symbio 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -5,6 +5,18 @@ versions follow [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.6.0]
+
+- Azure DevOps connections: add an organization with a personal access token in Settings; agents
+  push and pull through it (HTTPS remotes of that organization) and call its REST API with the new
+  `azure_devops_api` tool, e.g. to open pull requests. The token never reaches the agent and only
+  goes to the connection's own organization.
+- Credentials rule clarified: Symbio's own secrets stay off-limits to agents, but a project's own
+  credentials (connection strings, `.env`…) and ones the human gives may be used for the task;
+  agents must not copy them into anything committed or shared, and only read from systems the
+  human calls read-only or production. Agents had refused legitimate work (querying a database
+  with the app's connection string) under the old blanket rule.
+
 ## [0.5.0]
 
 - Docs tab: a folder tree instead of a flat list; search across all docs (any case or accent) that

package/README.md

@@ -77,8 +77,8 @@ place. Here Symbio was restarted mid-task, and it told the helper to pick up whe
 - **You stay in control.** Questions, plan approvals, permission requests (like installing
   software) and deploy approvals collect in a **Needs you** inbox. Pause one team or everything at
   once.
-- **Connections without exposing secrets.** Give agents a GitHub account or an SSH server. They
-  ask Symbio to push, call the API or deploy, and Symbio does it with credentials the agents never
+- **Connections without exposing secrets.** Give agents a GitHub account, an Azure DevOps
+  organization or an SSH server. They ask Symbio to push, open pull requests, call the API or deploy, and Symbio does it with credentials the agents never
   see. Each connection can require your approval for every action.
 - **Resilient.** A supervisor restarts OpenCode if it crashes, a watchdog unsticks hung agents, and
   when a model fails (quota, outage) the agent switches to the next allowed model and carries on.
@@ -142,7 +142,7 @@ itself. Whoever gets in controls your agents, so keep the link and code to yours
    - **Folder:** browse for or paste a folder. An empty folder starts a new project; an existing
      one is studied first. Symbio offers to set up git if the folder doesn't have it.
    - **Setup:** choose where the project documentation goes (in the project, or private), and which
-     connections (GitHub, servers) the agents may use.
+     connections (GitHub, Azure DevOps, servers) the agents may use.
    - **Models:** pick the models agents may use, and the one core runs on (the crown).
 3. **Talk to core.** Describe what you want. core asks questions, proposes a plan, and waits for
    your approval in the **Plan** tab (it shows a *Review* badge).
@@ -159,7 +159,7 @@ itself. Whoever gets in controls your agents, so keep the link and code to yours
 | **core** | The project's lead agent. It plans, delegates, reviews and merges; it coordinates rather than doing the work itself. |
 | **Helper** | An agent core creates for a piece of work. It works in its own git worktree (branch `symbio/<name>`) or, if the project is set to, in the project folder itself. |
 | **Shared asset** | Something more than one agent could change. Access goes through core: request, grant, release. |
-| **Connection** | A GitHub account or SSH server agents can use through Symbio, without ever seeing its credentials. |
+| **Connection** | A GitHub account, Azure DevOps organization or SSH server agents can use through Symbio, without ever seeing its credentials. |
 | **Allowed models** | The models a project's agents may run on. If one fails, agents fall back to the next. |
 
