managed-deepagents 0.4.0-dev.70 → 0.4.0-dev.73

package/dist/channels/types.d.ts

@@ -4,8 +4,6 @@
  * Provider-specific fields belong in a validated `native` payload or the
  * managed adapter — never on these core types.
  */
-/** Closed, managed adapter set; `"slack"` is the initial member. */
-export type ChannelProvider = "slack";
 export type JsonValue = null | boolean | number | string | readonly JsonValue[] | {
     readonly [key: string]: JsonValue;
 };
@@ -42,9 +40,11 @@ export interface ChannelEvent {
         action: string;
         value?: JsonValue;
     };
+    /** Provider-native payload for tools/connectors (sanitized subset). */
+    native?: ChannelNativePayload;
 }
 export interface ChannelNativePayload {
-    provider: ChannelProvider;
+    provider: string;
     payload: {
         readonly [key: string]: JsonValue;
     };
@@ -91,7 +91,7 @@ export interface ChannelCapabilities {
 export interface RuntimeChannel {
     /** File-derived configured channel name. */
     name: string;
-    provider: ChannelProvider;
+    provider: string;
     event: ChannelEvent;
     address: ChannelAddress;
     capabilities: ChannelCapabilities;

package/dist/channels/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/channels/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC;AAEtC,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,SAAS,EAAE,GACpB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,SAAS,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,EAAE,mBAAmB,CAAC;IAClC,IAAI,CACF,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,MAAM,CAAC,CACL,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GACxB,2BAA2B,GAC3B,yBAAyB,GACzB,gCAAgC,GAChC,wBAAwB,GACxB,+BAA+B,GAC/B,+BAA+B,GAC/B,iCAAiC,GACjC,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,kBAAkB,GAE7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAe5D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/channels/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,SAAS,GACjB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,SAAS,EAAE,GACpB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,WAAW,cAAc;IAC7B,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,YAAY;IAC3B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,WAAW,CAAC,EAAE;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,SAAS,CAAC;KACnB,CAAC;IACF,uEAAuE;IACvE,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE;QAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;CAChD;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACD;IACE,IAAI,EAAE,uBAAuB,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,oBAAoB,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,EAAE,mBAAmB,CAAC;IAClC,IAAI,CACF,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,MAAM,CAAC,CACL,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAClC;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GACxB,2BAA2B,GAC3B,yBAAyB,GACzB,gCAAgC,GAChC,wBAAwB,GACxB,+BAA+B,GAC/B,+BAA+B,GAC/B,iCAAiC,GACjC,oBAAoB,GACpB,+BAA+B,GAC/B,2BAA2B,CAAC;AAEhC,0EAA0E;AAC1E,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,kBAAkB,GAE7B;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAe5D"}

package/dist/channels/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/channels/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmIH,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,WAA+B;IAK/B,IAAI,WAAW,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,WAAW,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/channels/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkIH,0EAA0E;AAC1E,MAAM,UAAU,2BAA2B,CACzC,WAA+B;IAK/B,IAAI,WAAW,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,cAAc,EAAE,WAAW,CAAC,cAAc;YAC1C,QAAQ,EAAE,WAAW,CAAC,QAAQ;SAC/B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,cAAc,EAAE,WAAW,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC"}

