@sentry/junior-github 0.98.0 → 0.99.0

package/SETUP.md

@@ -98,7 +98,7 @@ Use `additionalUserScopes` only when a human-identity integration flow requires
 ## 3) Runtime behavior
 
 - When either GitHub skill is active, authenticated `gh` and `git` commands cause the runtime to inject GitHub credentials automatically for the current turn.
-- The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Workflow dispatches use the repository-scoped `installation-actions-write` grant. Allowlisted issue and pull request mutations use their own repository-scoped installation grants. Git smart-HTTP pushes use `installation-pr-branch-write`. Unknown REST writes and GraphQL mutations are denied.
+- The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations and Git smart-HTTP pushes share the repository-scoped `installation-write` grant. Unknown REST writes and GraphQL mutations are denied.
 - `user-read` and the remaining explicitly human `user-write` operations require the actor, or an explicitly delegated user subject, to authorize the GitHub App through the private OAuth flow. Junior-owned issue, pull request, and branch operations do not fall back to user OAuth.
 - Headless resource-event turns use the `resource-event` system actor and may receive the same repository-scoped installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
 - Git commits use Junior as author and committer. Resolvable human run actors are credited once with `Co-Authored-By` trailers.
@@ -133,14 +133,14 @@ The plugin uses installation credentials for read-only GitHub traffic, workflow
 Committing and pushing code uses more than one GitHub surface:
 
 - Creating the local Git commit does not call GitHub. Junior sets the GitHub App bot as author and committer and credits resolvable human actors with `Co-Authored-By` trailers.
-- Pushing a branch with Git smart HTTP (`git push`) uses the repository-scoped `installation-pr-branch-write` grant and requires `Contents: write`. If `Workflows: write` is configured, it is included so workflow-file changes can be pushed.
+- Pushing a branch with Git smart HTTP (`git push`) uses the repository-scoped `installation-write` grant and requires `Contents: write`. If `Workflows: write` is configured, it is included so workflow-file changes can be pushed.
 - The smart-HTTP classifier does not distinguish Junior-managed branches or independently detect force updates or ref deletion. Use GitHub branch protection and limit the App installation to repositories where Junior may push.
 - REST Git database and ref writes are denied by the current write allowlist. Use Git smart HTTP (`git push`) for branch updates instead.
 - Opening the PR after the branch exists is separate: `github_createPullRequest` needs pull-request write permission, but it should not create or push commits itself.
 
 Fork creation is not part of the default PR path and is denied by the current write allowlist. Do not grant `Administration: write` for routine PR creation; push a branch explicitly and create the PR with `github_createPullRequest` instead.
 
-GitHub App permission scoping is a safety rail, not a hard sandbox boundary. It helps prevent accidental write scope and wrong-repo mutations, and the host runtime still decides when to mint credentials. Credential injection is provider-domain scoped for sandbox traffic to `api.github.com` and `github.com` during turns with a signed credential context. Keep repo context explicit, and let the plugin choose the required grant for the outbound request.
+Repository scoping and the egress allowlist are the write boundaries. Credential injection is provider-domain scoped for sandbox traffic to `api.github.com` and `github.com` during turns with a signed credential context. Keep repo context explicit, and let the plugin choose the grant for the outbound request.
 
 Be careful with mixed-surface PR commands. Use the allowlisted REST endpoints
 rather than GraphQL-backed `gh pr` mutation commands. PR-native title, body,

