@sentry/junior-github 0.91.0 → 0.92.1

package/SETUP.md

@@ -98,9 +98,9 @@ Use `additionalUserScopes` only when an integration flow requires specific GitHu
 ## 3) Runtime behavior
 
 - When either GitHub skill is active, authenticated `gh` and `git` commands cause the runtime to inject GitHub credentials automatically for the current turn.
-- The plugin classifies GitHub traffic from the forwarded HTTP request. Safe app-readable API methods, GraphQL `GET`/`HEAD`/`OPTIONS` requests, GraphQL `POST` bodies that prove the operation is a query, and `git-upload-pack` use the `installation-read` grant. `GET /user` uses the `user-read` grant so account identity checks use the requester token. Write-specific REST URLs, GraphQL mutations/subscriptions, unknown GraphQL `POST` bodies, other non-read API methods, and `git-receive-pack` use the `user-write` grant.
-- `user-read` and `user-write` require the requester, or an explicitly delegated user subject from an allowed system run, to authorize the GitHub App through the private OAuth flow. Missing or expired user authorization pauses interactive turns, sends a private authorization link, and resumes after approval.
-- Git commits use the requester as the commit author, Junior as committer, and a Junior `Co-Authored-By` trailer.
+- The plugin classifies GitHub traffic from the forwarded HTTP request. Safe app-readable API methods, GraphQL `GET`/`HEAD`/`OPTIONS` requests, GraphQL `POST` bodies that prove the operation is a query, and `git-upload-pack` use the `installation-read` grant. `GET /user` uses the `user-read` grant so account identity checks use the actor token. Write-specific REST URLs, GraphQL mutations/subscriptions, unknown GraphQL `POST` bodies, other non-read API methods, and `git-receive-pack` use the `user-write` grant.
+- `user-read` and `user-write` require the actor, or an explicitly delegated user subject from an allowed system run, to authorize the GitHub App through the private OAuth flow. Missing or expired user authorization pauses interactive turns, sends a private authorization link, and resumes after approval.
+- Git commits use the actor as the commit author, Junior as committer, and a Junior `Co-Authored-By` trailer.
 - Issued credentials are reused only within the current turn, credential leases are cached separately by plugin grant name, and upstream 403 permission denials clear the cached lease before the next retry.
 - Sandbox does not receive raw tokens via env; host applies Authorization header transforms for GitHub API calls.
 
@@ -132,7 +132,7 @@ The plugin uses `installation-read` for read-only GitHub traffic and `user-write
 
 Committing and pushing code uses more than one GitHub surface:
 
-- Creating the local Git commit does not call GitHub. Junior sets the requester as author and the GitHub App bot as committer in the sandbox.
+- Creating the local Git commit does not call GitHub. Junior sets the actor as author and the GitHub App bot as committer in the sandbox.
 - Pushing a branch with Git smart HTTP (`git push`) uses the `user-write` grant and requires the GitHub App to have `Contents: write` on the target repository. The requesting user must also have write access to that repository.
 - REST Git database writes used by some `gh` flows also require `Contents: write`: create blob (`POST /git/blobs`), create tree (`POST /git/trees`), create commit (`POST /git/commits`), and create/update refs (`POST /git/refs`, `PATCH /git/refs/{ref}`). Changes to workflow files may also require `Workflows: write`.
 - Opening the PR after the branch exists is separate: `github_createPullRequest` needs pull-request write permission, but it should not create or push commits itself.