package/dist/connectors/github/index.d.ts

@@ -0,0 +1,80 @@
+/**
+ * GitHub connector — sandbox checkouts, CLI, and credential injection.
+ *
+ * Declares which repositories MDA should clone into the sandbox, whether to
+ * install the GitHub CLI, and whether resolved identity credentials should be
+ * available inside the sandbox so the agent can act as the signed-in user.
+ *
+ * Sandbox provisioning runs via the connector's {@link connector}'s `sandbox`
+ * hook. Channel ingress lives under `channels/github` (separate plugin).
+ * Connect-with-GitHub OAuth lives under `identity/github/`.
+ */
+import { type Connector } from "../../runtime/connector.js";
+export { connect, credentials, type GitHubActorTokenArgs, type GitHubAppJwtArgs, type GitHubCredentialsOptions, type GitHubIdentityConnectProviderOptions, type GitHubTokenSource, } from "../../identity/github/index.js";
+export { findGitHubConnector, provisionGitHubSandbox, buildGitHubProvisionScript, CLONE_FAILED_MARKDOWN, isBenignCheckoutFailure, GITHUB_TOKEN_REMOTE_PATH, GITHUB_PROVISION_REMOTE_PATH, } from "./sandbox.js";
+export type { GitHubSandboxBackend, ProvisionGitHubSandboxOptions, } from "./sandbox.js";
+/** How MDA should treat an existing sandbox checkout when a sandbox is reused. */
+export type GitHubCheckoutReuse = "keep" | "reset" | "fetch";
+/**
+ * Repository checkout declaration for the GitHub connector.
+ *
+ * Static `repo` checkouts are cloned when a sandbox is first provisioned. When
+ * a thread starts against a reused sandbox, MDA applies {@link onReuse}
+ * (default `"fetch"`) so the working tree picks up the latest commits for
+ * {@link ref}.
+ */
+export interface GitHubRepositoryCheckout {
+    /** Static repository to checkout, formatted as `owner/repo`. */
+    repo?: string;
+    /** Dynamic binding to the repository from a future GitHub channel event. */
+    from?: "event.repository";
+    /** Relative sandbox path where the repository should appear. */
+    path: string;
+    /** Git ref, branch, tag, SHA, or future `event.*` expression to checkout. */
+    ref?: string;
+    /** Shallow clone depth. Must be an integer >= 1. */
+    depth?: number;
+    /** Optional sparse checkout paths, relative to the repository root. */
+    sparsePaths?: string[];
+    /** Whether submodules should be initialized. Defaults to false. */
+    submodules?: boolean;
+    /** Whether the checkout needs write credentials instead of read credentials. */
+    write?: boolean;
+    /**
+     * Reuse behavior when a thread starts against an existing sandbox checkout.
+     * Defaults to `"fetch"` (pull latest for {@link ref}).
+     */
+    onReuse?: GitHubCheckoutReuse;
+}
+/** Configuration accepted by {@link connector}. */
+export interface GitHubConnectorConfig {
+    /** Repository checkouts to provision into the sandbox snapshot/workspace. */
+    repositories?: GitHubRepositoryCheckout[];
+    /** Shared repository allowlist, as `owner/repo` or `owner/*`. */
+    allowlist?: string[];
+    /**
+     * Install the [GitHub CLI](https://cli.github.com/) (`gh`) into the sandbox
+     * during provisioning. Defaults to `true`.
+     */
+    installCLI?: boolean;
+    /**
+     * Inject resolved GitHub identity credentials into the sandbox (`GH_TOKEN`,
+     * git credential helper) so the agent can act as the user. Defaults to `true`.
+     */
+    injectCredentials?: boolean;
+}
+/** Branded GitHub connector declaration discovered from `connectors/github.ts`. */
+export type GitHubConnector = Connector & Required<GitHubConnectorConfig> & {
+    /** Connector kind used for diagnostics and route namespacing. */
+    kind: "github";
+};
+/**
+ * Build the branded GitHub connector declaration.
+ *
+ * Validates authoring config and implements a `sandbox` hook so checkout / CLI /
+ * credential provisioning runs through the public connector protocol.
+ */
+export declare function connector(config?: GitHubConnectorConfig): GitHubConnector;
+/** Validate a GitHub connector config without constructing a connector. */
+export declare function validateGitHubConnector(config: GitHubConnectorConfig): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/connectors/github/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAEL,KAAK,SAAS,EAEf,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,OAAO,EACP,WAAW,EACX,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,oCAAoC,EACzC,KAAK,iBAAiB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AAEtB,kFAAkF;AAClF,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,mEAAmE;IACnE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,YAAY,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC1C,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,SAAS,GACrC,QAAQ,CAAC,qBAAqB,CAAC,GAAG;IAChC,iEAAiE;IACjE,IAAI,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEJ;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAE,qBAA0B,GAAG,eAAe,CAkB7E;AAED,2EAA2E;AAC3E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,IAAI,CAmC3E"}

