github-agent 2.4.14__py3-none-any.whl → 2.5.0__py3-none-any.whl

github_agent/api/api_client_dependabot.py

@@ -2,6 +2,7 @@
 from typing import Any
 
 from scion_sdk.exceptions import require_auth
+from scion_sdk.mcp.destructive import destructive_operation
 
 from github_agent.api.api_client_base import BaseApiClient
 from github_agent.github_response_models import Response
@@ -59,6 +60,7 @@ class Api(BaseApiClient):
         response.raise_for_status()
         return Response(response=response, data=response.json())
 
+    @destructive_operation
     @require_auth
     def update_dependabot_alert(
         self,

github_agent/api/api_client_orgs.py

@@ -111,8 +111,8 @@ class Api(BaseApiClient):
         """Schedule an organization for deletion. IRREVERSIBLE.
 
         GitHub responds 202 Accepted and deletes the organization, all of its
-        repositories, and all of its data asynchronously. The MCP layer gates
-        this action behind allow_destructive / GITHUB_ALLOW_DESTRUCTIVE.
+        repositories, and all of its data asynchronously. The SDK asks
+        the caller to confirm this action.
 
         DELETE /orgs/{org}
         https://docs.github.com/en/rest/orgs/orgs#delete-an-organization
@@ -240,8 +240,8 @@ class Api(BaseApiClient):
     def remove_organization_member(self, org: str, username: str) -> Response:
         """Remove a user from an organization (repositories access included).
 
-        Destructive: the MCP layer gates this action behind
-        allow_destructive / GITHUB_ALLOW_DESTRUCTIVE. GitHub responds 204.
+        Destructive: the SDK asks the caller to confirm this
+        action. GitHub responds 204.
 
         DELETE /orgs/{org}/members/{username}
         https://docs.github.com/en/rest/orgs/members#remove-an-organization-member

github_agent/api/api_client_pages.py

@@ -150,8 +150,8 @@ class Api(BaseApiClient):
     def delete_pages(self, owner: str, repo: str) -> Response:
         """Disable GitHub Pages for a repository and delete the site.
 
-        Destructive: the MCP layer gates this action behind
-        allow_destructive / GITHUB_ALLOW_DESTRUCTIVE. GitHub responds 204.
+        Destructive: the SDK asks the caller to confirm this
+        action. GitHub responds 204.
 
         DELETE /repos/{owner}/{repo}/pages
         https://docs.github.com/en/rest/pages/pages#delete-a-apiname-pages-site

github_agent/api/api_client_pulls.py

@@ -5,6 +5,7 @@ from scion_sdk.exceptions import (
     ParameterError,
     require_auth,
 )
+from scion_sdk.mcp.destructive import destructive_operation
 
 from github_agent.api.api_client_base import BaseApiClient
 from github_agent.github_input_models import (
@@ -107,6 +108,7 @@ class Api(BaseApiClient):
         response.raise_for_status()
         return Response(response=response, data=response.json())
 
+    @destructive_operation
     @require_auth
     def merge_pull_request(
         self,

github_agent/auth.py

@@ -21,16 +21,6 @@ from github_agent.api_client import Api
 logger = get_logger(__name__)
 
 
-def allow_destructive_default() -> bool:
-    """Fleet-wide default for the destructive-action gate.
-
-    Destructive MCP actions (e.g. organization delete, member removal) are
-    blocked unless the caller passes allow_destructive=true or the
-    GITHUB_ALLOW_DESTRUCTIVE environment variable is set truthy.
-    """
-    return setting("GITHUB_ALLOW_DESTRUCTIVE", False)
-
-
 def _exchange_delegated_token(settings: DelegationSettings) -> str:
     """Exchange the caller's verified MCP token for a downstream GitHub token."""
     logger.info(