@zackbart/connecta 0.34.1 → 0.36.0

package/dist/providers/github/safety.js

@@ -0,0 +1,216 @@
+import { valueSafety, safe, redact, refuse } from "../_shared/rest/value-safety.js";
+import { githubIndex } from "./lib/discovery.js";
+import { READ_PERMISSIONS, RELEASE_PERMISSIONS, INTERNAL_READS, MERGE } from "./lib/operations.js";
+// Reviewed pinned success paths. Temporary clone tokens and upload destinations
+// stay withheld; security-feature settings and public commit signatures carry
+// no authentication material. No vendor-wide credential-name exemption.
+const RESPONSE_PATHS = {
+    "GET /installation/repositories": {
+        "redact": ["repositories[].temp_clone_token"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}": {
+        "redact": [
+            "parent.temp_clone_token",
+            "source.temp_clone_token",
+            "temp_clone_token",
+            "template_repository.temp_clone_token",
+        ],
+        "keep": [
+            "security_and_analysis.advanced_security",
+            "security_and_analysis.secret_scanning",
+            "security_and_analysis.secret_scanning_ai_detection",
+            "security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "security_and_analysis.secret_scanning_delegated_bypass",
+            "security_and_analysis.secret_scanning_delegated_bypass_options",
+            "security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "security_and_analysis.secret_scanning_non_provider_patterns",
+        ],
+    },
+    "GET /repos/{owner}/{repo}/actions/runs": {
+        "redact": ["workflow_runs[].head_repository.temp_clone_token", "workflow_runs[].repository.temp_clone_token"],
+        "keep": [
+            "workflow_runs[].head_repository.security_and_analysis.advanced_security",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_ai_detection",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_non_provider_patterns",
+            "workflow_runs[].repository.security_and_analysis.advanced_security",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_ai_detection",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_non_provider_patterns",
+        ],
+    },
+    "GET /repos/{owner}/{repo}/actions/runs/{run_id}": {
+        "redact": ["head_repository.temp_clone_token", "repository.temp_clone_token"],
+        "keep": [
+            "head_repository.security_and_analysis.advanced_security",
+            "head_repository.security_and_analysis.secret_scanning",
+            "head_repository.security_and_analysis.secret_scanning_ai_detection",
+            "head_repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "head_repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "head_repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "head_repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "head_repository.security_and_analysis.secret_scanning_non_provider_patterns",
+            "repository.security_and_analysis.advanced_security",
+            "repository.security_and_analysis.secret_scanning",
+            "repository.security_and_analysis.secret_scanning_ai_detection",
+            "repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "repository.security_and_analysis.secret_scanning_non_provider_patterns",
+        ],
+    },
+    "GET /repos/{owner}/{repo}/actions/workflows/{workflow_id}/runs": {
+        "redact": ["workflow_runs[].head_repository.temp_clone_token", "workflow_runs[].repository.temp_clone_token"],
+        "keep": [
+            "workflow_runs[].head_repository.security_and_analysis.advanced_security",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_ai_detection",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "workflow_runs[].head_repository.security_and_analysis.secret_scanning_non_provider_patterns",
+            "workflow_runs[].repository.security_and_analysis.advanced_security",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_ai_detection",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "workflow_runs[].repository.security_and_analysis.secret_scanning_non_provider_patterns",
+        ],
+    },
+    "GET /repos/{owner}/{repo}/commits": {
+        "redact": [],
+        "keep": ["[].commit.verification.signature"],
+    },
+    "GET /repos/{owner}/{repo}/commits/{ref}": {
+        "redact": [],
+        "keep": ["commit.verification.signature"],
+    },
+    "GET /repos/{owner}/{repo}/compare/{basehead}": {
+        "redact": [],
+        "keep": [
+            "base_commit.commit.verification.signature",
+            "commits[].commit.verification.signature",
+            "merge_base_commit.commit.verification.signature",
+        ],
+    },
+    "GET /repos/{owner}/{repo}/issues": {
+        "redact": ["[].repository.temp_clone_token"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/issues/{issue_number}": {
+        "redact": ["repository.temp_clone_token"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/pulls": {
