@sentry/junior-github 0.30.0 → 0.32.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "private": false,
   "publishConfig": {
     "access": "public"

package/skills/github-code/SKILL.md

@@ -1,7 +1,6 @@
 ---
 name: github-code
-description: Clone GitHub repositories, investigate source code, and manage pull requests via GitHub CLI. Use when users ask to inspect implementation details in a repository, clone code, edit files, answer source-code questions from repo evidence, or open/edit/view/merge pull requests. Prefer this skill for repository and code tasks even when the repo concerns Sentry products.
-uses-config: github.repo
+description: Clone repositories, inspect source, edit code, and manage pull requests with GitHub CLI. Use for repo implementation questions, cloning/editing, PR inspection/mutation, and PR auth-order questions. For PR auth order, answer that `git push` needs GitHub remote write access before `gh pr create`. Prefer this skill for repository and code tasks even when the repo concerns Sentry products.
 allowed-tools: bash
 ---
 
@@ -22,6 +21,8 @@ Repository checkout, source-code investigation, and pull request operations via
 
 - Determine whether the task is `clone`, `source-code investigation`, a pull request inspection (`view`, `list`, `diff`, `checks`), or a pull request mutation (`create`, `update`, `close`, `merge`).
 - Resolve repository (`owner/repo`). If not explicit, query channel config with `jr-rpc config get github.repo` before running any `gh` or `git` command. If still missing, ask the user.
+- Run `jr-rpc config get github.repo` as its own bash command. Do not combine it with `cd`, `&&`, pipes, or any `gh` or `git` command.
+- After resolving a configured repo, pass it explicitly to the next `gh` command with `--repo owner/repo`; do not rely on implicit GitHub CLI repository discovery.
 - Resolve the pull request number for operations targeting an existing PR.
 - Keep `--repo owner/repo` explicit on `gh` commands so the command itself targets the intended repository, not a stale default.
 
@@ -47,6 +48,7 @@ Repository checkout, source-code investigation, and pull request operations via
 
 - Use for questions like "where is this implemented?", "how does this workflow work in code?", "is there already logic for X?", or "verify this from the repo."
 - If the current workspace already contains the target repository, inspect local files directly before cloning.
+- Do not treat this skill's `SKILL.md`, bundled references, or `/vercel/sandbox/skills/...` as target repository source code. If no checkout of the target repo is present, inspect the configured GitHub repository by cloning it shallowly or reading files through `gh` before answering.
 - Prefer the narrowest deterministic evidence: local file search, exact file reads, targeted clone inspection, existing issues/PRs, tests.
 - Cite repository evidence in the reply: file paths, symbols, issue/PR numbers, or commit references when known.
 - If evidence is incomplete, say what is unknown instead of guessing.
@@ -65,6 +67,7 @@ Repository checkout, source-code investigation, and pull request operations via
 
 #### 3. Resolve mutation inputs
 
+- For PR creation credential/order questions, explicitly answer that repository context comes first, then `git push` pushes the branch with GitHub remote write access, then `gh pr create` runs against the pushed branch with pull-request permissions.
 - For PR creation, resolve the base branch (explicit user request wins; otherwise repository default).
 - Resolve the head branch from the current checkout or user request.
 - If the head branch may not exist on the remote yet, push it explicitly before PR creation.

package/skills/github-code/references/api-surface.md

@@ -5,6 +5,7 @@ All operations use `gh` CLI. Commands must be deterministic and non-interactive.
 ## Repo scoping
 
 When the user omits `owner/repo`, resolve `github.repo` first with `jr-rpc config get github.repo`, then pass the resolved repo explicitly on the actual `gh` or `git` command.
+Run `jr-rpc config get github.repo` as a standalone bash command. Never chain it with `cd`, `&&`, pipes, or a provider command.
 Treat explicit repo flags as command-targeting safety rails, not as a credential-scoping mechanism.
 
 ## Capability to command mapping

package/skills/github-code/references/troubleshooting-workarounds.md

@@ -4,7 +4,7 @@ Use this table to recover quickly while keeping operations deterministic.
 