package/dist/index.js

@@ -887,24 +887,62 @@ function cleanIdentityPart(value) {
 function isSlackUserId(value) {
   return /^[UW][A-Z0-9]{5,}$/.test(value);
 }
-function requesterDisplayName(value, requester) {
+function isUserActor(actor) {
+  return Boolean(actor && "userId" in actor);
+}
+function actorDisplayName(value, actor) {
   const name = cleanIdentityPart(value);
-  if (!name || name.toLowerCase() === "unknown" || name === cleanIdentityPart(requester?.userId)) {
+  if (!name || name.toLowerCase() === "unknown" || name === cleanIdentityPart(isUserActor(actor) ? actor.userId : void 0)) {
     return void 0;
   }
   return isSlackUserId(name) ? void 0 : name;
 }
-function requesterName(requester) {
-  return requesterDisplayName(requester?.fullName, requester) || requesterDisplayName(requester?.userName, requester) || void 0;
+function actorName(actor) {
+  if (!isUserActor(actor)) {
+    return void 0;
+  }
+  return actorDisplayName(actor?.fullName, actor) || actorDisplayName(actor?.userName, actor) || void 0;
 }
-function requesterEmail(requester) {
-  const email = cleanIdentityPart(requester?.email);
+function actorEmail(actor) {
+  if (!isUserActor(actor)) {
+    return void 0;
+  }
+  const email = cleanIdentityPart(actor?.email);
   return /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(email) ? email : void 0;
 }
-function isGitCommitCommand(command) {
-  return /(?:^|[\s;|&])git(?:\s+(?:-C\s+\S+|-c\s+\S+|--git-dir(?:=\S+|\s+\S+)|--work-tree(?:=\S+|\s+\S+)|--namespace(?:=\S+|\s+\S+)))*\s+commit(?:\s|$)/.test(
-    command
-  );
+function actorIdentityKey(actor) {
+  if (actor.platform === "system") {
+    return `system ${actor.name}`;
+  }
+  return actor.platform === "slack" ? `slack ${actor.teamId} ${actor.userId}` : `${actor.platform} ${actor.userId}`;
+}
+function additionalActorCoauthorTrailers(args) {
+  if (!args.actors || args.actors.length === 0) {
+    return [];
+  }
+  const runActorKey = args.runActor ? actorIdentityKey(args.runActor) : void 0;
+  const seenEmails = /* @__PURE__ */ new Set([args.botEmail.toLowerCase()]);
+  if (args.authorEmail) {
+    seenEmails.add(args.authorEmail.toLowerCase());
+  }
+  const trailers = [];
+  for (const candidate of args.actors) {
+    if (runActorKey && actorIdentityKey(candidate) === runActorKey) {
+      continue;
+    }
+    const name = actorName(candidate);
+    const email = actorEmail(candidate);
+    if (!name || !email) {
+      continue;
+    }
+    const emailKey = email.toLowerCase();
+    if (seenEmails.has(emailKey)) {
+      continue;
+    }
+    seenEmails.add(emailKey);
+    trailers.push(`Co-Authored-By: ${name} <${email}>`);
+  }
+  return trailers;
 }
 function prepareCommitMsgHook() {
   return `#!/usr/bin/env bash
@@ -916,12 +954,12 @@ if [ -z "$message_file" ]; then
 fi
 
 if [ -z "\${JUNIOR_GIT_AUTHOR_NAME:-}" ] || [ -z "\${JUNIOR_GIT_AUTHOR_EMAIL:-}" ]; then
-  echo "Junior GitHub plugin internal error: requester commit attribution was not injected by the host runtime. Do not set Git author env vars manually; report this configuration error." >&2
+  echo "Junior GitHub plugin internal error: actor commit attribution was not injected by the host runtime. Do not set Git author env vars manually; report this configuration error." >&2
   exit 1
 fi
 
 if [ "\${GIT_AUTHOR_NAME:-}" != "$JUNIOR_GIT_AUTHOR_NAME" ] || [ "\${GIT_AUTHOR_EMAIL:-}" != "$JUNIOR_GIT_AUTHOR_EMAIL" ]; then
-  echo "Junior GitHub plugin internal error: Git author was not set to the resolved requester identity. Do not override Git author manually; report this configuration error." >&2
+  echo "Junior GitHub plugin internal error: Git author was not set to the resolved actor identity. Do not override Git author manually; report this configuration error." >&2
   exit 1
 fi
 
@@ -930,12 +968,86 @@ if [ -z "\${JUNIOR_GIT_COAUTHOR_NAME:-}" ] || [ -z "\${JUNIOR_GIT_COAUTHOR_EMAIL
   exit 1
 fi
 
-trailer="Co-Authored-By: $JUNIOR_GIT_COAUTHOR_NAME <$JUNIOR_GIT_COAUTHOR_EMAIL>"
-if grep -Fqx "$trailer" "$message_file"; then
+# Git and GitHub only interpret the final contiguous paragraph as the trailer
+# block, so all missing trailers are collected and appended as one block:
+# actor trailers in order, Junior's agent trailer last.
+desired_trailers=""
+add_trailer() {
+  desired_trailers="$desired_trailers$1"$'\\n'
+}
+
+if [ -n "\${JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS:-}" ]; then
+  while IFS= read -r actor_trailer; do
+    if [ -n "$actor_trailer" ]; then
+      add_trailer "$actor_trailer"
+    fi
+  done <<< "$JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS"
+fi
+
+add_trailer "Co-Authored-By: $JUNIOR_GIT_COAUTHOR_NAME <$JUNIOR_GIT_COAUTHOR_EMAIL>"
+
+final_trailer_block=$(awk '
+  { lines[NR] = $0 }
+  END {
+    line = NR
+    while (line > 0 && lines[line] == "") {
+      line--
+    }
+    if (line == 0) {
+      exit 0
+    }
+    start = line
+    while (start > 0 && lines[start] != "") {
+      start--
+    }
+    for (i = start + 1; i <= line; i++) {
+      if (lines[i] !~ /^[[:alnum:]-]+: .+/) {
+        exit 0
+      }
+    }
+    for (i = start + 1; i <= line; i++) {
+      print lines[i]
+    }
+  }
+' "$message_file")
+
+missing_trailers=""
+collect_missing_trailer() {
+  if ! printf '%s\\n' "$final_trailer_block" | grep -Fqx -- "$1"; then
+    missing_trailers="\${missing_trailers}\${1}"$'\\n'
+  fi
+}
+
+while IFS= read -r desired_trailer; do
+  if [ -n "$desired_trailer" ]; then
+    collect_missing_trailer "$desired_trailer"
+  fi
+done <<< "$desired_trailers"
+
+if [ -z "$missing_trailers" ]; then
   exit 0
 fi
 