+        "redact": ["[].base.repo.temp_clone_token", "[].head.repo.temp_clone_token"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/pulls/{pull_number}": {
+        "redact": ["base.repo.temp_clone_token", "head.repo.temp_clone_token"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/pulls/{pull_number}/commits": {
+        "redact": [],
+        "keep": ["[].commit.verification.signature"],
+    },
+    "GET /repos/{owner}/{repo}/releases": {
+        "redact": ["[].upload_url"],
+        "keep": [],
+    },
+    "POST /repos/{owner}/{repo}/releases": {
+        "redact": ["upload_url"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/releases/latest": {
+        "redact": ["upload_url"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/releases/tags/{tag}": {
+        "redact": ["upload_url"],
+        "keep": [],
+    },
+    "GET /repos/{owner}/{repo}/releases/{release_id}": {
+        "redact": ["upload_url"],
+        "keep": [],
+    },
+    "PATCH /repos/{owner}/{repo}/releases/{release_id}": {
+        "redact": ["upload_url"],
+        "keep": [],
+    },
+    "GET /search/code": {
+        "redact": ["items[].repository.temp_clone_token"],
+        "keep": [
+            "items[].repository.security_and_analysis.advanced_security",
+            "items[].repository.security_and_analysis.secret_scanning",
+            "items[].repository.security_and_analysis.secret_scanning_ai_detection",
+            "items[].repository.security_and_analysis.secret_scanning_delegated_alert_dismissal",
+            "items[].repository.security_and_analysis.secret_scanning_delegated_bypass",
+            "items[].repository.security_and_analysis.secret_scanning_delegated_bypass_options",
+            "items[].repository.security_and_analysis.secret_scanning_delegated_bypass_options.reviewers",
+            "items[].repository.security_and_analysis.secret_scanning_non_provider_patterns",
+        ],
+    },
+    "GET /search/issues": {
+        "redact": ["items[].repository.temp_clone_token"],
+        "keep": [],
+    },
+    "GET /search/repositories": {
+        "redact": ["items[].temp_clone_token"],
+        "keep": [],
+    },
+};
+export const SAFETY = {
+    title: "GitHub",
+    embeddedUrls: {
+        operations: Object.fromEntries(githubIndex.ops
+            .filter((op) => {
+            const key = `${op.method} ${op.path}`;
+            return READ_PERMISSIONS[key] || RELEASE_PERMISSIONS[key] || INTERNAL_READS.has(key) || key === MERGE;
+        })
+            .map((op) => [
+            `${op.method} ${op.path}`,
+            githubIndex
+                .fields(op)
+                // The index declares exhaustive roots, not every nested record.
+                // Scan each root's complete value so nested commit messages and
+                // search/repository descriptions receive the same URL protection.
+                .filter((f) => f.in === "response" && /^(?:\[\]\.)?[^.[\]]+$/.test(f.path))
+                .map((f) => f.path),
+        ])),
+    },
+    operations: Object.fromEntries(githubIndex.ops.map((op) => {
+        const key = `${op.method} ${op.path}`, reviewed = RESPONSE_PATHS[key];
+        return [
+            key,
+            READ_PERMISSIONS[key] || RELEASE_PERMISSIONS[key] || INTERNAL_READS.has(key) || key === MERGE
+                ? reviewed?.redact.length
+                    ? redact("Temporary repository clone tokens and upload destinations are withheld; security-feature settings and public commit signatures are metadata.", reviewed.redact, reviewed.keep)
+                    : safe("Reviewed repository metadata, authored content or release/merge record; public verification signatures contain no private key.", reviewed?.keep)
+                : refuse("Outside the reviewed repository resource allowlist; credential, signing, administrative and download operations are unavailable."),
+        ];
+    })),
+    fields: {
+        token: { verdict: "redact", reason: "Tokens never leave private authentication." },
+        key: { verdict: "redact", reason: "Deploy-key material is permanently withheld." },
+        private_key: { verdict: "redact", reason: "Private key material is never returned." },
+        secret: { verdict: "redact", reason: "Stored secrets are never returned." },
+        download_url: {
+            verdict: "redact",
+            reason: "File download URLs can expire or carry a private credential; use inline content.",
+        },
+    },
+};
+export const githubSafety = valueSafety(SAFETY, () => githubIndex);

package/dist/providers/github/skill.generated.js