 | Symptom                                                                         | Likely cause                                                                | Fix                                                                                                                                         |
 | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| `unknown command "..."` from `gh`                                               | CLI version too old or wrong binary.                                        | Verify `gh --version`; ensure GitHub CLI from `gh-cli` repo is installed.                                                                   |
+| `unknown command "..."` from `gh`                                               | CLI version too old or wrong binary in the plugin runtime.                  | Verify `gh --version`; if it is unavailable or too old, report that the GitHub plugin runtime dependency is not available.                  |
 | `unknown flag: --depth` from `gh repo clone`                                    | `git clone` flags were passed before `--`.                                  | Pass clone flags after `--`, for example `gh repo clone owner/repo -- --depth=1`.                                                           |
 | `Missing required option --repo`                                                | Repo not passed and no default was resolved.                                | Resolve with `jr-rpc config get github.repo`; pass `--repo owner/repo` explicitly when missing.                                             |
 | Command affects or authenticates against the wrong repo                         | Stale `github.repo` default or authenticated command missing explicit repo. | Pass `--repo owner/repo` for the target repository, or update `github.repo` before retrying.                                                |
@@ -14,7 +14,7 @@ Use this table to recover quickly while keeping operations deterministic.
 | 403 Forbidden                                                                   | App lacks required permission on repo or install scope is too narrow.       | Verify the repo context, then confirm GitHub App permissions and installation scope.                                                        |
 | `gh pr create` fails with auth/permission errors or tries to push interactively | The branch was not pushed first, or repo context is wrong.                  | Push the branch explicitly first, then rerun `gh pr create --repo owner/repo --head BRANCH ...`.                                            |
 | `git blame`, long log history, or old commits are missing after clone           | Repo was cloned shallow by design.                                          | Deepen incrementally with `git -C DIRECTORY fetch --depth=N origin`, or `git -C DIRECTORY fetch --unshallow` when full history is required. |
-| `sandbox setup failed (dnf install gh failed ...)`                              | `gh` package not available in default repos.                                | Configure/install from GitHub RPM repo (`gh-cli`) in sandbox dependency bootstrap, then retry.                                              |
+| `sandbox setup failed (dnf install gh failed ...)`                              | `gh` package not available from the plugin runtime dependency bootstrap.    | Report the plugin runtime bootstrap failure; do not try to repair package installation from the skill workflow.                             |
 
 ## Retry guidance
 

package/skills/github-issues/SKILL.md

@@ -1,13 +1,13 @@
 ---
 name: github-issues
-description: Create, update, comment on, label, and inspect GitHub issues via GitHub CLI with concise, evidence-backed content. Use when users ask to open, edit, view, close, reopen, or triage GitHub issues — including tracking bugs, features, or tasks. Prefer this skill over generic repository tools for any issue operation.
-uses-config: github.repo
+description: Create, update, comment on, label, and inspect GitHub issues via GitHub CLI with concise, evidence-backed content. Use when users ask to open, edit, view, close, reopen, or triage GitHub issues — including tracking bugs, features, or tasks. Prefer this skill over generic repository tools for issue operations; do not use for pull requests, branches, pushes, or PR auth-order questions.
 allowed-tools: bash
 ---
 
 # GitHub Issue Operations
 
 Issue create, update, comment, label, state, and inspection via `gh` CLI.
+Use only for GitHub issues. For pull requests, branches, pushes, or PR auth-order questions, load `github-code` instead.
 
 ## Reference loading
 
@@ -23,6 +23,8 @@ Issue create, update, comment, label, state, and inspection via `gh` CLI.
 
 - Determine whether the task is `create`, `update`, `comment`, `labels`, `state`, or read-only inspection.
 - Resolve repository (`owner/repo`). If not explicit, query channel config with `jr-rpc config get github.repo` before running any `gh` command. If still missing, ask the user.
+- Run `jr-rpc config get github.repo` as its own bash command. Do not combine it with `cd`, `&&`, pipes, or any `gh` command.
+- After resolving a configured repo, pass it explicitly to the next `gh` command with `--repo owner/repo`; do not rely on implicit GitHub CLI repository discovery.
 - Resolve the issue number for non-create operations.
 - Keep `--repo owner/repo` explicit on `gh` commands so the command itself targets the intended repository, not a stale default.
 
@@ -55,11 +57,11 @@ Follow [references/research-rules.md](references/research-rules.md) for cross-ty
 - Generalize session framing — strip channel references, slash commands, Slack thread IDs, user @mentions, and transcript fragments; replace with the underlying technical problem.
 - Compress source material. Research notes, hypotheses, or transcripts become a short summary + scoped bullets — never paste raw investigation into the body.
 - Do not add desired outcome, expected behavior, or acceptance criteria unless the thread explicitly requests them.
-- When the request originated from a Slack thread or any on-behalf-of context, append a final line `Action taken on behalf of <name>.` using the user's real name.
+- When the request originated from a Slack thread or any on-behalf-of context, append a final line `Action taken on behalf of <name>.` using the action requester's real name. The action requester is the current `<requester>` or the person who explicitly asked you to create/update the issue, not necessarily the original reporter.
 
 **Attribution:**
 
-- Mention who raised the issue when clear from the thread.
+- Mention who raised the issue when clear from the thread. If the reporter differs from the action requester, keep them separate with durable body text such as `Reported by Alice.` or `Raised by Alice during incident triage.`
 - Attach screenshots from the thread as image links when present.
 - Include code snippets, related issues, and related PRs only when they materially improve the issue.
 
@@ -68,7 +70,7 @@ Follow [references/research-rules.md](references/research-rules.md) for cross-ty
 Before running the `gh` create/edit command, check each gate. If any fails, revise and re-check before executing:
 
 - Title length ≤ 60 characters.
-- Delegated-action footer is the last line when applicable, using the user's real name.
+- Delegated-action footer is the last line when applicable, using the action requester's real name, not the reporter's name unless they are the same person.
 - No session framing remains (channel refs, slash commands, @mentions, Slack thread IDs).
 - Body structure matches complexity — no empty sections, no restated title, no raw research dump.
 