 ## Where your data lives

package/dist/server/connections.js

@@ -1,14 +1,22 @@
-// Global connections (set once in Settings, used by any project): GitHub accounts
-// and servers reachable over SSH. Public details live in ~/.symbio/connections.json;
-// secrets live in the encrypted vault and are never returned by the API.
+// Global connections (set once in Settings, used by any project): GitHub accounts,
+// Azure DevOps organizations and servers reachable over SSH. Public details live in
+// ~/.symbio/connections.json; secrets live in the encrypted vault and are never
+// returned by the API.
 import { promises as fs, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { SecretVault } from "./secrets.js";
 import { sshExec } from "./ssh.js";
 import { globalDir, newId } from "./store.js";
+/** Organization from what people paste: "org", https://dev.azure.com/org/…, https://org.visualstudio.com/…. */
+export function azureOrganization(value) {
+    const v = value.trim();
+    const m = /^https?:\/\/(?:[^@/]+@)?dev\.azure\.com\/([^/?#]+)/i.exec(v) ?? /^https?:\/\/(?:[^@/]+@)?([^./]+)\.visualstudio\.com/i.exec(v);
+    return decodeURIComponent(m ? m[1] : v.replace(/\/+$/, ""));
+}
 const SECRET_FIELDS = {
     github: ["token"],
+    azure: ["token"],
     server: ["privateKey", "passphrase", "password"],
 };
 export class Connections {
@@ -37,13 +45,15 @@ export class Connections {
         return { ...c, secrets };
     }
     async create(input) {
-        if (input.type !== "github" && input.type !== "server")
-            throw new Error("type must be github or server");
+        if (input.type !== "github" && input.type !== "azure" && input.type !== "server")
+            throw new Error("type must be github, azure or server");
         const now = Date.now();
         const base = { id: newId("con"), name: "", createdAt: now, updatedAt: now, lastTest: null };
         const conn = input.type === "github"
             ? { ...base, type: "github", account: null }
-            : { ...base, type: "server", host: "", port: 22, username: "", auth: "key", keyPath: null };
+            : input.type === "azure"
+                ? { ...base, type: "azure", organization: "", account: null }
+                : { ...base, type: "server", host: "", port: 22, username: "", auth: "key", keyPath: null };
         this.apply(conn, input);
         if (!conn.name)
             throw new Error("Give the connection a name.");
@@ -91,6 +101,14 @@ export class Connections {
                 conn.account = user.login;
                 result = { ok: true, message: `Signed in as ${user.login}${user.name ? ` (${user.name})` : ""}`, time: Date.now() };
             }
+            else if (conn.type === "azure") {
+                const data = await this.azureRequest(conn, "GET", "_apis/connectionData", undefined, "7.1-preview");
+                const user = data?.authenticatedUser;
+                conn.account = user?.providerDisplayName ?? user?.customDisplayName ?? null;
+                const projects = await this.azureRequest(conn, "GET", "_apis/projects").catch(() => null);
+                const count = Array.isArray(projects?.value) ? ` — ${projects.value.length} project(s) visible` : "";
+                result = { ok: true, message: `Signed in to ${conn.organization}${conn.account ? ` as ${conn.account}` : ""}${count}`, time: Date.now() };
+            }
             else {
                 const res = await sshExec(await this.sshTarget(conn), "uname -srm 2>/dev/null || ver", 30_000);
                 const out = (res.stdout || res.stderr).trim().split("\n")[0];