package/dist/connectors/github/index.js

@@ -0,0 +1,118 @@
+/**
+ * GitHub connector — sandbox checkouts, CLI, and credential injection.
+ *
+ * Declares which repositories MDA should clone into the sandbox, whether to
+ * install the GitHub CLI, and whether resolved identity credentials should be
+ * available inside the sandbox so the agent can act as the signed-in user.
+ *
+ * Sandbox provisioning runs via the connector's {@link connector}'s `sandbox`
+ * hook. Channel ingress lives under `channels/github` (separate plugin).
+ * Connect-with-GitHub OAuth lives under `identity/github/`.
+ */
+import { CONNECTOR_BRAND, } from "../../runtime/connector.js";
+import { provisionGitHubSandbox } from "./sandbox.js";
+export { connect, credentials, } from "../../identity/github/index.js";
+export { findGitHubConnector, provisionGitHubSandbox, buildGitHubProvisionScript, CLONE_FAILED_MARKDOWN, isBenignCheckoutFailure, GITHUB_TOKEN_REMOTE_PATH, GITHUB_PROVISION_REMOTE_PATH, } from "./sandbox.js";
+/**
+ * Build the branded GitHub connector declaration.
+ *
+ * Validates authoring config and implements a `sandbox` hook so checkout / CLI /
+ * credential provisioning runs through the public connector protocol.
+ */
+export function connector(config = {}) {
+    validateGitHubConnector(config);
+    const instance = {
+        [CONNECTOR_BRAND]: true,
+        kind: "github",
+        repositories: config.repositories ?? [],
+        allowlist: config.allowlist ?? [],
+        installCLI: config.installCLI !== false,
+        injectCredentials: config.injectCredentials !== false,
+        async sandbox(ctx) {
+            await provisionGitHubSandbox(ctx.backend, instance, {
+                mode: ctx.mode,
+                config: ctx.config,
+                identity: ctx.identity,
+            });
+        },
+    };
+    return instance;
+}
+/** Validate a GitHub connector config without constructing a connector. */
+export function validateGitHubConnector(config) {
+    if (config === null || typeof config !== "object") {
+        throw new Error("github.connector(...) requires a config object.");
+    }
+    if (config.installCLI !== undefined &&
+        typeof config.installCLI !== "boolean") {
+        throw new Error("github.connector(...) installCLI must be a boolean.");
+    }
+    if (config.injectCredentials !== undefined &&
+        typeof config.injectCredentials !== "boolean") {
+        throw new Error("github.connector(...) injectCredentials must be a boolean.");
+    }
+    for (const pattern of config.allowlist ?? []) {
+        if (!isAllowlistPattern(pattern)) {
+            throw new Error(`github.connector(...) allowlist entry "${pattern}" must look like "owner/repo" or "owner/*".`);
+        }
+    }
+    const seenPaths = new Set();
+    for (const repo of config.repositories ?? []) {
+        validateRepositoryCheckout(repo);
+        if (seenPaths.has(repo.path)) {
+            throw new Error(`github.connector(...) Duplicate repository checkout path "${repo.path}".`);
+        }
+        seenPaths.add(repo.path);
+    }
+}
+function validateRepositoryCheckout(repo) {
+    if (repo === null || typeof repo !== "object") {
+        throw new Error("github.connector(...) repositories entries must be objects.");
+    }
+    if (repo.repo === undefined && repo.from !== "event.repository") {
+        throw new Error('github.connector(...) repository checkout requires `repo` or from: "event.repository".');
+    }
+    if (repo.repo !== undefined && !isExactRepo(repo.repo)) {
+        throw new Error(`github.connector(...) repo "${repo.repo}" must look like "owner/repo".`);
+    }
+    if (typeof repo.path !== "string" || !isSafeRelativePath(repo.path)) {
+        throw new Error(`github.connector(...) repository path "${String(repo.path)}" must be a safe relative sandbox path.`);
+    }
+    if (repo.depth !== undefined &&
+        (!Number.isInteger(repo.depth) || repo.depth < 1)) {
+        throw new Error("github.connector(...) repository depth must be >= 1.");
+    }
+    if (repo.sparsePaths !== undefined &&
+        (!Array.isArray(repo.sparsePaths) ||
+            repo.sparsePaths.some((path) => !isSafeRelativePath(path)))) {
+        throw new Error("github.connector(...) sparsePaths must be safe relative paths.");
+    }
+    if (repo.onReuse !== undefined &&
+        repo.onReuse !== "keep" &&
+        repo.onReuse !== "reset" &&
+        repo.onReuse !== "fetch") {
+        throw new Error('github.connector(...) onReuse must be "keep", "reset", or "fetch".');
+    }
+}
+function isAllowlistPattern(pattern) {
+    const [owner, repo, extra] = pattern.split("/");
+    if (!owner || !repo || extra !== undefined)
+        return false;
+    return isSlug(owner) && (repo === "*" || isSlug(repo));
+}
+function isExactRepo(pattern) {
+    const [owner, repo, extra] = pattern.split("/");
+    if (!owner || !repo || extra !== undefined)
+        return false;
+    return isSlug(owner) && isSlug(repo);
+}
+function isSlug(value) {
+    return /^[A-Za-z0-9_.-]+$/.test(value);
+}
+function isSafeRelativePath(path) {
+    if (path.length === 0 || path.startsWith("/") || path.includes("\0")) {
+        return false;
+    }
+    return !path.split("/").some((part) => part === "..");
+}
+//# sourceMappingURL=index.js.map