-printf '\\n%s\\n' "$trailer" >> "$message_file"
+if [ -n "$(tail -c 1 "$message_file")" ]; then
+  printf '\\n' >> "$message_file"
+fi
+
+# When the message already ends with Junior's bot trailer, insert missing
+# actor trailers before it so the bot trailer stays last.
+last_line=$(tail -n 1 "$message_file")
+bot_trailer="Co-Authored-By: $JUNIOR_GIT_COAUTHOR_NAME <$JUNIOR_GIT_COAUTHOR_EMAIL>"
+if [ "$last_line" = "$bot_trailer" ]; then
+  tmp_file=$(mktemp)
+  trap 'rm -f "$tmp_file"' EXIT
+  sed '$d' "$message_file" > "$tmp_file"
+  printf '%s' "$missing_trailers" >> "$tmp_file"
+  printf '%s\\n' "$bot_trailer" >> "$tmp_file"
+  cat "$tmp_file" > "$message_file"
+elif [ -n "$final_trailer_block" ]; then
+  printf '%s' "$missing_trailers" >> "$message_file"
+else
+  printf '\\n%s' "$missing_trailers" >> "$message_file"
+fi
 `;
 }
 async function configureGit(ctx, key, value) {
@@ -1816,26 +1928,13 @@ function githubPlugin(options = {}) {
         if (ctx.tool.name !== "bash") {
           return;
         }
-        const command = typeof ctx.tool.input === "object" && ctx.tool.input && "command" in ctx.tool.input ? String(ctx.tool.input.command ?? "") : "";
         const botName = readEnv(botNameEnv);
         const botEmail = readEnv(botEmailEnv);
-        if ((!botName || !botEmail) && isGitCommitCommand(command)) {
-          ctx.decision.deny(
-            `Junior GitHub plugin is misconfigured: host env vars ${botNameEnv} and ${botEmailEnv} are missing. This is an internal deployment configuration error; do not set them in the sandbox.`
-          );
-          return;
-        }
         if (!botName || !botEmail) {
           return;
         }
-        const authorName = requesterName(ctx.requester);
-        const authorEmail = requesterEmail(ctx.requester);
-        if ((!authorName || !authorEmail) && isGitCommitCommand(command)) {
-          ctx.decision.deny(
-            "Junior GitHub plugin could not determine a resolved requester name and email for commit attribution. This is an internal request-context error; do not set author env vars manually."
-          );
-          return;
-        }
+        const authorName = actorName(ctx.actor);
+        const authorEmail = actorEmail(ctx.actor);
         if (authorName && authorEmail) {
           ctx.env.set("GIT_AUTHOR_NAME", authorName);
           ctx.env.set("GIT_AUTHOR_EMAIL", authorEmail);
@@ -1846,6 +1945,16 @@ function githubPlugin(options = {}) {
         ctx.env.set("GIT_COMMITTER_EMAIL", botEmail);
         ctx.env.set("JUNIOR_GIT_COAUTHOR_NAME", botName);
         ctx.env.set("JUNIOR_GIT_COAUTHOR_EMAIL", botEmail);
+        const actorTrailers = additionalActorCoauthorTrailers({
+          actors: ctx.actors,
+          authorEmail,
+          botEmail,
+          runActor: ctx.actor
+        });
+        ctx.env.set(
+          "JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS",
+          actorTrailers.join("\n")
+        );
       },
       grantForEgress(ctx) {
         return githubGrantForEgress(ctx);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.91.0",
+  "version": "0.92.1",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -25,7 +25,7 @@
   "dependencies": {
     "@sinclair/typebox": "^0.34.49",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.91.0"
+    "@sentry/junior-plugin-api": "0.92.1"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",

package/skills/github-code/references/api-surface.md

@@ -62,7 +62,7 @@ jr-rpc config set github.repo owner/repo
 
 - Prefer `--json` output for machine-readable parsing where available.
 - Pass extra `git clone` flags after `--` (e.g. `gh repo clone owner/repo -- --depth=1`).
-- A local `git commit` does not call GitHub. Pushing that commit does: `git push` requires `github.contents.write` on the target repo and requester write access.
+- A local `git commit` does not call GitHub. Pushing that commit does: `git push` requires `github.contents.write` on the target repo and actor write access.
 - REST Git commit construction also requires `github.contents.write`: `POST /git/blobs`, `POST /git/trees`, `POST /git/commits`, `POST /git/refs`, and `PATCH /git/refs/{ref}`.
 - If the commit changes workflow files under `.github/workflows`, expect `github.workflows.write` in addition to contents write.
 - Before `github_createPullRequest`, push the head branch explicitly and resolve the target repo's default branch for `base`. That push requires GitHub write access to the remote.