package/dist/index.js

@@ -848,21 +848,8 @@ var USER_REFRESH_TIMEOUT_MS = 2e4;
 var GITHUB_GRAPHQL_RESPONSE_BODY_LIMIT_BYTES = 64 * 1024;
 var HTTP_READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
 var USER_TOKEN_GRANTS = /* @__PURE__ */ new Set(["user-read", "user-write"]);
-var CONTENTS_WRITE_REQUIREMENTS = [
-  "GitHub App Contents: write on the target repository"
-];
-var ACTIONS_WRITE_REQUIREMENTS = [
-  "GitHub App Actions: write on the target repository"
-];
-var ISSUES_WRITE_REQUIREMENTS = [
-  "GitHub App Issues: write on the target repository"
-];
-var PULL_REQUESTS_WRITE_REQUIREMENTS = [
-  "GitHub App Pull requests: write on the target repository"
-];
-var PULL_REVIEW_WRITE_REQUIREMENTS = [
-  ...PULL_REQUESTS_WRITE_REQUIREMENTS,
-  "requesting GitHub user permission to review the pull request"
+var USER_WRITE_REQUIREMENTS = [
+  "requesting GitHub user permission to perform this operation"
 ];
 var GitHubUserRefreshRejectedError = class extends Error {
   constructor(message) {
@@ -1586,11 +1573,6 @@ async function issueInstallationCredential(options) {
   }
   const appJwt = createAppJwt(appId, options.privateKeyEnv);
   const permissions = options.permissions ?? await options.loadPermissions?.({ appJwt, installationId });
-  if (!permissions) {
-    throw new GitHubPluginSetupError(
-      "GitHub installation credential permissions are not configured."
-    );
-  }
   const accessTokenResponse = await githubRequest(
     "https://api.github.com",
     `/app/installations/${installationId}/access_tokens`,
@@ -1598,7 +1580,7 @@ async function issueInstallationCredential(options) {
       method: "POST",
       token: appJwt,
       body: {
-        permissions,
+        ...permissions ? { permissions } : {},
         ...options.repositories ? { repositories: options.repositories } : {}
       }
     }
@@ -1785,7 +1767,7 @@ function shouldInspectGitHubGraphqlResponse(ctx) {
   const contentType = ctx.response.headers.get("content-type");
   return contentType ? /\bjson\b/i.test(contentType) : false;
 }
-function githubApiWriteReason(method, upstreamUrl) {
+function githubApiWriteGrantName(method, upstreamUrl) {
   const pathname = upstreamUrl.pathname.toLowerCase();
   if (!isGitHubApiUrl(upstreamUrl)) {
     return void 0;
@@ -1793,56 +1775,38 @@ function githubApiWriteReason(method, upstreamUrl) {
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/actions\/workflows\/[^/]+\/dispatches$/.test(
     pathname
   )) {
-    return "github.actions-workflow-dispatch";
+    return "installation-write";
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues$/.test(pathname)) {
-    return "github.issue-create";
+    return "installation-write";
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+\/comments$/.test(pathname)) {
-    return "github.issues-write";
+    return "installation-write";
   }
   if (method === "PATCH" && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+$/.test(pathname)) {
-    return "github.issues-write";
+    return "installation-write";
   }
   if ((method === "POST" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/issues\/[^/]+\/(labels|assignees)(?:\/[^/]+)?$/.test(
     pathname
   )) {
-    return "github.issues-write";
+    return "installation-write";
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls$/.test(pathname)) {
-    return "github.pull-create";
+    return "installation-write";
   }
   if (method === "PATCH" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+$/.test(pathname)) {
-    return "github.pull-requests-write";
+    return "installation-write";
   }
   if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/ready_for_review$/.test(pathname)) {
-    return "github.pull-requests-write";
+    return "installation-write";
   }
   if ((method === "POST" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/requested_reviewers$/.test(pathname)) {
-    return "github.pull-requests-write";
+    return "installation-write";
   }