@@ -1,8 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "## Setup\n\nCreate a GitHub App, generate its RSA private key, and install it on every\nconfigured owner. Org grants require **All repositories**, including future\nrepositories. Exact repo grants work with selected-repository installations.\nRead-only grants request read permissions; read-write grants request only the\npermissions needed by each operation. The App needs repository Metadata,\nContents, Issues, Pull requests, Actions, Checks and Commit statuses for the\nreviewed read tools. Grant Contents, Issues, Pull requests and Actions write\nonly for the operations the deployment needs. Workflow-file edits also need\nthe App's Workflows write permission and `workflows: \"write\"` on the effective\nscope. Org grants authorize repository operations, not organization administration.\n\nPass `app: { appId, privateKey }` with the key from an environment secret, or\nomit privateKey and populate the connector's encrypted `privateKey` vault field.\nNever put private keys or installation tokens in agent instructions. Tokens\nstay in bounded runtime memory, refresh a minute before expiry, and are never\npersisted. Key rotation partitions the caches by the key's fingerprint.\nConfigured repository names bind to repository IDs on first use. Bindings last\nfor the provider instance; name lookups expire after five minutes. A rename\nkeeps its grant, while a replacement repository at the old name does not.\nReconfigure to authorize a replacement. Transfers leave the original\ninstallation and cannot use its tokens. Org grants bind to installation IDs.\n\n## Choose the target first\n\n`list_scopes({})` returns configured org/repo grants without network access.\n`list_scopes({ owner })` resolves that owner's installation and pages reachable\nrepositories. Carry its `next_page`. The connection context lists configured\nscopes and access. A repo entry overrides and may narrow its parent org entry.\nAn org grant covers current and future repositories, as long as the installation\nkeeps All repositories selected.\n\nEvery hosted call requires explicit `owner` and `repo`. Connecta checks scope\nand write access before reading the key or minting a token, and narrows each\nrepo call's token with `repository_ids` and the reviewed permissions.\nAn internal metadata-only installation token resolves names through GitHub's\ninstallation repository list; it never authenticates hosted calls or search.\nExpiry and misses refresh the name lookup without rebinding configured grants.\nUse discovery or the configured name to refresh a rename before using its new\nname; names that cannot map to a configured grant fail before operation tokens\nare minted. Cross-owner\nPR heads, cross-repository issue parents, opaque comment/review-thread IDs and\nsymlink writes are refused. The first release acts as the App; personal OAuth\nattribution is planned separately. Classification describes behavior; scope\nchecks authorize targets whether or not the endpoint is read-only.\n\n## Tools and paging\n\nHosted schemas and results come from GitHub. Reviewed reads cover files,\ncommits, branches, tags, releases, issues, labels, PR details/diffs/reviews,\nand Actions workflows/runs/jobs. Reviewed writes cover issues, comments, PR\ncreation/updates/reviews, branches, file edits and Actions dispatch/rerun/cancel.\nCompound `issue_write` is always a write, including update/close. Review methods\nare limited to create/submit_pending/delete_pending; resolve/unresolve by opaque thread ID are\nnot exposed. Scope-changing tools, repo creation/forks, deletion/transfer,\nadministration, secrets and Copilot delegation are absent. Unknown upstream\ntools, arguments and methods require review before use.\n\nUse `search_scoped` for repositories, issues, PRs or code across installations.\nSupply literal words and an optional subset of configured org/repo selectors.\nScope qualifiers and Boolean operators are refused. Results have a partition\nID, next page, and an incomplete-results flag. Pass pages keyed by those exact\npartition IDs. Each call makes at most 20 partition requests; select fewer\nscopes when needed. Search pages stop at 10 and retain incompleteness. Returned\nrepositories are checked by ID against both deployment scopes and selected\npartitions. Issue and PR results resolve their repository URL to an ID before\nany result is returned.\nInstallation tokens do not override GitHub's own code-search access restrictions.\n\nREST complements own `create_release`, `update_release`, `delete_release` and\n`merge_pull_request`. Publishing a draft is `update_release({ draft: false })`.\nMerge requires an expected head SHA, a same-repository head/base and explicit\nworkflow-write access on the effective scope. GitHub atomically guards only the\nhead SHA, so a concurrent base retarget can introduce workflow changes despite\nan earlier file comparison. Merge is therefore disabled by default.\nRead current state before updates. A dispatched write is attempted once;\nGitHub errors never trigger an automatic write retry. Honor retry timing on\nrate limits; an ambiguous 404 may mean absence or an installation permission\ngap. Fix the App installation/key/permissions for auth errors; the App has no\ninteractive OAuth reconnect flow.\n",
