@thinkai/tai-api-contract 2.66.0 → 2.67.0

package/openapi/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: ThinkAI API
-  version: 2.66.0
+  version: 2.67.0
   description: >
     Contract surface for the AI Driven SDLC backend used by ThinkAI.
     Workspace-scoped routes use `/workspaces/{workspaceId}/...`.
@@ -3394,7 +3394,20 @@ paths:
           required: false
           description: >
             When true, re-fetch GitHub App and installation permission metadata (used by the
-            login permission gate after the user approves on GitHub).
+            login permission gate after the user approves on GitHub). Clears App-permission and
+            product-settings caches so the next `productSettingsRefresh` re-probes. Does not itself
+            call alert-list APIs; use `productSettingsRefresh` for that.
+          schema:
+            type: boolean
+            default: false
+        - name: productSettingsRefresh
+          in: query
+          required: false
+          description: >
+            When true, probe Dependabot alerts and secret scanning enablement on a small sample of
+            connected repositories (only when security App grants are present). Without this flag,
+            status returns previously cached `githubProductSettings` only (no live probe).
+            Results are cached server-side for several minutes.
           schema:
             type: boolean
             default: false
@@ -11442,6 +11455,23 @@ components:
           enum: [github_permissions_check_failed]
           description: GitHub installation permissions could not be verified (transient upstream failure).
 
+    GithubProductSettingStatus:
+      type: string
+      enum: [ok, not_enabled, partial, forbidden, unknown]
+      description: >
+        Whether a GitHub Code security product is enabled and readable for sampled repos.
+        `partial` means mixed enablement across the sample; `unknown` when not probed or grants missing.
+
+    GithubProductSettingsDto:
+      type: object
+      additionalProperties: false
+      required: [dependabotAlerts, secretScanning]
+      properties:
+        dependabotAlerts:
+          $ref: "#/components/schemas/GithubProductSettingStatus"
+        secretScanning:
+          $ref: "#/components/schemas/GithubProductSettingStatus"
+
     GithubInstallationSummaryDto:
       type: object
       required:
@@ -11450,6 +11480,8 @@ components:
         - repos
         - permissionsUpgradeRequired
         - corePermissionsOk
+        - securityPermissionsOk
+        - financialPermissionsOk
         - writePermissionsOk
         - writePermissionsUpgradeRequired
         - automatedFixesEnabled
@@ -11483,6 +11515,40 @@ components:
           description: >
             True when installation grants read permissions for repository analysis (contents, metadata,
             pull requests, and members for org installs).
+        securityPermissionsOk:
+          type: boolean
+          description: >
+            True when installation grants Vulnerability alerts and Secret scanning alerts read for SDLC security metrics.
+        financialPermissionsOk:
+          type: boolean
+          description: >
+            True when installation grants financial/operational SDLC metric permissions (Actions, Deployments,
+            and org Administration / Copilot seat reads for organization installs).
+        missingSecurityPermissions:
+          type: array
+          items:
+            $ref: "#/components/schemas/GithubMissingPermissionDto"
+          description: Security alert permissions still needed for SDLC security metrics.
+        missingFinancialPermissions:
+          type: array
+          items:
+            $ref: "#/components/schemas/GithubMissingPermissionDto"
+          description: Financial/operational permissions still needed for SDLC financial metrics.
+        securityUpgradeMessage:
+          type: string
+          nullable: true
+          description: Human-readable summary when security App permissions are missing.
+        financialUpgradeMessage:
+          type: string
+          nullable: true
+          description: Human-readable summary when financial App permissions are missing.
+        githubProductSettings:
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/GithubProductSettingsDto"
+          description: >
+            Dependabot alerts and secret scanning enablement on sampled repos (throttled probe).
+            Omitted when security App grants are missing or the probe has not run.
         writePermissionsOk:
           type: boolean
           description: >
@@ -11820,6 +11886,8 @@ components:
         - installations
         - permissionsUpgradeRequired
         - corePermissionsOk
+        - securityPermissionsOk
+        - financialPermissionsOk
         - writePermissionsOk
         - writePermissionsUpgradeRequired
       properties:
@@ -11835,6 +11903,35 @@ components:
         corePermissionsOk:
           type: boolean
           description: True when every connected installation grants core read permissions.
+        securityPermissionsOk:
+          type: boolean
+          description: True when every connected installation grants security alert read permissions.
+        financialPermissionsOk:
+          type: boolean
+          description: True when every connected installation grants financial/operational read permissions.
+        missingSecurityPermissions:
+          type: array
+          items:
+            $ref: "#/components/schemas/GithubMissingPermissionDto"
+          description: Aggregated security permissions missing on installations with security gaps.
+        missingFinancialPermissions:
+          type: array
+          items:
+            $ref: "#/components/schemas/GithubMissingPermissionDto"
+          description: Aggregated financial permissions missing on installations with financial gaps.
+        securityUpgradeMessage:
+          type: string
+          nullable: true
+          description: Human-readable summary when security App permissions are missing.
+        financialUpgradeMessage:
+          type: string
+          nullable: true
+          description: Human-readable summary when financial App permissions are missing.
+        githubProductSettings:
+          nullable: true
+          allOf:
+            - $ref: "#/components/schemas/GithubProductSettingsDto"
+          description: Workspace-wide Code security product status reduced from installations.
         writePermissionsOk:
           type: boolean
           description: True when every connected installation grants write permissions for automated fixes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkai/tai-api-contract",
-  "version": "2.66.0",
+  "version": "2.67.0",
   "private": false,
   "type": "module",
   "main": "dist/index.js",