package/dist/connectors/github/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/connectors/github/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,eAAe,GAGhB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EACL,OAAO,EACP,WAAW,GAMZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,GAC7B,MAAM,cAAc,CAAC;AAkEtB;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAM,GAA0B,EAAE;IAC1D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAoB;QAChC,CAAC,eAAe,CAAC,EAAE,IAAI;QACvB,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE;QACjC,UAAU,EAAE,MAAM,CAAC,UAAU,KAAK,KAAK;QACvC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,KAAK,KAAK;QACrD,KAAK,CAAC,OAAO,CAAC,GAAmB;YAC/B,MAAM,sBAAsB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE;gBAClD,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ;aACvB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,IACE,MAAM,CAAC,UAAU,KAAK,SAAS;QAC/B,OAAO,MAAM,CAAC,UAAU,KAAK,SAAS,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IACE,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,OAAO,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAC7C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,6CAA6C,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,6DAA6D,IAAI,CAAC,IAAI,IAAI,CAC3E,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAA8B;IAChE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,IAAI,gCAAgC,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAC9C,IAAI,CAAC,IAAI,CACV,yCAAyC,CAC3C,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IACE,IAAI,CAAC,WAAW,KAAK,SAAS;QAC9B,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;YAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IACE,IAAI,CAAC,OAAO,KAAK,SAAS;QAC1B,IAAI,CAAC,OAAO,KAAK,MAAM;QACvB,IAAI,CAAC,OAAO,KAAK,OAAO;QACxB,IAAI,CAAC,OAAO,KAAK,OAAO,EACxB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACxD,CAAC"}