@@ -129,6 +147,40 @@ export class Connections {
         }
         return target;
     }
+    /** Calls the Azure DevOps REST API of the connection's organization with its token. */
+    async azureRequest(conn, method, apiPath, body, apiVersion = "7.1") {
+        const rel = apiPath.trim().replace(/^\/+/, "");
+        if (/^[a-z]+:/i.test(rel))
+            throw new Error("Give a path inside the organization (e.g. MyProject/_apis/git/repositories), not a full URL.");
+        const url = new URL(`https://dev.azure.com/${encodeURIComponent(conn.organization)}/${rel}`);
+        if (!url.searchParams.has("api-version"))
+            url.searchParams.set("api-version", apiVersion);
+        const token = await this.githubToken(conn);
+        const res = await fetch(url, {
+            method,
+            redirect: "manual", // a sign-in redirect means the token was refused
+            headers: {
+                authorization: `Basic ${Buffer.from(`:${token}`).toString("base64")}`,
+                accept: "application/json",
+                "user-agent": "symbio",
+                ...(body === undefined ? {} : { "content-type": "application/json" }),
+            },
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const text = await res.text();
+        // A rejected token gets a sign-in page (203 or a redirect) rather than a 401.
+        const html = /^\s*</.test(text) || (res.headers.get("content-type") ?? "").includes("text/html");
+        if (res.status === 401 || res.status === 203 || (res.status >= 300 && res.status < 400) || (html && res.ok)) {
+            throw new Error(`Azure DevOps rejected the token for "${conn.organization}" (expired, revoked, or without access to this organization?)`);
+        }
+        const data = text ? safeJson(text) : null;
+        if (!res.ok) {
+            const msg = data?.message ?? res.statusText;
+            throw new Error(`Azure DevOps ${res.status}: ${msg}`);
+        }
+        return data;
+    }
+    /** The stored token of a GitHub or Azure DevOps connection. */
     async githubToken(conn) {
         const token = await this.vault.get(`${conn.id}:token`);
         if (!token)
@@ -159,6 +211,8 @@ export class Connections {
     apply(conn, input) {
         if (input.name !== undefined)
             conn.name = input.name.trim();
+        if (conn.type === "azure" && input.organization !== undefined)
+            conn.organization = azureOrganization(input.organization);
         if (conn.type === "server") {
             if (input.host !== undefined)
                 conn.host = input.host.trim();
@@ -173,6 +227,9 @@ export class Connections {
         }
     }
     validate(conn) {
+        if (conn.type === "azure" && !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$/.test(conn.organization)) {
+            throw new Error("Give the organization, e.g. \"contoso\" or https://dev.azure.com/contoso.");
+        }
         if (conn.type === "server") {
             if (!conn.host)
                 throw new Error("Host is required.");
@@ -189,7 +246,7 @@ export class Connections {
             if (typeof value === "string" && value.trim())
                 await this.vault.set(`${conn.id}:${field}`, value.trim());
         }
-        if (conn.type === "github" && !(await this.vault.has(`${conn.id}:token`)))
+        if ((conn.type === "github" || conn.type === "azure") && !(await this.vault.has(`${conn.id}:token`)))
             throw new Error("The token is required.");
         if (conn.type === "server") {
             if (conn.auth === "password" && !(await this.vault.has(`${conn.id}:password`)))