-    "instructionsHeading": "Repository instructions",
-    "fragments": {
-        "guide": "## Setup\n\nCreate a GitHub App, generate its RSA private key, and install it on every\nconfigured owner. Org grants require **All repositories**, including future\nrepositories. Exact repo grants work with selected-repository installations.\nRead-only grants request read permissions; read-write grants request only the\npermissions needed by each operation. The App needs repository Metadata,\nContents, Issues, Pull requests, Actions, Checks and Commit statuses for the\nreviewed read tools. Grant Contents, Issues, Pull requests and Actions write\nonly for the operations the deployment needs. Workflow-file edits also need\nthe App's Workflows write permission and `workflows: \"write\"` on the effective\nscope. Org grants authorize repository operations, not organization administration.\n\nPass `app: { appId, privateKey }` with the key from an environment secret, or\nomit privateKey and populate the connector's encrypted `privateKey` vault field.\nNever put private keys or installation tokens in agent instructions. Tokens\nstay in bounded runtime memory, refresh a minute before expiry, and are never\npersisted. Key rotation partitions the caches by the key's fingerprint.\nConfigured repository names bind to repository IDs on first use. Bindings last\nfor the provider instance; name lookups expire after five minutes. A rename\nkeeps its grant, while a replacement repository at the old name does not.\nReconfigure to authorize a replacement. Transfers leave the original\ninstallation and cannot use its tokens. Org grants bind to installation IDs.\n\n## Choose the target first\n\n`list_scopes({})` returns configured org/repo grants without network access.\n`list_scopes({ owner })` resolves that owner's installation and pages reachable\nrepositories. Carry its `next_page`. The connection context lists configured\nscopes and access. A repo entry overrides and may narrow its parent org entry.\nAn org grant covers current and future repositories, as long as the installation\nkeeps All repositories selected.\n\nEvery hosted call requires explicit `owner` and `repo`. Connecta checks scope\nand write access before reading the key or minting a token, and narrows each\nrepo call's token with `repository_ids` and the reviewed permissions.\nAn internal metadata-only installation token resolves names through GitHub's\ninstallation repository list; it never authenticates hosted calls or search.\nExpiry and misses refresh the name lookup without rebinding configured grants.\nUse discovery or the configured name to refresh a rename before using its new\nname; names that cannot map to a configured grant fail before operation tokens\nare minted. Cross-owner\nPR heads, cross-repository issue parents, opaque comment/review-thread IDs and\nsymlink writes are refused. The first release acts as the App; personal OAuth\nattribution is planned separately. Classification describes behavior; scope\nchecks authorize targets whether or not the endpoint is read-only.\n\n## Tools and paging\n\nHosted schemas and results come from GitHub. Reviewed reads cover files,\ncommits, branches, tags, releases, issues, labels, PR details/diffs/reviews,\nand Actions workflows/runs/jobs. Reviewed writes cover issues, comments, PR\ncreation/updates/reviews, branches, file edits and Actions dispatch/rerun/cancel.\nCompound `issue_write` is always a write, including update/close. Review methods\nare limited to create/submit_pending/delete_pending; resolve/unresolve by opaque thread ID are\nnot exposed. Scope-changing tools, repo creation/forks, deletion/transfer,\nadministration, secrets and Copilot delegation are absent. Unknown upstream\ntools, arguments and methods require review before use.\n\nUse `search_scoped` for repositories, issues, PRs or code across installations.\nSupply literal words and an optional subset of configured org/repo selectors.\nScope qualifiers and Boolean operators are refused. Results have a partition\nID, next page, and an incomplete-results flag. Pass pages keyed by those exact\npartition IDs. Each call makes at most 20 partition requests; select fewer\nscopes when needed. Search pages stop at 10 and retain incompleteness. Returned\nrepositories are checked by ID against both deployment scopes and selected\npartitions. Issue and PR results resolve their repository URL to an ID before\nany result is returned.\nInstallation tokens do not override GitHub's own code-search access restrictions.\n\nREST complements own `create_release`, `update_release`, `delete_release` and\n`merge_pull_request`. Publishing a draft is `update_release({ draft: false })`.\nMerge requires an expected head SHA, a same-repository head/base and explicit\nworkflow-write access on the effective scope. GitHub atomically guards only the\nhead SHA, so a concurrent base retarget can introduce workflow changes despite\nan earlier file comparison. Merge is therefore disabled by default.\nRead current state before updates. A dispatched write is attempted once;\nGitHub errors never trigger an automatic write retry. Honor retry timing on\nrate limits; an ambiguous 404 may mean absence or an installation permission\ngap. Fix the App installation/key/permissions for auth errors; the App has no\ninteractive OAuth reconnect flow.\n"