@@ -77,11 +79,13 @@ Run [references/issue-quality-checklist.md](references/issue-quality-checklist.m
 ### 5. Execute
 
 - Use `gh issue` commands from [references/api-surface.md](references/api-surface.md).
-- Check duplicates silently before creating a new issue.
+- For issue listing or other read-only inspection, prefer `--json` output so empty results still produce deterministic stdout.
+- Check duplicates silently before creating a new issue. Do not mention this check in the final reply unless a duplicate blocks creation.
 
 ### 6. Report result
 
-- Return canonical issue URL, issue number, issue type, and applied changes.
+- Return canonical issue URL, issue number, and issue type.
+- Mention only user-visible issue changes. Do not mention duplicate checks, searches, "no duplicates found", or routine preparation steps.
 
 ## Guardrails
 

package/skills/github-issues/references/api-surface.md

@@ -5,6 +5,7 @@ All operations use `gh` CLI. Commands must be deterministic and non-interactive.
 ## Repo scoping
 
 When the user omits `owner/repo`, resolve `github.repo` first with `jr-rpc config get github.repo`, then pass the resolved repo explicitly on the actual `gh` command.
+Run `jr-rpc config get github.repo` as a standalone bash command. Never chain it with `cd`, `&&`, pipes, or a `gh` command.
 Treat explicit repo flags as command-targeting safety rails, not as a credential-scoping mechanism.
 
 ## Capability to command mapping
@@ -25,6 +26,7 @@ Treat explicit repo flags as command-targeting safety rails, not as a credential
 | Add labels          | `gh issue edit NUMBER --repo owner/repo --add-label LABEL [--add-label LABEL2]`                               |
 | Remove labels       | `gh issue edit NUMBER --repo owner/repo --remove-label LABEL [--remove-label LABEL2]`                         |
 | Add comment         | `gh issue comment NUMBER --repo owner/repo --body-file PATH`                                                  |
+| List issues         | `gh issue list --repo owner/repo --json number,title,state,url --limit 20`                                    |
 | Read issue          | `gh issue view NUMBER --repo owner/repo --json number,title,state,labels,assignees,author,url,body`           |
 | Read comments       | `gh api /repos/owner/repo/issues/NUMBER/comments --method GET --header "Accept: application/vnd.github+json"` |
 

package/skills/github-issues/references/issue-examples.md

@@ -69,6 +69,26 @@ Good scope — quantified and specific:
 >
 > Action taken on behalf of Jane Doe.
 
+## Distinct reporter/requester example
+
+Bad attribution:
+
+> The bot resolved the review thread even though the warning still applies.
+>
+> Action taken on behalf of Bojan Oro.
+
+Good attribution:
+
+> Warden can resolve its own review thread even when the underlying warning still appears valid and the PR remains blocked.
+>
+> Reported by Bojan Oro.
+>
+> - Observed on a PR where Warden left a review comment about a missing backport
+> - The review thread was later marked resolved by the bot
+> - The PR still showed a blocking warning
+>
+> Action taken on behalf of David Cramer.
+
 ## Feature example
 
 Bad framing:
@@ -111,5 +131,6 @@ Good framing — current state, gap, options:
 - Confident fix claims without root-cause evidence
 - Speculative detail mixed into verified facts
 - Dumping a list of URLs without inline context
-- Session-specific content (user names, slash commands, channel references)
+- Session-specific content (slash commands, channel references, raw transcript framing, or unrelated user chatter)
+- Conflating reporter and action requester when they differ
 - Missing delegated attribution footer on user-requested issue creation

package/skills/github-issues/references/troubleshooting-workarounds.md

@@ -4,7 +4,7 @@ Use this table to recover quickly while keeping operations deterministic.
 
 | Symptom                                                 | Likely cause                                                                | Fix                                                                                                                                   |
 | ------------------------------------------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
-| `unknown command "issue"` from `gh`                     | CLI version too old or wrong binary.                                        | Verify `gh --version`; ensure GitHub CLI from `gh-cli` repo is installed.                                                             |
+| `unknown command "issue"` from `gh`                     | CLI version too old or wrong binary in the plugin runtime.                  | Verify `gh --version`; if it is unavailable or too old, report that the GitHub plugin runtime dependency is not available.            |
 | `Missing required option --repo`                        | Repo not passed and no default was resolved.                                | Resolve with `jr-rpc config get github.repo`; pass `--repo owner/repo` explicitly when missing.                                       |
 | Command affects or authenticates against the wrong repo | Stale `github.repo` default or authenticated command missing explicit repo. | Pass `--repo owner/repo` for the target repository, or update `github.repo` before retrying.                                          |
 | `GraphQL: Could not resolve to a Repository`            | Repo slug is wrong or inaccessible.                                         | Validate `owner/repo` and confirm app installation on target repository.                                                              |