package/dist/server/prompts.js

@@ -337,15 +337,33 @@ export function kickoffMessage(project) {
         : "Symbio: the project was just created on a folder that already has content (see the folder summary in your instructions). Greet the human briefly, mention in one or two sentences what you can see at a glance, and offer to study the folder before planning.";
 }
 function connectionsSection(connections) {
-    return `## Connections (GitHub, servers)
+    return `## Connections (GitHub, Azure DevOps, servers)
 
 ${connections || "None."}
 
-Use connections only through Symbio's tools: \`list_connections\`, \`git_push\`,
-\`git_pull\`, \`github_api\` (GitHub) and \`remote_exec\`, \`remote_upload\` (servers).
-Symbio performs the action with the stored credentials — you never see them.
-Never ask for credentials, never write secrets into files or commands, and never
-look for them on this machine. Remote commands must be non-interactive. Always
-give a clear \`reason\`: when a connection needs approval, the human decides based
-on it, and the result arrives later as a message.`;
+Use connections only through Symbio's tools: \`list_connections\`; \`git_push\`,
+\`git_pull\` (GitHub or Azure DevOps); \`github_api\` (GitHub); \`azure_devops_api\`
+(Azure DevOps: pull requests, repositories, branches); \`remote_exec\`,
+\`remote_upload\` (servers). Symbio performs the action with the stored
+credentials — you never see them. To open a pull request: push the branch with
+\`git_push\`, then create it with \`github_api\` or \`azure_devops_api\`.
+Remote commands must be non-interactive. Always give a clear \`reason\`: when a
+connection needs approval, the human decides based on it, and the result
+arrives later as a message.
+
+## Credentials
+
+- **Symbio's secrets are off-limits:** its vault and connections, SSH keys, its
+  UI key. Use connections only through the tools above; never try to read them.
+- **The project's own credentials** (in its config files: connection strings,
+  \`.env\`, \`Web.config\`, \`appsettings.json\`…) and **credentials the human gives
+  you** may be used for the task, e.g. connecting to a database the work needs.
+  A developer on this project would use them too; don't refuse a task over that.
+- **Don't spread them:** never put a credential into anything that is committed
+  or shared — new files in the project, docs, the rules register, the plan,
+  messages to other agents — and don't print it in your answers. Prefer
+  commands that read it from the config file over pasting it into a command line.
+- **Respect the environment:** if the human says a system is a read-only mirror
+  or production, only read from it; changing production needs the human's
+  explicit OK.`;
 }