-    }
+    "content": "## Choose the target\n\nAct as the configured GitHub App. `list_scopes` identifies its configured grants\nand reachable repositories. An exact repository grant can narrow its parent\norganization grant. Organization access covers repository operations, including\nfuture repositories in the installation, rather than organization administration.\nA repository rename keeps its ID-bound grant; a replacement at the old name does\nnot inherit it. A transfer cannot use the old installation's token.\n\nUse `search_scoped` for literal-word data search across installations. Each item\ncarries its partition and verified repository. Search completeness can be false\nat GitHub's search limit; narrow the selected scopes or terms when that matters.\nInstallation tokens do not override GitHub's own code-search restrictions.\nKeep the same `limit` with every named-list cursor. Omission uses 30, so a\ncursor issued with limit 30 can continue without an explicit limit.\n\n## Join the right identifiers\n\nAn issue or pull request number belongs to one owner/repository pair; a numeric\nrecord ID is a different identifier. An issue-list response can contain pull\nrequests: the `pull_request` property distinguishes them. Issue IDs returned for\npull requests are not necessarily the PR IDs from the pull-request endpoint.\nReviews join by pull request number; their `commit_id` identifies the reviewed\nrevision. Compare review and head commit IDs when deciding whether feedback is\ncurrent. Issue comments and pull-request review comments are different resources.\n\nRead files at an explicit Git ref when a stable revision matters. Nested contents\npaths are relative: `/repos/alice/widget/contents/lib/index.ts` reads that file,\nand `/repos/alice/widget/contents` lists the root directory. No dot segments,\nempty segments, backslashes or encoded traversal are accepted. In `commits/{ref}`\nand `compare/{basehead}`, encode branch-name slashes as `%2F`, for example\n`commits/feature%2Fx` or `compare/main...feature%2Fx`. Refs stay inside the selected\nrepository; owner-prefixed object refs and cross-repository compares are unavailable.\nFor a PR list, use `head:\"alice:feature/x\"`: the required `login:branch` filter\nselects this repository's PRs and never reads the login's repository. A bare\n`head` branch is refused because GitHub silently ignores it. `base` stays a branch name.\nContents are\nbase64 encoded; decode the inline content before interpreting it. Directory\nlistings have a vendor cap and are not recursive. Missing inline content or a\nmissing patch does not establish an empty file or an unchanged diff. Raw diff,\nlog/archive downloads, secret/admin operations and arbitrary GraphQL are unavailable.\n\n## Release and merge semantics\n\nPublishing a draft release updates that release's `draft` to false. Deleting a\nrelease does not delete its Git tag. Resolve the intended repository and existing\nrelease before changing it; a tag name is not a numeric release ID.\n\nUse `merge_pull_request` for merges. It requires the expected head SHA and a\nsame-repository head and base, plus explicit workflow-write access. GitHub's\natomic SHA guard binds the head rather than the base: a concurrent base retarget\ncan introduce workflow changes after the preflight. A response with `merged:false`\nis a failed merge, not a completed one. Inspect current PR state before a new attempt.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `github_api_details`, `github_api_read`, `github_api_search`, `list_scopes`, `search_scoped`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 30, at most 100). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `github_api_search` finds this API's operations and reads no account data, `github_api_details` shows one operation's contract, and `github_api_read` calls a reviewed read. `github_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 5 operations are refused by design; use `github_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. An unknown id, or one these credentials cannot reach, fails as `connector_call_failed`; this API does not tell the two apart. `conflict` means: HTTP 409 is a conflict; a merged:false response and the expected-SHA/same-repository preflight also refuse a merge.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "instructionsHeading": "Repository instructions"
 };