface GitHubPullRequestPeopleTarget {
+    /** Pull request author and assignees from the webhook. */
+    logins: string[];
+    number: number;
+    repositoryFullName: string;
+}
+/**
+ * Collect the people involved in a pull request: the webhook logins, commit
+ * authors, and `Co-authored-by` trailers. Junior adds a trailer for each
+ * person whose instructions a run accepted, so people who steer later are
+ * included. Noreply emails become logins. `[bot]` accounts are skipped.
+ */
+export declare function loadGitHubPullRequestPeople(args: {
+    logins: readonly string[];
+    loadPage(page: number, perPage: number): Promise<unknown>;
+}): Promise<EventPerson[]>;
+/**
+ * Add the people involved to approval and merge events. It loads them only
+ * when a Watch or event automation matches, so other deliveries make no extra
+ * GitHub calls. People only add context, so a failed load keeps the events.
+ */
+export declare function withGitHubPullRequestPeople(args: {
+    body: unknown;
+    deliveryId: string;
+    events: EventInput[];
+    hasMatch: EventPublisher["hasMatch"];
+    load?(target: GitHubPullRequestPeopleTarget): Promise<EventPerson[]>;
+    log?: Pick<PluginLogger, "error">;
+}): Promise<EventInput[]>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.249.0",
+  "version": "0.250.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.249.0"
+    "@sentry/junior-plugin-api": "0.250.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",

package/skills/github-code/SKILL.md

@@ -7,14 +7,14 @@ description: Work with GitHub repositories, source code, branches, commits, pull
 
 Use `git` and `gh` for repository work.
 
-| Action                          | Tool / command                                                           |
-| ------------------------------- | ------------------------------------------------------------------------ |
-| Create PR                       | `github_createPullRequest` (not `gh pr create`)                          |
-| Update PR title/body/base/state | `github_updatePullRequest`                                               |
-| Mark PR ready / draft           | `github_updatePullRequest` with `draft: false` / `draft: true`           |
-| Submit PR review                | `github_submitPullRequestReview`                                         |
-| Resolve review thread           | `github_resolvePullRequestReviewThread`                                  |
-| Clone missing repo              | `github_cloneRepository`; on Workspace match error use `switchWorkspace` |
+| Action                          | Tool / command                                                                                                |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| Create PR                       | `github_createPullRequest` (not `gh pr create`)                                                               |
+| Update PR title/body/base/state | `github_updatePullRequest`                                                                                    |
+| Mark PR ready / draft           | `github_updatePullRequest` with `draft: false` / `draft: true`                                                |
+| Submit PR review                | `github_submitPullRequestReview`                                                                              |
+| Resolve review thread           | `github_resolvePullRequestReviewThread`                                                                       |
+| Clone missing repo              | `github_cloneRepository` (not `git clone` or `gh repo clone`); on Workspace match error use `switchWorkspace` |
 
 ## Open when needed
 

package/skills/github-code/references/api-surface.md

@@ -12,7 +12,7 @@ If the user omits `owner/repo`, run `jr-rpc config get github.repo`. Then pass `
 | ---------------------------- | ------------------------------------------------------------------------------------ |
 | `github.actions.read`        | `gh run list`, `gh run view`, `gh run watch`, `gh workflow list`, `gh workflow view` |
 | `github.actions.write`       | `gh workflow run`, `gh run rerun`, `gh run cancel`                                   |
-| `github.contents.read`       | `gh repo clone`, `git fetch`                                                         |
+| `github.contents.read`       | `github_cloneRepository`, `git fetch`                                                |
 | `github.contents.write`      | Git smart-HTTP `git push` only                                                       |
 | `github.workflows.write`     | Workflow-file changes on push                                                        |
 | `github.pull-requests.read`  | `gh pr view`, `gh pr list`, `gh pr diff`, `gh pr checks`                             |
@@ -22,7 +22,7 @@ If the user omits `owner/repo`, run `jr-rpc config get github.repo`. Then pass `
 
 | Operation               | Command                                                                                         |
 | ----------------------- | ----------------------------------------------------------------------------------------------- |
-| Clone (default shallow) | `gh repo clone owner/repo [DIR] -- --depth=1`                                                   |
+| Clone (default shallow) | `github_cloneRepository`. Do not use `git clone` or `gh repo clone`.                            |
 | Fetch bounded base      | `git -C DIR fetch --depth=N origin BASE:refs/remotes/origin/BASE`                               |
 | Deepen base             | `git -C DIR fetch --deepen=N origin BASE:refs/remotes/origin/BASE`                              |
 | Unshallow               | `git -C DIR fetch --unshallow origin`                                                           |
@@ -51,7 +51,7 @@ If the user omits `owner/repo`, run `jr-rpc config get github.repo`. Then pass `
 
 ## Notes
 
-- Prefer `--json` where available. Pass clone flags after `--`.
+- Prefer `--json` where available.
 - A local commit does not call GitHub. A push uses installation credentials. Workflow changes also need `workflows.write`.
 - Deepen a shallow clone before work that needs old history. Do not force-push to work around missing history.
 - Push `head` and read the default `base` before `github_createPullRequest`.

package/skills/github-code/references/troubleshooting-workarounds.md

@@ -3,7 +3,6 @@
 | Problem                                                    | Action                                                                                    |
 | ---------------------------------------------------------- | ----------------------------------------------------------------------------------------- |
 | `gh` reports an unknown command                            | Report that the GitHub plugin is unavailable. Do not install it.                          |
-| Clone rejects `--depth`                                    | Put clone flags after `--`: `gh repo clone owner/repo -- --depth=1`.                      |
 | Repository is missing or wrong                             | Read `github.repo`, then pass `--repo owner/repo`.                                        |
 | GraphQL cannot find the repository                         | Check `owner/repo` and the GitHub App installation.                                       |
 | `junior-auth-required` with `user-write`                   | Follow the private OAuth prompt. Never ask for a pasted token.                            |

package/skills/github-code/references/workflow.md

@@ -5,7 +5,7 @@ Open this when making repository edits, not for read-only inspection.
 ## Resolve and inspect
 
 1. Identify repo, checkout, branches, worktree, package manager, and relevant checks.
-2. Prefer an existing checkout or matching Workspace; otherwise clone shallowly.
+2. Prefer an existing checkout or matching Workspace; otherwise clone with `github_cloneRepository`.
 3. If clone returns a Workspace match error, switch Workspace or pass `allowAdHoc=true`.
 4. Shallow clones are for fast inspection. Before rebase, merge-base, blame, or base comparison, fetch/deepen the needed refs. Never force-push around missing history.
 5. For edits, pick the smallest credible validation path. Capture a baseline when a failure may be pre-existing.