package/dist/server/remote.js

@@ -1,7 +1,7 @@
 // Actions agents take through connections (SSH commands and uploads, git push/pull,
-// GitHub API). Symbio runs them itself with credentials from the vault — agents
-// only see results. Connections set to "ask" queue an approval for the human; the
-// result is delivered to the agent as a message once approved.
+// GitHub and Azure DevOps APIs). Symbio runs them itself with credentials from the
+// vault — agents only see results. Connections set to "ask" queue an approval for
+// the human; the result is delivered to the agent as a message once approved.
 import { execFile } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { promises as fs, existsSync, realpathSync } from "node:fs";
@@ -28,13 +28,16 @@ export class RemoteOps {
     }
     describeFor(project) {
         const list = this.enabled(project);
-        if (list.length === 0)
-            return "This project has no connections. If the work needs GitHub or a server, tell the human to add one in the project's sidebar (Connections).";
+        if (list.length === 0) {
+            return "This project has no connections. If the work needs GitHub, Azure DevOps or a server, tell the human to add one in the project's Settings (Connections).";
+        }
         return list
             .map(({ conn, link }) => {
             const what = conn.type === "github"
                 ? `GitHub${conn.account ? ` account ${conn.account}` : ""} — git_push, git_pull, github_api`
-                : `server ${conn.username}@${conn.host} — remote_exec, remote_upload`;
+                : conn.type === "azure"
+                    ? `Azure DevOps organization ${conn.organization}${conn.account ? ` (as ${conn.account})` : ""} — git_push, git_pull, azure_devops_api`
+                    : `server ${conn.username}@${conn.host} — remote_exec, remote_upload`;
             return `- "${conn.name}": ${what} (${link.policy === "ask" ? "each action needs the human's approval" : "allowed without approval"})`;
         })
             .join("\n");
@@ -43,7 +46,7 @@ export class RemoteOps {
     async request(project, agent, action, reason) {
         const { conn, link } = this.resolve(project, action.connectionId, action.kind);
         const summary = this.summarize(conn, action, agent);
-        const readOnly = action.kind === "github_api" && action.method.toUpperCase() === "GET";
+        const readOnly = (action.kind === "github_api" || action.kind === "azure_devops_api") && action.method.toUpperCase() === "GET";
         if (link.policy === "allow" || readOnly) {
             return this.execute(project, agent, conn, action, summary, reason);
         }
@@ -106,9 +109,17 @@ export class RemoteOps {
             const names = this.enabled(project).map(({ conn }) => conn.name).join(", ") || "none";
             throw new Error(`No connection "${connectionRef}" in this project. Available: ${names}.`);
         }
-        const needs = kind.startsWith("remote_") ? "server" : "github";
-        if (found.conn.type !== needs)
-            throw new Error(`"${found.conn.name}" is a ${found.conn.type} connection; ${kind} needs a ${needs} connection.`);
+        const needs = kind.startsWith("remote_")
+            ? ["server"]
+            : kind === "github_api"
+                ? ["github"]
+                : kind === "azure_devops_api"
+                    ? ["azure"]
+                    : ["github", "azure"]; // git_push / git_pull
+        if (!needs.includes(found.conn.type)) {
+            const label = (t) => (t === "azure" ? "Azure DevOps" : t === "github" ? "GitHub" : "server");
+            throw new Error(`"${found.conn.name}" is a ${label(found.conn.type)} connection; ${kind} needs a ${needs.map(label).join(" or ")} connection.`);
+        }
         return found;
     }
     summarize(conn, a, agent) {
@@ -123,6 +134,8 @@ export class RemoteOps {
                 return `git pull ${a.remote ?? "origin"} ${a.branch ?? "(current branch)"} into ${agent.name}'s workspace using ${conn.name}`;
             case "github_api":
                 return `GitHub API ${a.method.toUpperCase()} ${a.path} using ${conn.name}`;
+            case "azure_devops_api":
+                return `Azure DevOps API ${a.method.toUpperCase()} ${a.path} using ${conn.name}`;
         }
     }
     async execute(project, agent, conn, a, summary, reason) {
@@ -163,12 +176,11 @@ export class RemoteOps {
             }
             case "git_push":
             case "git_pull": {
-                const token = await this.connections.githubToken(conn);
+                const gitConn = conn;
+                const token = await this.connections.githubToken(gitConn);
                 const remote = a.remote ?? "origin";
                 const url = remote.startsWith("https://") ? remote : await gitOut(agent.directory, ["remote", "get-url", remote]);
-                if (!/^https:\/\/github\.com\//i.test(url)) {
-                    throw new Error(`The remote must be a GitHub HTTPS URL (got ${url || "nothing"}). Add one with: git remote add origin https://github.com/<owner>/<repo>.git`);
-                }
+                const auth = gitAuth(gitConn, url, token);
                 const branch = a.branch ?? (await gitOut(agent.directory, ["rev-parse", "--abbrev-ref", "HEAD"]));
                 // The agent controls this repository, so its config and hooks are untrusted: a hook
                 // would see the token, a proxy or URL rewrite would send it elsewhere.
