For activity digests and local code exploration (both auth paths):
- github_list_commits: newest-first with ISO since/until + author filters,
per_page capped at 100, response trimmed to sha/author/date/message
(500 chars) so summaries don't drown the model. No approval (read).
Combined with github_search's date qualifiers this covers on-demand
"what happened this week" digests and scheduled summary automations.
- github_clone / github_pull (approval-gated): target must resolve inside
a WRITABLE granted root; private repos authenticate via a per-invocation
HTTP header on the git command line — the token is never written to
.git/config or any credential store, and the clone is scrubbed-or-
aborted if anything credential-shaped would persist. Pull re-mints and
fast-forwards only. Public repos work tokenless. GITHUB_GIT_URL
override keeps tests hermetic (local bare-repo 'githost').
- Tests: commit filters/trim, full clone→push→pull round-trip with an
on-disk no-token scan of the whole .git tree, path-guard refusals
(outside roots, no writable root, non-empty target).
659 pytest / 23 vitest / e2e green.
The desktop half of the GitHub App relay (github-relay-spec §13 Step 3):
- relay_client.py: extract RelayHub — ONE authenticated cloud socket owns
the transport/read-loop/reconnect watchdog; frames fan out by provider
tag. SlackRelayAdapter becomes its first consumer (public surface
unchanged); GitHubRelayAdapter its second. Also pin the relay tests'
name resolution to a dead loopback port — unstubbed lookups were
reaching slack.com and intermittently blowing the 2s dispatch window.
- github_relay.py: GitHubRelayAdapter — github:owner/repo#N addressing,
installation_id rides source.team_id so the gateway's per-team
allow-list (park → allow & deliver) applies per installation unchanged;
missed/revoked frames handled; send() posts an issue/PR comment with a
minted installation token.
- github_installs.py: github:install:<id> profiles (metadata ONLY — no
token field by design), default pointer + per-installation allow-lists
on the profile; last-removal turns relay off without resurrecting a
stored manual PAT.
- cloud.py: github_installation_token — memory-only ~50-min cache, force
re-mint for the 401 path, never written to the secret store;
per-installation cloud disconnect; managed-connect flow passthrough.
- Managed OAuth callback branch (token-less by design, so it precedes the
access_token check) + gateway hot-add; per-installation disconnect and
status routes; allow-list edits target github:install:<id>.
- Tools: _github_call resolves auth per repo owner — manual PAT wins
untouched, managed profiles mint and re-mint once on 401; new
github_reply + github_review (approval-gated). The §12.5 write ceiling
is enforced by what exists: no push/delete/settings tools on any path.
- github descriptor: two_way + managed.
655 pytest + 23 vitest green; 13 new tests cover install callback,
per-installation allow-lists, hub fan-out, missed/revoked, addressing,
send, token cache/re-mint, tool auth on both paths.
Rohit C Prasad