package/src/generated/openapi.ts

@@ -4765,6 +4765,15 @@ export interface components {
              */
             error: "github_permissions_check_failed";
         };
+        /**
+         * @description Whether a GitHub Code security product is enabled and readable for sampled repos. `partial` means mixed enablement across the sample; `unknown` when not probed or grants missing.
+         * @enum {string}
+         */
+        GithubProductSettingStatus: "ok" | "not_enabled" | "partial" | "forbidden" | "unknown";
+        GithubProductSettingsDto: {
+            dependabotAlerts: components["schemas"]["GithubProductSettingStatus"];
+            secretScanning: components["schemas"]["GithubProductSettingStatus"];
+        };
         GithubInstallationSummaryDto: {
             installationId: string;
             account: components["schemas"]["GithubAccountDto"];
@@ -4778,6 +4787,20 @@ export interface components {
             permissionsUpgradeRequired: boolean;
             /** @description True when installation grants read permissions for repository analysis (contents, metadata, pull requests, and members for org installs). */
             corePermissionsOk: boolean;
+            /** @description True when installation grants Vulnerability alerts and Secret scanning alerts read for SDLC security metrics. */
+            securityPermissionsOk: boolean;
+            /** @description True when installation grants financial/operational SDLC metric permissions (Actions, Deployments, and org Administration / Copilot seat reads for organization installs). */
+            financialPermissionsOk: boolean;
+            /** @description Security alert permissions still needed for SDLC security metrics. */
+            missingSecurityPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Financial/operational permissions still needed for SDLC financial metrics. */
+            missingFinancialPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Human-readable summary when security App permissions are missing. */
+            securityUpgradeMessage?: string | null;
+            /** @description Human-readable summary when financial App permissions are missing. */
+            financialUpgradeMessage?: string | null;
+            /** @description Dependabot alerts and secret scanning enablement on sampled repos (throttled probe). Omitted when security App grants are missing or the probe has not run. */
+            githubProductSettings?: components["schemas"]["GithubProductSettingsDto"] | null;
             /** @description True when automated fixes are enabled and the linked Automations (write) installation grants write permissions required for fix PRs. */
             writePermissionsOk: boolean;
             /** @description Alias for `!writePermissionsOk`. */
@@ -4962,6 +4985,20 @@ export interface components {
             permissionsUpgradeRequired: boolean;
             /** @description True when every connected installation grants core read permissions. */
             corePermissionsOk: boolean;
+            /** @description True when every connected installation grants security alert read permissions. */
+            securityPermissionsOk: boolean;
+            /** @description True when every connected installation grants financial/operational read permissions. */
+            financialPermissionsOk: boolean;
+            /** @description Aggregated security permissions missing on installations with security gaps. */
+            missingSecurityPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Aggregated financial permissions missing on installations with financial gaps. */
+            missingFinancialPermissions?: components["schemas"]["GithubMissingPermissionDto"][];
+            /** @description Human-readable summary when security App permissions are missing. */
+            securityUpgradeMessage?: string | null;
+            /** @description Human-readable summary when financial App permissions are missing. */
+            financialUpgradeMessage?: string | null;
+            /** @description Workspace-wide Code security product status reduced from installations. */
+            githubProductSettings?: components["schemas"]["GithubProductSettingsDto"] | null;
             /** @description True when every connected installation grants write permissions for automated fixes. */
             writePermissionsOk: boolean;
             /** @description True when any connected installation lacks write permissions for automated fixes. */
@@ -6811,6 +6848,8 @@ export type RepoEligibilityLimitsDto = components['schemas']['RepoEligibilityLim
 export type GithubMissingPermissionDto = components['schemas']['GithubMissingPermissionDto'];
 export type GithubWritePermissionsRequiredErrorDto = components['schemas']['GithubWritePermissionsRequiredErrorDto'];
 export type GithubPermissionsCheckFailedErrorDto = components['schemas']['GithubPermissionsCheckFailedErrorDto'];
+export type GithubProductSettingStatus = components['schemas']['GithubProductSettingStatus'];
+export type GithubProductSettingsDto = components['schemas']['GithubProductSettingsDto'];
 export type GithubInstallationSummaryDto = components['schemas']['GithubInstallationSummaryDto'];
 export type GithubPendingApprovalDto = components['schemas']['GithubPendingApprovalDto'];
 export type GithubSetupInProgressDto = components['schemas']['GithubSetupInProgressDto'];
@@ -10431,8 +10470,10 @@ export interface operations {
             query?: {
                 /** @description When true, bypass `tai_workspace_vcs_repos_cache` and re-fetch from GitHub. When productivity backfill phase is `complete`, also triggers inline `on_demand` ingest for the current UTC week (gap-fill only when metrics are missing). Response includes `productivityRefreshInProgress` while the workspace advisory lock is held. */
                 refresh?: boolean;
-                /** @description When true, re-fetch GitHub App and installation permission metadata (used by the login permission gate after the user approves on GitHub). */
+                /** @description When true, re-fetch GitHub App and installation permission metadata (used by the login permission gate after the user approves on GitHub). Clears App-permission and product-settings caches so the next `productSettingsRefresh` re-probes. Does not itself call alert-list APIs; use `productSettingsRefresh` for that. */
                 permissionsRefresh?: boolean;
+                /** @description When true, probe Dependabot alerts and secret scanning enablement on a small sample of connected repositories (only when security App grants are present). Without this flag, status returns previously cached `githubProductSettings` only (no live probe). Results are cached server-side for several minutes. */
+                productSettingsRefresh?: boolean;
                 /** @description Page size for the nested installation repo list (default 25, max 100). */
                 repoLimit?: components["parameters"]["GithubRepoLimit"];
                 /** @description Zero-based offset into the merged installation repo list. */