@@ -177,7 +189,7 @@ export class RemoteOps {
                 const safe = ["-c", `core.hooksPath=${noHooks}`, "-c", "http.proxy=", "-c", "http.sslVerify=true", "-c", "credential.helper="];
                 // The token goes in an HTTP header via environment-only git config: never in
                 // the command line, the repo config or the agent's view.
-                const header = `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}`;
+                const { headerKey, header } = auth;
                 const git = (args, withToken) => run("git", [...safe, ...args], {
                     cwd: agent.directory,
                     windowsHide: true,
@@ -185,9 +197,7 @@ export class RemoteOps {
                     env: {
                         ...process.env,
                         GIT_TERMINAL_PROMPT: "0",
-                        ...(withToken
-                            ? { GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: "http.https://github.com/.extraheader", GIT_CONFIG_VALUE_0: header }
-                            : {}),
+                        ...(withToken ? { GIT_CONFIG_COUNT: "1", GIT_CONFIG_KEY_0: headerKey, GIT_CONFIG_VALUE_0: header } : {}),
                     },
                 }).catch((err) => {
                     throw new Error(scrub(String(err.stderr || err.message), token));
@@ -201,8 +211,11 @@ export class RemoteOps {
                 const merged = await git(["merge", "--no-edit", "FETCH_HEAD"], false);
                 return scrub(`${fetched.stdout}${fetched.stderr}${merged.stdout}${merged.stderr}`.trim() || "done", token);
             }
-            case "github_api": {
-                const data = await this.connections.githubRequest(conn, a.method.toUpperCase(), a.path, a.body);
+            case "github_api":
+            case "azure_devops_api": {
+                const data = a.kind === "github_api"
+                    ? await this.connections.githubRequest(conn, a.method.toUpperCase(), a.path, a.body)
+                    : await this.connections.azureRequest(conn, a.method.toUpperCase(), a.path, a.body);
                 const text = JSON.stringify(data, null, 2) ?? "(no content)";
                 return text.length > 20_000 ? `${text.slice(0, 20_000)}\n… (truncated)` : text;
             }
@@ -258,7 +271,7 @@ export async function refuseRiskyGitConfig(dir) {
         .filter(([scope, key]) => (scope === "local" || scope === "worktree") && key && RISKY_GIT_CONFIG.some((re) => re.test(key.toLowerCase())))
         .map(([, key]) => key);
     if (risky.length) {
-        throw new Error(`Refusing to use GitHub credentials: this repository's git config sets ${risky.join(", ")}, which could redirect or capture them. Remove ${risky.length > 1 ? "these settings" : "it"} (git config --unset <name>) and try again.`);
+        throw new Error(`Refusing to use the connection's credentials: this repository's git config sets ${risky.join(", ")}, which could redirect or capture them. Remove ${risky.length > 1 ? "these settings" : "it"} (git config --unset <name>) and try again.`);
     }
 }
 async function gitOut(cwd, args) {
@@ -266,6 +279,35 @@ async function gitOut(cwd, args) {
     return stdout.trim();
 }
 function scrub(text, secret) {
-    const b64 = Buffer.from(`x-access-token:${secret}`).toString("base64");
-    return text.split(secret).join("***").split(b64).join("***");
+    let out = text.split(secret).join("***");
+    for (const user of ["x-access-token:", ":"])
+        out = out.split(Buffer.from(`${user}${secret}`).toString("base64")).join("***");
+    return out;
+}
+/**
+ * How to send a connection's token to a git remote, after checking the remote belongs to it:
+ * a GitHub HTTPS URL for GitHub; for Azure DevOps, a dev.azure.com (or older visualstudio.com)
+ * URL of the connection's own organization, so its token never goes to someone else's.
+ */
+export function gitAuth(conn, url, token) {
+    if (conn.type === "github") {
+        if (!/^https:\/\/github\.com\//i.test(url)) {
+            throw new Error(`The remote must be a GitHub HTTPS URL (got ${url || "nothing"}). Add one with: git remote add origin https://github.com/<owner>/<repo>.git`);
+        }
+        return { headerKey: "http.https://github.com/.extraheader", header: `Authorization: Basic ${Buffer.from(`x-access-token:${token}`).toString("base64")}` };
+    }
+    const devAzure = /^https:\/\/(?:[^@/]+@)?dev\.azure\.com\/([^/]+)\//i.exec(url);
+    const legacy = /^https:\/\/(?:[^@/]+@)?([^./]+)\.visualstudio\.com\//i.exec(url);
+    if (!devAzure && !legacy) {
+        throw new Error(`The remote must be an Azure DevOps HTTPS URL (got ${url || "nothing"}). ` +
+            (/^git@|^ssh:/i.test(url)
+                ? "It's an SSH remote; switch it to HTTPS: git remote set-url origin https://dev.azure.com/<organization>/<project>/_git/<repository>"
+                : "Add one with: git remote add origin https://dev.azure.com/<organization>/<project>/_git/<repository>"));
+    }
+    const org = decodeURIComponent((devAzure ?? legacy)[1]);
+    if (org.toLowerCase() !== conn.organization.toLowerCase()) {
+        throw new Error(`This remote belongs to the Azure DevOps organization "${org}", but "${conn.name}" is for "${conn.organization}". Use a connection for "${org}".`);
+    }
+    const host = devAzure ? "https://dev.azure.com/" : `https://${legacy[1]}.visualstudio.com/`;
+    return { headerKey: `http.${host}.extraheader`, header: `Authorization: Basic ${Buffer.from(`:${token}`).toString("base64")}` };
 }