   if (/^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/reviews(?:\/[^/]+(?:\/(events|dismissals))?)?$/.test(
     pathname
   ) && !HTTP_READ_METHODS.has(method)) {
-    return "github.pull-review-write";
-  }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/forks$/.test(pathname)) {
-    return "github.fork-create";
-  }
-  if (/^\/repos\/[^/]+\/[^/]+\/contents(?:\/|$)/.test(pathname) && (method === "PUT" || method === "DELETE")) {
-    return pathname.includes("/.github/workflows/") ? "github.workflows-write" : "github.contents-write";
-  }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/git\/(blobs|trees|commits)$/.test(pathname)) {
-    return "github.contents-write";
-  }
-  if (method === "POST" && /^\/repos\/[^/]+\/[^/]+\/git\/refs$/.test(pathname)) {
-    return "github.contents-write";
-  }
-  if ((method === "PATCH" || method === "DELETE") && /^\/repos\/[^/]+\/[^/]+\/git\/refs\/.+/.test(pathname)) {
-    return "github.contents-write";
-  }
-  if (method === "PUT" && /^\/repos\/[^/]+\/[^/]+\/pulls\/[^/]+\/merge$/.test(pathname)) {
-    return "github.contents-write";
+    return "user-write";
   }
   return void 0;
 }
@@ -1915,22 +1879,7 @@ function assertGitHubWriteAllowed(input) {
   }
 }
 function grantRequirements(reason) {
-  if (reason === "github.actions-workflow-dispatch") {
-    return ACTIONS_WRITE_REQUIREMENTS;
-  }
-  if (reason === "github.git-write" || reason === "github.contents-write") {
-    return CONTENTS_WRITE_REQUIREMENTS;
-  }
-  if (reason === "github.issue-create" || reason === "github.issues-write") {
-    return ISSUES_WRITE_REQUIREMENTS;
-  }
-  if (reason === "github.pull-review-write") {
-    return PULL_REVIEW_WRITE_REQUIREMENTS;
-  }
-  if (reason === "github.pull-create" || reason === "github.pull-requests-write") {
-    return PULL_REQUESTS_WRITE_REQUIREMENTS;
-  }
-  return void 0;
+  return reason === "github.user-write" ? USER_WRITE_REQUIREMENTS : void 0;
 }
 function grantForAccess(access, reason, name, leaseScope) {
   const requirements = grantRequirements(reason);
@@ -1951,37 +1900,6 @@ function repositoryLeaseScope(upstreamUrl) {
   }
   return githubRepositoryLeaseScope(repository);
 }
-function installationGrantForWrite(reason, upstreamUrl) {
-  const leaseScope = repositoryLeaseScope(upstreamUrl);
-  if (reason === "github.actions-workflow-dispatch") {
-    return grantForAccess(
-      "write",
-      reason,
-      "installation-actions-write",
-      leaseScope
-    );
-  }
-  if (reason === "github.issue-create" || reason === "github.issues-write") {
-    return grantForAccess(
-      "write",
-      reason,
-      "installation-issues-write",
-      leaseScope
-    );
-  }
-  if (reason === "github.pull-create" || reason === "github.pull-requests-write") {
-    return grantForAccess(
-      "write",
-      reason,
-      "installation-pull-requests-write",
-      leaseScope
-    );
-  }
-  if (reason === "github.pull-review-write") {
-    return grantForAccess("write", reason, "user-write", leaseScope);
-  }
-  return void 0;
-}
 async function githubGrantForEgress(ctx) {
   const method = ctx.request.method.toUpperCase();
   const upstreamUrl = new URL(ctx.request.url);
@@ -1996,8 +1914,8 @@ async function githubGrantForEgress(ctx) {
     if (smartHttpAccess === "write") {
       return grantForAccess(
         "write",
-        "github.git-write",
-        "installation-pr-branch-write",
+        "github.installation-write",
+        "installation-write",
         repositoryLeaseScope(upstreamUrl)
       );
     }
@@ -2011,14 +1929,13 @@ async function githubGrantForEgress(ctx) {
   if (userReadReason) {
     return grantForAccess("read", userReadReason, "user-read");
   }
-  const writeReason = githubApiWriteReason(method, upstreamUrl);
-  if (writeReason) {
-    const grant = installationGrantForWrite(writeReason, upstreamUrl);
-    if (grant) {
-      return grant;
-    }
-    throw new EgressPolicyDenied(
-      `GitHub write operation ${writeReason} is not enabled for Junior credentials.`