package/dist/connectors/github/sandbox.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Provision GitHub connector state inside a managed sandbox.
+ *
+ * On first create: optionally install `gh`, inject credentials, and clone
+ * declared repositories. When a thread starts against a reused sandbox, refresh
+ * credentials and apply each checkout's `onReuse` policy (default `fetch`).
+ */
+import type { SandboxBackendProtocolV2 } from "deepagents";
+import type { GitHubConnector } from "./index.js";
+import type { IdentityDefinition } from "../../identity/index.js";
+import type { Connector } from "../../runtime/connector.js";
+import type { ManagedRunConfig } from "../../runtime/types.js";
+/** Absolute paths used for GitHub provisioning artifacts inside the sandbox. */
+export declare const GITHUB_TOKEN_REMOTE_PATH = "/tmp/mda-gh-token";
+export declare const GITHUB_PROVISION_REMOTE_PATH = "/tmp/mda-github-provision.sh";
+/** Backend surface required for GitHub sandbox provisioning. */
+export type GitHubSandboxBackend = Pick<SandboxBackendProtocolV2, "execute"> & Partial<Pick<SandboxBackendProtocolV2, "uploadFiles">>;
+/** Options for {@link provisionGitHubSandbox}. */
+export interface ProvisionGitHubSandboxOptions {
+    /**
+     * `"create"` installs/clones; `"reuse"` refreshes credentials + onReuse;
+     * `"credentials"` only re-injects the token / gh wrapper (same thread).
+     */
+    mode: "create" | "reuse" | "credentials";
+    /** Per-run LangGraph config (identity + thread scoping). */
+    config?: ManagedRunConfig;
+    /** Root identity declaration, when the project opts into managed identity. */
+    identity?: IdentityDefinition;
+}
+/** Narrow a connector list to the GitHub connector, if present. */
+export declare function findGitHubConnector(connectors: readonly Connector[] | undefined): GitHubConnector | undefined;
+/**
+ * Apply GitHub connector provisioning to a sandbox backend.
+ *
+ * Safe to call repeatedly: create installs/clones once; reuse refreshes
+ * credentials and pulls declared refs when a thread starts.
+ */
+export declare function provisionGitHubSandbox(backend: GitHubSandboxBackend, connector: GitHubConnector, options: ProvisionGitHubSandboxOptions): Promise<void>;
+/** Build the shell script that installs `gh`, wires credentials, and syncs repos. */
+export declare function buildGitHubProvisionScript(connector: GitHubConnector, options: {
+    mode: "create" | "reuse" | "credentials";
+    hasToken: boolean;
+}): string;
+/** Resolve a GitHub token for sandbox injection (actor → read → env). */
+export declare function resolveSandboxGitHubToken(connector: GitHubConnector, options: Pick<ProvisionGitHubSandboxOptions, "config" | "identity">): Promise<string | undefined>;
+/** Marker file written when a static checkout cannot be cloned. */
+export declare const CLONE_FAILED_MARKDOWN = "CLONE_FAILED.md";
+/**
+ * Resolve an authoring-relative checkout path to the absolute sandbox location.
+ *
+ * Authoring forbids absolute paths; deepagents filesystem tools require them.
+ * `workspace/...` maps to `/workspace/...` to match fixture/setup conventions.
+ */
+export declare function absoluteCheckoutPath(relativePath: string): string;
+/** True when provision failed for a recoverable git checkout reason. */
+export declare function isBenignCheckoutFailure(output: string): boolean;
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/connectors/github/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/connectors/github/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAmB,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,YAAY,CAAC;AAE5E,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAO5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAE3E,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,wBAAwB,EAAE,SAAS,CAAC,GAC1E,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,CAAC;AAEzD,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C;;;OAGG;IACH,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IACzC,4DAA4D;IAC5D,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,mEAAmE;AACnE,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,GAC3C,eAAe,GAAG,SAAS,CAO7B;AAWD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;IAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,GACvE,MAAM,CA8CR;AAED,yEAAyE;AACzE,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,IAAI,CAAC,6BAA6B,EAAE,QAAQ,GAAG,UAAU,CAAC,GAClE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAqD7B;AAyMD,mEAAmE;AACnE,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAiGvD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAMjE;AAkCD,wEAAwE;AACxE,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAI/D"}