package/dist/server/tools.js

@@ -330,20 +330,20 @@ const remoteUpload = {
     run: ({ connection, local_path, remote_path, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "remote_upload", connectionId: String(connection), localPath: String(local_path), remotePath: String(remote_path) }, String(reason)),
 };
 const gitFields = {
-    connection: str("GitHub connection name"),
-    remote: str("Remote name or https://github.com/… URL (default: origin)"),
+    connection: str("GitHub or Azure DevOps connection name"),
+    remote: str("Remote name or HTTPS URL (github.com, dev.azure.com) (default: origin)"),
     branch: str("Branch (default: your current branch)"),
     reason: reasonField,
 };
 const gitPush = {
     name: "git_push",
-    description: "Push committed work from your working folder to GitHub (the token is applied by Symbio; plain `git push` has no credentials).",
+    description: "Push committed work from your working folder to GitHub or Azure DevOps (the token is applied by Symbio; plain `git push` may have no credentials).",
     inputSchema: obj(gitFields, ["connection", "reason"]),
     run: ({ connection, remote, branch, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "git_push", connectionId: String(connection), remote: remote ? String(remote) : null, branch: branch ? String(branch) : null }, String(reason)),
 };
 const gitPull = {
     name: "git_pull",
-    description: "Pull from GitHub into your working folder (merge, no rebase).",
+    description: "Pull from GitHub or Azure DevOps into your working folder (merge, no rebase).",
     inputSchema: obj(gitFields, ["connection", "reason"]),
     run: ({ connection, remote, branch, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "git_pull", connectionId: String(connection), remote: remote ? String(remote) : null, branch: branch ? String(branch) : null }, String(reason)),
 };
@@ -354,11 +354,29 @@ const githubApi = {
         connection: str("GitHub connection name"),
         method: { type: "string", enum: ["GET", "POST", "PATCH", "PUT", "DELETE"] },
         path: str("API path, e.g. /user/repos"),
-        body: { type: "object", description: "JSON body for POST/PATCH/PUT" },
+        // Some endpoints take a list (e.g. Azure DevOps ref updates), others an object.
+        body: { anyOf: [{ type: "object" }, { type: "array" }], description: "JSON body for POST/PATCH/PUT (an object, or a list where the API expects one)" },
         reason: reasonField,
     }, ["connection", "method", "path", "reason"]),
     run: ({ connection, method, path, body, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "github_api", connectionId: String(connection), method: String(method), path: String(path), body }, String(reason)),
 };
+const azureDevopsApi = {
+    name: "azure_devops_api",
+    description: "Call the Azure DevOps REST API of the connection's organization. The path is relative to https://dev.azure.com/<organization>/ " +
+        "and api-version is added if missing. E.g. GET <project>/_apis/git/repositories to find a repository's id; " +
+        "POST <project>/_apis/git/repositories/<repo>/pullrequests with {sourceRefName: 'refs/heads/<branch>', targetRefName: " +
+        "'refs/heads/main', title, description} to open a pull request (push the branch first with git_push); " +
+        "GET <project>/_apis/git/repositories/<repo>/pullrequests?searchCriteria.status=active to list them. Read-only GET calls never need approval.",
+    inputSchema: obj({
+        connection: str("Azure DevOps connection name"),
+        method: { type: "string", enum: ["GET", "POST", "PATCH", "PUT", "DELETE"] },
+        path: str("Path inside the organization, e.g. MyProject/_apis/git/repositories"),
+        // Some endpoints take a list (e.g. Azure DevOps ref updates), others an object.
+        body: { anyOf: [{ type: "object" }, { type: "array" }], description: "JSON body for POST/PATCH/PUT (an object, or a list where the API expects one)" },
+        reason: reasonField,
+    }, ["connection", "method", "path", "reason"]),
+    run: ({ connection, method, path, body, reason }, { team, project, agent }) => team.remote.request(project, agent, { kind: "azure_devops_api", connectionId: String(connection), method: String(method), path: String(path), body }, String(reason)),
+};
 // ---- rules register (only when the project keeps one)
 function registerOn(project) {
     if (!project.rulesRegister)
@@ -460,6 +478,7 @@ const COMMON = [
     gitPush,
     gitPull,
     githubApi,
+    azureDevopsApi,
     sendMessage,
     askHuman,
     listTeam,

package/dist/server/updates.js

@@ -74,6 +74,23 @@ export const AGENT_UPDATES = [
             "leave reviewing many images to a helper. If a conversation still becomes too large, Symbio moves that agent to a fresh " +
             "session with a handoff note instead of trying other models.",
     },
+    {
+        id: "2026-11-06-credentials",
+        text: "Credentials, clarified: the old rule \"never look for credentials or put secrets in commands\" was meant for Symbio's own " +
+            "secrets (its vault, connections, SSH keys), and it stopped agents from doing legitimate work. Now: Symbio's secrets stay " +
+            "off-limits (use connections only through the tools). The project's own credentials (connection strings, .env, Web.config…) " +
+            "and credentials the human gives you may be used for the task, e.g. querying a database the work needs. Don't spread them: " +
+            "never put one into anything committed or shared (new files, docs, the rules register, the plan, messages to other agents), " +
+            "and prefer commands that read it from the config file. If the human says a system is a read-only mirror or production, only " +
+            "read from it unless they explicitly OK changes. If you refused such a task before, you can do it now.",
+    },
+    {
+        id: "2026-11-06-azure-devops",
+        text: "Azure DevOps connections: the human can now add an Azure DevOps organization (with a personal access token) in Settings and " +
+            "enable it per project. git_push and git_pull work with it (HTTPS remotes of that organization; SSH remotes must be switched to " +
+            "HTTPS), and the new azure_devops_api tool calls its REST API, e.g. to open a pull request after pushing the branch. Reading " +
+            "(GET) never needs approval. If a push or a pull request failed for lack of credentials, ask the human to add the connection.",
+    },
 ];
 /** Entries a project hasn't been told about yet. */
 export function unseenUpdates(seen) {