+  const writeGrantName = githubApiWriteGrantName(method, upstreamUrl);
+  if (writeGrantName) {
+    return grantForAccess(
+      "write",
+      writeGrantName === "user-write" ? "github.user-write" : "github.installation-write",
+      writeGrantName,
+      repositoryLeaseScope(upstreamUrl)
     );
   }
   const graphqlAccess = githubGraphqlAccess(
@@ -2046,38 +1963,6 @@ async function githubGrantForEgress(ctx) {
   }
   return grantForAccess(access, "github.api-read", "installation-read");
 }
-function configuredWritePermission(appPermissions, permission) {
-  const level = appPermissions?.[permission];
-  if (level !== void 0 && level !== "write" && level !== "admin") {
-    throw new GitHubPluginSetupError(
-      `githubPlugin appPermissions.${permission} must allow write access for Junior-owned GitHub resources.`
-    );
-  }
-  return {
-    metadata: "read",
-    ...permission === "pull_requests" ? { contents: "read" } : {},
-    [permission]: "write"
-  };
-}
-function configuredBranchWritePermissions(appPermissions) {
-  const contents = appPermissions?.contents;
-  if (contents !== void 0 && contents !== "write" && contents !== "admin") {
-    throw new GitHubPluginSetupError(
-      "githubPlugin appPermissions.contents must allow write access for Junior-managed pull request branches."
-    );
-  }
-  const workflows = appPermissions?.workflows;
-  if (workflows !== void 0 && workflows !== "write" && workflows !== "admin") {
-    throw new GitHubPluginSetupError(
-      "githubPlugin appPermissions.workflows must allow write access when configured."
-    );
-  }
-  return {
-    contents: "write",
-    metadata: "read",
-    ...workflows === "write" || workflows === "admin" ? { workflows: "write" } : {}
-  };
-}
 function githubPlugin(options = {}) {
   const botNameEnv = options.botNameEnv ?? "GITHUB_APP_BOT_NAME";
   const botEmailEnv = options.botEmailEnv ?? "GITHUB_APP_BOT_EMAIL";
@@ -2208,23 +2093,7 @@ function githubPlugin(options = {}) {
               ...appReadPermissions ? { permissions: appReadPermissions } : { loadPermissions: loadReadPermissions }
             });
           }
-          if (ctx.grant.name === "installation-actions-write" || ctx.grant.name === "installation-issues-write" || ctx.grant.name === "installation-pull-requests-write") {
-            const repository = githubRepositoryFromLeaseScope(
-              ctx.grant.leaseScope
-            );
-            const permission = ctx.grant.name === "installation-actions-write" ? "actions" : ctx.grant.name === "installation-issues-write" ? "issues" : "pull_requests";
-            return await issueInstallationCredential({
-              appIdEnv,
-              privateKeyEnv,
-              installationIdEnv,
-              permissions: configuredWritePermission(
-                appPermissions,
-                permission
-              ),
-              repositories: [repository.name]
-            });
-          }
-          if (ctx.grant.name === "installation-pr-branch-write") {
+          if (ctx.grant.name === "installation-write") {
             const repository = githubRepositoryFromLeaseScope(
               ctx.grant.leaseScope
             );
@@ -2232,7 +2101,12 @@ function githubPlugin(options = {}) {
               appIdEnv,
               privateKeyEnv,
               installationIdEnv,
-              permissions: configuredBranchWritePermissions(appPermissions),
+              ...appPermissions ? {
+                permissions: {
+                  ...appPermissions,
+                  metadata: "read"
+                }
+              } : {},
               repositories: [repository.name]
             });
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.98.0",
+  "version": "0.99.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -25,7 +25,7 @@
   "dependencies": {
     "@sinclair/typebox": "^0.34.49",
     "zod": "^4.4.3",
-    "@sentry/junior-plugin-api": "0.98.0"
+    "@sentry/junior-plugin-api": "0.99.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.1",